Power supply control device and program

Abstract

To diagnose whether or not a gate circuit which outputs a cut-off signal to a cut-off device operates correctly.SOLUTION: A power supply control device according an embodiment includes a cut-off device, a first detection part, a second detection part, a gate circuit, and a diagnosis part. The first detection part detects power supply failure of a first system or a second system by using a first detection logic, and outputs a first cut-off command. The second detection part detects power supply failure of the first system or the second system by using a second detection logic, and outputs a second cut-off command. The gate circuit outputs a cut-off signal which causes the cut-off device to be cut-off state if at least either the first or second cut-off command is inputted. The diagnosis part, in a diagnosis mode, executes processing to cause the first detection part to output the first cut-off command, then to halt the output of the first cut-off command, and processing to cause the second detection part to output the second cut-off command, then to halt the output of the second cut-off command, and diagnoses whether or not a corresponding cut-off signal is output from the gate circuit.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates to a power supply control device and a program. [Background technology]

[0002] Conventionally, there has been known a power supply control device that includes a first system having a first power supply that is a main power supply, a second system having a second power supply that is a backup power supply, and a circuit breaker that can connect and disconnect the first and second systems (see, for example, Patent Document 1). In such a power supply control device, when a power failure occurs in the first system, the circuit breaker is set to a disconnected state, and backup control is performed using the power of the second power supply.

[0003] Furthermore, a power supply control device according to the prior art includes a first detection unit and a second detection unit that detect a power supply failure. When a power supply failure is detected, a shutdown command output from the first detection unit and a shutdown command output from the second detection unit are input to a gate circuit composed of an OR circuit. When at least one of the shutdown commands is input, the gate circuit outputs a shutdown signal to the shutdown device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2023-043533 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the prior art, it was not possible to diagnose whether the gate circuit was operating correctly. In other words, in the power supply control device described above, it would be desirable to be able to diagnose whether the gate circuit could correctly output a shutdown signal to the shutdown device in response to the shutdown commands output from the first and second detection units, but such a diagnosis was not performed.

[0006] The present invention has been made in consideration of the above, and aims to provide a power supply control device and a program that can diagnose whether a gate circuit that outputs a shutdown signal to a shutdown device is operating correctly. [Means for solving the problem]

[0007] In order to solve the above problems and achieve the object, in the present invention, a power supply control device includes a shutoff device, a first detection unit, a second detection unit, a gate circuit, and a diagnostic unit. The shutoff device is configured to be able to connect and disconnect a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load. The first detection unit detects a power failure in the first system or the second system using a first detection logic and outputs a first shutoff command. The second detection unit detects a power failure in the first system or the second system using a second detection logic and outputs a second shutoff command. The gate circuit is configured to be able to input the first shutoff command and the second shutoff command, and outputs a shutoff signal that puts the shutoff device into a shutoff state when at least one of the first shutoff command and the second shutoff command is input. When in a diagnostic mode in which the gate circuit is diagnosed, the diagnostic unit causes the first detection unit to output the first shutoff command and then executes a process to stop output of the first shutoff command. The diagnostic unit causes the second detection unit to output the second shutoff command and then executes processing to stop the output of the second shutoff command. The diagnostic unit diagnoses whether the shutoff signal corresponding to the output and stop of the first shutoff command by the first detection unit and the output and stop of the second shutoff command by the second detection unit is output from the gate circuit. [Effects of the Invention]

[0008] According to the present invention, in a diagnostic mode, a power supply control device executes a process of causing a first detection unit to output a first shutoff command and then stopping the output of the first shutoff command, and a process of causing a second detection unit to output a second shutoff command and then stopping the output of the second shutoff command. The power supply control device monitors the output of the gate circuit when executing these processes. That is, the power supply control device diagnoses whether the gate circuit outputs a shutoff signal corresponding to the output and stopping of the first shutoff command by the first detection unit and the output and stopping of the second shutoff command by the second detection unit. This makes it possible to diagnose whether the gate circuit operates correctly in accordance with the output and stopping of the first shutoff command and the output and stopping of the second shutoff command. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram showing an example of the configuration of a control system including a power supply control device according to the first embodiment. [Figure 2] FIG. 2 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the first embodiment. [Figure 3] FIG. 3 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the first embodiment. [Figure 4] FIG. 4 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the first embodiment. [Figure 5] FIG. 5 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the first embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of the configuration of the first detection unit and the second detection unit according to the first embodiment. [Figure 7] FIG. 7 is a diagram for explaining the diagnosis of the gate circuit. [Figure 8] FIG. 8 is a flowchart illustrating an example of processing executed by the microcomputer. [Figure 9] FIG. 9 is a diagram illustrating an example of the configuration of the first detection unit and the second detection unit according to the second embodiment. [Figure 10] FIG. 10 is a flowchart illustrating an example of processing executed by a microcomputer according to the second embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of the configuration of the first detection unit and the second detection unit according to the third embodiment. [Figure 12] FIG. 12 is a flowchart showing an example of processing executed by the main microcomputer according to the third embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of processing executed by a sub-microcomputer according to the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of a power supply control device and a program will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below. The power supply control device according to the embodiment is mounted on a vehicle such as an electric vehicle, a hybrid vehicle, or an engine vehicle that runs on an internal combustion engine, but is not limited thereto. Furthermore, the power supply control device according to the embodiment is a device mounted on a vehicle with an automatic driving function and supplies power to a load, but is not limited thereto.

[0011] [First embodiment] [1-1. Control system configuration] 1 is an explanatory diagram showing an example of the configuration of a control system 100 including a power supply control device 1 according to the first embodiment. As shown in Fig. 1, the control system 100 according to this embodiment includes the power supply control device 1, a first power source 10, a first load 101, a second load 102, and an automatic driving control device 200.

[0012] When the power supply control device 1 is installed in an engine vehicle, the first power supply 10 includes a lead battery (hereinafter referred to as "PbB11") and a generator 12. The first power supply 10 is the main power supply. Note that the battery of the first power supply 10 may be any secondary battery other than PbB11.

[0013] The generator 12 is, for example, an alternator that converts the kinetic energy of a running vehicle into electricity to generate power. The generator 12 charges the PbB 11 and a second power source 20 (described later) with the generated power. The first power source 10 also supplies power to a plurality of electrical loads mounted on the vehicle.

[0014] When the power supply control device 1 is mounted on an electric vehicle or a hybrid vehicle, the first power supply 10 includes a DC / DC converter (not shown, hereinafter referred to as "DCDC") and a PbB 11. In this case, the DCDC is connected to a generator 12 and a high-voltage battery (not shown) whose voltage is higher than that of the PbB 11, and steps down the voltages of the generator 12 and the high-voltage battery to supply power to a plurality of electrical loads. The high-voltage battery is, for example, a battery for driving the vehicle mounted on the electric vehicle or hybrid vehicle.

[0015] The first load 101 includes a load for autonomous driving. The first load 101 includes, for example, a steering motor, an electric brake device, an on-board camera, and the like that operate during autonomous driving. The first load 101 may also include a general load that is not involved in autonomous driving. The general load includes, for example, a display, an air conditioner, an audio device, a video device, various lights, and the like.

[0016] The second load 102 has some of the functions for automatic driving that the first load 101 has. The second load 102 includes, for example, a steering motor, an electric brake device, and a radar, which are the minimum devices required for FOP (Failure in Operation, evacuation driving control). The first load 101 and the second load 102 operate using power supplied from the power supply control device 1.

[0017] The first load 101 and the second load 102 may be the same load. The first load 101 and the second load 102 operate using power supplied from at least one of the first power source 10 and the second power source 20 via the power supply control device 1.

[0018] The automatic driving control device 200 is an external device that controls automatic driving of a vehicle by operating a first load 101 and a second load 102. If a failure (abnormality) occurs in the first power source 10 during automatic driving of the vehicle, the automatic driving control device 200 can implement FOP using the second load 102. Furthermore, if a failure occurs in the second power source 20, the automatic driving control device 200 can implement FOP using the first load 101. Note that a failure of the first power source 10 includes a failure in the power supply system of the first power source 10 (a first system 110 described below). Furthermore, a failure of the second power source 20 includes a failure in the power supply system of the second power source 20 (a second system 120 described below).

[0019] The power supply control device 1 is connected to a first power source 10, a first load 101, a second load 102, and an automatic driving control device 200. The power supply control device 1 includes a first system 110 and a second system 120. The first system 110 is a power supply line that supplies power from the first power source 10 to the first load 101. The second system 120 is a power supply line that supplies power from a second power source 20 (described later) to the second load 102.

[0020] The power supply control device 1 includes a second power supply 20, an inter-system switch 41, a battery switch 42, a controller 3, a first voltage sensor 51, and a second voltage sensor 52. The second power supply 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). The second power supply 20 is a backup power supply in case the first power supply 10 is unable to supply power. Note that the battery of the second power supply 20 may be any secondary battery other than the LiB21.

[0021] The inter-system switch 41 is provided on the inter-system line 130 that connects the first system 110 and the second system 120. The inter-system switch 41 is a switch that can connect and disconnect the first system 110 and the second system 120. The inter-system switch 41 is an example of a disconnecting device.

[0022] In this embodiment, electrically connecting the first system 110 and the second system 120 by the inter-system switch 41 is referred to as bringing the inter-system switch 41 into a conductive state. Also, in this embodiment, cutting off (disconnecting) the electrical connection between the first system 110 and the second system 120 by the inter-system switch 41 is referred to as bringing the inter-system switch 41 into a cut-off state.

[0023] The battery switch 42 is provided between the second power source 20 and the second system 120. The battery switch 42 is a switch that can connect and disconnect the second power source 20 to the second system 120. In this embodiment, electrically connecting the second power source 20 and the second system 120 by the battery switch 42 is referred to as putting the battery switch 42 into a conductive state. Also, in this embodiment, cutting off (disconnecting) the electrical connection between the second power source 20 and the second system 120 by the battery switch 42 is referred to as putting the battery switch 42 into a cut-off state.

[0024] The first voltage sensor 51 is provided in the first system 110. The first voltage sensor 51 detects the voltage of the first system 110 and outputs the detection result to the controller 3. The second voltage sensor 52 is provided in the second system 120. The second voltage sensor 52 detects the voltage of the second system 120 and outputs the detection result to the controller 3.

[0025] The controller 3 includes a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc., and various other circuits. The controller 3 also includes a storage unit (not shown) such as a semiconductor memory element such as RAM or flash memory, or a hard disk or optical disk. The controller 3 is realized, for example, by the CPU or the like executing various programs stored in the storage unit using the RAM as a working area. The controller 3 may also be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

[0026] The controller 3 detects a power failure in the first system 110 or the second system 120 based on the detection results input from the first voltage sensor 51 and the second voltage sensor 52. The power failure may be, for example, a ground fault. The controller 3 includes a first detector 60 and a second detector 70 that detect a power failure in the first system 110 or the second system 120, and configuration examples of the first and second detectors 60 and 70 will be described later with reference to FIG. 6.

[0027] When the controller 3 detects a ground fault in the first system 110 or the second system 120, it notifies the automatic driving control device 200 of that fact. Specifically, when the controller 3 detects a ground fault in the first system 110 or the second system 120, it outputs an automatic driving prohibition signal indicating that automatic driving is not possible to the automatic driving control device 200. Furthermore, when the controller 3 does not detect a ground fault in the first system 110 or the second system 120, it outputs an automatic driving permission signal indicating that automatic driving is possible to the automatic driving control device 200.

[0028] [1-2. Example of power supply control device operation] Next, the operation of the power supply control device 1 according to the first embodiment will be described with reference to Figures 2 to 5. Figures 2 to 5 are explanatory diagrams showing an example of the operation of the power supply control device 1 according to the first embodiment.

[0029] [1-2-1. Normal operation] In normal operation when no ground fault is detected in the first system 110 or the second system 120, the controller 3 sets the battery switch 42 in an interrupted state and the inter-system switch 41 in a conductive state, as shown in FIG.

[0030] As a result, the controller 3 supplies power from the first power source 10 to the first load 101 and the second load 102. Note that the controller 3 outputs an automatic driving permission signal to the automatic driving control device 200 during normal times when no ground fault occurs in the first system 110 or the second system 120.

[0031] [1-2-2. Operation in the event of a power supply control device failure] In the power supply control device 1, as shown in FIG. 3, if a ground fault 300 occurs in the first system 110 or a ground fault 301 occurs in the second system 120, an overcurrent flows toward the ground fault point, and the voltages of the first system 110 and the second system 120 become lower than the normal voltages.

[0032] For this reason, when the voltage of the second system 120 detected by the second voltage sensor 52 (hereinafter referred to as "second system voltage V2") becomes equal to or lower than the ground fault threshold, the controller 3 provisionally determines that a failure has occurred in the power supply system. Then, the controller 3 turns off the inter-system switch 41 to bring it into a disconnected state, and turns on the battery switch 42 to bring it into a conductive state. Note that the controller 3 may provisionally determine that a failure has occurred in the power supply system, for example, when the voltage of the first system 110 detected by the first voltage sensor 51 (hereinafter referred to as "first system voltage V1") becomes equal to or lower than the ground fault threshold.

[0033] This disconnects the first system 110 from the second system 120. Then, if there is no ground fault in the second system 120, the power supply control device 1 becomes able to supply power from the second power source 20, which is a backup power source. Also, if there is no ground fault in the first system 110, the power supply control device 1 becomes able to supply power from the first power source 10, which is a main power source.

[0034] Specifically, after the provisional determination, if the first system voltage V1 remains below the ground fault threshold for a predetermined time or longer and the second system voltage V2 recovers to exceed the ground fault threshold within the predetermined time, the controller 3 officially determines that a ground fault 300 has occurred in the first system 110 including the first power supply 10. The predetermined time is set to, for example, 100 ms, but is not limited to this and can be set to any value.

[0035] 4, the controller 3 performs backup control (fail-safe control) to supply power from the second power source 20 to the second load 102 via the second system 120. The controller 3 also notifies the automatic driving control device 200 that backup control to supply power from the second power source 20 to the second load 102 has been executed. This enables the automatic driving control device 200 to operate the second load 102 using power supplied from the second power source 20, and to perform FOP, such as evacuating the vehicle to a safe place and stopping the vehicle.

[0036] Furthermore, if, after the provisional determination, the second system voltage V2 remains below the ground fault threshold for a predetermined time or longer and the first system voltage V1 recovers to exceed the ground fault threshold within the predetermined time, the controller 3 finally determines that a ground fault 301 has occurred in the second system 120 including the second power source 20. Then, as shown in Fig. 5 , the controller 3 turns off the battery switch 42 to bring it into a cutoff state, and performs backup control (fail-safe control) to supply power from the first power source 10 to the first load 101 via the first system 110.

[0037] The controller 3 notifies the automatic driving control device 200 that backup control has been executed to supply power from the first power source 10 to the first load 101. As a result, the automatic driving control device 200 can operate the first load 101 using power supplied from the first power source 10 and perform FOP, such as evacuating the vehicle to a safe place and stopping the vehicle.

[0038] Furthermore, if the first system voltage V1 and the second system voltage V2 recover to exceed the ground fault threshold within a predetermined time after the provisional determination, the controller 3 determines that the provisional determination result is incorrect. In other words, the controller 3 officially determines that the power supply system has not failed. The controller 3 then turns off the battery switch 42 to establish a cutoff state, and turns on the inter-system switch 41 to establish a conduction state. This causes the power supply control device 1 to return to normal operation as shown in FIG. 2.

[0039] [1-3. Configuration example of first and second detection units] Next, a configuration example of the first detection unit 60 and the second detection unit 70 that detect a power failure in the first system 110 or the second system 120 will be described with reference to Fig. 6. Fig. 6 is a diagram showing a configuration example of the first detection unit 60 and the second detection unit 70 according to the first embodiment.

[0040] 6, the controller 3 includes a first detection unit 60, a second detection unit 70, and a gate circuit 80. The first detection unit 60 and the second detection unit 70 detect a power supply failure using different logics.

[0041] The first detection unit 60 uses first detection logic to detect a power failure in the first system 110 or the second system 120. The first detection logic is circuit logic that detects a power failure using a circuit configured by hardware.

[0042] Specifically, the first detection unit 60 includes a comparator 61 and a latch circuit 62. When the system voltage of the first system 110 or the second system 120 becomes equal to or lower than the ground fault threshold, the comparator 61 outputs a voltage drop signal indicating a drop in the system voltage. Specifically, the comparator 61 is a comparator that compares the second system voltage V2 detected as a sensor voltage by the second voltage sensor 52 with the ground fault threshold. When the second system voltage V2 becomes equal to or lower than the ground fault threshold, the comparator 61 determines that the voltage of the power supply system has dropped and a failure has occurred, and outputs a voltage drop signal to the latch circuit 62. In other words, the comparator 61 makes a provisional determination of a power supply failure. Note that, although the second system voltage V2 has been given above as an example of the system voltage, the system voltage may be the first system voltage V1.

[0043] The ground fault threshold of the comparator 61 is variably set by a PWM (Pulse Width Modulation) signal output from the microcomputer 71. Specifically, the ground fault threshold increases as the duty ratio of the PWM signal increases, and decreases as the duty ratio decreases. The ground fault threshold of the comparator 61 may be set by dividing the power supply voltage between a fixed resistor and a variable resistor. In this case, the microcomputer 71 sets an arbitrary ground fault threshold by adjusting the resistance value of the variable resistor.

[0044] The latch circuit 62 latches (holds) the voltage drop signal output from the comparator 61, and outputs a first cutoff command (latch signal) to the gate circuit 80 as a circuit command from the first detection unit 60, which is a circuit.

[0045] The gate circuit 80 is an OR logic circuit. When the first shutoff command is input from the latch circuit 62, the gate circuit 80 outputs a shutoff signal to the inter-system switch 41 to turn the inter-system switch 41 into a shutoff state. As a result, the inter-system switch 41 is turned off and into a shutoff state, and the connection between the first system 110 and the second system 120 is cut off (see FIG. 3).

[0046] The gate circuit 80 also outputs the cutoff signal to a microcomputer 71 (hereinafter referred to as "microcomputer 71") of the second detection unit 70, which will be described later. When the cutoff signal is input from the gate circuit 80, the microcomputer 71 turns on the battery switch 42 to bring it into a conductive state (see FIG. 3).

[0047] As described above, the first detection unit 60 according to this embodiment is configured by a circuit configured by hardware including the comparator 61, the latch circuit 62, etc. Furthermore, the first detection unit 60 detects a power failure in the first system 110 or the second system 120 using the first detection logic, outputs a first shutoff command, and turns the inter-system switch 41 into a shutoff state. As a result, in this embodiment, when a power failure in the first system 110 or the second system 120 is detected, the inter-system switch 41 can be turned into a shutoff state early.

[0048] The second detection unit 70 uses second detection logic to detect a power failure in the first system 110 or the second system 120. The second detection logic is software logic that detects a power failure using software.

[0049] Specifically, the second detection unit 70 includes a microcomputer 71 that controls the inter-system switch 41, the battery switch 42, etc., by software. Upon receiving a shutoff signal from the gate circuit 80, the microcomputer 71 makes a final determination as to whether the first system 110 or the second system 120 is in a failure state. In more detail, the microcomputer 71 makes a final determination as to whether the power supply failure detected by the first detection unit 60 is a true failure or a false detection caused by a temporary voltage drop or the like.

[0050] Specifically, first, when a shutdown signal is input from the gate circuit 80 (in other words, when a shutdown signal due to a voltage drop is input), the microcomputer 71 executes a process to maintain the shutdown state of the inter-system switch 41. More specifically, when the shutdown signal is input from the gate circuit 80, the microcomputer 71 outputs a second shutdown command to the gate circuit 80 as a software command from the second detection unit 70 using software. Next, the microcomputer 71 outputs a clear signal to the latch circuit 62 to clear the latch circuit 62 and stop outputting the first shutdown command.

[0051] In the normal mode, the microcomputer 71 outputs a PWM signal so that the ground fault threshold of the comparator 61 becomes a predetermined value. In the diagnostic mode, which will be described later, the microcomputer 71 outputs a PWM signal so that the ground fault threshold of the comparator 61 becomes equal to or higher than the system voltage.

[0052] In the gate circuit 80, the first shutoff command is not input from the latch circuit 62, but the second shutoff command is input from the microcomputer 71, so the output of the shutoff signal to the inter-system switch 41 is maintained. That is, the shutoff state of the inter-system switch 41 is maintained. In this way, the gate circuit 80 is configured to be able to input the first shutoff command and the second shutoff command, and outputs the shutoff signal when at least one of the first shutoff command and the second shutoff command is input.

[0053] After the provisional determination, if the first-system voltage V1 remains equal to or lower than the ground-fault threshold for a predetermined time or longer and the second-system voltage V2 recovers to exceed the ground-fault threshold within the predetermined time, the microcomputer 71 makes a final determination that a ground fault 300 has occurred in the first system 110 (see FIG. 4). Furthermore, after the provisional determination, if the second-system voltage V2 remains equal to or lower than the ground-fault threshold for a predetermined time or longer and the first-system voltage V1 recovers to exceed the ground-fault threshold within the predetermined time, the microcomputer 71 makes a final determination that a ground fault 301 has occurred in the second system 120 (see FIG. 5). The microcomputer 71 continues to output a second shutoff command in accordance with the result of the final determination, and supplies power to the load from the normal power supply system to perform backup control.

[0054] In this way, the second detection unit 70 according to this embodiment is configured by software, detects a power failure in the first system 110 or the second system 120 using the second detection logic, and outputs a second shutoff command.

[0055] On the other hand, if the first system voltage V1 and the second system voltage V2 recover to exceed the ground fault threshold within a predetermined time after the provisional determination, the microcomputer 71 determines that the provisional determination is incorrect, i.e., determines that the power supply system has not failed. In this case, the microcomputer 71 stops outputting the second shutoff command. As a result, the second shutoff command is no longer input to the gate circuit 80 from the microcomputer 71, and the gate circuit 80 stops outputting the shutoff signal to the inter-system switch 41. As a result, the inter-system switch 41 turns on and enters a connected state. The microcomputer 71 also turns off the battery switch 42 and enters a shutoff state. This allows the power supply control device 1 to return to normal operation (see FIG. 2).

[0056] The power supply control device 1 having the controller 3 configured as described above includes a diagnostic unit 72 that diagnoses whether the gate circuit 80 can correctly output a shutdown signal to the inter-system switch 41. The microcomputer 71 also functions as this diagnostic unit 72. In other words, the microcomputer 71 is a single microcomputer that functions as both the second detection unit 70 and the diagnostic unit 72.

[0057] In the present invention, diagnosing the gate circuit 80 means not only diagnosing the gate circuit 80 itself but also diagnosing the interruption system including the gate circuit 80. Specifically, this means diagnosing the circuit command system consisting of the comparator 61 and the latch circuit 62, the software command system output from the microcomputer 71, and the gate circuit 80.

[0058] [1-4. Gate circuit diagnosis] Here, the diagnosis of the gate circuit 80 will be described with reference to FIG. 7. FIG. 7 is a diagram for explaining the diagnosis of the gate circuit 80. In FIG. 7, the stop of output of the first shutoff command as a circuit command from the first detection unit 60 is referred to as a "connect command." Similarly, the stop of output of the second shutoff command as a software command from the second detection unit 70 is referred to as a "connect command."

[0059] 7, there are four patterns for diagnosing whether the gate circuit 80 can correctly output a shutdown signal. Specifically, there are four diagnostic patterns for diagnosing whether the gate circuit 80 can correctly output a shutdown signal in accordance with the output and stop of the first shutdown command, which is a circuit command, and the output and stop of the second shutdown command, which is a software command.

[0060] [1-4-1. Diagnostic Pattern 1] Diagnostic pattern 1 is a case where a shutoff command (first shutoff command) is output as a circuit command and a connect command is output as a software command (in other words, a case where the second shutoff command is stopped). In this case, if a shutoff signal is output from the gate circuit 80, the gate circuit 80 is diagnosed as normal. On the other hand, if a shutoff signal is not output from the gate circuit 80, the gate circuit 80 is diagnosed as abnormal.

[0061] [1-4-2. Diagnostic Pattern 2] Diagnostic pattern 2 is a case where a shutoff command (first shutoff command) is output as a circuit command and a shutoff command (second shutoff command) is output as a software command. In this case, if a shutoff signal is output from the gate circuit 80, the gate circuit 80 is diagnosed as normal. On the other hand, if a shutoff signal is not output from the gate circuit 80, the gate circuit 80 is diagnosed as abnormal.

[0062] [1-4-3. Diagnostic Pattern 3] Diagnostic pattern 3 is a case where a connection command is output as a circuit command (in other words, the first disconnection command is stopped) and a connection command is output as a software command (in other words, the second disconnection command is stopped). In this case, if a disconnection signal is not output from the gate circuit 80, the gate circuit 80 is diagnosed as normal. On the other hand, if a disconnection signal is output from the gate circuit 80, the gate circuit 80 is diagnosed as abnormal.

[0063] [1-4-4. Diagnostic Pattern 4] Diagnostic pattern 4 is a case where a connection command is output as a circuit command (in other words, the first shutoff command is stopped) and a shutoff command (second shutoff command) is output as a software command. In this case, if a shutoff signal is output from the gate circuit 80, the gate circuit 80 is diagnosed as normal. On the other hand, if a shutoff signal is not output from the gate circuit 80, the gate circuit 80 is diagnosed as abnormal.

[0064] The diagnostic unit 72 of the microcomputer 71, in a diagnostic mode for diagnosing the gate circuit 80, creates a situation (state) that results in the circuit commands and software commands of the above-mentioned diagnostic patterns 1 to 4. The diagnostic mode is executed when the vehicle ignition is turned on, but is not limited to this. That is, the diagnostic mode can be set at any timing, such as when the ignition is turned off or before the execution of automatic driving.

[0065] Specifically, in the diagnostic mode, the microcomputer 71 outputs a first shutoff command (shutoff command) or stops outputting the first shutoff command (shutoff command) (i.e., outputs a connection command) so as to obtain a circuit command shown in diagnostic patterns 1 to 4. In more detail, in the diagnostic mode, the microcomputer 71 controls the circuit command output from the first detection unit 60 by changing the ground fault threshold, as shown in FIG. 6 . Specifically, the microcomputer 71 outputs a PWM signal to change the ground fault threshold so that it is equal to or greater than the system voltage. As a result, the system voltage (e.g., the second system voltage V2) becomes equal to or less than the ground fault threshold, and the comparator 61 of the first detection unit 60 outputs a voltage drop signal to the latch circuit 62. The latch circuit 62 latches the voltage drop signal output from the comparator 61 and outputs a first shutoff command (shutoff command) to the gate circuit 80 as a circuit command. The microcomputer 71 also outputs a clear signal to the latch circuit 62 to clear the latch circuit 62. As a result, the latch circuit 62 stops outputting the first disconnect command, in other words, outputs a connect command as a circuit command.

[0066] Also, in the diagnostic mode, the microcomputer 71 outputs a second shutoff command (shutoff command) or stops outputting the second shutoff command (shutoff command) (in other words, outputs a connection command) so as to result in the soft command shown in diagnostic patterns 1 to 4 (see FIG. 7).

[0067] [1-5. Processing performed by the microcontroller] Next, the above-mentioned detection of power supply failure and diagnosis of gate circuit 80 will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of processing executed by microcomputer 71. Note that the processing shown in Fig. 8 is repeatedly executed every time a predetermined time elapses, but is not limited to this.

[0068] 8, the microcomputer 71 determines whether or not the microcomputer 71 is in the diagnosis mode (step S101). If the microcomputer 71 determines that the microcomputer 71 is not in the diagnosis mode (step S101, No), the microcomputer 71 determines whether or not a shutdown signal due to a voltage drop is present (step S102). More specifically, step S102 is a process in which the system voltage falls below the ground fault threshold, causing the comparator 61 to output a voltage drop signal, the latch circuit 62 to latch the voltage drop signal and output a first shutdown command, and the gate circuit 80 to determine whether or not it is outputting a shutdown signal.

[0069] If the microcomputer 71 determines that there is no cutoff signal (step S102, No), it skips the subsequent processing. On the other hand, if the microcomputer 71 determines that there is a cutoff signal (step S102, Yes), it outputs a drive signal for the battery switch 42 (step S103) to turn on the battery switch 42 and set it to a conductive state (see FIG. 3). Here, since the gate circuit 80 is outputting the cutoff signal, the inter-system switch 41 is set to a cutoff state (see FIG. 3).

[0070] Next, the microcomputer 71 outputs a shutoff command (second shutoff command) to the gate circuit 80 (step S104). Subsequently, the microcomputer 71 outputs a clear signal for the latch circuit 62 (step S105), clearing the latch circuit 62 and stopping the output of the first shutoff command. As a result, the first shutoff command from the latch circuit 62 is not input to the gate circuit 80, but the second shutoff command from the microcomputer 71 is input, so the output of the shutoff signal is maintained and therefore the shutoff state of the inter-system switch 41 is maintained.

[0071] Next, the microcomputer 71 determines whether the power supply failure detected by the first detection unit 60 is a true failure or an erroneous detection caused by a temporary voltage drop or the like (step S106). Specifically, the microcomputer 71 monitors the first and second system voltages V1, V2, and determines whether the first and second system voltages V1, V2 will recover to exceed the ground fault threshold within a predetermined time.

[0072] Next, the microcomputer 71 determines whether or not the first system 110 and the second system 120 are normal based on the determination result in the main determination process of step S106 (step S107). In other words, the microcomputer 71 determines whether or not the power failure detected by the first detection unit 60 was a false detection caused by a temporary voltage drop or the like.

[0073] If the microcomputer 71 determines that the first and second systems 110, 120 are normal (step S107, Yes), that is, if the detection was erroneous, it stops outputting the shutdown command (second shutdown command) (step S108). As a result, the second shutdown command is no longer input from the microcomputer 71 to the gate circuit 80, so the output of the shutdown signal is stopped, and the inter-system switch 41 is turned on to enter the connected state.

[0074] Next, the microcomputer 71 stops outputting the drive signal for the battery switch 42 (step S109). This turns off the battery switch 42 and puts it into a cutoff state. As a result, the power supply control device 1 returns to normal operation (see FIG. 2).

[0075] On the other hand, when the determination result in the main determination process of step S106 is that the first system 110 or the second system 120 is not normal (step S107, No), the microcomputer 71 performs backup control (step S110). Specifically, when the determination result in the main determination process is a ground fault 300 in the first system 110, the microcomputer 71 performs backup control to supply power from the second power source 20 to the second load 102 via the second system 120 while continuing to output the second shutoff command. When the determination result in the main determination process is a ground fault 301 in the second system 120, the microcomputer 71 performs backup control to supply power from the first power source 20 to the first load 101 via the first system 110 while continuing to output the second shutoff command.

[0076] Next, the microcomputer 71 executes a failure process (step S111). The failure process includes a process of outputting an automatic driving prohibition signal to the automatic driving control device 200, a process of storing the detection of the power supply failure as diagnostic information in a storage unit (not shown), a process of notifying the user of the detection of the power supply failure, and the like, but these are merely examples and are not limited thereto.

[0077] On the other hand, if it is determined that the microcomputer 71 is in the diagnosis mode (step S101, Yes), the microcomputer 71 changes the ground fault threshold (step S112). Specifically, the microcomputer 71 changes the ground fault threshold in the comparator 61 so that it is equal to or greater than the grid voltage. As a result, the grid voltage becomes equal to or less than the ground fault threshold, and the comparator 61 of the first detection unit 60 outputs a voltage drop signal to the latch circuit 62. The latch circuit 62 latches the voltage drop signal output from the comparator 61 and outputs a first shutoff command (shutoff command) as a circuit command to the gate circuit 80. Note that at this time, the microcomputer 71 is outputting a connect command as a software command, in other words, is not outputting a second shutoff command. In other words, the process of step S112 is a process for creating a situation in which the circuit command and software command of diagnostic pattern 1 (see FIG. 7) are issued.

[0078] Since the circuit command input to the gate circuit 80 is a disconnect command and the software command is a connect command, the microcomputer 71 determines whether the gate circuit 80 is correctly outputting a disconnect signal (step S113). If the microcomputer 71 determines that the gate circuit 80 is not outputting a disconnect signal (step S113, No), the microcomputer 71 proceeds to the processing of step S123, which will be described later.

[0079] When it is determined that the gate circuit 80 is outputting a shutoff signal (step S113, Yes), the microcomputer 71 determines that the diagnostic pattern 1 is normal, and subsequently outputs a shutoff command (second shutoff command) as a software command to the gate circuit 80 (step S114). That is, the process of step S114 is a process for creating a situation in which the circuit command and software command of the diagnostic pattern 2 (see FIG. 7) are issued.

[0080] Since the circuit command input to the gate circuit 80 is a shutoff command and the software command is a shutoff command, the microcomputer 71 determines whether the gate circuit 80 is correctly outputting a shutoff signal (step S115). If the microcomputer 71 determines that the gate circuit 80 is not outputting a shutoff signal (step S115, No), the microcomputer 71 proceeds to the processing of step S123, which will be described later.

[0081] If it is determined that the gate circuit 80 is outputting a shutoff signal (step S115, Yes), the microcomputer 71 determines that diagnostic pattern 2 is normal, and subsequently outputs a clear signal to the latch circuit 62 (step S116) to clear the latch circuit 62. This causes the latch circuit 62 to stop outputting the first shutoff command; in other words, it outputs a connect command as a circuit command. Next, the microcomputer 71 stops outputting the second shutoff command (shutoff command) (step S117); in other words, it outputs a connect command as a software command to the gate circuit 80. In other words, the processing of steps S116 and S117 is processing to create a situation in which the circuit command and software command of diagnostic pattern 3 (see FIG. 7) are issued.

[0082] Since the circuit command input to the gate circuit 80 is a connection command and the software command is a connection command, the microcomputer 71 determines whether the output of the shutdown signal from the gate circuit 80 has been properly stopped (step S118). If the microcomputer 71 determines that the output of the shutdown signal from the gate circuit 80 has not been stopped (step S118, No), that is, if it determines that the shutdown signal is being output, the microcomputer 71 proceeds to the processing of step S123, which will be described later.

[0083] When it is determined that the output of the shutdown signal from the gate circuit 80 has stopped (step S118, Yes), the microcomputer 71 determines that the diagnostic pattern 3 is normal, and subsequently outputs a shutdown command (second shutdown command) as a software command to the gate circuit 80 (step S119). That is, the process of step S119 is a process for creating a situation in which the circuit command and software command of the diagnostic pattern 4 (see FIG. 7) are issued.

[0084] Since the circuit command input to the gate circuit 80 is a connect command and the software command is a disconnect command, the microcomputer 71 determines whether the gate circuit 80 is correctly outputting a disconnect signal (step S120). If the microcomputer 71 determines that the gate circuit 80 is not outputting a disconnect signal (step S120, No), the microcomputer 71 proceeds to the processing of step S123, which will be described later.

[0085] If the microcontroller 71 determines that the gate circuit 80 is outputting a blocking signal (step S120, Yes), it determines that diagnostic pattern 4 is normal, and since diagnostic patterns 1 to 4 are all normal, it determines that the diagnostic result of the gate circuit 80 is normal (step S121).

[0086] Next, the microcomputer 71 executes a diagnosis termination process (step S122). The diagnosis termination process may include a process for changing both the circuit command and the software command into a connection command, a process for restoring the ground fault threshold value changed in step S112, and the like, but these are merely examples and are not intended to be limiting.

[0087] On the other hand, if it is determined in steps S113, S115, and S120 that the gate circuit 80 is not outputting a shutdown signal, or if it is determined in step S118 that the output of the shutdown signal from the gate circuit 80 has not stopped, the process proceeds to step S123. In step S123, since the gate circuit 80 is not operating normally in any of diagnostic patterns 1 to 4 and is determined to be abnormal, the diagnosis result of the gate circuit 80 is determined to be abnormal.

[0088] Next, the microcomputer 71 executes an abnormality process (step S124). The abnormality process may include a process of outputting an automatic driving prohibition signal to the automatic driving control device 200, a process of storing the abnormality detection of the gate circuit 80 as diagnostic information in a storage unit, and a process of notifying the user of the abnormality detection, but these are merely examples and are not limited thereto. After executing the abnormality process, the microcomputer 71 executes the process of step S122 described above.

[0089] As described above, the power supply control device 1 according to the first embodiment includes an inter-system switch (shutdown device) 41, a first detection unit 60, a second detection unit 70, a gate circuit 80, and a diagnosis unit 72. The inter-system switch 41 is configured to be able to connect and disconnect the first system 110, which supplies power from the first power source 10 to the first load 101, and the second system 120, which supplies power from the second power source 20 to the second load 102. The first detection unit 60 detects a power failure in the first system 110 or the second system 120 using a first detection logic and outputs a first shutdown command. The second detection unit 70 detects a power failure in the first system 110 or the second system 120 using a second detection logic and outputs a second shutdown command. The gate circuit 80 is configured to be able to input a first shutdown command and a second shutdown command, and outputs a shutdown signal that switches the inter-system switch 41 to a shutdown state when at least one of the first shutdown command and the second shutdown command is input. In a diagnostic mode in which the diagnostic unit 72 diagnoses the gate circuit 80, the diagnostic unit 72 causes the first detection unit 60 to output a first shutoff command, and then executes a process to stop the output of the first shutoff command. The diagnostic unit 72 causes the second detection unit 70 to output a second shutoff command, and then executes a process to stop the output of the second shutoff command. The diagnostic unit 72 diagnoses whether or not shutoff signals corresponding to the output and stop of the first shutoff command by the first detection unit 60 and the output and stop of the second shutoff command by the second detection unit 70 are being output from the gate circuit 80.

[0090] Thus, in the diagnostic mode, the power supply control device 1 executes a process of causing the first detection unit 60 to output a first shutoff command and then stopping the output of the first shutoff command, and a process of causing the second detection unit 70 to output a second shutoff command and then stopping the output of the second shutoff command. The power supply control device 1 monitors the output of the gate circuit 80 when executing these processes. That is, the power supply control device 1 diagnoses whether or not the gate circuit 80 outputs a shutoff signal corresponding to the output and stop of the first shutoff command by the first detection unit 60 and the output and stop of the second shutoff command by the second detection unit 70. This makes it possible to diagnose whether or not the gate circuit 80 operates correctly in accordance with the output and stop of the first shutoff command and the output and stop of the second shutoff command.

[0091] The first detection unit 60 is configured with hardware including a comparator 61 and a latch circuit 62. The comparator 61 outputs a voltage drop signal indicating a drop in the system voltage when the system voltage of the first system 110 or the second system 120 falls below a ground fault threshold. The latch circuit 62 latches the voltage drop signal output from the comparator 61 and outputs a first shutoff command. In the diagnosis mode, the diagnosis unit 72 changes the ground fault threshold to be equal to or greater than the system voltage, causing the first detection unit 60 to output the first shutoff command, and then clears the latch circuit 62 to stop outputting the first shutoff command.

[0092] In this way, since the ground fault threshold is changed in the diagnostic mode, it is possible to cause the first detection unit 60 to output the first shutoff command without intentionally lowering the grid voltage. That is, it is conceivable to intentionally lower the grid voltage in order to cause the first detection unit 60 to output the first shutoff command in the diagnostic mode, but lowering the grid voltage may affect the operation of the load, etc. In this embodiment, since the ground fault threshold is changed instead of lowering the grid voltage, it is possible to cause the first detection unit 60 to output the first shutoff command without affecting the operation of the load, etc. In addition, in this embodiment, the output of the first shutoff command can be easily stopped by clearing the latch circuit 62.

[0093] The second detection unit 70 is configured by software. In the diagnosis mode, the diagnosis unit 72 causes the second detection unit 70 to output a second shutoff command and then stops the output of the second shutoff command. In this way, since the second detection unit 70 is configured by software, the diagnosis unit 72 can reliably output the second shutoff command and stop the output of the second shutoff command in accordance with the diagnosis patterns 1 to 4 in the diagnosis mode.

[0094] The power supply control device 1 includes a single microcomputer 71 that functions as the second detection unit 70 and the diagnosis unit 72. As a result, in this embodiment, the single microcomputer 71 can be used to diagnose whether the gate circuit 80 operates correctly.

[0095] [Second embodiment] [2-1. Configuration example of first and second detection units according to the second embodiment] Next, the first detection unit 60a and the second detection unit 70 of the power supply control device 1 according to the second embodiment will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the configuration of the first detection unit 60a and the second detection unit 70 according to the second embodiment. Note that, in the following, the same reference numerals are used for the configurations common to the first embodiment, and the description thereof will be omitted.

[0096] 9, the first detection unit 60a includes a pulse output device 63 instead of the latch circuit 62 of the first embodiment. As the pulse output device 63, a one-shot multivibrator (monostable multivibrator) can be used.

[0097] Specifically, pulse output device 63 outputs a pulse indicating a first shutoff command for a certain period of time in response to the voltage drop signal output from comparator 61. More specifically, when the voltage drop signal is input from comparator 61, pulse output device 63 outputs a drive pulse (one-shot pulse) indicating the first shutoff command to gate circuit 80 for a certain period of time (e.g., 50 ms). Then, after a certain period of time has elapsed since outputting the drive pulse, pulse output device 63 stops outputting the drive pulse indicating the first shutoff command. In other words, the output of the first shutoff command stops after the certain period of time has elapsed.

[0098] Upon receiving the cutoff signal output from the gate circuit 80, the microcomputer 71 outputs a second cutoff command to the gate circuit 80. As a result, the microcomputer 71 takes over the cutoff state of the inter-system switch 41 before the drive pulse output from the pulse output device 63 stops.

[0099] In this way, when the comparator 61 outputs a voltage drop signal, the pulse output device 63 outputs a first shutoff command as a circuit command to the gate circuit 80 for a certain period of time. The gate circuit 80 outputs a shutoff signal to the inter-system switch 41 for the certain period of time during which the pulse output device 63 outputs the first shutoff command. As a result, the inter-system switch 41 is turned off and enters a shutoff state, and the connection between the first system 110 and the second system 120 is cut off (see FIG. 3).

[0100] As described above, the first detection unit 60a according to the second embodiment is configured by a circuit configured by hardware including the comparator 61 and the pulse output device 63. As a result, in this embodiment, when a power failure in the first system 110 or the second system 120 is detected, the inter-system switch 41 can be quickly switched to a cut-off state.

[0101] [2-2. Processing Executed by the Microcomputer According to the Second Embodiment] Next, detection of a power supply failure and diagnosis of the gate circuit 80 will be described with reference to Fig. 10. Fig. 10 is a flowchart showing an example of processing executed by the microcomputer 71 according to the second embodiment. Note that the processing shown in Fig. 10 is repeatedly executed every time a predetermined time elapses, but is not limited to this.

[0102] 10, if it is determined in step S101 that the microcomputer 71 is not in the diagnosis mode, the microcomputer 71 determines whether or not a shutdown signal due to a voltage drop is present (step S102). In more detail, step S102 is a process for determining whether or not the system voltage has fallen below the ground fault threshold, causing the comparator 61 to output a voltage drop signal, causing the pulse output device 63 to output a drive pulse indicating a first shutdown command, and causing the gate circuit 80 to output a shutdown signal.

[0103] If the microcomputer 71 determines that there is no cutoff signal (step S102, No), it skips the subsequent processing. On the other hand, if the microcomputer 71 determines that there is a cutoff signal (step S102, Yes), it outputs a drive signal for the battery switch 42 before the output of the first cutoff command from the pulse output device 63 stops (step S103). That is, the microcomputer 71 turns on the battery switch 42 to bring it into a conductive state (see FIG. 3).

[0104] Next, the microcomputer 71 outputs a shutoff command (second shutoff command) to the gate circuit 80 before the output of the first shutoff command from the pulse output device 63 stops (step S104). As a result, after a certain time has elapsed, the first shutoff command from the pulse output device 63 is no longer input to the gate circuit 80, but the second shutoff command from the microcomputer 71 is input to the gate circuit 80, so the output of the shutoff signal is maintained and therefore the shutoff state of the inter-system switch 41 is maintained.

[0105] Next, the microcomputer 71 makes a final determination on the power failure detected by the first detection unit 60a (step S106). Note that steps S106 to S111 are the same processes as in the first embodiment, and therefore a description thereof will be omitted here.

[0106] When it is determined that the microcomputer 71 is in the diagnosis mode (step S101, Yes), the microcomputer 71 changes the ground fault threshold (step S112). More specifically, the microcomputer 71 changes the ground fault threshold in the comparator 61 so that it is equal to or greater than the grid voltage. As a result, the grid voltage becomes equal to or less than the ground fault threshold, and the comparator 61 of the first detection unit 60a outputs a voltage drop signal to the pulse output device 63. The pulse output device 63 outputs a drive pulse indicating a first shutoff command; in other words, it outputs a first shutoff command (shutoff command) as a circuit command to the gate circuit 80. At this time, the microcomputer 71 is in a state of outputting a connection command as a software command, in other words, is not outputting a second shutoff command.

[0107] Since the circuit command input to the gate circuit 80 is a disconnect command and the software command is a connect command, the microcomputer 71 determines whether the gate circuit 80 is correctly outputting a disconnect signal (step S113). If the microcomputer 71 determines that the gate circuit 80 is not outputting a disconnect signal (step S113, No), the microcomputer 71 proceeds to the processing of step S123.

[0108] If it is determined that the gate circuit 80 is outputting a shutdown signal (step S113, Yes), the microcomputer 71 determines that the diagnostic pattern 1 is normal. Then, before the output of the first shutdown command from the pulse output device 63 stops, the microcomputer 71 outputs a shutdown command (second shutdown command) as a soft command to the gate circuit 80 (step S114).

[0109] Since the circuit command input to the gate circuit 80 is a shutoff command and the software command is a shutoff command, the microcomputer 71 determines whether the gate circuit 80 is correctly outputting a shutoff signal (step S115). If the microcomputer 71 determines that the gate circuit 80 is not outputting a shutoff signal (step S115, No), the microcomputer 71 proceeds to the processing of step S123.

[0110] If it is determined that the gate circuit 80 is outputting a disconnection signal (step S115, Yes), the microcomputer 71 determines that diagnostic pattern 2 is normal. Then, the microcomputer 71 waits for a certain time to elapse after detecting the disconnection signal in step S113, and for the output of the first disconnection command from the pulse output device 63 to stop (step S116a). Note that this certain time is a time equal to or longer than the pulse width of the drive pulse output by the pulse output device 63, for example, 60 ms. Next, the microcomputer 71 stops the output of the second disconnection command (disconnection command) (step S117). In other words, it outputs a connection command to the gate circuit 80 as a software command.

[0111] Since the circuit command input to the gate circuit 80 is a connection command and the software command is a connection command, the microcomputer 71 determines whether the output of the shutdown signal from the gate circuit 80 has been properly stopped (step S118). If the microcomputer 71 determines that the output of the shutdown signal from the gate circuit 80 has not been stopped (step S118, No), that is, if it determines that the shutdown signal is being output, the microcomputer 71 proceeds to the processing of step S123.

[0112] If the microcontroller 71 determines that the output of the shutdown signal from the gate circuit 80 has stopped (step S118, Yes), it determines that diagnostic pattern 3 is normal and then outputs a shutdown command (second shutdown command) as a soft command to the gate circuit 80 (step S119).

[0113] Since the circuit command input to the gate circuit 80 is a connect command and the software command is a disconnect command, the microcomputer 71 determines whether the gate circuit 80 is correctly outputting a disconnect signal (step S120). If the microcomputer 71 determines that the gate circuit 80 is not outputting a disconnect signal (step S120, No), the microcomputer 71 proceeds to the processing of step S123.

[0114] If it is determined that the gate circuit 80 is outputting a shutoff signal (step S120, Yes), the microcomputer 71 determines that diagnostic pattern 4 is normal, and since diagnostic patterns 1 to 4 are all normal, it determines that the diagnostic result of the gate circuit 80 is normal (step S121). Note that steps S122 to S124 are the same processes as in the first embodiment, and therefore description thereof will be omitted here.

[0115] As described above, the first detection unit 60a according to the second embodiment is configured by hardware including the comparator 61 and the pulse output device 63. The comparator 61 outputs a voltage drop signal indicating a drop in the system voltage when the system voltage of the first system 110 or the second system 120 falls below the ground fault threshold. The pulse output device 63 outputs a pulse indicating a first shutoff command for a certain period of time in response to the voltage drop signal output from the comparator 61. In the diagnosis mode, the diagnosis unit 72 changes the ground fault threshold to be equal to or greater than the system voltage, thereby causing the first detection unit 60a to output the first shutoff command. The output of the first shutoff command stops after a certain period of time has elapsed.

[0116] In this way, since the ground fault threshold is changed in the diagnosis mode, it becomes possible to output the first shutoff command from the first detection unit 60a without intentionally lowering the system voltage and affecting the operation of the load, as in the first embodiment. Furthermore, in the second embodiment, by using the pulse output device 63, it is possible to easily stop the output of the first shutoff command after a certain period of time has elapsed.

[0117] [Third embodiment] [3-1. Configuration example of first and second detection units according to the third embodiment] Next, the first detection unit 60 and second detection units 70a, 70b of the power supply control device 1 according to the third embodiment will be described with reference to Fig. 11. Fig. 11 is a diagram showing an example configuration of the first detection unit 60 and second detection units 70a, 70b according to the third embodiment.

[0118] In the third embodiment, the second detection unit 70a includes a main microcomputer 71a, and the second detection unit 70b includes a sub-microcomputer 71b. In the third embodiment, the main microcomputer 71a executes a process for detecting a power failure in the first system 110 or the second system 120, and the sub-microcomputer 71b executes a process for diagnosing the gate circuit 80. The main microcomputer 71a is an example of a first microcomputer, and the sub-microcomputer 71b is an example of a second microcomputer.

[0119] Specifically, as shown in FIG. 11, the controller 3 includes a first detection unit 60, a second detection unit 70a having a main microcomputer 71a, a second detection unit 70b having a sub-microcomputer 71b, a first gate circuit 91, and a second gate circuit 92.

[0120] As described above, when a power failure in the first system 110 or the second system 120 is detected, the first detection unit 60 outputs a first shutoff command as a circuit command to the gate circuit 80. In response to the first shutoff command, the gate circuit 80 outputs a shutoff signal to the inter-system switch 41, thereby turning the inter-system switch 41 into a shutoff state. Note that the configuration of the first detection unit 60 is the same as that in the first embodiment, and therefore further description will be omitted.

[0121] When the main microcomputer 71a of the second detection unit 70a receives the shutdown signal from the gate circuit 80, it makes a final determination as to whether the first system 110 or the second system 120 is in a fault state. Specifically, first, when the shutdown signal is input from the gate circuit 80 (in other words, when a shutdown signal due to a voltage drop is input), the main microcomputer 71a executes a process to maintain the shutdown state of the inter-system switch 41. More specifically, when the shutdown signal is input from the gate circuit 80, the main microcomputer 71a outputs a second shutdown command as a software command to the first gate circuit 91.

[0122] The first gate circuit 91 is an OR logic circuit. When at least one of a second shutoff command from the main microcomputer 71a and a second shutoff command from a sub-microcomputer 71b (described later) is input, the first gate circuit 91 outputs a second shutoff command to the gate circuit 80. Therefore, when the second shutoff command is input from the main microcomputer 71a, the first gate circuit 91 outputs the second shutoff command to the gate circuit 80.

[0123] Next, the main microcomputer 71a outputs a clear signal for the latch circuit 62 to the second gate circuit 92. The second gate circuit 92 is an OR logic circuit. The second gate circuit 92 outputs a clear signal to the latch circuit 62 when at least one of a clear signal from the main microcomputer 71a and a clear signal from a sub-microcomputer 71b (described later) is input. Therefore, when a clear signal is input from the main microcomputer 71a, the second gate circuit 92 outputs the clear signal to the latch circuit 62. This clears the latch circuit 62, and the output of the first shutoff command is stopped.

[0124] Although the first shutoff command is not input from the latch circuit 62 to the gate circuit 80, the second shutoff command is input from the main microcomputer 71a, and therefore the output of the shutoff signal to the inter-system switch 41 is maintained. That is, the shutoff state of the inter-system switch 41 is maintained.

[0125] After the preliminary determination, the main microcomputer 71a monitors the first and second system voltages V1 and V2 to make a final determination of the failure state of the first system 110 or the second system 120. However, since this final determination is similar to the processing performed by the microcomputer 71 in the first embodiment, a description thereof will be omitted.

[0126] In addition, in the diagnostic mode executed by the sub-microcomputer 71b, when there is no failure in the first and second systems 110, 120, processing such as outputting a shutoff signal from the gate circuit 80 is performed. In such a diagnostic mode, the main microcomputer 71a's failure processing, such as the main determination processing executed in response to the occurrence of a power supply failure, the process of storing diagnostic information, and the process of notifying the user of the detection of a power supply failure, is not required, and therefore the main microcomputer 71a stops the failure processing in the diagnostic mode.

[0127] The sub-microcomputer 71b of the second detection unit 70b is connected to the main microcomputer 71a so as to be able to communicate with the main microcomputer 71a. The sub-microcomputer 71b also functions as a diagnosis unit 72a that diagnoses whether the gate circuit 80 can correctly output a shutoff signal to the inter-system switch 41. When the sub-microcomputer 71b enters the diagnosis mode, it notifies the main microcomputer 71a that it is in the diagnosis mode. In response to this, the main microcomputer 71a stops the failure processing. In addition, when the diagnosis mode ends, the sub-microcomputer 71b notifies the main microcomputer 71a that the diagnosis mode has ended. In response to this, the main microcomputer 71a cancels the stop of the failure processing and returns to normal control.

[0128] In the diagnostic mode for diagnosing the gate circuit 80, the diagnostic unit 72a of the sub-microcomputer 71b performs the diagnosis by creating a situation (state) that results in the circuit commands and software commands of diagnostic patterns 1 to 4 (see FIG. 7).

[0129] Specifically, in the diagnostic mode, the sub-microcomputer 71b outputs a first shutoff command (shutoff command) or stops outputting the first shutoff command (shutoff command) (i.e., outputs a connection command) so as to obtain a circuit command shown in diagnostic patterns 1 to 4. Specifically, in the diagnostic mode, the sub-microcomputer 71b controls the circuit command output from the first detection unit 60 by changing the ground fault threshold, as shown in FIG. 11 . Specifically, the sub-microcomputer 71b changes the ground fault threshold so that it is equal to or greater than the system voltage. As a result, the system voltage (e.g., the second system voltage V2) becomes equal to or less than the ground fault threshold, and the comparator 61 of the first detection unit 60 outputs a voltage drop signal to the latch circuit 62. The latch circuit 62 latches the voltage drop signal output from the comparator 61 and outputs the first shutoff command (shutoff command) to the gate circuit 80 as a circuit command. The sub-microcomputer 71b also outputs a clear signal for the latch circuit 62 to the second gate circuit 92. When the clear signal is input from the sub-microcomputer 71b, the second gate circuit 92 outputs the clear signal to the latch circuit 62. This clears the latch circuit 62 and stops the output of the first disconnect command; in other words, it outputs a connect command to the gate circuit 80 as a circuit command.

[0130] Furthermore, in the diagnostic mode, the sub-microcomputer 71b outputs a second shutoff command (shutoff command) or stops outputting the second shutoff command (shutoff command) (in other words, outputs a connect command) so as to result in a soft command shown in diagnostic patterns 1 to 4 (see FIG. 7). Specifically, in the diagnostic mode, the sub-microcomputer 71b outputs the second shutoff command as a soft command to the first gate circuit 91. When the second shutoff command is input from the sub-microcomputer 71b, the first gate circuit 91 outputs the second shutoff command to the gate circuit 80. Furthermore, in the diagnostic mode, the sub-microcomputer 71b stops outputting the second shutoff command (shutoff command); in other words, it outputs a connect command to the first gate circuit 91 as a soft command. When the connect command is input from the sub-microcomputer 71b, the first gate circuit 91 outputs the connect command to the gate circuit 80 as a soft command.

[0131] [3-2. Processing Executed by the Main Microcomputer and Sub-Microcomputer According to the Third Embodiment] Next, detection of a power supply failure by the main microcomputer 71a and diagnosis of the gate circuit 80 by the sub-microcomputer 71b will be described with reference to Figures 12 and 13. Figure 12 is a flowchart showing an example of processing executed by the main microcomputer 71a according to the third embodiment. Figure 13 is a flowchart showing an example of processing executed by the sub-microcomputer 71b according to the third embodiment. Note that the processing shown in Figures 12 and 13 is repeatedly executed every time a predetermined time elapses, but is not limited to this.

[0132] First, the processing by the main microcomputer 71a will be described. As shown in Fig. 12, the main microcomputer 71a determines whether or not it is in the diagnosis mode (step S201). If it is determined that it is not in the diagnosis mode (step S201, No), the main microcomputer 71a determines whether or not a shutdown signal due to a voltage drop is present (step S202). More specifically, step S202 is a process in which the system voltage falls below the ground fault threshold, causing the comparator 61 to output a voltage drop signal, the latch circuit 62 to latch the voltage drop signal and output a first shutdown command, and the gate circuit 80 to determine whether or not it is outputting a shutdown signal.

[0133] If the main microcomputer 71a determines that there is no cutoff signal (step S202, No), it skips the subsequent processing. On the other hand, if the main microcomputer 71a determines that there is a cutoff signal (step S202, Yes), it outputs a drive signal for the battery switch 42 (step S203) to turn on the battery switch 42 and set it to a conductive state (see FIG. 3). Note that, here, since the gate circuit 80 is outputting the cutoff signal, the inter-system switch 41 is set to a cutoff state (see FIG. 3).

[0134] Next, the main microcomputer 71a outputs a cutoff command (second cutoff command) to the first gate circuit 91 (step S204). When the cutoff command (second cutoff command) is input from the main microcomputer 71a, the first gate circuit 91 outputs the cutoff command (second cutoff command) to the gate circuit 80.

[0135] Next, the main microcomputer 71a outputs a clear signal for the latch circuit 62 to the second gate circuit 92 (step S205). When the clear signal is input from the main microcomputer 71a, the second gate circuit 92 outputs the clear signal to the latch circuit 62. This clears the latch circuit 62 and stops the output of the first shutoff command. As a result, the first shutoff command from the latch circuit 62 is not input to the gate circuit 80, but the second shutoff command from the main microcomputer 71a is input, so the output of the shutoff signal is maintained and the shutoff state of the inter-system switch 41 is maintained.

[0136] Next, the main microcomputer 71a determines whether the power supply failure detected by the first detection unit 60 is a true failure or an erroneous detection caused by a temporary voltage drop or the like (step S206). Specifically, the main microcomputer 71a monitors the first and second system voltages V1, V2, and determines whether the first and second system voltages V1, V2 will recover to exceed the ground fault threshold within a predetermined time.

[0137] Next, the main microcomputer 71a determines whether or not the first system 110 and the second system 120 are normal based on the determination result in the main determination process of step S206 (step S207). In other words, the main microcomputer 71a determines whether or not the power failure detected by the first detection unit 60 was a false detection caused by a temporary voltage drop or the like.

[0138] If the main microcomputer 71a determines that the first and second systems 110, 120 are normal (step S207, Yes), that is, if the detection was erroneous, it stops outputting the shutdown command (second shutdown command) (step S208). As a result, the second shutdown command that had been input from the main microcomputer 71a via the first gate circuit 91 is no longer input to the gate circuit 80, so the output of the shutdown signal is stopped, and the inter-system switch 41 is turned on to enter the connected state.

[0139] Next, the main microcomputer 71a stops outputting the drive signal for the battery switch 42 (step S209). This turns off the battery switch 42 and puts it into a cutoff state. As a result, the power supply control device 1 returns to normal operation (see FIG. 2).

[0140] On the other hand, if the main determination process in step S206 determines that the first system 110 or the second system 120 is not normal (step S207, No), the main microcomputer 71a performs backup control (step S210). Specifically, if the main determination process determines that a ground fault 300 has occurred in the first system 110, the main microcomputer 71a performs backup control to supply power from the second power source 20 to the second load 102 via the second system 120 while continuing to output the second shutoff command. If the main determination process determines that a ground fault 301 has occurred in the second system 120, the main microcomputer 71a performs backup control to supply power from the first power source 20 to the first load 101 via the first system 110 while continuing to output the second shutoff command. Next, the main microcomputer 71a executes failure processing (step S211).

[0141] On the other hand, if the main microcomputer 71a determines that the diagnostic mode is in effect (step S201, Yes), it stops the failure processing (step S212). Specifically, when the main microcomputer 71a is notified by the sub-microcomputer 71b that the diagnostic mode has started, it determines that the diagnostic mode is in effect and skips, i.e., stops, the failure processing of steps S202 to S211. Note that when the main microcomputer 71a is notified by the sub-microcomputer 71b that the diagnostic mode has ended, it determines in step S201 that the diagnostic mode is not in effect.

[0142] Next, the processing by the sub-microcomputer 71b will be described. As shown in Fig. 13, the sub-microcomputer 71b determines whether or not it is in the diagnostic mode (step S301). The sub-microcomputer 71b is set to the diagnostic mode at a predetermined timing, such as when the power is turned on. If it is determined that it is not in the diagnostic mode (step S301, No), the sub-microcomputer 71b skips the subsequent processing.

[0143] On the other hand, if it is determined that the sub-microcomputer 71b is in the diagnostic mode (step S301, Yes), the sub-microcomputer 71b executes a diagnostic start process (step S302). The diagnostic start process may be, for example, a process of notifying the main microcomputer 71a of the start of the diagnostic mode, but is not limited to this.

[0144] Next, the sub-microcomputer 71b changes the ground fault threshold (step S303). More specifically, the sub-microcomputer 71b changes the ground fault threshold in the comparator 61 so that it is equal to or greater than the grid voltage. As a result, the grid voltage becomes equal to or less than the ground fault threshold, and the comparator 61 of the first detection unit 60 outputs a voltage drop signal to the latch circuit 62. The latch circuit 62 latches the voltage drop signal output from the comparator 61 and outputs a first shutoff command (shutoff command) as a circuit command to the gate circuit 80. Note that at this time, the sub-microcomputer 71b is in a state where it is outputting a connect command as a software command, in other words, is not outputting a second shutoff command. In other words, the processing of step S303 is processing to create a situation where the circuit command and software command of diagnostic pattern 1 (see FIG. 7) are issued.

[0145] Since the circuit command input to the gate circuit 80 is a disconnect command and the software command is a connect command, the sub-microcomputer 71b determines whether the gate circuit 80 is correctly outputting a disconnect signal (step S304). If the sub-microcomputer 71b determines that the gate circuit 80 is not outputting a disconnect signal (step S304, No), the process proceeds to step S314, which will be described later.

[0146] If it is determined that the gate circuit 80 is outputting a shutdown signal (step S304, Yes), the sub-microcomputer 71b determines that diagnostic pattern 1 is normal, and subsequently outputs a shutdown command (second shutdown command) as a software command to the first gate circuit 91 (step S305). When the shutdown command (second shutdown command) is input from the sub-microcomputer 71b, the first gate circuit 91 outputs the shutdown command (second shutdown command) to the gate circuit 80. In other words, the processing of step S305 is processing to create a situation in which the circuit command and software command of diagnostic pattern 2 (see FIG. 7) are issued.

[0147] Since the circuit command input to the gate circuit 80 is a shutoff command and the software command is a shutoff command, the sub-microcomputer 71b determines whether the gate circuit 80 is correctly outputting a shutoff signal (step S306). If the sub-microcomputer 71b determines that the gate circuit 80 is not outputting a shutoff signal (step S306, No), the process proceeds to step S314, which will be described later.

[0148] If the sub-microcomputer 71b determines that the gate circuit 80 is outputting a shutdown signal (step S306, Yes), it determines that diagnostic pattern 2 is normal and subsequently outputs a clear signal for the latch circuit 62 to the second gate circuit 92 (step S307). When the clear signal is input from the sub-microcomputer 71b, the second gate circuit 92 outputs the clear signal to the latch circuit 62. This clears the latch circuit 62 and stops the output of the first shutdown command. In other words, it outputs a connect command as a circuit command. Next, the sub-microcomputer 71b stops the output of the second shutdown command (shutdown command) (step S308). In other words, it outputs a connect command as a software command to the first gate circuit 91. The first gate circuit 91 outputs this connect command to the gate circuit 80. In other words, the processing of steps S307 and S308 is processing to create a situation in which the circuit command and software command of diagnostic pattern 3 (see FIG. 7) are issued.

[0149] Since the circuit command input to the gate circuit 80 is a connection command and the software command is a connection command, the sub-microcomputer 71b determines whether the output of the shutdown signal from the gate circuit 80 has been properly stopped (step S309). If the sub-microcomputer 71b determines that the output of the shutdown signal from the gate circuit 80 has not been stopped (step S309, No), that is, if it determines that the shutdown signal is being output, the process proceeds to step S314, which will be described later.

[0150] If it is determined that the output of the shutdown signal from the gate circuit 80 has stopped (step S309, Yes), the sub-microcomputer 71b determines that diagnostic pattern 3 is normal. Subsequently, the sub-microcomputer 71b outputs a shutdown command (second shutdown command) as a software command to the first gate circuit 91 (step S310). When the shutdown command (second shutdown command) is input from the sub-microcomputer 71b, the first gate circuit 91 outputs the shutdown command (second shutdown command) to the gate circuit 80. In other words, the processing of step S310 is processing to create a situation in which the circuit command and software command of diagnostic pattern 4 (see FIG. 7) are issued.

[0151] Since the circuit command input to the gate circuit 80 is a connect command and the software command is a disconnect command, the sub-microcomputer 71b determines whether the gate circuit 80 is correctly outputting a disconnect signal (step S311). If the sub-microcomputer 71b determines that the gate circuit 80 is not outputting a disconnect signal (step S311, No), the process proceeds to step S314, which will be described later.

[0152] If it is determined that the gate circuit 80 is outputting a shutoff signal (step S311, Yes), the sub-microcomputer 71b determines that diagnostic pattern 4 is normal. Since diagnostic patterns 1 to 4 are all normal, the sub-microcomputer 71b determines that the diagnostic result of the gate circuit 80 is normal (step S312).

[0153] Next, the sub-microcomputer 71b executes a diagnosis end process (step S313), which may include, but is not limited to, a process for changing both the circuit command and the software command into a connection command, a process for restoring the ground fault threshold value changed in step S303 to its original state, and a process for notifying the main microcomputer 71a of the end of the diagnosis mode.

[0154] On the other hand, if it is determined in steps S304, S306, and S311 that the gate circuit 80 is not outputting a shutdown signal, or if it is determined in step S309 that the output of the shutdown signal from the gate circuit 80 has not stopped, the process proceeds to step S314. In step S314, since the gate circuit 80 is not operating normally in any of diagnostic patterns 1 to 4 and is determined to be abnormal, the diagnosis result of the gate circuit 80 is determined to be abnormal.

[0155] Next, the sub-microcomputer 71b executes abnormality processing (step S315). The abnormality processing includes processing to output an automatic driving prohibition signal to the automatic driving control device 200, processing to store the abnormality detection of the gate circuit 80 as diagnostic information in a memory unit, and processing to notify the user of the abnormality detection, but these are examples and are not limited to these. After executing the abnormality processing, the sub-microcomputer 71b executes the processing of step S313 described above.

[0156] As described above, the power supply control device 1 according to the third embodiment includes a main microcomputer 71a (first microcomputer) and a sub-microcomputer 71b (second microcomputer). The main microcomputer 71a functions as the second detection unit 70a. The sub-microcomputer 71b functions as the diagnosis unit 72a and also functions as the second detection unit 70b in the diagnosis mode. In other words, the power supply control device 1 according to the third embodiment includes a main microcomputer 71a for detecting a power supply failure and a sub-microcomputer 71b for diagnosing the gate circuit 80. As a result, in the third embodiment, it is possible to diagnose whether the gate circuit 80 is operating correctly simply by adding the sub-microcomputer 71b, without making any major design changes to the main microcomputer 71a.

[0157] Furthermore, in the diagnostic mode, the diagnostic unit 72a of the sub-microcomputer 71b stops the failure processing executed by the main microcomputer 71a in response to the occurrence of a power failure, thereby stopping unnecessary failure processing in the diagnostic mode (for example, the actual determination processing, the processing for storing the detection of a power failure in a storage unit as diagnostic information, the processing for notifying the user of the detection of a power failure, etc.).

[0158] The first to third embodiments described above can be combined as appropriate. For example, the second and third embodiments can be combined to provide a configuration including the pulse output device 63 of the second embodiment instead of the latch circuit 62 of the third embodiment.

[0159] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0160] 1 Power supply control device 41 Intersystem switch 60, 60a First detection unit 70, 70a, 70b Second detection unit 72,72a Diagnostic Department 80 Gate Circuit

Claims

1. a breaker device capable of connecting and disconnecting a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a first detection unit that detects a power failure of the first system or the second system using a first detection logic and outputs a first shutoff command; a second detection unit that detects a power failure of the first system or the second system using a second detection logic and outputs a second shutoff command; a gate circuit configured to be able to input the first shutoff command and the second shutoff command, and which outputs a shutoff signal that puts the shutoff device into a shutoff state when at least one of the first shutoff command and the second shutoff command is input; a diagnostic unit that, in a diagnostic mode for diagnosing the gate circuit, executes a process of causing the first detection unit to output the first shutoff command and then stopping the output of the first shutoff command, and a process of causing the second detection unit to output the second shutoff command and then stopping the output of the second shutoff command, and diagnoses whether or not the shutoff signal corresponding to the output and stop of the first shutoff command by the first detection unit and the output and stop of the second shutoff command by the second detection unit is output from the gate circuit; A power supply control device comprising:

2. The first detection unit The power supply is configured by hardware including a comparator that outputs a voltage drop signal indicating that the system voltage has dropped when the system voltage of the first system or the second system becomes equal to or lower than a ground fault threshold, and a latch circuit that latches the voltage drop signal output from the comparator and outputs the first shutoff command, The diagnostic unit In the diagnosis mode, the first detection unit outputs the first shutoff command by changing the ground fault threshold value so that the ground fault threshold value is equal to or greater than the system voltage, and then the latch circuit is cleared to stop outputting the first shutoff command. The power supply control device according to claim 1 .

3. The first detection unit The power supply is configured by hardware including: a comparator that outputs a voltage drop signal indicating that the system voltage has dropped when the system voltage of the first system or the second system becomes equal to or lower than a ground fault threshold; and a pulse output device that outputs a pulse indicating the first shutoff command for a certain period of time in response to the voltage drop signal output from the comparator, The diagnostic unit In the diagnosis mode, the ground fault threshold is changed to be equal to or greater than the system voltage, thereby causing the first detection unit to output the first shut-off command; The output of the first shutoff command is stopped after the certain time has elapsed. The power supply control device according to claim 1 .

4. The second detection unit It is composed of software, The diagnostic unit In the diagnosis mode, the second detection unit outputs the second shutoff command, and then stops outputting the second shutoff command. The power supply control device according to claim 1 .

5. a single microcomputer that functions as the second detection unit and the diagnosis unit; The power supply control device according to claim 1 , comprising:

6. a first microcomputer that functions as the second detection unit; a second microcomputer that functions as the diagnostic unit and also functions as the second detection unit in the diagnostic mode; The power supply control device according to claim 1 , comprising:

7. The diagnostic unit In the diagnosis mode, when a power failure occurs, the failure process executed by the first microcomputer is stopped. The power supply control device according to claim 6.

8. a breaker device capable of connecting and disconnecting a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a first detection unit that detects a power failure of the first system or the second system using a first detection logic and outputs a first shutoff command; a second detection unit that detects a power failure of the first system or the second system using a second detection logic and outputs a second shutoff command; a gate circuit configured to be able to input the first shutoff command and the second shutoff command, and which outputs a shutoff signal that puts the shutoff device into a shutoff state when at least one of the first shutoff command and the second shutoff command is input; A program for controlling a power supply control device comprising: during a diagnostic mode in which the gate circuit is diagnosed, a process of causing the first detection unit to output the first shutoff command and then stopping the output of the first shutoff command, and a process of causing the second detection unit to output the second shutoff command and then stopping the output of the second shutoff command are executed, and a diagnosis is made as to whether or not the shutoff signal corresponding to the output and stop of the first shutoff command by the first detection unit and the output and stop of the second shutoff command by the second detection unit is output from the gate circuit; A program that causes a computer to execute the following.

Images