Power supply control device

Abstract

To provide a power supply control device capable of preventing delay in fail-safe control when a ground fault occurs.SOLUTION: A power supply control device includes a first system, a second system, an inter-system switch, a first detection unit, and a second detection unit. The first system supplies power from a first power source to a first load, and the second system supplies power from a second power source to a second load. The inter-system switch can connect and disconnect the first system and the second system. The first detection unit detects an abnormality in the first system or the second system on the basis of a physical quantity indicating the state of the first system or the second system and a first threshold value, and when an abnormality is detected, shuts off the inter-system switch. The second detection unit determines whether the system in which the abnormality is detected by the first detection unit is the first system or the second system on the basis of the physical quantity and a second threshold value set to have higher sensitivity for detecting abnormalities than the first threshold value, taking a longer time than the detection time of the first detection unit, and transitions to fail-safe control while maintaining the inter-system switch in a shut-off state.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The disclosed embodiments relate to a power supply control device. [Background technology]

[0002] There is a power supply control device that includes a first system that supplies power from a first power source to a first load, a second system that supplies power from a second power source to a second load, and an inter-system switch that can connect and disconnect the first system and the second system.

[0003] When the power supply control device detects a ground fault in the first or second system using hardware, it shuts off the inter-system switch, and then uses software to identify whether the system in which the ground fault was detected is the first or second system, and transitions to fail-safe control (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2019-62727 Summary of the Invention [Problem to be solved by the invention]

[0005] However, since software-based detection of a ground fault takes a longer time to determine than hardware-based detection of a ground fault, fail-safe control is delayed if a ground fault actually occurs.

[0006] One aspect of the embodiment has been made in consideration of the above, and aims to provide a power supply control device that can prevent delays in fail-safe control when a ground fault has actually occurred. [Means for solving the problem]

[0007] According to one embodiment, the power supply control device includes a first system, a second system, an inter-system switch, a first detection unit, and a second detection unit. The first system supplies power from a first power source to a first load. The second system supplies power from a second power source to a second load. The inter-system switch is capable of connecting and disconnecting the first system and the second system. The first detection unit detects an abnormality in the first system or the second system based on a physical quantity indicating a state of the first system or the second system and a first threshold value, and shuts off the inter-system switch upon detecting the occurrence of the abnormality. The second detection unit determines whether the system in which the abnormality is detected by the first detection unit is the first system or the second system based on the physical quantity and a second threshold value set to have a higher sensitivity for detecting abnormalities than the first threshold value, taking a longer time than the detection time of the first detection unit, and transitions to fail-safe control while maintaining the inter-system switch in a shut-off state. [Effects of the Invention]

[0008] A power supply control device according to one aspect of the embodiment has an effect of preventing a delay in fail-safe control when a ground fault has actually occurred. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of the configuration of a power supply control device according to an embodiment. [Figure 2] FIG. 2 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 3] FIG. 3 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 4] FIG. 4 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 5] FIG. 5 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 6] FIG. 6 is an explanatory diagram of the first threshold value and the second threshold value according to the embodiment. [Figure 7] FIG. 7 is an explanatory diagram illustrating a configuration example of a switch driving unit according to the embodiment. [Figure 8] FIG. 8 is a flowchart illustrating an example of processing executed by the switch driving unit according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of a power supply control device and a power supply control method will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below. The following description will be given using an example of a power supply control device that is installed in a vehicle with an autonomous driving function and supplies power to a load, but the power supply control device according to the embodiment may also be installed in a vehicle that does not have an autonomous driving function.

[0011] In addition, although the following description will be given of a case where the vehicle in which the power supply control device is installed is an electric vehicle or a hybrid vehicle, the vehicle in which the power supply control device is installed may also be an engine vehicle that runs on an internal combustion engine.

[0012] In addition, the power supply control device according to the embodiment may be installed in any device that has a first power supply and a second power supply, and that backs up the first power supply using the other power supply system in the event of a power failure in either the first power supply or the second power supply system.

[0013] [1. Power supply control device configuration] Fig. 1 is an explanatory diagram showing an example of the configuration of a power supply control device according to an embodiment. As shown in Fig. 1, the power supply control device 1 according to the embodiment is connected to a first power source 10, a first load 101, a general load 102, a second load 103, and an automatic driving control device 100. The power supply control device 1 includes a first system 110 that supplies power from the first power source 10 to the first load 101 and the general load 102, and a second system 120 that supplies power from a second power source 20 (described later) to the second load 103.

[0014] The first load 101 includes a load for autonomous driving. For example, the first load 101 includes a steering motor, an electric brake device, an in-vehicle camera, etc. that operate during autonomous driving. The general load 102 includes, for example, a display, an air conditioner, an audio device, a video device, various lights, etc.

[0015] The second load 103 has some of the functions for automatic driving that the first load 101 has. For example, the second load 103 includes the minimum devices required for FOP (fail-safe control), such as a steering motor, an electric brake device, and a radar. The first load 101, the general load 102, and the second load 103 operate using power supplied from the power supply control device 1.

[0016] The automatic driving control device 100 is a device that controls the automatic driving of a vehicle. The automatic driving control device 100 operates a first load 101 and a second load 103 to cause the vehicle to travel by automatic driving. Furthermore, the automatic driving control device 100 can perform FOP by the second load 103 when a ground fault occurs in the first system 110 during automatic driving, and can perform FOP by the first load 101 when a ground fault occurs in the second system 120.

[0017] The first power source 10 includes a DC / DC converter (hereinafter referred to as "DC / DC 11") and a lead battery (hereinafter referred to as "PbB 12"). The battery of the first power source 10 may be any secondary battery other than PbB 12.

[0018] The DC / DC converter 11 is connected to a generator and a high-voltage battery having a higher voltage than the PbB 12, and steps down the voltages of the generator and the high-voltage battery and outputs the stepped-down voltage to the first system 110. The generator is, for example, an alternator that converts the kinetic energy of a running vehicle into electricity to generate power. The high-voltage battery is, for example, a battery for driving the vehicle that is installed in an electric vehicle or a hybrid vehicle.

[0019] When the first power supply 10 is installed in an engine vehicle, an alternator (generator) is provided instead of the DC / DC 11. The DC / DC 11 charges the PbB 12, supplies power to the first load 101 and the general load 102, supplies power to the second load 103, and charges the second power supply 20, which will be described later.

[0020] The power supply control device 1 includes a second power supply 20, an inter-system switch 41, a battery switch 42, a switch driver 3, a first voltage sensor 51, and a second voltage sensor 52. The second power supply 20 is a backup power supply in case the first power supply 10 is unable to supply power. The second power supply 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). Note that the battery of the second power supply 20 may be any secondary battery other than the LiB21.

[0021] The inter-system switch 41 is provided on the inter-system line 130 connecting the first system 110 and the second system 120, and is a switch that can connect and disconnect the first system 110 and the second system 120. The battery switch 42 is a switch that connects the second power source 20 to the second system 120. In the following description, connecting the inter-system switch 41 means electrically connecting, or conducting, the first system 110 and the second system 120. Disconnecting the inter-system switch 41 means disconnecting, or blocking, the electrical connection between the first system 110 and the second system 120.

[0022] The first voltage sensor 51 is provided in the first system 110, detects the voltage of the first system 110, and outputs the detection result to the switch driver 3. The second voltage sensor 52 is provided in the second system 120, detects the voltage of the second system 120, and outputs the detection result to the switch driver 3.

[0023] The switch driver 3 includes various circuits and a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc. The switch driver 3 may also be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

[0024] The switch driver 3 includes a first detector 31 and a second detector 32 that function when the CPU executes a program stored in the ROM using the RAM as a work area, and controls the operation of the power supply control device 1. The first detector 31 may be configured as hardware.

[0025] The first detection unit 31 detects an abnormality in the first system 110 or the second system 120 based on a physical quantity indicating the state of the first system 110 or the second system 120 and a first threshold value. In the following, a case where the physical quantity according to the embodiment is a voltage will be described. In addition, in the following, a case where the abnormality according to the embodiment is a ground fault will be described.

[0026] Note that the physical quantity according to the embodiment is not limited to voltage, and may be a physical quantity other than voltage, such as current or temperature. Furthermore, the abnormality according to the embodiment is not limited to a ground fault, and may be an abnormality other than a ground fault, such as an abnormal overcurrent state or an abnormally high temperature state. Cases where the physical quantity is other than voltage and cases where the abnormality is other than a ground fault will be described later.

[0027] The second detection unit 32 determines whether the system in which the first detection unit 31 detected an abnormality is the first system 110 or the second system 120, taking a longer time than the detection time of the first detection unit 31 based on a physical quantity indicating the state of the first system 110 or the second system 120 and a second threshold value that is set to have higher sensitivity for detecting abnormalities than the first threshold value, and then transitions to fail-safe control. This allows the power supply control device 1 to prevent delays in fail-safe control when a ground fault has actually occurred.

[0028] A specific configuration example of the switch driver 3 will be described later with reference to Fig. 7. When activated, the switch driver 3 connects (turns on) the inter-system switch 41 and disconnects (turns off) the battery switch 42. The switch driver 3 detects a ground fault in the first system 110 or the second system 120 based on the detection results input from the first voltage sensor 51 and the second voltage sensor 52. A specific example of a method for detecting a ground fault by the switch driver 3 will be described later.

[0029] When the switch driving unit 3 detects a ground fault in the first system 110 or the second system 120, it notifies the automatic driving control device 100 of that fact. When the switch driving unit 3 detects a ground fault in the first system 110 or the second system 120, it outputs an automatic driving prohibition signal indicating that automatic driving is not possible to the automatic driving control device 100. Furthermore, when the switch driving unit 3 does not detect a ground fault in the first system 110 or the second system 120, it outputs an automatic driving permission signal indicating that automatic driving is possible to the automatic driving control device 100.

[0030] When a power supply failure such as a ground fault occurs in the first system 110, the switch driving unit 3 cuts off the inter-system switch 41, connects the battery switch 42, and supplies power from the second power supply 20 to the second load 103. When a power supply failure such as a ground fault occurs in the second system 120, the switch driving unit 3 cuts off the inter-system switch 41 and supplies power from the first power supply 10 to the first load 101 and the general load 102 with the battery switch 42 cut off.

[0031] As a result, even if a ground fault occurs in one of the systems during automatic driving, the power supply control device 1 can use the other system and stop the vehicle by implementing FOP, which causes the vehicle to evacuate to a safe place using the automatic driving control device 100. Next, the operation of the power supply control device 1 will be described with reference to Figures 2 to 5.

[0032] [2. Normal operation of the power supply control device] 2 , the switch driving unit 3 turns off the battery switch 42 and connects the inter-system switch 41 to supply power from the first power source 10 to the first load 101, the general load 102, and the second load 103. In this way, during normal times when no ground fault occurs, the switch driving unit 3 outputs an automatic driving permission signal to the automatic driving control device 100.

[0033] [3. Operation of power supply control device when a ground fault occurs] Next, the operation of the power supply control device 1 when a ground fault occurs will be described with reference to Figures 3 to 5. As shown in Figure 3, in the power supply control device 1, for example, when a ground fault 200 occurs in the first system 110 or when a ground fault 201 occurs in the second system 120, an overcurrent flows toward the ground fault point, and the voltages detected by the first voltage sensor 51 and the second voltage sensor 52 become equal to or lower than the ground fault determination threshold value.

[0034] Therefore, when the first detection unit 31 of the switch driving unit 3 detects by hardware that the voltage detected by the second voltage sensor 52 has fallen below the first threshold, which is the ground fault determination threshold, the first detection unit 31 provisionally determines that a ground fault 200, 201 has occurred in the first system 110 or the second system 120.

[0035] Then, when the first detection unit 31 tentatively determines that ground faults 200, 201 have occurred, the switch drive unit 3 outputs an automatic driving prohibition signal to the automatic driving control device 100, immediately disconnects the inter-system switch 41, and connects the battery switch 42. This disconnects the first system 110 and the second system 120, and power is supplied from the first power source 10 to the first system 110, and power is supplied from the second power source 20 to the second system 120.

[0036] In addition, the first detection unit 31 can also tentatively determine that a ground fault has occurred in the first system 110 or the second system 120 when the voltage detected by at least one of the first voltage sensor 51 or the second voltage sensor 52 becomes equal to or lower than a first threshold value.

[0037] Thereafter, the second detection unit 32 of the switch driving unit 3 determines whether the system in which the ground fault is detected is the first system 110 or the second system 120 based on the voltage detected by the first voltage sensor 51 and the voltage detected by the second voltage sensor 52, and the second threshold value.

[0038] The second threshold is set to have a higher sensitivity for detecting abnormalities than the first threshold. Specifically, the second threshold is set to a value that is a predetermined voltage higher than the second threshold. The second detection unit 32 then takes a longer time to identify the system in which the ground fault occurred than the time it took for the first detection unit 31 to detect the ground fault, and transitions to fail-safe control.

[0039] At this time, if the voltage detected by the first voltage sensor 51 is below the second threshold for a predetermined time or more and the voltage detected by the second voltage sensor 52 returns to exceeding the second threshold within the predetermined time, the second detection unit 32 determines that a ground fault 200 has occurred in the first system 110.

[0040] In this case, as shown in Fig. 4, the second detection unit 32 transitions to fail-safe control, supplies power from the second power source 20 to the second load 103 while maintaining the interrupted state of the inter-system switch 41 and the connected state of the battery switch 42, and notifies the automatic driving control device 100 of this. As a result, the automatic driving control device 100 can operate the second load 103 using the power supplied from the second power source 20 and cause the vehicle to evacuate to a safe place and stop. The automatic driving control device 100 may be configured to start evacuating when an automatic driving prohibition signal is input from the power source control device 1.

[0041] Furthermore, after the first detection unit 31 provisionally determines that a ground fault has occurred in the first system 110 or the second system 120, if the voltage detected by the second voltage sensor 52 remains below the second threshold even after a predetermined time has elapsed and the voltage detected by the first voltage sensor 51 returns to exceeding the second threshold within the predetermined time, the second detection unit 32 finally determines that a ground fault 201 has occurred in the second system 120.

[0042] 5, the second detection unit 32 transitions to fail-safe control, keeps the inter-system switch 41 in the cut-off state, cuts off the battery switch 42, supplies power from the first power source 10 to the first load 101, and notifies the automatic driving control device 100 of this. As a result, the automatic driving control device 100 can operate the first load 101 using the power supplied from the first power source 10, and cause the vehicle to evacuate to a safe place and stop. The automatic driving control device 100 may be configured to start evacuating when an automatic driving prohibition signal is input from the power supply control device 1.

[0043] In this way, the second detection unit 32 identifies the system that has experienced a ground fault by comparing the voltage detected by the first voltage sensor 51 and the voltage detected by the second voltage sensor 52 with the second threshold value that is higher than the first threshold value, and transitions to fail-safe control. This allows the power supply control device 1 to prevent delays in fail-safe control when a ground fault has actually occurred.

[0044] In the power supply control device 1, the voltage detected by the first voltage sensor 51 may temporarily become equal to or lower than the ground fault determination threshold if the first load 101 or the general load 102 temporarily becomes overloaded, rather than if the ground faults 200 and 201 occur. In the power supply control device 1, the voltage detected by the second voltage sensor 52 may temporarily become equal to or lower than the ground fault determination threshold if the second load 103 temporarily becomes overloaded.

[0045] In this case, in the power supply control device 1, power is continuously supplied from the first power source 10 to the first load 101 and the general load 102, and from the second power source 20 to the second load 103. Therefore, after provisionally determining that a ground fault 200, 201 has occurred in the first system 110 or the second system 120, if the voltages detected by the first voltage sensor 51 and the second voltage sensor 52 both return to exceeding the ground fault determination threshold before a predetermined time has elapsed, the switch driver 3 officially determines that this is a transient voltage drop and that there is no abnormality in the power supply. Thereafter, the switch driver 3 disconnects the battery switch 42 and reconnects the inter-system switch 41 to return to normal operation shown in FIG. 2.

[0046] [4. Explanation of the first and second thresholds] 6 is an explanatory diagram of the first threshold value and the second threshold value according to the embodiment. As shown in Fig. 6, in the power supply control device 1, for example, when a ground fault or an overload state occurs, the voltage detected by the first detection unit 31 (the voltage of the first system 110 or the voltage of the second system 120) drops. When the detected voltage drops to the first threshold value at time t1, the first detection unit 31 determines that an abnormality has occurred.

[0047] At this time, even if the second detection unit 32 detects the voltage of the first system 110 or the voltage of the second system 120, it may not detect exactly the same voltage as the first detection unit 31 due to, for example, individual differences. That is, the second detection unit 32 may cause a voltage detection error.

[0048] Here, if the second detection unit 32 detects a voltage higher than the detection voltage of the first detection unit 31 (see the dotted line on the high voltage side in Figure 6) when the first detection unit 31 detects an abnormality at time t1, it may make an erroneous judgment if it uses the same first threshold as the first detection unit 31.

[0049] Specifically, the second detection unit 32 performs an abnormality determination from time t1, when the first detection unit 31 determines that an abnormality has occurred, to time t2. However, if the second detection unit 32 detects the voltage indicated by the dotted line on the high-voltage side in FIG. 6, the detected voltage will not drop to the first threshold value, and the second detection unit 32 will erroneously determine that there is no abnormality at time t2.

[0050] Therefore, if the determination period is extended to time t3, for example, the second detection unit 32 can determine that an abnormality has occurred at time t3, just like the first detection unit 31. However, if the determination period is set too long, the second detection unit 32 will delay the transition to fail-safe control.

[0051] Therefore, when an abnormality is detected by the first detection unit 31, the second detection unit 32 sets the second threshold value based on the detected value of the physical quantity detected by the second detection unit 32. At this time, the second detection unit 32 sets the second threshold value used as the ground fault determination threshold value to be higher than the first threshold value (for example, +0.5 V).

[0052] For example, the second detection unit 32 intentionally causes a ground fault condition in the second system by lowering the voltage of the second system 120, for example, by shutting off the inter-system switch 41, in a situation where the vehicle's operation is not affected, such as before the power supply control device 1 is shipped or while the vehicle is stopped after being installed in the vehicle.

[0053] Then, when the first detection unit 31 detects a ground fault, the second detection unit 32 acquires the detected voltage of the second voltage sensor 52 and sets the value obtained by adding a predetermined voltage (for example, +0.5 V) to the acquired voltage as the second threshold value.

[0054] As a result, the second detection unit 32 can set an appropriate second threshold value that can accurately detect a ground fault even when there is an error between the detected voltage and the voltage detected by the first detection unit 31. Furthermore, in the case shown in Fig. 6, the second detection unit 32 can determine that an abnormality has occurred at time t2 without extending the determination period. Therefore, the power supply control device 1 can reliably detect a ground fault while preventing the delay of fail-safe control.

[0055] 5. Configuration Example of Switch Driving Unit According to Embodiment Next, a configuration example of the switch driver 3 according to the embodiment will be described with reference to Fig. 7. Fig. 7 is an explanatory diagram showing a configuration example of the switch driver 3 according to the embodiment.

[0056] 7, the switch driver 3 includes a first detector 31, a second detector 32, an OR logic circuit 33, and an OR logic circuit 34. The first detector 31 and the second detector 32 receive the detection result of the voltage of the first system 110 from the first voltage sensor 51, and the detection result of the voltage of the second system 120 from the second voltage sensor 52.

[0057] When the first detection unit 31 detects a ground fault in the first system 110 or the second system 120, it turns off the inter-system switch 41 and turns on the battery switch 42. Specifically, when the voltage of the first system 110 or the voltage of the second system 120 becomes equal to or lower than a first threshold, the first detection unit 31 outputs a primary ground fault detection signal to the second detection unit 32 and the OR logic circuits 33 and 34. At this time, the first detection unit 31 outputs, for example, a 50 ms one-shot pulse signal as the primary ground fault detection signal. When the primary ground fault detection signal is input from the first detection unit 31, the second detection unit 32 outputs a secondary ground fault detection signal to the OR logic circuits 33 and 34.

[0058] The OR logic circuit 34 outputs the primary ground fault detection signal from the first detection unit 31 or the secondary ground fault detection signal from the second detection unit 32 as a disconnection signal to the inter-system switch 41, thereby disconnecting the inter-system switch 41. The OR logic circuit 33 outputs the primary ground fault detection signal from the first detection unit 31 or the secondary ground fault detection signal from the second detection unit 32 as a connect signal to the battery switch 42, thereby connecting the battery switch 42.

[0059] Therefore, when a ground fault occurs in the first system 110 or the second system 120, the first detection unit 31 instantly detects the ground fault and disconnects the inter-system switch 41 via the OR logic circuit 34, while connecting the battery switch 42 via the OR logic circuit 33.

[0060] After a short delay, the second detection unit 32 maintains the inter-system switch 41 in a cut-off state via the OR logic circuit 34, and maintains the battery switch 42 in a connected state via the OR logic circuit 33. Furthermore, when a primary ground fault detection signal is input from the first detection unit 31, the second detection unit 32 outputs an automatic driving prohibition signal to the automatic driving control device 100.

[0061] In addition, when a ground fault is detected by the first detection unit 31, the second detection unit 32 identifies whether the system in which the ground fault was detected is the first system 110 or the second system 120, and if the ground fault has been resolved, performs recovery control to reconnect the inter-system switch 41 and cut off the battery switch 42.

[0062] Specifically, when the second detection unit 32 detects the primary ground fault detection signal output from the first detection unit 31, it samples the voltages of the first system 110 and the second system 120 at a predetermined cycle for a predetermined period of time. Then, the second detection unit 32 identifies the system in which the second detection unit 32 has sampled a voltage equal to or lower than the second threshold value for a predetermined period of time (for example, 40 ms) or more as the system in which a ground fault has been detected.

[0063] Furthermore, when the second detection unit 32 samples voltages exceeding the second threshold continuously for a predetermined time (e.g., 40 ms) or more in both the first system 110 and the second system 120, it determines that the ground fault is not continuing and outputs a connection signal (a signal with reverse logic to the secondary ground fault detection signal) to the OR logic circuit 34. When the connection signal is input from the second detection unit 32, the OR logic circuit 34 outputs a connection signal to the inter-system switch 41 to reconnect the inter-system switch 41. At this time, the second detection unit 32 outputs an automatic driving permission signal to the automatic driving control device 100 and outputs a control signal to the battery switch 42 via the OR logic circuit 33 to turn off the battery switch 42.

[0064] [6. Processing performed by the switch driver] Next, the process executed by the switch driver 3 of the power supply control device 1 will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the process executed by the switch driver 3 of the power supply control device 1 according to the embodiment. The switch driver 3 repeatedly executes the process shown in Fig. 8 during normal operation.

[0065] Specifically, as shown in FIG. 8, the switch driving unit 3 first determines whether or not an abnormality (e.g., occurrence of a ground fault) has been detected based on a physical quantity (e.g., voltage) of the first system 110 or the second system 120 and a first threshold value (step S101).

[0066] If the switch driving unit 3 determines that no abnormality has been detected (step S101, No), it ends the process and restarts the process from step S101. If the switch driving unit 3 determines that an abnormality has been detected (step S101, Yes), it turns off the inter-system switch 41 and turns on the battery switch 42 (step S102).

[0067] Thereafter, the switch driving unit 3 determines whether or not the system in which the abnormality was detected has been identified based on a second threshold value that is more sensitive than the first threshold value (step S103). If the switch driving unit 3 determines that the system in which the abnormality was detected has been identified (step S103, Yes), that is, if it has determined that an abnormality has occurred, the switch driving unit 3 proceeds to fail-safe control (step S104) and ends the process.

[0068] For example, when the switch driving unit 3 determines that a ground fault 200 has occurred in the first system 110, it switches to fail-safe control in which the inter-system switch 41 is turned off and the battery switch 42 is turned on, and power is supplied from the second power source 20 to the second load 103. When the switch driving unit 3 determines that a ground fault 201 has occurred in the second system 120, it switches to fail-safe control in which power is supplied from the first power source 10 to the first load 101 and the general load 102, and the inter-system switch 41 and the battery switch 42 are turned off.

[0069] If the switch driving unit 3 determines that it has not been able to identify the system in which the abnormality was detected (No in step S103), that is, if it determines that no abnormality has occurred, it turns on the system switch 41 and cuts off the battery switch 42 (step S105) to return to normal operation. Thereafter, the switch driving unit 3 starts the process again from step S101.

[0070] [7. Variations] The power supply control device 1 may be configured to acquire a current value as a physical quantity indicating the state of the first system 110 or the second system 120, and determine whether or not there is an abnormality in the first system 110 or the second system 120 based on the current value.

[0071] In this case, the power supply control device 1 further includes a first current sensor that detects the current value flowing through the first system 110 and outputs the detection result to the switch driving unit 3, and a second current sensor that detects the current value flowing through the second system 120 and outputs the detection result to the switch driving unit 3.

[0072] When the current value detected by the first current sensor or the second current sensor exceeds the first threshold, the first detection unit 31 detects the occurrence of an overcurrent abnormality and shuts off the inter-system switch 41. The second detection unit 32 sets a value lower than the first threshold as the second threshold.

[0073] For example, the second detection unit 32 operates the DC / DC 11 in a situation where the running of the vehicle is not hindered, such as before the power supply control device 1 is shipped or while the vehicle is parked after being installed in the vehicle, and increases the current flowing to the first system 110 and the second system 120. When the first detection unit 31 detects an overcurrent abnormality, the second detection unit 32 acquires the detected current value of the first detection unit 31, and sets a value obtained by subtracting a predetermined value from the acquired current value as the second threshold value.

[0074] The second detection unit 32 then determines whether the system in which the overcurrent anomaly has been detected by the first detection unit 31 is the first system 110 or the second system 120, based on the current value detected by the first current sensor or the second current sensor and the second threshold value, taking a longer time than the detection time of the first detection unit 31, and transitions to fail-safe control. This allows the power supply control device 1 to prevent delays in fail-safe control when an overcurrent anomaly has actually occurred.

[0075] The power supply control device 1 may also be configured to acquire temperature as a physical quantity indicating the state of the first system 110 or the second system 120, and determine whether there is an abnormality in the first system 110 or the second system 120 based on the temperature.

[0076] In this case, the first power supply 10 includes a first temperature sensor that detects the temperature of the PbB 12 and outputs the temperature to the switch driver 3. The second power supply 20 includes a second temperature sensor that detects the temperature of the LiB 21 and outputs the temperature to the switch driver 3.

[0077] When the temperature detected by the first temperature sensor or the second temperature sensor exceeds the first threshold, the first detection unit 31 detects the occurrence of an overheating abnormality and shuts off the inter-system switch 41. The second detection unit 32 sets a value lower than the first threshold as the second threshold.

[0078] For example, the second detection unit 32 heats the first power source 10 or the second power source 20 using a heating device such as a heater to increase the temperature before shipping the power supply control device 1. Then, when the first detection unit 31 detects an overheating abnormality, the second detection unit 32 acquires the temperature of the first detection unit 31 and sets the value obtained by subtracting a predetermined value from the acquired temperature as the second threshold value.

[0079] The second detection unit 32 then determines whether the system in which the overheating abnormality was detected by the first detection unit 31 is the first system 110 or the second system 120, based on the temperature detected by the first temperature sensor or the second temperature sensor and the second threshold value, taking a longer time than the detection time of the first detection unit 31, and transitions to fail-safe control. This allows the power supply control device 1 to prevent delays in fail-safe control when an overheating abnormality has actually occurred.

[0080] The power supply control device 1 may be configured to determine whether an overvoltage abnormality has occurred in the first system 110 or the second system 120 based on the voltage value of the first system 110 or the second system 120.

[0081] In this case, when the voltage value detected by the first voltage sensor 51 or the second voltage sensor 52 exceeds the first threshold, the first detection unit 31 detects the occurrence of an overvoltage abnormality and shuts off the inter-system switch 41. The second detection unit 32 sets the second threshold to a value lower than the first threshold.

[0082] For example, the second detection unit 32 operates the DC / DC 11 to increase the voltage of the first system 110 and the second system 120 in a situation where the running of the vehicle is not impaired, such as before the power supply control device 1 is shipped or while the vehicle is parked after being installed in the vehicle. When the first detection unit 31 detects an overvoltage abnormality, the second detection unit 32 acquires the detected voltage value of the first detection unit 31 and sets a value obtained by subtracting a predetermined value from the acquired current value as the second threshold value.

[0083] Then, the second detection unit 32 determines whether the system in which the overvoltage abnormality has been detected by the first detection unit 31 is the first system 110 or the second system 120, based on the voltage value detected by the first voltage sensor 51 or the second voltage sensor 52 and the second threshold value, taking a longer time than the detection time of the first detection unit 31, and transitions to fail-safe control. This allows the power supply control device 1 to prevent delays in fail-safe control when an overvoltage abnormality has actually occurred.

[0084] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0085] 1 Power supply control device 10 1st power supply 11 DC / DC 12 PbB 20 2nd power supply 21 LiB 3 Switch drive unit 31 First detection unit 32 Second detection unit 33 OR logic circuit 34 OR logic circuit 41 Intersystem switch 42 Battery switch 51 First voltage sensor 52 Second voltage sensor 100 Automatic driving control device 101 1st load 102 General load 103 2nd load 110 1st system 120 2nd system

Claims

1. a first system that supplies power from a first power source to a first load; a second system that supplies power from a second power source to a second load; an inter-system switch capable of connecting and disconnecting the first system and the second system; a first detection unit that detects an abnormality in the first system or the second system based on a physical quantity indicating a state of the first system or the second system and a first threshold value, and shuts off the inter-system switch when the occurrence of the abnormality is detected; a second detection unit that determines whether the system in which the abnormality is detected by the first detection unit is the first system or the second system based on the physical quantity and a second threshold value that is set to have a higher sensitivity for detecting abnormalities than the first threshold value, over a longer time than the detection time of the first detection unit, and transitions to fail-safe control while maintaining the interrupted state of the inter-system switch; A power supply control device comprising:

2. a first system that supplies power from a first power source to a first load; a second system that supplies power from a second power source to a second load; an inter-system switch capable of connecting and disconnecting the first system and the second system; a battery switch capable of connecting and disconnecting the second power supply to the second system; a first detection unit that detects an abnormality in the first system or the second system based on a physical quantity indicating a state of the first system or the second system and a first threshold value while the inter-system switch is connected and the battery switch is disconnected, and that disconnects the inter-system switch and connects the battery switch when an abnormality is detected; a second detection unit that determines whether the system in which the abnormality is detected by the first detection unit is the first system or the second system based on the physical quantity and a second threshold value that is set to have a higher sensitivity for detecting abnormalities than the first threshold value, taking a longer time than the detection time of the first detection unit, and if the abnormal system is the first system, transitions to fail-safe control while maintaining the interrupted state of the inter-system switch and the connected state of the battery switch; A power supply control device comprising:

3. a first system that supplies power from a first power source to a first load; a second system that supplies power from a second power source to a second load; an inter-system switch capable of connecting and disconnecting the first system and the second system; a battery switch capable of connecting and disconnecting the second power supply to the second system; a first detection unit that detects an abnormality in the first system or the second system based on a physical quantity indicating a state of the first system or the second system and a first threshold value while the inter-system switch is connected and the battery switch is disconnected, and that disconnects the inter-system switch and connects the battery switch when an abnormality is detected; a second detection unit that determines whether the system in which the abnormality is detected by the first detection unit is the first system or the second system based on the physical quantity and a second threshold value that is set to have a higher sensitivity for detecting abnormalities than the first threshold value, taking a longer time than the detection time of the first detection unit, and if the abnormal system is the second system, continues the cut-off state of the inter-system switch, cuts off the battery switch, and transitions to fail-safe control; A power supply control device comprising:

4. When the second detection unit determines that no abnormality has occurred in the identification, the second detection unit performs recovery control to connect the inter-system switch. The power supply control device according to any one of claims 1 to 3.

5. A power supply control device that supplies power to a load provided in a vehicle, The fail-safe control is a control for causing the vehicle to run to safety. The power supply control device according to any one of claims 1 to 4.

6. a first system that supplies power from a first power source to a first load; a second system that supplies power from a second power source to a second load; an inter-system switch capable of connecting and disconnecting the first system and the second system; a first detection unit that provisionally determines whether an abnormality has occurred in the first system or the second system based on a physical quantity indicating a state of the first system or the second system and a first threshold value, and that shuts off the inter-system switch when provisionally determining that an abnormality has occurred; a second detection unit that, after the first detection unit has provisionally determined that an abnormality has occurred, performs a final determination of the occurrence of an abnormality based on the physical quantity and a second threshold value that is set to have a higher sensitivity for detecting an abnormality than the first threshold value, for a time longer than the detection time of the first detection unit, and performs recovery control to connect the inter-system switch when it is finally determined that no abnormality has occurred; A power supply control device comprising:

7. a first system that supplies power from a first power source to a first load; a second system that supplies power from a second power source to a second load; an inter-system switch capable of connecting and disconnecting the first system and the second system; a battery switch capable of connecting and disconnecting the second power supply to the second system; a first detection unit that, with the inter-system switch connected and the battery switch disconnected, provisionally determines whether an abnormality has occurred in the first system or the second system based on a physical quantity indicating a state of the first system or the second system and a first threshold value, and, when provisionally determining that an abnormality has occurred, disconnects the inter-system switch and connects the battery switch; a second detection unit that, after the first detection unit has provisionally determined that an abnormality has occurred, performs a final determination of the occurrence of an abnormality based on the physical quantity and a second threshold value that is set to have a higher sensitivity for detecting an abnormality than the first threshold value, for a time longer than the detection time of the first detection unit, and when it is finally determined that no abnormality has occurred, connects the inter-system switch and cuts off the battery switch; A power supply control device comprising:

8. the first detection unit is configured with hardware, The second detection unit is configured as a computer that functions by executing a program. The power supply control device according to any one of claims 1 to 7.

9. the physical quantity is a voltage value, The second detection unit The second threshold value is set to a value higher than the first threshold value. The power supply control device according to any one of claims 1 to 8.

10. the physical quantity is a current value, The second detection unit The second threshold value is set to a value lower than the first threshold value. The power supply control device according to any one of claims 1 to 8.

11. the physical quantity is temperature, The second detection unit The second threshold value is set to a value lower than the first threshold value. The power supply control device according to any one of claims 1 to 8.

Images