Redundant power supply system

Abstract

To provide a redundant power supply system capable of supplying, to a load, an electric power for performing a movement to be performed in a backup control when a failure of a main power supply is determined.SOLUTION: A redundant power supply system for backing up a power to a plurality of loads when a main power supply fails, comprises: a sub power supply; a first circuit for supplying the power of the main power supply to a first load which is one of the plurality of loads; a second circuit for supplying the power of the sub power supply to the plurality of loads; and a control unit for controlling an operation of the first circuit and the second circuit based on a state of the main power supply. The control unit operates only the first circuit when there is no failure notification of the main power supply from the plurality of loads, operates only the second circuit when there is no failure notification of the main power supply from the first load and there is a failure notification of the main power supply from the second load which is one of the plurality of loads, and then operates the first circuit when the voltage of a sub power supply falls to a predetermined lower limit voltage.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a redundant power supply system that supplies backup power from a sub-power supply to a plurality of loads in the event of a failure of a main power supply. [Background technology]

[0002] Patent Document 1 discloses a redundant power supply system that can supply backup power from a sub-power supply to multiple loads (shift-by-wire, brakes, door unlock) mounted on a vehicle in the event that the main power supply that supplies power to the multiple loads fails, in place of the main power supply. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-161163 Summary of the Invention [Problem to be solved by the invention]

[0004] Switching of the power supply source from the main power supply to the sub-power supply is based on the judgment of the main power supply failure for each of the multiple loads. However, this judgment of the main power supply failure varies depending on various factors (design values ​​of the load, wiring length from the main power supply to the load, detection error, etc.). For this reason, it is possible that some loads will judge that the main power supply has failed, while other loads will judge that the main power supply has not failed.

[0005] In redundant power supply systems such as those disclosed in Patent Document 1, in order to prioritize vehicle safety, when it is determined that at least one load has experienced a failure in the main power supply and that a backup is required, backup control is initiated to supply power from a sub-power supply. However, if a specific load continues to exist for which it is not possible to determine that the main power supply has failed even after backup control has begun (for example, if the voltage does not drop to the determination criterion for the specific load), this specific load will continue to undergo normal control, and there is a risk that it will not be possible to execute the actions that should be performed under backup control (vehicle behavior, state transitions, etc.).

[0006] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a redundant power supply system that can supply power to a load to perform actions that should be performed in backup control when there is a load for which a failure in the main power supply has not been determined even after a failure in the main power supply has been determined by another load. [Means for solving the problem]

[0007] In order to solve the above problem, one aspect of the disclosed technology is a redundant power supply system that supplies backup power to multiple loads in the event of a main power supply failure, comprising: a sub-power supply; a first circuit for supplying the power of the main power supply to a first load that is one of the multiple loads; a second circuit for supplying the power of the sub-power supply to the multiple loads; and a control unit that controls operation of the first circuit and the second circuit based on the state of the main power supply, wherein the control unit operates only the first circuit when there is no notification of a main power supply failure from the multiple loads, and operates only the second circuit when there is no notification of a main power supply failure from the first load but there is a notification of a main power supply failure from a second load that is one of the multiple loads, and then operates the first circuit when the voltage of the sub-power supply drops to a predetermined lower limit voltage. [Effects of the Invention]

[0008] According to the redundant power supply system of the present disclosure, after the power supply source becomes the sub-power supply (the second circuit is activated) due to a failure of the main power supply determined by a second load other than the first load, if the sub-power supply voltage drops to the lower limit voltage without the first load determining that the main power supply has failed, the main power supply and the first load are connected (the first circuit is activated), allowing the first load to perform the operation that should be performed in backup control. [Brief explanation of the drawings]

[0009] [Figure 1] A functional block diagram of a redundant power supply system and its peripheral components according to an embodiment of the present disclosure. [Figure 2] Operational sequence illustrating the operation of the redundant power system, shift-by-wire, and brakes in the event of a main power failure [Figure 3] An example application sequence illustrating the behavior of the redundant power system, shift-by-wire, and brakes in the event of a main power failure. DETAILED DESCRIPTION OF THE INVENTION

[0010] In the redundant power supply system according to the present disclosure, after the power supply source is switched from the main power supply to the sub-power supply due to a determination that the main power supply has failed due to braking or the like, if the sub-power supply becomes unable to back up without the shift-by-wire system determining that the main power supply has failed, power is supplied pass-through from the main power supply to the shift-by-wire system, thereby enabling the shift-by-wire system to perform the parking lock operation using the main power supply even if the sub-power supply runs out. Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0011] <Embodiment> [composition] Fig. 1 is a functional block diagram of a redundant power supply system 100 and its peripheral components according to one embodiment of the present disclosure. The functional blocks illustrated in Fig. 1 include the redundant power supply system 100, a shift-by-wire (SBW) system 210, a brake (BRK) system 220, and a door unlock system 230. In Fig. 1, power lines over which power is exchanged are indicated by solid lines, and signal lines over which control instructions, notifications, detected values, and the like are transmitted and received are indicated by dotted lines. The redundant power supply system 100, shift-by-wire system 210, brake system 220, and door unlock system 230 are mounted on a vehicle or the like.

[0012] The main power supply 300 is a power supply source that supplies power of a predetermined voltage (+B voltage) to the redundant power supply system 100, the shift-by-wire 210, the brake 220, and the door unlock 230. The main power supply 300 is formed from a secondary battery that is configured to be rechargeable, such as a lithium-ion battery or a lead-acid battery.

[0013] The redundant power supply system 100 is a unit that functions as an auxiliary power supply for backing up and supplying power to the shift-by-wire 210, the brakes 220, and the door unlock 230 when an abnormality occurs in the power supply from the main power supply 300 to the shift-by-wire 210, the brakes 220, and the door unlock 230 due to a power failure of the main power supply 300 or the like. The redundant power supply system 100 includes a pass-through circuit 110, a sub-power supply 120, a DC-DC converter 130, a plurality of switches 141 to 143, a monitor 150, and a control unit 160.

[0014] Pass-through circuit 110 is connected to main power supply 300 and is configured to supply power from main power supply 300 to shift-by-wire 210 and door unlock 230. Pass-through circuit 110 is typically configured to include a switching element such as a semiconductor relay, and switches the electrical connection state between main power supply 300 and shift-by-wire 210 and door unlock 230 by controlling the conduction / cut-off of the switching element based on instructions from control unit 160.

[0015] The sub-power supply 120 is a power supply source that is formed of, for example, a storage element such as a capacitor or a secondary battery such as a lithium-ion battery that is configured to be chargeable and dischargeable. The sub-power supply 120 is connected to the DC-DC converter 130 so that it can be charged with power input from the main power supply 300 via the pass-through circuit 110 and can discharge its own stored power (backup power) to the shift-by-wire 210, the brake 220, and the door unlock 230.

[0016] The DC-DC converter 130 is a power converter for controlling the charging and discharging of the power of the sub-power supply 120. Based on instructions from the control unit 160, the DC-DC converter 130 can convert the power input from the main power supply 300 via the pass-through circuit 110 into power of a predetermined voltage and output it to the sub-power supply 120, or convert the power stored in the sub-power supply 120 into power of a predetermined voltage and output it to the shift-by-wire 210, the brake 220, and the door unlock 230.

[0017] The multiple switches 141 to 143 are configured with switching elements such as normally-off type semiconductor relays, and are inserted between a power line connecting the pass-through circuit 110 and the DC-DC converter 130 and the shift-by-wire 210, between the power line and the brake 220, and between the power line and the door unlock 230, and the switch 141 to 143 are respectively connected to the shift-by-wire 210, the brake 220, and the door unlock 230. When the redundant power supply system 100 performs backup control based on an instruction from the control unit 160, the switches 141 to 143 are controlled to be conductive so that backup power from the sub-power supply 120 is supplied to the shift-by-wire 210, the brake 220, and the door unlock 230.

[0018] In the redundant power supply system 100 described above, the pass-through circuit 110 constitutes a first circuit, and the sub-power supply 120, the DC-DC converter 130, and the switches 141 to 143 constitute a second circuit.

[0019] Monitor 150 is configured to detect the state of sub-power supply 120. Monitor 150 typically includes sensors that detect physical quantities such as voltage, current, and charged amount as the state of sub-power supply 120. The state of sub-power supply 120 detected by monitor 150 is acquired by control unit 160.

[0020] The control unit 160 is configured to control the operations of the pass-through circuit 110, the DC-DC converter 130, and the switches 141 to 143 based on the state of the sub-power supply 120 acquired from the monitor 150, thereby realizing a backup supply of power by the redundant power supply system 100. This control unit 160 uses a microcomputer or the like.

[0021] The shift-by-wire (SBW) 210, the brake (BRK) 220, and the door unlock 230 are in-vehicle loads for realizing predetermined functions related to the vehicle, and are devices (or systems) that particularly require a redundant power supply configuration. Note that the multiple devices installed in the vehicle are not limited to those shown in FIG. 1.

[0022] The shift-by-wire (SBW) 210 is a device (first load) that performs shift-by-wire control, which can change gear positions in a transmission (not shown) using an electrical signal. When the main power supply 300 is normal, the shift-by-wire 210 operates on power (+B pass-through power) supplied from the main power supply 300 via the pass-through circuit 110 of the redundant power supply system 100 (normal control), and when the main power supply 300 fails, the shift-by-wire 210 operates on power supplied from the sub-power supply 120 via the DC-DC converter 130 (backup control). Furthermore, the shift-by-wire 210 can determine that the main power supply 300 has failed when the voltage (+B voltage) applied from the main power supply 300 is equal to or lower than a predetermined first threshold. When a failure of the main power supply 300 is determined, the shift-by-wire 210 transmits a notification (failure notification) to the control unit 160 of the redundant power supply system 100, informing the control unit 160 of the failure of the main power supply 300.

[0023] The brake (BRK) 220 is a device (second load) that performs brake control and is capable of generating a braking force on the vehicle. When the main power supply 300 is normal, the brake 220 operates on power supplied directly from the main power supply 300 (normal control), and when the main power supply 300 fails, the brake 220 operates on power supplied from the sub-power supply 120 via the DC-DC converter 130 (backup control). The brake 220 can also determine that the main power supply 300 has failed when the voltage (+B voltage) applied from the main power supply 300 is equal to or lower than a predetermined second threshold. If a failure of the main power supply 300 is determined, the brake 220 transmits a notification (failure notification) to the control unit 160 of the redundant power supply system 100, informing the control unit 160 of the failure of the main power supply 300.

[0024] The door unlock 230 is a device (second load) that performs door locking / unlocking control, enabling locking / unlocking of vehicle doors using an electrical signal. When the main power supply 300 is normal, the door unlock 230 operates on power (+B pass-through power) supplied from the main power supply 300 via the pass-through circuit 110 of the redundant power supply system 100 (normal control). When the main power supply 300 fails, the door unlock 230 operates on power supplied from the sub-power supply 120 via the DC-DC converter 130 (backup control). The door unlock 230 can also determine that the main power supply 300 has failed when the voltage (+B voltage) applied from the main power supply 300 is equal to or lower than a predetermined third threshold. If a failure of the main power supply 300 is determined, the door unlock 230 transmits a notification (failure notification) to the control unit 160 of the redundant power supply system 100, informing the control unit 160 of the failure of the main power supply 300.

[0025] In this embodiment, it is assumed that the first threshold value used by the shift-by-wire 210 to determine a failure of the main power supply 300 is set lower than the second and third threshold values ​​used by the brake 220 and the door unlock 230 to determine a failure of the main power supply 300. Under this assumption, a situation may arise in which the brake 220 or the door unlock 230 determines a failure of the main power supply 300, but the shift-by-wire 210 does not determine a failure of the main power supply 300. Therefore, in order to deal with such a situation where the failure determinations differ, the redundant power supply system 100 performs the following operation.

[0026] [Operation] Next, the operation of the redundant power supply system 100 according to one embodiment of the present disclosure will be described with further reference to Figure 2. Figure 2 shows an operation sequence that explains the behavior of the redundant power supply system 100, the shift-by-wire (SBW) 210, and the brake (BRK) 220 in the event of a failure of the main power supply 300. Note that the operation of the door unlock 230 is basically the same as that of the brake 220, and is therefore omitted from Figure 2.

[0027] The operation shown in FIG. 2 illustrates a situation in which the shift-by-wire 210 sets a first threshold value for determining whether the main power supply 300 has failed to 8.5 V, the brake 220 sets a second threshold value for determining whether the main power supply 300 has failed to 9.4 V, and the state of the main power supply 300 (+B state) drops from a voltage of 12 V or higher to a voltage of 9.0 V.

[0028] (1) Phase 1: Main power supply is normal When the main power supply 300 is in a normal state (S41), power of 12 V or more is supplied from the main power supply 300 to the redundant power supply system 100, the shift-by-wire 210, and the brake 220 (+B power supply). The shift-by-wire 210 executes normal control (S11) because the voltage of the +B power supply is 12 V or more (>first threshold). The brake 220 executes normal control (S31) because the voltage of the +B power supply is 12 V or more (>second threshold). The redundant power supply system 100 executes normal control (pass-through mode) because there is no notification of a failure in the main power supply 300 from the shift-by-wire 210 or the brake 220 (S21).

[0029] (2) Phase 2: Main power supply is abnormal If a failure occurs in the main power supply 300 that causes the voltage to drop to 9.0 V (S42), power of 9.0 V is supplied from the main power supply 300 to the redundant power supply system 100, the shift-by-wire 210, and the brake 220 (+B power supply). The shift-by-wire 210 continues to execute normal control because the voltage of the +B power supply is 9.0 V or higher (>first threshold). In response to this, the brake 220 determines that a failure has occurred in the main power supply 300 (S32) because the voltage of the +B power supply is 9.0 V (<second threshold). Based on this determination, the brake 220 notifies the redundant power supply system 100 of the failure of the main power supply 300. Because the brake 220 has notified the redundant power supply system 100 of the failure of the main power supply 300, the redundant power supply system 100 determines that backup to the brake 220 is necessary (S22, Yes).

[0030] (3) Phase 3: Transition from normal control to backup control The redundant power supply system 100 executes backup control (capacitor mode) in response to determining that backup to the brake 220 is necessary (S23). In this backup control, the redundant power supply system 100 shuts off the pass-through circuit 110 and turns on the switches 141 to 143, and supplies backup power (12 V or more) from the sub-power supply 120 via the DC-DC converter 130 to the shift-by-wire 210 and the brake 220 (C power supply).

[0031] Brake 220, which has notified redundant power supply system 100 of the failure of main power supply 300, requires power to perform three braking operations to generate braking force on the vehicle in order to safely stop the vehicle (S33). This required power is consumed from sub-power supply 120 (consumption of capacitor capacity).

[0032] (4) Phase 4: P-lock control (as it happens) After starting backup control (capacitor mode), redundant power supply system 100 determines whether or not it is necessary to lock the vehicle's shift in the parking position (hereinafter referred to as "P lock") (S24). This determination is made based on the capacity (lower limit capacity) of sub-power supply 120, and is typically made appropriately based on conditions such as whether or not the capacity required for control in the event of a failure of brake 220 has been consumed from sub-power supply 120, and whether or not the capacity required to execute P lock remains in sub-power supply 120.

[0033] If redundant power supply system 100 determines that P lock is necessary (S24, Yes), it transmits a P lock control signal (for example, a PWM signal having a predetermined duty ratio) instructing the execution of P lock to shift-by-wire 210 (S25). This P lock control signal is repeatedly transmitted until the voltage of sub-power supply 120 reaches the lower limit voltage at which backup control is possible (PWC detection limit voltage), that is, until the capacity of sub-power supply 120 drops to a level that is considered depletion (S26).

[0034] On the other hand, since shift-by-wire 210 is operating under normal control, it does not respond even when it receives a P lock control signal from redundant power supply system 100, that is, it continues control without P locking the shift (S12).

[0035] When the voltage of the sub-power supply 120 reaches the lower limit voltage at which backup control is possible (S26, YES), the redundant power supply system 100 stops sending the P lock control signal (S27). Thereafter, the redundant power supply system 100 executes safety control to make the pass-through circuit 110 conductive (S28).

[0036] (5) Phase 5: Restarting the pass-through circuit When the redundant power supply system 100 performs conduction control on the pass-through circuit 110, power of 9.0 V is again supplied (+B power supply) from the main power supply 300 to the shift-by-wire 210 and the brake 220 via the pass-through circuit 110 (S44). The resumption of the power supply of 9.0 V by this pass-through enables the shift-by-wire 210 to operate in response to a manual P lock operation by the driver or the like.

[0037] Shift-by-wire 210 determines whether or not a manual P lock operation has been performed by the driver of the vehicle or the like (S13). If a manual P lock operation has been performed, shift-by-wire 210 locks the shift in the parking position to immobilize the vehicle (S14).

[0038] As described above, in the redundant power supply system 100 according to this embodiment, if the shift-by-wire 210 does not respond to the P lock control signal transmitted to the shift-by-wire 210 during backup control, the pass-through circuit 110, which was cut off during backup control, is made conductive again and applied to the shift-by-wire 210. With this control, if the voltage at the time of failure of the main power supply 300 is a voltage at which the shift-by-wire 210 can operate, the shift can be placed in P lock in response to a manual P lock operation. This makes it possible to avoid a situation in which the backup power of the sub power supply 120 runs out and the P lock becomes impossible.

[0039] [Applied operation] FIG. 3 is an operational sequence illustrating the practical operation of the redundant power supply system 100, the shift-by-wire (SBW) 210, and the brake (BRK) 220 when the main power supply 300 fails.

[0040] The applied operation shown in Fig. 3 is the same as the operation shown in Fig. 2 in the first, second, and third phases, but is different from the operation shown in Fig. 2 in the fourth phase and thereafter. Therefore, the difference from the fourth phase onwards will be explained below.

[0041] (4') 4th phase: P-lock control (forced) After starting backup control (S23), redundant power supply system 100 determines whether or not the vehicle shift needs to be P-locked (S24). This determination is made based on the capacity (lower limit capacity) of sub-power supply 120, and is typically made appropriately based on conditions such as whether or not the capacity required for control in the event of a failure of brake 220 has been consumed from sub-power supply 120, and whether or not the capacity required to execute P-lock remains in sub-power supply 120.

[0042] When the redundant power supply system 100 determines that the P lock is necessary (S24, YES), it transmits a P lock control signal to the shift-by-wire 210 instructing the execution of the P lock (S25). Here, the shift-by-wire 210 is designed in advance to forcibly P-lock the shift when it receives a P lock control signal from the redundant power supply system 100, regardless of whether the control it is executing itself is normal control or backup control. Therefore, in this applied operation, when the shift-by-wire 210 receives a P lock control signal from the redundant power supply system 100, it P-locks the shift (S15). This immobilizes the vehicle (S14). When the P lock of the shift has been completed (S29, YES), the redundant power supply system 100 stops transmitting the P lock control signal (S27).

[0043] In the applied operation described above, by designing shift-by-wire 210 in advance so that the shift is forcibly put into P lock upon receiving a P lock control signal regardless of the control state, it is possible to automatically put the shift into P lock at the required timing without depleting the sub-power supply 120.

[0044] <Actions and Effects> As described above, according to the redundant power supply system 100 of an embodiment of the present disclosure, in a configuration in which the +B voltage of the main power supply 300 is applied to the shift-by-wire 210 via the pass-through circuit 110, if there is no notification of a failure of the main power supply 300 from the shift-by-wire 210 but there is a notification of a failure of the main power supply 300 from the brake 220 or the door unlock 230, priority is given to the application of backup voltage by the sub-power supply 120, and when the voltage of the sub-power supply 120 drops to the lower limit voltage at which backup is possible, voltage application from the pass-through circuit 110 is resumed.

[0045] With this control, if the failure of main power supply 300 is such that a voltage level capable of operating shift-by-wire 210 can be maintained (for example, a voltage drop due to deterioration of the battery that is main power supply 300, or a voltage drop due to an increase in the in-vehicle load that uses main power supply 300 as a power source), it is possible to supply as much power as possible from main power supply 300 to shift-by-wire 210. Therefore, even if sub-power supply 120 runs out, the +B voltage reapplied from main power supply 300 allows shift-by-wire 210 to perform a P lock operation based on a manual operation.

[0046] Furthermore, according to the redundant power supply system 100 of this embodiment, if the shift-by-wire 210 is provided in advance with a function for forcibly placing the shift in P lock in response to a P lock control signal, the shift can be easily placed in P lock using the P lock control signal.

[0047] The above describes one embodiment of the disclosed technology, but the present disclosure can be understood as not only a redundant power supply system, but also a control method performed by a control unit of a redundant power supply system, a program for that control method, a computer-readable non-transitory storage medium storing that program, a vehicle equipped with a power supply system, etc. [Industrial Applicability]

[0048] The redundant power supply system of the present disclosure can be used in cases where it is desired to supply backup power from a sub-power supply to multiple loads in the event of a failure of the main power supply. [Explanation of symbols]

[0049] 100 Redundant Power System 110 Pass-through circuit 120 Sub-power supply 130 DC-DC converter 141~143 Switch 150 monitors 160 control section 210 Shift-by-wire (SBW) 220 Brake (BRK) 230 Door Unlock 300 Main Power Supply

Claims

1. A redundant power supply system that supplies backup power to multiple loads when a main power supply fails, Sub-power supply and a first circuit for supplying power from the main power supply to a first load that is one of the plurality of loads; a second circuit for supplying power from the sub-power supply to the plurality of loads; a control unit that controls operations of the first circuit and the second circuit based on a state of the main power supply, The control unit When there is no notification of a failure of the main power supply from the plurality of loads, only the first circuit is operated; when there is no notification of a failure of the main power supply from the first load but there is a notification of a failure of the main power supply from a second load that is one of the plurality of loads, only the second circuit is operated, and then when the voltage of the sub-power supply drops to a predetermined lower limit voltage, the first circuit is operated. Redundant power supply system.

2. the first circuit is a pass-through circuit that outputs the power input from the main power supply as is when it is in operation; 10. The redundant power supply system of claim 1.

3. the control unit operates only the first circuit if it determines that a backup supply of power to the plurality of loads is unnecessary even when there is no notification of a failure of the main power supply from the first load and there is a notification of a failure of the main power supply from the second load.

3. The redundant power supply system according to claim 1 or 2.

4. The redundant power supply system is mounted on a vehicle, the first load is a shift-by-wire device, the second load is a brake device or a door unlocking device; 4. The redundant power supply system according to claim 1.

5. A redundant power supply system that is mounted on a vehicle and supplies backup power to multiple loads in the event of a main power supply failure, Sub-power supply and a first circuit for supplying power from the main power supply to a shift-by-wire device that is one of the plurality of loads; a second circuit for supplying power from the sub-power supply to the plurality of loads; a control unit that controls operations of the first circuit and the second circuit based on a state of the main power supply, The control unit When there is no notification of a failure of the main power supply from the plurality of loads, only the first circuit is operated; when there is no notification of a failure of the main power supply from the shift-by-wire device but there is a notification of a failure of the main power supply from a device other than the shift-by-wire device included in the plurality of loads, only the second circuit is operated, and then when the capacity of the sub-power supply drops to a predetermined lower limit capacity, the shift-by-wire device is controlled to activate a parking lock. Redundant power supply system.

6. the control unit operates only the first circuit if it determines that a backup supply of power to the plurality of loads is unnecessary even when there is no notification of a failure of the main power supply from the shift-by-wire device and there is a notification of a failure of the main power supply from the other device.

6. The redundant power supply system of claim 5.

7. The other device is a brake device or a door unlocking device.

7. The redundant power supply system according to claim 5 or 6.

Images