Power supply control device and power supply control system

Abstract

To prevent power supply interruption during fail-safe control when a microcomputer of a power supply control device malfunctions.SOLUTION: The power supply control device includes a controller and a delay circuit. The controller outputs a first power hold signal to a power relay to control the power relay that supplies power to multiple control devices upon receiving either the first power hold signal or a second power hold signal. The delay circuit delays the first power hold signal for at least the time required for an external device to detect the controller malfunction when the power relay receives the second power hold signal from the external device as a fail-safe control during the controller malfunction.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The disclosed embodiments relate to a power supply control device and a power supply control system. [Background technology]

[0002] Conventionally, a technology has been known in which a power supply relay is provided in a power supply ECU (Electronic Control Unit) in a vehicle, and a microcomputer in the power supply ECU controls the power relay to control the power supply to multiple ECUs other than the power supply ECU (see, for example, Patent Document 1).

[0003] However, if the microcomputer in the power supply ECU fails, the power relay will shut off, cutting off the power supply to each ECU.To address this issue, for example, a device other than the power supply ECU could detect a failure in the microcomputer in the power supply ECU and maintain continuity of the power relay in place of the power supply ECU. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-166549 Summary of the Invention [Problem to be solved by the invention]

[0005] However, if the microcomputer in the power supply ECU fails, the output port of the signal that normally drives the power supply relay will be reset to its initial state, so the power supply relay will be immediately shut off when the microcomputer fails.

[0006] In contrast, devices other than the power supply ECU described above maintain the conduction of the power supply relay after determining that the microcomputer has failed, so the power supply relay remains in a cut-off state until the devices other than the power supply ECU determine that the microcomputer has failed.

[0007] One aspect of the embodiment has been made in consideration of the above, and aims to provide a power supply control device and a power supply control system that can prevent power supply from being cut off during fail-safe control when an abnormality occurs in the microcomputer of the power supply control device. [Means for solving the problem]

[0008] According to one embodiment, a power supply control device includes a controller and a delay circuit. The controller controls a power supply relay that receives a first power supply holding signal or a second power supply holding signal and supplies power to a plurality of control devices by outputting the first power supply holding signal to the power supply relay. When the power supply relay receives the second power supply holding signal from an external device as fail-safe control in the event of an abnormality in the controller, the delay circuit delays the first power supply holding signal by at least the time required for the external device to detect the abnormality in the controller. [Effects of the Invention]

[0009] According to one aspect of the embodiment, if the controller (microcomputer) of a power supply control device fails, an external device controls the power relay in place of the controller to supply power to multiple control devices. In this case, the first power hold signal output from the controller is delayed by a delay circuit for a period of time equal to or longer than the time it takes the external device to detect an abnormality in the controller. As a result, even if the controller fails and the output of the first power hold signal from the controller is interrupted, the delay circuit continues to supply the first power hold signal to the power relay until at least the second power hold signal is input, preventing the power relay from being shut off. This prevents the power supply from being shut off during fail-safe control when the microcomputer of the power supply control device fails. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a power supply control system according to an embodiment. [Figure 2] FIG. 2 is an explanatory diagram of the requirements for connecting / disconnecting the power relay. [Figure 3] FIG. 3 is a diagram illustrating an example of the configuration of a delay circuit according to the embodiment. [Figure 4] FIG. 4 is a diagram showing the relationship between the MHLD signal and the delay SW in different states of the microcomputer. [Figure 5] FIG. 5 is an explanatory diagram of the ON / OFF requirements of the RHLD signal. [Figure 6] FIG. 6 is a diagram illustrating an example of the operation of the power supply control system in a normal state. [Figure 7] FIG. 7 is a diagram illustrating an example of the operation of the delay circuit in a normal state. [Figure 8] FIG. 8 is an explanatory diagram of mutual alive monitoring between the power supply ECU and the integrated control ECU. [Figure 9] FIG. 9 is a diagram (part 1) showing an example of the operation of the power supply control system when an abnormality occurs in the microcomputer of the power supply ECU. [Figure 10] FIG. 10 is a diagram (part 1) showing an example of the operation of the delay circuit in a normal state. [Figure 11] FIG. 11 is a diagram (part 2) showing an example of the operation of the power supply control system when an abnormality occurs in the microcomputer of the power supply ECU. [Figure 12] FIG. 12 is a diagram (part 3) showing an example of the operation of the power supply control system when an abnormality occurs in the microcomputer of the power supply ECU. [Figure 13] FIG. 13 is a timing chart (part 1) illustrating an example of the operation of the power supply control system. [Figure 14] FIG. 14 is a timing chart (part 2) illustrating an example of the operation of the power supply control system. [Figure 15] FIG. 15 is a diagram showing a processing sequence executed by the power supply control system. [Figure 16] FIG. 16 is a flowchart showing the procedure of the state determination process executed by the control ECU. [Figure 17] FIG. 17 is a diagram showing a delay circuit according to another embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of a power supply control device and a power supply control system disclosed in the present application will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to the following embodiments.

[0012] In the following description, the power supply control device according to the embodiment is assumed to be a power supply ECU 10 (see FIG. 1). In addition, in the following description, when it is necessary to distinguish between multiple identical components, a number in the form of "-n" (n is a positive integer) may be added after the symbol indicating the component. When there is no particular need to distinguish between them, this numbering will not be used.

[0013] (Example of power supply control system configuration) 1 is a diagram showing an example of the configuration of a power supply control system 1 according to an embodiment. The power supply control system 1 is a system mounted on a vehicle. As shown in FIG. 1, the power supply control system 1 includes a power supply relay 2, a plurality of power supply relays 3, a power supply ECU 10, an integrated control ECU 20, and a plurality of control ECUs 30.

[0014] In this embodiment, for convenience of explanation, it is assumed that there are three power supply relays 3, 3-1, 3-2, and 3-3, and there are two control ECUs 30, 30-1 and 30-2, as shown in FIG.

[0015] The power supply ECU 10, the integrated control ECU 20, and the control ECUs 30-1 and 30-2 are connected to each other via an in-vehicle network so that they can communicate with each other. In this embodiment, the in-vehicle network is exemplified by a CAN (Controller Area Network), but it is not limited to a CAN. Also, although FIG. 1 illustrates one CAN system, two or more CAN systems may be used for redundancy.

[0016] The power supply relay 2 is a circuit that connects / disconnects the power supply path (+B) from the vehicle battery (BATT) to the power supply ECU 10. The power supply relay 2 connects / disconnects the power supply path to the power supply ECU 10 in response to an MREL-0 signal among relay drive signals (MREL signals) output from the power supply ECU 10. The power supply relay 2 may be provided inside the power supply ECU 10. The power supply (+B) supplied to the power supply ECU 10 via the power supply relay 2 is also supplied as the power supply (+B) to a delay circuit 12, which will be described later.

[0017] The power supply relay 3 is a circuit that connects / disconnects the power supply path from the vehicle battery to the integrated control ECU 20 and each control ECU 30. The power supply relay 3 connects / disconnects the power supply path to the integrated control ECU 20 and each control ECU 30 in response to an MREL-1 signal, an MREL-2 signal, and an MREL-3 signal among the MREL signals output from the power supply ECU 10. The power supply relay 3 may also be provided inside the power supply ECU 10.

[0018] When each of the power supply relays 2, 3 receives a Hi voltage MREL signal (hereinafter referred to as "MREL ON") from the power supply ECU 10, it connects the power supply path to the corresponding power supply ECU 10, delay circuit 12, integrated control ECU 20, and each control ECU 30. When each of the power supply relays 2, 3 receives a Lo voltage MREL signal (hereinafter referred to as "MREL OFF") from the power supply ECU 10, it cuts off the power supply path to the corresponding power supply ECU 10, delay circuit 12, integrated control ECU 20, and each control ECU 30. "MREL ON" is an example of a power supply hold signal. "MREL OFF" is an example of a power supply cutoff signal.

[0019] 1, power supply relay 3-1 connects / disconnects the power supply path to integrated control ECU 20 in response to an MREL-1 signal output from power supply ECU 10. Power supply relay 3-2 connects / disconnects the power supply path to control ECU 30-1 in response to an MREL-2 signal output from power supply ECU 10. Power supply relay 3-3 connects / disconnects the power supply path to control ECU 30-2 in response to an MREL-3 signal output from power supply ECU 10.

[0020] In addition, in this embodiment, when an abnormality occurs in the microcomputer 11 of the power supply ECU 10, the power supply relay 3 connects / disconnects the power supply path in response to a relay drive signal (RHLD signal) output from the integrated control ECU 20 during fail-safe control, which will be described later.

[0021] The power supply relays 3 simultaneously receive the RHLD signal output from the integrated control ECU 20, and simultaneously connect / disconnect the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30.

[0022] When each power supply relay 3 receives a Hi voltage RHLD signal (hereinafter referred to as "RHLD ON" where appropriate) from the integrated control ECU 20, it simultaneously connects the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30. When each power supply relay 3 receives a Lo voltage RHLD signal (hereinafter referred to as "RHLD OFF" where appropriate), it simultaneously cuts off the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30. "RHLD ON" is an example of a power supply maintaining signal. "RHLD OFF" is an example of a power supply shutoff signal.

[0023] The connection / disconnection requirements for the power relay 3 in this embodiment are shown in Fig. 2. Fig. 2 is an explanatory diagram of the connection / disconnection requirements for the power relay 3. As shown in Fig. 2, each power relay 3 is in a connected state when "MREL ON" or "RHLD ON" (see also "OR" in each power relay 3 in Fig. 1). On the other hand, each power relay 3 is in a disconnected state when "MREL OFF" and "RHLD OFF" are both set.

[0024] 1, the power supply ECU 10 is an ECU that manages the power supply of the vehicle. The power supply ECU 10 includes a microcomputer 11 and a delay circuit 12.

[0025] The microcomputer 11 is a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The microcomputer 11 corresponds to an example of a controller.

[0026] The microcomputer 11 may be configured in part or in whole using hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0027] The microcomputer 11 has a power supply control unit 11a and a delay control unit 11b, which function when the CPU executes a program stored in the ROM using the RAM as a work area. The power supply control unit 11a controls the corresponding power supply relays 2 and 3 based on vehicle scene signals input to the power supply control system 1 via a CAN or the like.

[0028] The vehicle scene signal corresponds to an example of a signal related to a situation. The vehicle scene signal is an identification signal corresponding to various vehicle scenes such as driving, charging, etc. The vehicle scene signal is an identification signal for each IG type, for example, IG2, IGB, etc.

[0029] Here, IG2 is a signal that is output when the ignition is turned ON (or "Ready ON"), and is a signal that is output from an external ECU (not shown) when the vehicle starts to drive, i.e., an identification signal that indicates the driving scene. IG2 becomes "IG2 ON" when the ignition is turned ON and the vehicle starts to drive, and becomes "IG2 OFF" when the ignition is turned OFF and the vehicle finishes driving. In other words, "IG2 ON" is a vehicle scene-specific signal that indicates that the vehicle is driving. "IG2 OFF" is a vehicle scene-specific signal that indicates that the vehicle has finished driving or is not driving.

[0030] The IGB is a signal output from an external ECU (not shown) when the vehicle is connected to an external charging device to charge the vehicle battery. It is a signal output during charging, i.e., an identification signal indicating the charging scene. The IGB becomes "IGB ON" when the vehicle is connected to an external charging device, and becomes "IGB OFF" when the connection is released. In other words, "IGB ON" is a vehicle scene-specific signal indicating that the vehicle is under charging control. "IGB OFF" is a vehicle scene-specific signal indicating that the vehicle has finished charging control or is not under charging control. Note that the vehicle scene-specific signal may also include information indicating various other vehicle conditions.

[0031] In this embodiment, the microcomputer 11 has four power supply control units 11a: power supply control units 11a-0, 11a-1, 11a-2, and 11a-3. The power supply control unit 11a-0 controls the power supply relay 2 by the MREL-0 signal in response to the vehicle scene signal. The power supply control unit 11a-1 controls the power supply relay 3-1 by the MREL-1 signal in response to the vehicle scene signal. The power supply control unit 11a-2 controls the power supply relay 3-2 by the MREL-2 signal in response to the vehicle scene signal. The power supply control unit 11a-3 controls the power supply relay 3-3 by the MREL-3 signal in response to the vehicle scene signal. The microcomputer 11 is also configured so that if an abnormality occurs in the microcomputer 11 itself, the output ports for each MREL signal become Low voltage and "MREL OFF" is output. The microcomputer 11 is supplied with battery voltage directly from a battery (not shown) and is in a sleep state. When the microcomputer 11 receives a vehicle scene-specific signal (for example, "IG2 ON" or "IGB ON"), it wakes up, and the power supply control units 11a-0, 11a-1, 11a-2, and 11a-3 start control.

[0032] The delay control unit 11b controls the delay circuit 12 by a power relay delay signal (MHLD signal). The output port of the MHLD signal of the microcomputer 11 is set to, for example, Lo voltage when the microcomputer 11 becomes abnormal, and a delay SW (switch) 12a (described later) is set to be in the ON state. That is, when the output port of the MHLD signal is at Hi voltage, "MHLD OFF" is output. When the output port of the MHLD signal is at Lo voltage, "MHLD ON" is output. As a result, when the output port of the MHLD signal becomes Lo voltage due to an abnormality in the microcomputer 11 of the power supply ECU 10, "MHLD ON" is output, and the delay SW 12a (described later) can be set to the ON state.

[0033] When the delay circuit 12 receives "MHLD OFF" from the delay control unit 11b, it operates so as not to delay the MREL-1 signal, MREL-2 signal, and MREL-3 signal. Furthermore, when the delay circuit 12 receives "MHLD ON" from the delay control unit 11b, it operates so as to delay the MREL-1 signal, MREL-2 signal, and MREL-3 signal by a first time. "Delaying by a first time" means maintaining the "MREL ON" state of the MREL-1 signal, MREL-2 signal, and MREL-3 signal for at least a first time. Another way of saying this is to delay the change of the MREL-1 signal, MREL-2 signal, and MREL-3 signal from "MREL ON" to "MREL OFF" by a first time.

[0034] A configuration example of the delay circuit 12 will be described in more detail. Fig. 3 is a diagram showing a configuration example of the delay circuit 12 according to the embodiment. Fig. 3 is an enlarged view of the R1 portion shown in Fig. 1. Fig. 4 is a diagram showing the relationship between the MHLD signal and the delay SW 12a in different states of the microcomputer 11.

[0035] As shown in FIG. 3, the delay circuit 12 includes a delay SW 12a and a capacitor C. The delay SW 12a is a switch that connects or disconnects the capacitor C to the output lines L-1, L-2, and L-3 of the MREL-1 signal, the MREL-2 signal, and the MREL-3 signal. The delay SW 12a is a Lo active switch that turns on at a Lo voltage and is controlled by the output (Lo voltage) of a port that is in an initial state when an abnormality occurs in the microcomputer 11 of the power supply ECU 10. When the port is in the initial state, the delay SW 12a connects the capacitor C to the output lines L-1, L-2, and L-3. The delay SW 12a switches between a connected and disconnected state depending on the state of the MHLD signal.

[0036] When the delay switch 12a is in the cut-off state, the capacitor C stores the charge of the power supply (+B) supplied from the power supply relay 2 to the delay circuit 12. That is, the capacitor C is charged by the voltage of the power supply (+B) of the power supply ECU 10. This allows the capacitor C to be charged while the microcomputer 11 of the power supply ECU 10 is operating normally, in preparation for the operation of the delay circuit 12 in the event of an abnormality in the microcomputer 11.

[0037] Furthermore, the capacitor C supplies the stored charge to each power supply relay 3 when the delay SW12a is in a connected state.

[0038] The delay SW12a connects or disconnects the path from the capacitor C to each power relay 3 in response to the MHLD signal. As shown in FIG. 4, when the microcomputer 11 is normal, the output port for the MHLD signal can be at a high voltage or a low voltage, but the microcomputer 11 is set to output a high voltage when normal. When the output port for the MHLD signal is at a high voltage, the MHLD signal becomes "MHLD OFF." In response to "MHLD OFF," the delay SW12a becomes OFF (disconnected). When the output port for this MHLD signal is at a high voltage, this corresponds to an example of a "non-initial state" of the port. When the microcomputer 11 of the power supply ECU 10 is normal, it is in this non-initial state.

[0039] Furthermore, when an abnormality occurs in the microcomputer 11, the output port for the MHLD signal becomes Lo voltage. When the output port for the MHLD signal is at Lo voltage, the MHLD signal becomes "MHLD ON." In response to "MHLD ON," the delay SW12a becomes ON (connected). When the output port for this MHLD signal is at Lo voltage, this corresponds to an example of the "initial state" of the port. When an abnormality occurs in the microcomputer 11 of the power supply ECU 10, this initial state is entered.

[0040] 3, when the microcomputer 11 of the power supply ECU 10 is operating normally and not abnormal, the delay SW12a is turned off by "MHLD OFF." This allows the delay circuit 12 to not delay the MREL-1 signal, MREL-2 signal, and MREL-3 signal under normal conditions, thereby preventing the behavior of the vehicle from being affected. In other words, when the microcomputer 11 is operating normally, the delay SW12a is turned off, so the MREL-1 signal, MREL-2 signal, and MREL-3 signal are not affected by the capacitor C, and no delay occurs when the microcomputer 11 outputs these MREL signals.

[0041] On the other hand, as shown in FIG. 4, when the microcontroller 11 malfunctions, the delay SW 12a is turned on by "MHLD ON," and the delay circuit 12 delays the MREL-1, MREL-2, and MREL-3 signals. That is, when the microcontroller 11 malfunctions, the delay SW 12a is immediately turned on by the port that is in the initial state, and the charge stored in the capacitor C is supplied to the output lines L-1, L-2, and L-3 for the MREL-1, MREL-2, and MREL-3 signals. Therefore, when the microcontroller 11 malfunctions, the charging voltage of the capacitor C can be immediately supplied as the MREL signal, effectively delaying the MREL-1, MREL-2, and MREL-3 signals. The specific operation of the delay circuit 12 when the microcontroller 11 malfunctions and when it malfunctions will be described later using FIG. 6 and subsequent figures.

[0042] Returning to the explanation of Figure 1, the integrated control ECU 20 is an ECU that performs fail-safe control by controlling the power supply relay 3 in place of the power supply ECU 10 when an abnormality occurs in the microcomputer 11 of the power supply ECU 10. Furthermore, when the microcomputer 11 of the power supply ECU 10 is normal, the integrated control ECU 20 executes an app (application software) that realizes the vehicle control-related functions originally assigned to the integrated control ECU 20.

[0043] The integrated control ECU 20 includes a microcomputer 21. The microcomputer 21 is a microcomputer including a CPU, a ROM, a RAM, etc. The microcomputer 21 may be configured in part or in whole using hardware such as an ASIC or an FPGA.

[0044] The microcomputer 21 includes a power supply control unit 21a and an application execution unit 21b, which function when the CPU executes a program stored in the ROM using the RAM as a work area.

[0045] The power supply control unit 21a performs mutual alive monitoring with the power supply ECU 10 via an in-vehicle network such as a CAN. Furthermore, when the power supply control unit 21a detects an abnormality in the microcomputer 11 of the power supply ECU 10 through alive monitoring, it performs fail-safe control to control the power supply relay 3 to maintain power by outputting an RHLD signal instead of the MREL signal of the power supply ECU 10.

[0046] When the power supply control unit 21a detects an abnormality in the microcomputer 11 of the power supply ECU 10, it outputs "RHLD ON" for a second time period that is shorter than the first time period.

[0047] Specifically, when the microcomputer 11 of the power supply ECU 10 becomes abnormal, the time required for the power supply control unit 21a to determine that the microcomputer 11 is abnormal and output "RHLD ON" is the second time. In other words, the power supply control unit 21a determines that the microcomputer 11 is abnormal if the abnormal state of the microcomputer 11 continues for more than the second time. When the microcomputer 11 becomes abnormal, the output port for the MREL signal immediately becomes "MREL OFF." Therefore, if the MREL-1 signal, MREL-2 signal, and MREL-3 signal are not delayed at least from the time when the microcomputer 11 becomes abnormal until the integrated control ECU 20 outputs "RHLD ON," the power supply relay 3 will be immediately turned off. Therefore, by delaying the MREL-1 signal, MREL-2 signal, and MREL-3 signal for a first time period longer than the second time period, the delay circuit 12 delays the MREL-1 signal, MREL-2 signal, and MREL-3 signal for a first time period longer than the second time period, "MREL ON" will be maintained for the first time period even if the microcomputer 11 becomes abnormal. If the power supply control unit 21a outputs "RHLD ON" during this time, the drive signal for the power supply relay 3 will not be interrupted. This prevents the "MREL ON" output from the microcomputer 11 of the power supply ECU 10 from becoming a Lo voltage when an abnormality occurs in the microcomputer 11 and immediately changing to "MREL OFF," thereby preventing the power supply relay 3 from cutting off the power supply.

[0048] Furthermore, the power supply control unit 21a performs fail-safe control and transmits information about the status during the fail-safe control via the CAN to each control ECU 30. The information about the status during the fail-safe control includes vehicle scene signals and the like.

[0049] In addition, the power supply control unit 21a receives the status of each control ECU 30 transmitted from each control ECU 30 based on the information regarding the transmitted situation, and determines whether or not to shut down the entire system based on each received status and the control status of the integrated control ECU 20 itself.

[0050] If the power supply control unit 21a determines that the entire system can be shut down, it outputs "RHLD OFF" to the power supply relay 3, causing the power supply relay 3 to cut off the supply of power to the integrated control ECU 20 and each control ECU 30.

[0051] The ON / OFF requirements for the RHLD signal in this embodiment are shown in Fig. 5. Fig. 5 is an explanatory diagram of the ON / OFF requirements for the RHLD signal. As shown in Fig. 5, the RHLD signal becomes "RHLD ON" when the microcomputer 11 of the power supply ECU 10 is abnormal and system shutdown is not possible.

[0052] On the other hand, the RHLD signal is "RHLD OFF" when the microcomputer 11 of the power supply ECU 10 is normal. Alternatively, the RHLD signal is "RHLD OFF" when the microcomputer 11 of the power supply ECU 10 is abnormal and the system can be shut down.

[0053] Returning to the explanation of Fig. 1, the application execution unit 21b executes an application that realizes the vehicle control functions originally assigned to the integrated control ECU 20 when the microcomputer 11 of the power supply ECU 10 is operating normally.

[0054] Each control ECU 30 is an ECU that executes an application that realizes a function related to vehicle control assigned to the control ECU 30.

[0055] Each control ECU 30 has a microcomputer 31. The microcomputer 31 is a microcomputer having a CPU, ROM, RAM, etc. The microcomputer 31 may be partially or entirely configured with hardware such as an ASIC or FPGA.

[0056] The microcomputer 31 has an application execution unit 31a that functions by the CPU executing a program stored in the ROM using the RAM as a work area. The application execution unit 31a executes applications that realize functions related to vehicle control assigned to each control ECU 30.

[0057] Furthermore, the microcomputer 31 receives information about the status of fail-safe control from the integrated control ECU 20 during fail-safe control via the CAN, and determines whether or not control by the microcomputer 31 is necessary based on this information. If the microcomputer 31 determines that control is unnecessary, it transitions to a standby state before sleep (a state in which control is terminated and the power supply can be turned off at any time). The standby state before sleep corresponds to an example of a waiting state. In this embodiment, the state in which the supply of power (+B) to the control ECU 30 is cut off and the microcomputer 31 stops operating is referred to as "sleep." The same applies to the microcomputer 21 of the integrated control ECU 20.

[0058] The operation of the power supply control system 1 will be described in more detail below, based on the explanation given above, using timing charts, processing sequences, and the like.

[0059] In this embodiment, the control ECU 30-1 is a driving-system ECU (e.g., a motor control device, an engine control device, etc.), and the control ECU 30-2 is an ECU that controls charging. In this case, the control ECU 30-1 controls vehicle driving and must be activated when a vehicle scene signal indicating "IG2 ON" indicating driving is input to the power supply ECU 10. The control ECU 30-2 controls charging and must be activated when a vehicle scene signal indicating "IGB ON" indicating charging is input to the power supply ECU 10. The integrated control ECU 20 monitors the microcomputer 11 of the power supply ECU 10 in each vehicle scene and must perform fail-safe control. Therefore, the integrated control ECU 20 must be activated when a vehicle scene signal indicating "IG2 ON" indicating driving or a vehicle scene signal indicating "IGB ON" indicating charging is input to the power supply ECU 10. First, FIG. 6 is a diagram showing an example of the operation of the power supply control system 1 during normal operation.

[0060] (Example of normal operation) As shown in FIG. 6, under normal conditions, the power supply ECU 10 acquires vehicle scene-specific signals from an external device (not shown), and each power supply control unit 11a corresponding to the vehicle scene-specific signal controls each power supply relay 3 individually using the MREL signal (see arrows a1-0 to a1-3).

[0061] For example, when the power supply ECU 10 starts up, the power supply control unit 11a-0 causes the power supply relay 2 to supply power to the power supply ECU 10 using the MREL-0 signal "MREL ON", and then causes the power supply relay 2 to supply power to the delay circuit 12 (see arrow a2-0).

[0062] Furthermore, for example, when a vehicle scene signal to activate the integrated control ECU 20 is input to the power supply ECU 10, the power supply control unit 11a-1 causes the power supply relay 3-1 to supply power to the integrated control ECU 20 using the MREL-1 signal of "MREL ON" (see arrow a2-1). The vehicle scene signal at this time is, for example, "IG2 ON" or "IGB ON."

[0063] Furthermore, for example, when a vehicle scene signal to activate the control ECU 30-1 is input, the power supply control unit 11a-2 causes the power supply relay 3-2 to supply power to the control ECU 30-1 by the MREL-2 signal of "MREL ON" (see arrow a2-2). The vehicle scene signal at this time is, for example, "IG2 ON."

[0064] Furthermore, for example, when a vehicle scene signal to put the control ECU 30-1 into sleep mode is input, the power supply control unit 11a-2 causes the power supply relay 3-2 to cut off the supply of power to the control ECU 30-1 by an MREL-2 signal of "MREL OFF." The vehicle scene signal at this time is, for example, "IG2 OFF."

[0065] Furthermore, for example, when a vehicle scene signal to activate the control ECU 30-2 is input, the power supply control unit 11a-3 causes the power supply relay 3-3 to supply power to the control ECU 30-2 by the MREL-3 signal of "MREL ON" (see arrow a2-3). The vehicle scene signal at this time is, for example, "IGB ON."

[0066] Furthermore, for example, when a vehicle scene signal to put the control ECU 30-2 into sleep mode is input, the power supply control unit 11a-3 causes the power supply relay 3-3 to cut off the supply of power to the control ECU 30-2 by an MREL-3 signal of "MREL OFF." The vehicle scene signal at this time is, for example, "IGB OFF."

[0067] That is, when a vehicle scene-specific signal "IG2 ON" indicating the start of driving is input, the power supply control units 11a-1 and 11a-2 output the MREL-1 and MREL-2 signals of "MREL ON" to start up the integrated control ECU 20 and the control ECU 30-1. Also, when a vehicle scene-specific signal "IG2 OFF" indicating the end of driving is input, the power supply control units 11a-1 and 11a-2 output the MREL-1 and MREL-2 signals of "MREL OFF" to put the integrated control ECU 20 and the control ECU 30-1 to sleep.

[0068] Furthermore, when a vehicle scene signal "IGB ON" indicating charging is input, the power supply control units 11a-1 and 11a-3 output the MREL-1 and MREL-3 signals of "MREL ON" to start up the integrated control ECU 20 and the control ECU 30-2. Furthermore, when a vehicle scene signal "IGB OFF" indicating the end of charging is input, the power supply control units 11a-1 and 11a-3 output the MREL-1 and MREL-3 signals of "MREL OFF" to put the integrated control ECU 20 and the control ECU 30-2 to sleep.

[0069] The operation of the delay circuit 12 under normal conditions will be described with reference to Fig. 7. Fig. 7 is a diagram showing an example of the operation of the delay circuit 12 under normal conditions. Note that arrows a1-0 to a1-3 and a2-0 in Fig. 7 correspond to the same arrows in Fig. 6.

[0070] 7, while each MREL signal of "MREL ON" indicated by arrows a1-0 to a1-3 is being output, delay SW 12a is in the OFF state due to "MHLD OFF" from delay control unit 11b, and the path from capacitor C to power supply relay 3 is cut off. On the other hand, power is supplied to delay circuit 12 via the power supply (+B) of power supply ECU 10 due to "MREL ON" of the MREL-0 signal. In this case, capacitor C stores the charge of the supplied power (see arrow a2-0).

[0071] Returning to the explanation of Figure 6, the power supply ECU 10 and the integrated control ECU 20 monitor each other's alive status via the CAN (see arrow a3). The alive status monitoring is a process of monitoring whether the other ECU and the mutual communication are normal or abnormal, and is performed by exchanging counter signals using a watchdog timer or the like, for example.

[0072] 8 is an explanatory diagram of mutual alive monitoring between the power supply ECU 10 and the integrated control ECU 20. Here, it is assumed that the power supply ECU 10 and the integrated control ECU 20 exchange counter signals with each other. The power supply ECU 10 periodically (e.g., every time it counts up) transmits a counter signal that counts up periodically (e.g., every 1 ms) to the integrated control ECU 20. The integrated control ECU 20 periodically transmits a counter signal that counts up periodically to the power supply ECU 10.

[0073] Then, in the "normal state," both the power supply ECU 10 and the integrated control ECU 20 can count up, and the count-up determination of the counter signal received from each other is normal.

[0074] However, when "the microcomputer of the power supply ECU 10 is abnormal," the integrated control ECU 20 can count up, but the power supply ECU 10 stops counting up. As a result, the integrated control ECU 20 determines that the count up of the power supply ECU 10 is abnormal. Specifically, if the counter signal received from the power supply ECU 10 does not change for a period of time Δt21 or more, the integrated control ECU 20 determines that the microcomputer 11 of the power supply ECU 10 has become abnormal. Furthermore, the power supply ECU 10 is unable to determine that the integrated control ECU 20 is counting up in the first place.

[0075] Furthermore, when "the microcomputer of the integrated control ECU 20 is abnormal," the power supply ECU 10 can count up, but the integrated control ECU 20 stops counting up. As a result, the power supply ECU 10 determines that the count up of the integrated control ECU 20 is abnormal. Specifically, if the counter signal received from the integrated control ECU 20 does not change for a period of time Δt21 or more, the power supply ECU 10 determines that the microcomputer 21 of the integrated control ECU 20 has become abnormal. Furthermore, the integrated control ECU 20 is unable to determine that the power supply ECU 10 is counting up in the first place.

[0076] By monitoring each other's status in this way, it becomes possible to detect not only abnormalities in the microcomputer 11 of the power supply ECU 10, but also abnormalities in the microcomputer 21 of the integrated control ECU 20. Since this embodiment relates to fail-safe control when an abnormality occurs in the microcomputer 11 of the power supply ECU 10, the following description will focus particularly on the abnormality of the microcomputer 11 of the power supply ECU 10.

[0077] The alive monitoring is not limited to the counter signal method described above, but may be a Q&A method in which "questions" and "answers" are exchanged between each other.

[0078] (Example of operation when the power supply ECU microcomputer malfunctions) Next, an example of the operation of power supply control system 1 when an abnormality occurs in the microcomputer of power supply ECU 10 will be described with reference to Figures 9 to 12. Figure 9 is a diagram (part 1) showing an example of the operation of power supply control system 1 when an abnormality occurs in the microcomputer of power supply ECU 10. Also, Figure 10 is a diagram showing an example of the operation of delay circuit 12 when an abnormality occurs. Note that arrows a4-0 to a4-3 and a4-10 in Figure 10 correspond to the same arrows in Figure 9.

[0079] 11 is a diagram (part 2) showing an example of operation of the power supply control system 1 when an abnormality occurs in the microcomputer of the power supply ECU 10. Also, FIG. 12 is a diagram (part 3) showing an example of operation of the power supply control system 1 when an abnormality occurs in the microcomputer of the power supply ECU 10.

[0080] 9, it is assumed that the integrated control ECU 20 detects an abnormality in the microcomputer 11 of the power supply ECU 10 through the above-mentioned alive monitoring. In this case, each MREL signal output from each power supply control unit 11a of the power supply ECU 10 immediately becomes a low voltage and is set to "MREL OFF" when an abnormality occurs in the microcomputer 11 (see arrows a4-0 to a4-3).

[0081] At the same time, the MHLD signal output from the delay control unit 11b also becomes a Lo voltage when the microcomputer 11 becomes abnormal, but becomes "MHLD ON" as shown in Fig. 10. This also causes the delay SW12a to turn ON the moment the microcomputer 11 becomes abnormal, connecting the path from the capacitor C to each power relay 3.

[0082] Then, the supply of power to the delay circuit 12 via the power relay 2, i.e., via the power supply (+B) of the power supply ECU 10, is cut off (see arrow a4-10), but because the capacitor C stores charge, current flows from the capacitor C to each power relay 3 for a while (see arrows a4-11 to a4-13). As a result, the delay circuit 12 maintains the "MREL ON" input to each power relay 3 for the first time period mentioned above.

[0083] While the delay circuit 12 keeps the "MREL ON" input to each power relay 3 for the first time, the power supply control unit 21a of the integrated control ECU 20 detects an abnormality in the microcomputer 11 of the power supply ECU 10.

[0084] Then, as soon as the power supply control unit 21a detects an abnormality in the microcomputer 11, it simultaneously outputs an RHLD signal that becomes "RHLD ON" to each power supply relay 3 (see arrow a5), as shown in FIG.

[0085] Upon receiving this RHLD signal, each power supply relay 3 simultaneously connects the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30 (see arrows a6-1 to a6-3).

[0086] That is, the integrated control ECU 20 and each control ECU 30 that have already been powered and activated continue to receive power. Also, each control ECU 30 that has not been powered and is in a sleep state receives power and is activated. That is, when the microcomputer 11 of the power supply ECU 10 becomes abnormal, the integrated control ECU 20 and all control ECUs 30 enter an activated state.

[0087] The power supply control unit 21a of the integrated control ECU 20 simultaneously outputs an RHLD signal that turns "RHLD ON" to each of the power supply relays 3, thereby making it possible to collectively maintain the ON state of each of the power supply relays 3 without interruption from the state in which "MREL ON" is maintained by the delay circuit 12. This also enables the integrated control ECU 20 to comprehensively control the power supply in place of the power supply ECU 10. Furthermore, by simultaneously outputting an RHLD signal to the multiple power supply relays 3 and putting all of the control ECUs 30 into an activated state, it becomes possible to acquire the state of each control ECU 30 that is necessary for determining whether or not to shut down the system.

[0088] Then, the integrated control ECU 20 transmits the vehicle scene-specific signal and the power supply control fail-safe information via the CAN (see arrow a7) to all the control ECUs 30. The vehicle scene-specific signal and the power supply control fail-safe information correspond to an example of the information regarding the situation during the fail-safe control described above.

[0089] During alive monitoring, the integrated control ECU 20 can receive vehicle scene signals along with the counter signal from the power supply ECU 10. However, since the vehicle scene signals from the power supply ECU 10 are considered to be unreliable when an abnormality occurs in the microcomputer 11, the integrated control ECU 20 receives the vehicle scene signals from an external ECU (not shown) via a CAN or the like instead of the power supply ECU 10.

[0090] The power supply control fail-safe information also includes, for example, information indicating that an abnormality has been detected in the power supply ECU 10 and that the integrated control ECU 20 is currently performing fail-safe control.

[0091] 12, each control ECU 30 determines the state of its own device based on the vehicle scene-specific signal and the power supply control fail-safe information received from the integrated control ECU 20. Specifically, each control ECU 30 determines whether or not control by its own device is necessary based on the vehicle scene-specific signal and the power supply control fail-safe information.

[0092] For example, in a scene in which the vehicle is moving, the control ECU 30-1 that performs vehicle control related to the vehicle's movement determines that control by the control ECU 30-1 itself is necessary. Also, in the same scene in which the vehicle is moving, the control ECU 30-2 that performs vehicle control unrelated to the vehicle's movement determines that control by the control ECU 30-2 itself is unnecessary.

[0093] If each control ECU 30 determines that control is not necessary, it transitions to the standby state before sleep. If each control ECU 30 determines that control is necessary, it continues control by its own device. Then, each control ECU 30 transmits the determined state of its own device to the integrated control ECU 20 (see arrows a8-1 and a8-2).

[0094] The power supply control unit 21a of the integrated control ECU 20 determines whether the system can be shut down based on the status of each control ECU 30 received from each control ECU 30 and the control status of the integrated control ECU 20 itself. Specifically, if one or more control ECUs 30, including the power supply control unit 21a, require control (control is required), the power supply control unit 21a determines that the system cannot be shut down and therefore cannot be shut down. However, if the power supply control unit 21a and all control ECUs 30 do not require control, the power supply control unit 21a determines that the system can be shut down. If the power supply control unit 21a determines that the system cannot be shut down, it periodically receives the latest vehicle scene-specific signal from a CAN or the like and transmits it to each control ECU 30 along with power supply control fail-safe information periodically or when the vehicle scene-specific signal changes.

[0095] At this time, the power supply control unit 21a may transmit the vehicle scene-specific signal and the power supply control fail-safe information only to each control ECU 30 that is not yet in the standby state, based on the state of each control ECU 30 that has already been received.

[0096] The control ECU 30 that has received the vehicle scene-specific signal again determines whether or not control by its own device is necessary, and transmits the determined state of its own device to the integrated control ECU 20. For example, assume that the integrated control ECU 20 received an "IG2 ON" vehicle scene-specific signal when it detected an abnormality in the microcomputer 11. If the control ECU 30-1, which had determined that control was necessary in response to this "IG2 ON" signal, subsequently receives an "IG2 OFF" vehicle-specific signal from the integrated control ECU 20 indicating that driving has ended, the control ECU 30-1 performs termination processing and then transmits "control not required" to the integrated control ECU 20. In this way, when the integrated control ECU 20 receives "control not required" from all control ECUs 30 and the vehicle control originally assigned to the integrated control ECU 20 has also ended, it determines that the system can be terminated.

[0097] When the power supply control unit 21a determines that the system can be shut down, it simultaneously outputs an RHLD signal that turns to "RHLD OFF" to each power supply relay 3 (see arrow a9).

[0098] Upon receiving this RHLD signal, each power supply relay 3 simultaneously cuts off the power supply path to the corresponding integrated control ECU 20 and each control ECU 30. As a result of this cutoff, the integrated control ECU 20 and each control ECU 30, which have had their power supply cut off, simultaneously transition to a sleep state.

[0099] The integrated control ECU 20 acquires the state determination results of each control ECU 30 based on the vehicle scene signals and power supply control fail-safe information sent to each control ECU 30 and uses the results to determine whether or not the system can be shut down, thereby enabling safer power supply shutdown control. Furthermore, the integrated control ECU 20 can cause each power supply relay 3 to simultaneously cut off the power supply path, thereby quickly transitioning the power supply control system 1 to a safe power supply shutdown state after determining that the system can be shut down.

[0100] (Timing chart) Next, a description will be given of timing charts in the operation example of the power supply control system 1 described above. Fig. 13 is a diagram (part 1) showing a timing chart in the operation example of the power supply control system 1. Fig. 14 is a diagram (part 2) showing a timing chart in the operation example of the power supply control system 1.

[0101] As described above, the control ECU 30-1 is a driving system ECU (activated when "IG2 ON"), and the control ECU 30-2 is a charge control ECU (activated when "IGB ON").

[0102] As shown in Figure 13, first, the power supply ECU 10 is started up before time t1, and the MREL-0 signal is "MREL ON." Then, when the vehicle scene-specific signal becomes "IG2 ON" at time t1, the microcomputer 11 of the power supply ECU 10 sets the MREL-1 signal and the MREL-2 signal to "MREL ON" to start up the integrated control ECU 20 and the control ECU 30-1. Because the control ECU 30-2 is not involved in driving, the MREL-3 signal remains "MREL OFF."

[0103] The power relay 3-1 corresponding to the MREL-1 signal receives the MREL-1 signal of "MREL ON" and turns ON at time t1. Similarly, the power relay 3-2 corresponding to the MREL-2 signal receives the MREL-2 signal of "MREL ON" and turns ON at time t1.

[0104] Then, at time t2, when the microcomputer 11 of the power supply ECU 10 becomes abnormal, the MREL-1 signal and the MREL-2 signal immediately become "MREL OFF." However, the power supply relays 3-1 and 3-2 remain in the ON state for at least the delay time Δt22 (the first time period described above) set by the delay circuit 12.

[0105] On the other hand, when the microcomputer 21 of the integrated control ECU 20 detects an abnormality in the microcomputer 11 of the power supply ECU 10 because the abnormality has continued for Δt21 (<Δt22), it sets the RHLD signal to "RHLD ON" at time t2+Δt21.

[0106] 14, when the microcomputer 11 of the power supply ECU 10 becomes abnormal at time t2, the output port of the MHLD changes from High voltage to Low voltage, which in turn causes the MHLD signal to become "MHLD ON."

[0107] This "MHLD ON" switches the delay SW12a of the delay circuit 12 to the ON state, and when the path from capacitor C to each power relay 3 is connected, capacitor C outputs the stored charge to each power relay 3. The output of capacitor C drops to 0 as it discharges to each power relay 3, but the power relay 3 remains ON until time t2 + Δt22 (first time) when the output drops to voltage V1, which is enough to maintain the power relay 3 in the ON state. In other words, the delay circuit 12 delays the "MREL ON" MREL signal for Δt22 from the time when the microcomputer 11 becomes abnormal.

[0108] During this time, when the microcomputer 21 of the integrated control ECU 20 detects an abnormality in the microcomputer 11 of the power supply ECU 10 because the abnormality has continued for Δt21 (<Δt22), it sets the RHLD signal to "RHLD ON" at time t2+Δt21.

[0109] Returning to the explanation of Figure 13, as a result, all power supply relays 3 are simultaneously closed, power supply relays 3-1 and 3-2 remain in the ON state, and power supply relay 3-3 changes from the OFF state to the ON state, and control ECU 30-2 is also started up. In other words, all control ECUs 30 are started up.

[0110] At this time, the microcomputer 21 of the integrated control ECU 20 transmits a current vehicle scene-specific signal (IG2 ON) to the integrated control ECU 30. In response to this, the control ECU 30-1 determines the state of its own device and transmits a "control required" signal indicating that control by its own device is required to the integrated control ECU 20. The control ECU 30-2 also determines the state of its own device and transmits a "control not required" signal indicating that control by its own device is not required to the integrated control ECU 20.

[0111] The integrated control ECU 20 determines that the system cannot be shut down because the control ECU 30-1 is in a "control required" state, and maintains the "RHLD ON" state of the RHLD signal as the relay hold period.

[0112] Then, at time t3, when the vehicle stops traveling and the vehicle scene signal changes to “IG2 OFF”, the integrated control ECU 20 transmits the vehicle scene signal (IG2 OFF) to the overall control ECU 30.

[0113] In response to this, the control ECU 30-1 performs termination processing, including storing control data in a non-volatile memory, and when this is complete, transmits "control not required" to the integrated control ECU 20. The control ECU 30-2 continues to transmit "control not required" to the integrated control ECU 20.

[0114] When both the control ECU 30-1 and the control ECU 30-2 become "control unnecessary," the integrated control ECU 20 determines that the system can be shut down if the integrated control ECU 20 itself also does not require control. Then, at time t4, which is the time of this determination, the integrated control ECU 20 sets the RHLD signal to "RHLD OFF" to simultaneously shut off all the power supply relays 3.

[0115] As a result, the main control ECU 30, which has been cut off from the power supply, transitions to a sleep state. The integrated control ECU 20 also transitions to a sleep state at the same time as the main control ECU 30.

[0116] (Processing sequence) Next, a description will be given of a processing sequence executed by the power supply control system 1. Fig. 15 is a diagram showing a processing sequence executed by the power supply control system 1. Fig. 16 is a flowchart showing the processing procedure of the state determination process executed by the control ECU 30.

[0117] 15, the power supply ECU 10 transmits a counter signal to the integrated control ECU 20 (step S101). On the other hand, the integrated control ECU 20 transmits a counter signal to the power supply ECU 10 (step S102).

[0118] If an abnormality occurs in the microcomputer 11, the power supply ECU 10 outputs "MHLD ON" to the delay circuit 12 (step S103), as the output port of the MHLD signal becomes Lo voltage. Upon receiving "MHLD ON", the delay circuit 12 maintains the ON state of each power supply relay 3 for at least a time Δt22.

[0119] Then, the integrated control ECU 20 determines whether or not the counting based on the counter signal from the power supply ECU 10 has stopped (step S104). If the counting has not stopped (step S104, No), the integrated control ECU 20 determines that the microcomputer 11 of the power supply ECU 10 is normal, and repeats the process from step S101.

[0120] On the other hand, if the counting has stopped for time Δt21 or more (step S104, Yes), the integrated control ECU 20 determines that an abnormality has been detected in the microcomputer 11 of the power supply ECU 10 and outputs "RHLD ON" to all power supply relays 3-1, 3-2, 3-3 (step S105). As a result, all power supply relays 3-1, 3-2, 3-3 are turned ON, power is supplied to all control ECUs 30-1, 30-2, and all control ECUs 30-1, 30-2 are started up.

[0121] Subsequently, the integrated control ECU 20 acquires the latest vehicle scene-specific signals via the CAN or the like (step S106).Then, the integrated control ECU 20 transmits the acquired vehicle scene-specific signals and power supply control fail-safe information to the control ECUs 30-1 and 30-2 (step S107).

[0122] The control ECU 30-1 executes a state determination process based on the vehicle scene-specific signal and the power supply control fail-safe information received from the integrated control ECU 20 (step S108). The control ECU 30-2 also executes a state determination process based on the vehicle scene-specific signal and the power supply control fail-safe information received from the integrated control ECU 20 (step S109).

[0123] In the state determination process, as shown in FIG. 16, the control ECUs 30-1 and 30-2 determine whether or not control by their own devices is necessary based on the vehicle scene-specific signal and the power supply control fail-safe information (step S201).

[0124] If the control is not required (step S202, Yes), the control ECUs 30-1 and 30-2 transition to the standby state before sleep (step S203). On the other hand, if the control is required, that is, if the control cannot be terminated (step S202, No), the control ECUs 30-1 and 30-2 continue the control by their own devices (step S204). Then, the control ECUs 30-1 and 30-2 terminate the state determination process.

[0125] Returning to the description of Fig. 15, after step S108, the control ECU 30-1 transmits the device state of the control ECU 30-1, which is the determination result in step S108, to the integrated control ECU 20 (step S110).

[0126] Similarly, after step S109, the control ECU 30-2 transmits the device status of the control ECU 30-2, which is the determination result in step S109, to the integrated control ECU 20 (step S111). Note that the device status in steps S110 and S111 is, for example, a status value indicating "control not required" corresponding to a standby state or "control required" corresponding to a control continuation state.

[0127] The integrated control ECU 20 determines whether or not the system can be shut down based on the device status of the integrated control ECU 20 itself and the device status received from the control ECUs 30-1 and 30-2 (step S112). If the system cannot be shut down (No in step S112), the integrated control ECU 20 repeats the process from step S106.

[0128] If system shutdown is permitted (step S112, Yes), the integrated control ECU 20 outputs "RHLD OFF" to all power supply relays 3-1, 3-2, and 3-3 (step S113). As a result, all power supply relays 3-1, 3-2, and 3-3 are turned OFF, and power supply to the integrated control ECU 20 and all control ECUs 30-1 and 30-2 is cut off. Then, the integrated control ECU 20 and all control ECUs 30-1 and 30-2 transition to a sleep state (steps S114, S115, and S116).

[0129] As described above, the power supply ECU 10 (corresponding to an example of a "power supply control device") according to the embodiment includes a microcomputer 11 (corresponding to an example of a "controller") and a delay circuit 12. The microcomputer 11 receives an MREL signal (corresponding to an example of a "first power supply holding signal") or an RHLD signal (corresponding to an example of a "second power supply holding signal") and outputs an MREL signal to the power supply relay 3, which supplies power to the integrated control ECU 20 and the control ECU 30 (corresponding to an example of "multiple control devices"), to control the power supply relay 3. When the power supply relay 3 receives an RHLD signal from an external device as fail-safe control in the event of an abnormality in the microcomputer 11, the delay circuit 12 delays the MREL signal by at least the time required for the external device to detect the abnormality in the microcomputer 11.

[0130] Therefore, according to the power supply ECU 10 of this embodiment, if the microcomputer 11 fails, an external device controls the power supply relay 3 in place of the microcomputer 11 to supply power to the integrated control ECU 20 and the control ECU 30. At that time, the MREL signal output from the microcomputer 11 is delayed by the delay circuit 12 for at least the time it takes for the external device to detect an abnormality in the microcomputer 11. As a result, even if the microcomputer 11 fails and the output of the MREL signal from the microcomputer 11 is interrupted, the MREL signal is supplied to the power supply relay 3 by the delay circuit 12 at least until the RHLD signal is input, so the power supply relay 3 is not shut off. This makes it possible to prevent the power supply from being shut off during fail-safe control when an abnormality occurs in the microcomputer of the power supply ECU 10.

[0131] The external device is one of the plurality of control devices. That is, the external device is the integrated control ECU 20 according to the embodiment. This allows the integrated control ECU 20 to be used as the external device.

[0132] In the above embodiment, the delay circuit 12 is described as a circuit that delays the "MREL ON" MREL signal only when the microcomputer 11 of the power supply ECU 10 becomes abnormal. However, in another embodiment, instead of the delay circuit 12, an integrating circuit composed of a capacitor C and a resistor R may be provided as a delay circuit 12' on each of the output lines L-1, L-2, and L-3 from the power supply control unit 11a to the power supply relay 3. This example is shown in FIG. 17. FIG. 17 is a diagram showing the delay circuit 12' according to another embodiment. The delay circuit 12' also delays each MREL signal by Δt22 (first time). In this case, the delay SW 12a of the delay circuit 12 and the diode and delay control unit 11b that output the MHLD signal shown in FIG. 3 are not required, thereby simplifying the configuration. However, the delay circuit 12' delays the MREL signal even when the microcomputer 11 outputs the "MREL ON" MREL signal, even when the microcomputer 11 does not become abnormal. This delay delays the startup of the integrated control ECU 20 and the control ECU 30. When priority is given to the response of the start-up of the integrated control ECU 20 and the control ECU 30, the delay circuit 12 may be employed, and when priority is given to simplifying the configuration, the delay circuit 12' may be employed.

[0133] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0134] 1 Power supply control system 3 Power Relay 10 Power ECU 11 Microcomputer 11a Power supply control unit 12,12' delay circuit 20 Integrated Control ECU 21 Microcomputer 21a Power supply control unit 21b Application execution section 30 Control ECU 31 Microcomputer 31a Application execution section

Claims

1. a controller that outputs a first power supply holding signal to a power supply relay that receives a first power supply holding signal or a second power supply holding signal and supplies power to a plurality of control devices; and a delay circuit that delays the first power supply holding signal by at least the time required for the external device to detect an abnormality in the controller when the power supply relay receives the second power supply holding signal from the external device as a fail-safe control in the event of an abnormality in the controller; A power supply control device comprising:

2. The delay circuit a capacitor that is charged by the voltage of the power supply; a switch that connects or disconnects the output line of the first power supply holding signal and the capacitor; Equipped with The switch is The control is performed by an output of a port that is set to an initial state when an abnormality occurs in the controller, and when the port is set to the initial state, the capacitor and the output line are connected. The power supply control device according to claim 1 .

3. the switch disconnects the capacitor from the output line when the port is in a non-initial state; The power supply control device according to claim 2 .

4. The delay circuit charging the capacitor when power is supplied and the port is in a non-initial state; The power supply control device according to claim 2 .

5. the external device outputs the second power supply holding signal to the power supply relay for a second time period that is shorter than a first time period during which the capacitor and the output line are connected to allow a current to flow from the capacitor to the output line and the power supply relay can be maintained in a conductive state; The power supply control device according to claim 2 .

6. the external device simultaneously outputs the second power supply holding signal to the power supply relays corresponding to the plurality of control devices. The power supply control device according to claim 5 .

7. the external device is one of the plurality of control devices, The power supply control device according to claim 1 .

8. a power supply control device; a power supply relay that receives a first power supply holding signal or a second power supply holding signal and supplies power to a plurality of control devices; and a first control device that is one of the control devices; The power supply control device includes: a controller that outputs the first power supply holding signal to the power supply relay to control the power supply relay; a delay circuit that delays the first power supply holding signal by at least the time required for the first control device to detect an abnormality in the controller when the power supply relay receives the second power supply holding signal from the first control device as a fail-safe control in the event of an abnormality in the controller; Equipped with The first control device performing the fail-safe control by outputting the second power supply holding signal to the power supply relay when an abnormality in the controller is detected; Power control system.

Images