Power supply control device and power supply control program

Abstract

To provide a power supply control device and a power supply control program which can perform load control of a system other than a running system that is required to be performed after fail-safe control is completed, more surely.SOLUTION: A power supply control device according to an embodiment supplies electric power to a load on a running system relating to running of a vehicle and a load on a system other than the running system, through a power supply path from a first power supply and a second power supply. The power supply control device comprises a controller. When detecting a failure of the first power supply, the controller performs fail-safe control by which the first power supply is separated from the power supply path and electric power is supplied from the second power supply to the loads. After the fail-safe control is completed, the controller supplies electric power to the load on the system other than the running system, and stops supply of electric power to the load on the running system.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The disclosed embodiments relate to a power supply control device and a power supply control program. [Background technology]

[0002] In the event of a power failure in the primary system that supplies power from the first power source to the load, the controller of the redundant power supply system installed in the vehicle performs fail-safe control by supplying power from the second power source to the load via the secondary system so that the vehicle can run to an evacuation location and stop.If the power of the second power source is limited, it is desirable for the controller to ensure that the time available for fail-safe control is as long as possible.

[0003] For this reason, there is a technique in which the priority of loads in the driving system related to the driving of the vehicle is set higher than the priority of loads other than the driving system, and as the remaining amount of the second power source decreases during fail-safe control, the loads with lower priority are disconnected from the power source (see, for example, Patent Document 1).This allows the controller to secure a longer period of time for fail-safe control by the amount of power consumption by loads other than the driving system eliminated during fail-safe control. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2023-42332 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the prior art, if loads other than the driving system are disconnected from the power supply as the remaining capacity of the second power supply decreases during fail-safe control, it may not be possible to control the loads other than the driving system after fail-safe control ends.

[0006] One aspect of the embodiment has been made in consideration of the above, and aims to provide a power supply control device and a power supply control program that can more reliably control loads other than the driving system that need to be controlled after fail-safe control has ended. [Means for solving the problem]

[0007] A power supply control device according to one aspect of the present invention supplies power from a first power source and a second power source via a power supply path to a load related to the running of a vehicle and a load other than the running system. The power supply control device includes a controller. When the controller detects a failure of the first power source, it performs fail-safe control by disconnecting the first power source from the power supply path and supplying power from the second power source to the load. When the fail-safe control ends, the controller causes power to be supplied to the load other than the running system and stops the power supply to the running system load. [Effects of the Invention]

[0008] According to an embodiment, a power supply control device and a power supply control program supply power to a load other than the driving system and stop the power supply to the driving system load when fail-safe control ends. This allows the power supply control device and the power supply control program to more reliably control the load other than the driving system that needs to be controlled after fail-safe control ends. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of the configuration of a power supply control device according to an embodiment. [Figure 2] FIG. 2 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 3] FIG. 3 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 4] FIG. 4 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 5]FIG. 5 is a flowchart illustrating a first example of processing executed by the controller according to the embodiment. [Figure 6] FIG. 6 is a flowchart illustrating a second processing example executed by the controller according to the embodiment. [Figure 7] FIG. 7 is a flowchart illustrating a third example of processing executed by the controller according to the embodiment. [Figure 8] FIG. 8 is a flowchart illustrating a fourth example of processing executed by the controller according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of a power supply control device and a power supply control program will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below. The following description will be given using an example of a power supply control device that is installed in a vehicle with an autonomous driving function and supplies power to a load, but the power supply control device according to the embodiment may also be installed in a vehicle that does not have an autonomous driving function.

[0011] In addition, although the following description will be given of a case where the vehicle in which the power supply control device is installed is an electric vehicle or a hybrid vehicle, the vehicle in which the power supply control device is installed may also be an engine vehicle that runs on an internal combustion engine.

[0012] ≪1. Configuration of power supply control device≫ 1 is an explanatory diagram showing an example of the configuration of a power supply control device 1 according to an embodiment. The power supply control device 1 according to the embodiment is connected to a first power source 10, a DC / DC converter 11 (hereinafter referred to as "DCC 11"), a driving load 101, a non-driving load 102, an automatic driving control device 201, and an operation device 202.

[0013] The first power source 10 is, for example, a lead battery. However, the first power source 10 may be any secondary battery other than a lead battery. The first power source 10 is a power source that mainly supplies power to the traveling load 101 and the non-traveling load 102.

[0014] The DCC 11 is connected to a high-voltage battery 12. The high-voltage battery 12 is a vehicle drive battery that supplies power to a motor that drives the vehicle. The high-voltage battery 12 is, for example, a lithium-ion battery.

[0015] The DCC 11 steps down the voltage of the high-voltage battery 12 to charge the first power source 10 and a second power source 20 (described later). The DCC 11 also steps down the voltage of the high-voltage battery 12 to supply power to the traveling load 101, the non-traveling load 102, and the like.

[0016] When the DCC 11 is mounted on an engine vehicle, it is connected to an alternator that converts the vehicle's regenerative energy into electric power to generate electricity, and transforms and outputs the input voltage input from the generator.

[0017] The traveling load 101 is a load related to the traveling of the vehicle. The traveling load 101 is a device used for fail-safe control (hereinafter referred to as "FOP") that uses the power of the second power source 20 to make the vehicle travel to an evacuation point when the first power source 10 fails. The evacuation point is travel in which the vehicle is stopped on the shoulder of the road in a safe place. The traveling load 101 is also used when autonomous driving is performed.

[0018] The driving load 101 includes devices related to automatic driving, steering, and braking of the vehicle. For example, the driving load 101 includes an electric steering device, an electric braking device, radar, a sensor, an on-board camera, and the like.

[0019] The non-driving loads 102 are loads other than the driving loads 101. For example, the non-driving loads 102 include a door lock device, an emergency call device, an information notification device, an A / V (audio / video) device, an air conditioner, a power window, and an outlet inside or outside the vehicle.

[0020] The automatic driving control device 201 is a control device that operates the traveling load 101 to control the automatic driving of the vehicle. Furthermore, if the automatic driving control device 201 is unable to supply power from the first power source 10, it operates the traveling load 101 using power from the second power source 20 to perform FOP. The automatic driving control device 201 is supplied with power from the first power source 10 and the second power source 20 and operates.

[0021] The operation devices 202 are devices used by the vehicle driver or the automatic driving control device 201 to drive the vehicle. The operation devices 202 include, for example, a steering mechanism, an accelerator mechanism, a brake mechanism, and a shift mechanism. Each operation device 202 includes a sensor that detects the amount of operation when operated by the driver or the automatic driving control device 201.

[0022] The power supply control device 1 is supplied with power from an externally provided first power supply 10. The power supply control device 1 can supply the power supplied from the externally provided first power supply 10 to a traveling load 101 and a non-traveling load 102.

[0023] The power supply control device 1 includes a first system 110 and a second system 120. The first system 110 is a system capable of supplying power from a first power source 10 to a traveling load 101 and a non-traveling load 102. The second system 120 is a system capable of supplying power from a second power source 20 (described later) to the traveling load 101 and the non-traveling load 102.

[0024] The first system 110 and the second system 120 are connected by an inter-system line 130. The inter-system line 130 is provided with an inter-system switch 32 that can connect and disconnect the first system 110 and the second system 120.

[0025] The power supply control device 1 includes a second power supply 20, a battery switch 31, an inter-system switch 32, a first load switch 33, a second load switch 34, a third load switch 35, a fourth load switch 36, a first voltage sensor 51, a second voltage sensor 52, and a controller 3.

[0026] The second power source 20 is, for example, a lithium ion battery. The second power source 20 is a backup power source in case the first power source 10 is unable to supply power. Note that the second power source 20 may be any secondary battery other than a lithium ion battery.

[0027] The battery switch 31 is a switch that can connect and disconnect the second power source 20 and the second system 120. The inter-system switch 32 is provided on the inter-system line 130. The inter-system switch 32 is a switch that can connect and disconnect the first system 110 and the second system 120.

[0028] The first load switch 33 is a switch that can connect and disconnect the first system 110 and the traveling load 101. The second load switch 34 is a switch that can connect and disconnect the second system 120 and the traveling load 101.

[0029] The third load switch 35 is a switch that can connect and disconnect the first system 110 and the non-driving load 102. The fourth load switch 36 is a switch that can connect and disconnect the second system 120 and the non-driving load 102.

[0030] The first voltage sensor 51 is provided in the first system 110. The first voltage sensor 51 detects the voltage of the first system 110 and outputs the detection result to the controller 3. The second voltage sensor 52 is provided in the second system 120. The second voltage sensor 52 detects the voltage of the second system 120 and outputs the detection result to the controller 3.

[0031] The controller 3 includes a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc., and various other circuits. The controller 3 may also be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0032] The controller 3 controls the operations of the battery switch 31, the inter-system switch 32, and the first to fourth load switches 33 to 36 by having the CPU execute a power supply control program stored in the ROM using the RAM as a work area. The power supply control program may be stored in a storage device from the outside via a communication line or the like.

[0033] ≪2. Example of power supply control device operation≫ Next, an example of operation of the power supply control device 1 according to the embodiment will be described with reference to Figures 2 to 4. Figures 2 to 4 are explanatory diagrams showing an example of operation of the power supply control device 1 according to the embodiment.

[0034] 2, during normal operation when no power supply failure occurs, the controller 3 turns off the battery switch 31 and turns on the inter-system switch 32 and the first to fourth load switches 33 to 36. This allows power to be supplied from the first power source 10 to the traveling load 101 and the non-traveling load 102.

[0035] Thereafter, the controller 3 monitors whether a ground fault has occurred in the first system 110 or the second system 120. Specifically, when a ground fault occurs in the first system 110 or the second system 120, a large current flows toward the ground fault point, causing the voltage of the first system 110 (hereinafter referred to as "first system voltage V1") and the voltage of the second system 120 (hereinafter referred to as "second system voltage V2") to fall below the ground fault threshold.

[0036] Therefore, when the detection result (first system voltage V1 and second system voltage V2) input from the first voltage sensor 51 or the second voltage sensor 52 becomes below the ground fault threshold, the controller 3 provisionally determines that a ground fault has occurred in the first system 110 or the second system 120.

[0037] When the controller 3 provisionally determines that a ground fault has occurred, it pre-shuts off the inter-system switch 32 and turns on the battery switch 31. This cuts off the connection between the first system 110 and the second system 120, and power is supplied to the first system 110 from the first power source 10, and to the second system 120 from the second power source 20. Thereafter, the controller 3 makes a final determination as to whether a ground fault has occurred in the first system 110 or the second system 120.

[0038] At this time, if a ground fault occurs in the second system 120, the second system voltage V2 remains below the ground fault threshold even when the inter-system switch 32 is turned off. On the other hand, the first system voltage V1 returns to a normal value higher than the ground fault threshold when the inter-system switch 32 is turned off.

[0039] Furthermore, if a ground fault occurs in the first system 110, the first system voltage V1 remains below the ground fault threshold even if the inter-system switch 32 is turned off. On the other hand, the second system voltage V2 returns to a normal value higher than the ground fault threshold when the inter-system switch 32 is turned off.

[0040] Therefore, the controller 3 officially determines that a ground fault has occurred in the second system 120 when the second system voltage V2 remains equal to or lower than the ground fault threshold for a predetermined time period after the inter-system switch 32 is turned off. Also, the controller 3 officially determines that a ground fault has occurred in the first system 110 when the first system voltage V1 remains equal to or lower than the ground fault threshold for a predetermined time period after the inter-system switch 32 is turned off.

[0041] If the first system voltage V1 and the second system voltage V2 remain higher than the ground fault threshold for a predetermined time after the inter-system switch 32 is turned off, the controller 3 determines that this is a transient voltage drop due to an overload or the like and that no ground fault has occurred. In this case, the controller 3 turns the inter-system switch 32 back on and turns the battery switch 31 off again, returning the state of the power supply control device 1 to the normal state shown in FIG. 2.

[0042] When the controller 3 determines that a ground fault has occurred in the first system 110, it switches off the first load switch 33 and the third load switch 35 from the pre-shutdown state in which the inter-system switch 32 is shut down, as shown in Figure 3.

[0043] As a result, power is supplied from the second power source 20 to the traveling loads 101 and the non-traveling loads 102 via the second system 120. Therefore, the automatic driving control device 201 or the driver can operate the traveling loads 101 and the non-traveling loads 102 using the power from the second power source 20 to cause the vehicle to evacuate.

[0044] In addition, if the controller 3 determines that a ground fault has occurred in the second system 120, it switches off the battery switch 31, the second load switch 34, and the fourth load switch 36 from the pre-shutdown state in which the system-to-system switch 32 is shut down.

[0045] As a result, power is supplied from the first power source 10 to the traveling loads 101 and the non-traveling loads 102 via the first system 110. This allows the automatic driving control device 201 or the driver to operate the traveling loads 101 and the non-traveling loads 102 using the power from the first power source 10 to cause the vehicle to evacuate.

[0046] In this way, when a ground fault occurs in the first system 110, the controller 3 performs FOP using the second power source 20, but the power of the second power source 20 is limited, and there is control that must be performed with the remaining power after the FOP is completed.

[0047] For example, after the end of FOP, the controller 3 needs to perform control to unlock the doors, control to notify an emergency center, and control to notify the occupants that the vehicle is unable to run. The controller 3 performs these controls by activating the non-running load 102. If the remaining capacity of the second power source 20 is insufficient at this time, the controller 3 may not be able to complete the controls that need to be performed after the end of FOP.

[0048] Therefore, as shown in FIG. 4, when the FOP ends, the controller 3 according to the embodiment cuts off the second load switch 34, keeps the fourth load switch 36 in a conductive state, supplies power to the non-driving load 102, and stops supplying power to the driving load 101.

[0049] At this time, the controller 3 determines that the FOP has ended when, for example, it receives information indicating that the FOP has ended from the automatic driving control device 201. Note that the automatic driving control device 201 transmits information indicating that the FOP has ended to the controller 3 when it detects that the vehicle has stopped on a safe shoulder of the road based on an image from an in-vehicle camera or information acquired from a GPS (Global Positioning System).

[0050] As a result, dark current no longer flows to the traveling load 101 after FOP, so the controller 3 can concentrate the surplus power of the second power source 20 on the non-traveling load 102, and can more reliably perform the control that needs to be performed after the end of FOP.

[0051] Since the non-driving loads 102 include a plurality of loads, the controller 3 may supply power only to loads that are likely to be controlled after FOP, such as a door lock control load, a communication load, or a load for in-vehicle notification, rather than supplying power to all of the non-driving loads 102 after FOP. In this case, a third load switch 35 and a fourth load switch 36 are provided for each load, and the load switch of the load that requires power supply is set to a conductive state.

[0052] The controller 3 can also obtain the remaining charge of the second power source 20 via the status monitoring line 140. Therefore, for example, when FOP ends, the controller 3 can increase the priority of the non-driving load 102 over the driving load 101, and supply power to the load with the higher priority according to the remaining charge of the second power source 20.

[0053] As a result, if the remaining power of the second power source 20 is low when the FOP ends, the controller 3 can supply the surplus power of the second power source 20 preferentially to the non-driving loads 102, thereby more reliably performing the control that needs to be performed after the FOP ends. Specific examples of the processing executed by the controller 3 according to the embodiment will be described below.

[0054] 3. Processes executed by the controller The controller 3 repeatedly executes any one of the process examples shown in Figures 5 to 8 from when the vehicle ignition switch is turned on until it is turned off. When the ignition switch is turned on, the controller 3 turns off (hereinafter may be referred to as "off") the battery switch 31. Then, the controller 3 turns on (hereinafter may be referred to as "on") the inter-system switch 32 and the first to fourth load switches 33 to 36, and then starts the process.

[0055] ≪3-1. First processing example≫ 5 is a flowchart showing a first example of processing executed by the controller 3 according to the embodiment. As shown in FIG. 5, the controller 3 first determines whether a power failure has occurred (step S101). The power failure here is, for example, a ground fault in the first system 110 or the second system 120. If the controller 3 determines that a power failure has not occurred (step S101, No), the controller 3 ends the processing.

[0056] Furthermore, when the controller 3 determines that a power supply failure has occurred (step S101, Yes), it turns off (pre-shutdown) the inter-system switch 32 and turns on the battery switch 31 (step S102). Next, the controller 3 makes a final determination of the system in which the ground fault has occurred (step S103). That is, the controller 3 makes a final determination of whether the system in which the ground fault has occurred is the first system 110 or the second system 120, or whether a ground fault has actually occurred.

[0057] When the controller 3 determines that the first system 110 has failed (Yes in step S104), it disconnects the first power source 10 from the power supply path (step S105). Specifically, the controller 3 turns off the first load switch 33 and the third load switch 35 from the pre-shutdown state of the inter-system switch 32, thereby disconnecting the first power source 10 from the power supply path.

[0058] Thereafter, the controller 3 determines whether or not the FOP has ended (step S106). When the controller 3 receives information indicating that the FOP has ended from the automatic driving control device 201, the controller 3 determines that the FOP has ended.

[0059] As mentioned above, when the automatic driving control device 201 detects that the vehicle has stopped on a safe shoulder of the road based on the video from the onboard camera or information obtained from the GPS, it transmits information indicating that the FOP has ended to the controller 3.

[0060] If the controller 3 determines that the FOP has not ended (step S106, No), it repeats the determination of step S106 until the FOP ends. If the controller 3 determines that the FOP has ended (step S106, Yes), it supplies power to the non-driving load 102 and stops the power supply to the driving load 101 (step S107).

[0061] As a result, dark current no longer flows to the traveling load 101 after FOP, so the controller 3 can concentrate the surplus power of the second power source 20 on the non-traveling load 102, and can more reliably perform the control that needs to be performed after the end of FOP.

[0062] Thereafter, the controller 3 determines whether or not a driving start operation by the driver has been detected (step S108). The controller 3 detects the driving start operation by, for example, detecting that the driver has operated the shift lever from neutral to drive or reverse.

[0063] Furthermore, the controller 3 may detect a driving start operation by detecting an operation in which the parking brake is released by the driver, an operation in which the accelerator is depressed, or an operation in which the steering wheel is turned.

[0064] If the controller 3 determines that the driving start operation has not been detected (step S108, No), the controller 3 ends the processing. On the other hand, if the controller 3 determines that the driving start operation has been detected (step S108, Yes), the controller 3 resumes power supply to the driving load 101 (step S109) and ends the processing. In this way, for example, when the driver tries to stop the vehicle in a safer place, the controller 3 can operate the driving load 101 to drive the vehicle.

[0065] Furthermore, if the controller 3 determines that the first system 110 is not malfunctioning (step S104, No), it determines whether the second system 120 is malfunctioning (step S110). If the second system 120 is malfunctioning (step S110, Yes), the controller 3 turns off the battery switch 31 (step S111) and ends the process.

[0066] Furthermore, if there is no failure in the second system 120 (step S110, No), the controller 3 determines that no ground fault has occurred, turns on the inter-system switch 32, turns off the battery switch 31 (step S112), returns to the normal state (see Figure 2), and terminates the processing.

[0067] 3-2. Second processing example Fig. 6 is a flowchart showing a second processing example executed by the controller 3 according to the embodiment. As shown in Fig. 6, the controller 3 first determines whether a power supply failure has occurred (step S201). The power supply failure here is, for example, a ground fault in the first system 110 or the second system 120. If the controller 3 determines that a power supply failure has not occurred (step S201, No), the controller 3 ends the processing.

[0068] Furthermore, when the controller 3 determines that a power supply failure has occurred (Yes at step S201), it turns off (pre-shutdown) the inter-system switch 32 and turns on the battery switch 31 (step S202).

[0069] Next, the controller 3 makes a final determination as to which system has the ground fault (step S203). That is, the controller 3 makes a final determination as to whether the system in which the ground fault has occurred is the first system 110 or the second system 120, or whether no ground fault has actually occurred.

[0070] When the controller 3 determines that the first system 110 has failed (Yes in step S204), it disconnects the first power source 10 from the power supply path (step S205). Specifically, the controller 3 turns off the first load switch 33 and the third load switch 35 from the pre-shutdown state of the inter-system switch 32, thereby disconnecting the first power source 10 from the power supply path.

[0071] Thereafter, the controller 3 sets the priority of the traveling load 101 higher than that of the non-traveling load 102 (step S206). This allows the controller 3 to supply power preferentially to the traveling load 101, thereby enabling the FOP to be completed appropriately. Thereafter, the controller 3 determines whether the remaining power of the second power source 20 is less than a threshold value (step S207).

[0072] If the controller 3 determines that the remaining power of the second power source 20 is not less than the threshold value (No in step S207), that is, if the remaining power of the second power source 20 is equal to or greater than the threshold value, the controller 3 proceeds to step S209.

[0073] Furthermore, when the controller 3 determines that the remaining amount of the second power source 20 is less than the threshold value (Yes in step S207), it stops power supply to the low-priority load (here, the non-driving load 102) (step S208).

[0074] In this way, during FOP, the controller 3 gives higher priority to the traveling loads 101 than to the non-traveling loads 102, and stops the power supply to the non-traveling loads 102, which have a lower priority, as the remaining capacity of the second power source 20 decreases.

[0075] This allows the controller 3 to reduce power consumption by the non-driving loads 102 with low priority during FOP, thereby reducing power consumption by the second power source 20 and more reliably completing FOP.

[0076] Thereafter, the controller 3 determines whether or not the FOP has ended (step S209). When the controller 3 receives information indicating that the FOP has ended from the automatic driving control device 201, the controller 3 determines that the FOP has ended.

[0077] As mentioned above, when the automatic driving control device 201 detects that the vehicle has stopped on a safe shoulder of the road based on the video from the onboard camera or information obtained from the GPS, it transmits information indicating that the FOP has ended to the controller 3.

[0078] If the controller 3 determines that the FOP has not ended (step S209, No), the controller 3 proceeds to step S207. If the controller 3 determines that the FOP has ended (step S209, Yes), the controller 3 supplies power to the non-driving load 102 and stops supplying power to the driving load 101 (step S210).

[0079] As a result, dark current no longer flows to the traveling load 101 after FOP, so the controller 3 can concentrate the surplus power of the second power source 20 on the non-traveling load 102, and can more reliably perform the control that needs to be performed after the end of FOP.

[0080] Thereafter, the controller 3 determines whether or not a driving start operation by the driver has been detected (step S211). The controller 3 detects the driving start operation by, for example, detecting that the driver has operated the shift lever from neutral to drive or reverse.

[0081] Furthermore, the controller 3 may detect a driving start operation by detecting an operation in which the parking brake is released by the driver, an operation in which the accelerator is depressed, or an operation in which the steering wheel is turned.

[0082] When the controller 3 determines that the driving start operation has not been detected (step S211, No), the controller 3 ends the processing. When the controller 3 determines that the driving start operation has been detected (step S211, Yes), the controller 3 resumes power supply to the driving load 101 (step S212) and ends the processing. In this way, for example, when the driver tries to stop the vehicle in a safer place, the controller 3 can operate the driving load 101 to drive the vehicle.

[0083] Furthermore, if the controller 3 determines that the first system 110 is not malfunctioning (step S204, No), it determines whether the second system 120 is malfunctioning (step S213). If the second system 120 is malfunctioning (step S213, Yes), the controller 3 turns off the battery switch 31 (step S214) and ends the process.

[0084] Furthermore, if there is no failure in the second system 120 (step S213, No), the controller 3 determines that no ground fault has occurred, turns on the system switch 32, turns off the battery switch 31 (step S215), returns to the normal state (see Figure 2), and terminates the processing.

[0085] ≪3-3. Third processing example≫ 7 is a flowchart showing a third example of processing executed by the controller 3 according to the embodiment. As shown in FIG. 7, the controller 3 first determines whether a power failure has occurred (step S301). The power failure here is, for example, a ground fault in the first system 110 or the second system 120. If the controller 3 determines that a power failure has not occurred (step S301, No), the controller 3 ends the processing.

[0086] Furthermore, when the controller 3 determines that a power supply failure has occurred (step S301, Yes), it turns off (pre-shutdown) the inter-system switch 32 and turns on the battery switch 31 (step S302). Next, the controller 3 makes a final determination of the system in which the ground fault has occurred (step S303). That is, the controller 3 makes a final determination of whether the system in which the ground fault has occurred is the first system 110 or the second system 120, or whether a ground fault has actually occurred.

[0087] When the controller 3 determines that the first system 110 has failed (Yes in step S304), it disconnects the first power source 10 from the power supply path (step S305). Specifically, the controller 3 turns off the first load switch 33 and the third load switch 35 from the pre-shutdown state of the inter-system switch 32, thereby disconnecting the first power source 10 from the power supply path.

[0088] Thereafter, the controller 3 determines whether or not the FOP has ended (step S306). When the controller 3 receives information indicating that the FOP has ended from the automatic driving control device 201, the controller 3 determines that the FOP has ended.

[0089] As mentioned above, when the automatic driving control device 201 detects that the vehicle has stopped on a safe shoulder of the road based on the video from the onboard camera or information obtained from the GPS, it transmits information indicating that the FOP has ended to the controller 3.

[0090] If the controller 3 determines that the FOP has not ended (step S306, No), it repeats the process of step S306 until the FOP ends. If the controller 3 determines that the FOP has ended (step S306, Yes), it sets the priority of the non-driving load 102 higher than that of the driving load 101 (step S307), and determines whether the remaining power of the second power source 20 is less than a threshold value (step S308).

[0091] If the controller 3 determines that the remaining power of the second power source 20 is not less than the threshold value (No at step S308), that is, if the remaining power of the second power source 20 is equal to or greater than the threshold value, the controller 3 proceeds to step S310.

[0092] Furthermore, when the controller 3 determines that the remaining amount of the second power source 20 is less than the threshold value (Yes in step S308), it supplies power to a load with a high priority (here, the non-driving load 102) (step S309).

[0093] In this way, when the FOP ends, the controller 3 increases the priority of the non-driving load 102 above the priority of the driving load 101, and supplies power to the non-driving load 102 with the higher priority according to the remaining capacity of the second power source 20.

[0094] As a result, when the capacity of the second power source 20 is low at the end of FOP, the controller 3 can supply surplus power from the second power source 20 preferentially to the non-driving load 102, and can more reliably perform the control that needs to be performed after the end of FOP.

[0095] For example, after the FOP ends, the controller 3 can reliably perform control to unlock the doors, control to notify the emergency center, and control to notify the occupants that the vehicle has become unable to run.

[0096] Thereafter, the controller 3 determines whether or not a driving start operation by the driver has been detected (step S310). The controller 3 detects the driving start operation by, for example, detecting that the driver has operated the shift lever from neutral to drive or reverse.

[0097] Furthermore, the controller 3 may detect a driving start operation by detecting an operation in which the parking brake is released by the driver, an operation in which the accelerator is depressed, or an operation in which the steering wheel is turned.

[0098] When the controller 3 determines that the driving start operation has not been detected (step S310, No), the controller 3 ends the processing. When the controller 3 determines that the driving start operation has been detected (step S310, Yes), the controller 3 resumes power supply to the driving load 101 (step S311) and ends the processing. In this way, for example, when the driver tries to stop the vehicle in a safer place, the controller 3 can operate the driving load 101 to drive the vehicle.

[0099] Furthermore, if the controller 3 determines that the first system 110 is not malfunctioning (step S304, No), it determines whether the second system 120 is malfunctioning (step S312). If the second system 120 is malfunctioning (step S312, Yes), the controller 3 turns off the battery switch 31 (step S313) and ends the process.

[0100] Furthermore, if there is no failure in the second system 120 (step S312, No), the controller 3 determines that no ground fault has occurred, turns on the system switch 32, turns off the battery switch 31 (step S314), returns to the normal state (see Figure 2), and terminates the processing.

[0101] 3-4. Fourth Processing Example Fig. 8 is a flowchart showing a fourth example of processing executed by the controller 3 according to the embodiment. As shown in Fig. 8, the controller 3 first determines whether a power failure has occurred (step S401). The power failure here is, for example, a ground fault in the first system 110 or the second system 120. If the controller 3 determines that a power failure has not occurred (step S401, No), it ends the processing.

[0102] Furthermore, when the controller 3 determines that a power supply failure has occurred (step S401, Yes), it turns off (pre-shutdown) the inter-system switch 32 and turns on the battery switch 31 (step S402). Next, the controller 3 makes a final determination of the system in which the ground fault has occurred (step S403). That is, the controller 3 makes a final determination of whether the system in which the ground fault has occurred is the first system 110 or the second system 120, or whether a ground fault has actually occurred.

[0103] When the controller 3 determines that the first system 110 has failed (Yes in step S404), it disconnects the first power source 10 from the power supply path (step S405). Specifically, the controller 3 turns off the first load switch 33 and the third load switch 35 from the pre-shutdown state of the inter-system switch 32, thereby disconnecting the first power source 10 from the power supply path.

[0104] Thereafter, the controller 3 sets the priority of the traveling load 101 higher than that of the non-traveling load 102 (step S406), and supplies power to the load with the higher priority (here, the traveling load 101) (step S407). This allows the controller 3 to more reliably complete the FOP while suppressing power consumption of the second power source 20.

[0105] Thereafter, the controller 3 determines whether or not the FOP has ended (step S408). When the controller 3 receives information indicating that the FOP has ended from the automatic driving control device 201, the controller 3 determines that the FOP has ended.

[0106] As mentioned above, when the automatic driving control device 201 detects that the vehicle has stopped on a safe shoulder of the road based on the video from the onboard camera or information obtained from the GPS, it transmits information indicating that the FOP has ended to the controller 3.

[0107] If the controller 3 determines that the FOP has not ended (step S408, No), it repeats the process of step S408 until the FOP ends. If the controller 3 determines that the FOP has ended (step S408, Yes), it sets the priority of the non-driving load 102 higher than that of the driving load 101 (step S409), and determines whether the remaining power of the second power source 20 is less than a threshold value (step S410).

[0108] If the controller 3 determines that the remaining power of the second power source 20 is not less than the threshold value (No at step S410), that is, if the remaining power of the second power source 20 is equal to or greater than the threshold value, the controller 3 proceeds to step S412.

[0109] Furthermore, when the controller 3 determines that the remaining amount of the second power source 20 is less than the threshold value (Yes in step S410), it supplies power to a load with a high priority (here, the non-driving load 102) (step S411).

[0110] In this way, the controller 3 changes the priority of the loads during and after the FOP is completed, and supplies power to the loads with higher priority according to the remaining capacity of the second power source 20. This allows the controller 3 to more reliably complete the FOP, and more reliably perform necessary control after the FOP is completed.

[0111] Furthermore, during FOP, the controller 3 sets the priority of the traveling load 101 higher than the priority of the non-traveling load 102. This allows the controller 3 to reliably drive the vehicle to the evacuation location using FOP.

[0112] Thereafter, the controller 3 determines whether or not a driving start operation by the driver has been detected (step S412). The controller 3 detects the driving start operation by, for example, detecting that the driver has operated the shift lever from neutral to drive or reverse.

[0113] Furthermore, the controller 3 may detect a driving start operation by detecting an operation in which the parking brake is released by the driver, an operation in which the accelerator is depressed, or an operation in which the steering wheel is turned.

[0114] If the controller 3 determines that the driving start operation has not been detected (step S412, No), the controller 3 ends the processing. On the other hand, if the controller 3 determines that the driving start operation has been detected (step S412, Yes), the controller 3 resumes power supply to the driving load 101 (step S413) and ends the processing. In this way, for example, when the driver tries to stop the vehicle in a safer place, the controller 3 can operate the driving load 101 to drive the vehicle.

[0115] Furthermore, if the controller 3 determines that the first system 110 is not malfunctioning (step S404, No), it determines whether the second system 120 is malfunctioning (step S414). If the second system 120 is malfunctioning (step S414, Yes), the controller 3 turns off the battery switch 31 (step S415) and ends the process.

[0116] Furthermore, if there is no failure in the second system 120 (step S414, No), the controller 3 determines that no ground fault has occurred, turns on the system switch 32, turns off the battery switch 31 (step S416), restores the normal state (see Figure 2), and terminates the processing.

[0117] In the above embodiment, the case where the power supply control device 1 includes the system switch 32 has been described, but the power supply control device 1 may be configured not to include the system switch 32. In this case, the second power supply 20 is provided outside the power supply control device 1. The power supply control device 1 is also provided with a battery switch that can connect and disconnect the first power supply 10 and the first system 110.

[0118] When a ground fault occurs, the controller 3 controls all the switches to turn off only one switch from a state in which all the switches are on. Then, when the first system voltage V1 or the second system voltage V2 recovers to a normal voltage after turning off a switch, the controller 3 identifies the location where that switch is installed as the ground fault location, and maintains the switch at the ground fault location in the off state to perform FOP.

[0119] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0120] 1 Power supply control device 3 Controller 10 1st power supply 12 High-voltage battery 20 2nd power supply 31 Battery switch 32 Intersystem switch 33 First load switch 34 Second load switch 35 Third load switch 36 4th load switch 51 First voltage sensor 52 Second voltage sensor 101 Running load 102 Non-driving load 110 1st system 120 2nd system 130 Intersystem Line 140 Condition Monitoring Line 201 Automatic driving control device 202 Operating device 11 DCC

Claims

1. A power supply control device that supplies power to a load of a driving system related to vehicle driving and a load other than the driving system via a power supply path from a first power supply and a second power supply, When a failure of the first power supply is detected, a fail-safe control is performed in which the first power supply is disconnected from the power supply path and power is supplied to the load from the second power supply; When the fail-safe control is completed, a controller supplies power to a load other than the traveling system and stops the power supply to the traveling system load. A power supply control device comprising:

2. The controller During the fail-safe control, the priority of the load of the traveling system is set higher than that of the load other than the traveling system, and power supply to the load of lower priority is stopped as the remaining amount of the second power source decreases. The power supply control device according to claim 1 .

3. The controller After the fail-safe control is completed, when an operation by the driver to start driving the vehicle is detected, the power supply to the load of the driving system is resumed. The power supply control device according to claim 1 .

4. A power supply control device that supplies power to a load of a driving system related to vehicle driving and a load other than the driving system via a power supply path from a first power supply and a second power supply, When a failure of the first power supply is detected, a fail-safe control is performed in which the first power supply is disconnected from the power supply path and power is supplied to the load from the second power supply; When the fail-safe control is completed, the controller sets the priority of the loads other than the traveling system higher than the priority of the traveling system load, and supplies power to the loads with higher priority according to the remaining amount of the second power source. A power supply control device comprising:

5. The controller The priority of the load is changed during the fail-safe control and after the fail-safe control is completed, and power is supplied to the load with a higher priority according to the remaining capacity of the second power source. The power supply control device according to claim 4 .

6. The controller During the fail-safe control, the priority of the load of the traveling system is made higher than the priority of the load other than the traveling system. The power supply control device according to claim 5 .

7. The controller After the fail-safe control is completed, when an operation by the driver to start driving the vehicle is detected, the power supply to the load of the driving system is resumed. The power supply control device according to claim 4 .

8. a controller of a power supply control device that supplies power from a first power supply and a second power supply via a power supply path to a load of a driving system related to vehicle driving and a load other than the driving system; a step of performing fail-safe control in which, when a failure of the first power supply is detected, the first power supply is disconnected from the power supply path and power is supplied to the load from the second power supply; When the fail-safe control is completed, power is supplied to a load other than the traveling system, and power supply to the traveling system load is stopped. A power control program that runs the

9. a controller of a power supply control device that supplies power from a first power supply and a second power supply via a power supply path to a load of a driving system related to vehicle driving and a load other than the driving system; a step of performing fail-safe control in which, when a failure of the first power supply is detected, the first power supply is disconnected from the power supply path and power is supplied to the load from the second power supply; when the fail-safe control is completed, a priority of the loads other than the traveling system is made higher than a priority of the loads of the traveling system, and power is supplied to the loads having a higher priority according to a remaining amount of the second power source; A power control program that runs the

Images