Power supply monitoring device and control system

Abstract

To provide a power supply monitor device and a control system that can prevent the driving of a vehicle from being affected in a case of occurrence of ground fault abnormality.SOLUTION: In a control system 100 that comprises a first control device 41 and a second control device 42 capable of controlling an electric load 32, and supplies electric power from a first power supply 10 to the first control device through a first line LA1 and electric power from a second power supply 16 to the second control device through a second line LA2, a power supply monitor device 20 comprises: a connection line LB which connects the first line and second line; an inter-line switch SW; a current limiting element 23 which allows electrification from a first line side to a second line side in a current-limited state and also blocks electrification from the second line side to the first line side; a monitor part 21 which monitors a voltage drop on the first line with the inter-line switch closed; and a switch operation part 22 which releases the inter-line switch when it is determined that a voltage drop is caused during drive supporting.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a power supply monitoring device and a control system. [Background technology]

[0002] In recent years, there has been known a power supply system that is applied to, for example, a vehicle and supplies power to various devices of the vehicle. In addition, there has been known a power supply system that has a first power supply and a second power supply as power supplies for supplying power to an electrical load, such as an electric brake device or an electric steering device, so as to prevent the loss of function even if an abnormality occurs in the electrical load that performs a function necessary for driving the vehicle while the vehicle is being driven.

[0003] For example, Patent Document 1 discloses a power supply system having a first system including a first load connected to a first power source, and a second system including a second load connected to a second power source. In this system, an inter-system switch is provided in a connection path connecting the systems, and when a short circuit occurs in one system and a short-circuit current flows through the connection path, the inter-system switch is opened by a control device. This ensures the functions necessary for driving the vehicle by the load of the other system where no short circuit occurs. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-62727 A Summary of the Invention [Problem to be solved by the invention]

[0005] Also, a configuration can be considered in which the control devices are provided in each of the first and second systems to provide redundancy to the control devices. In this case, by providing a control device for each system, even if the stored power of one of the power sources drops, power supply failure in each control device is suppressed. However, for example, if a ground fault occurs in either system, a large current flows through the power sources in both systems. In this case, if a voltage drop occurs in the first and second systems between the time the ground fault occurs and the time the inter-system switch is opened, there is a concern that this may cause problems in controlling each load in the vehicle.

[0006] The present invention has been made to solve the above-mentioned problems, and its object is to provide a power supply monitoring device and control system that can suppress the impact on vehicle operation when a ground fault anomaly occurs. [Means for solving the problem]

[0007] A first means for solving the above problem is applied to a control system that includes a first control device and a second control device capable of controlling an electric load, and supplies power from a first power source via a first path to the first control device, while supplying power from a second power source via a second path to the second control device, and includes a connection path that connects the first path and the second path, an inter-path switch provided in the connection path, a current limiting element that is provided in series with the inter-path switch in the connection path, and allows current to flow from the first path side to the second path side in a current-limited state and blocks current to flow from the second path side to the first path side, a monitoring unit that monitors a voltage drop in the first path with the inter-path switch closed, and a switch operating unit that opens the inter-path switch when the monitoring unit determines that a voltage drop has occurred in the first path.

[0008] In a control system including a first control device and a second control device, in which power is supplied from the first power source to the first control device via a first path while power is supplied from the second power source to the second control device via a second path, redundancy can be provided as a control function for an electric load, and redundancy of a power supply system can be provided while using the first power source as a main power source, for example. In addition, since an inter-path switch and a current limiting element are provided in series in a connection path connecting the first path and the second path, power can be supplied from the first power source to the second power source and the second control device.

[0009] In addition, in a configuration in which a first path on the first power source side and a second path on the second power source side are connected by a connection path, if a ground fault occurs in the second path, a voltage drop will occur in the second path as well as in the first path, and there is a concern that the voltage drops in the first and second paths may cause problems in controlling the electrical load.

[0010] In this regard, the monitoring unit monitors a voltage drop in the first path while the inter-path switch is closed, and the switch operation unit opens the inter-path switch when the monitoring unit determines that a voltage drop has occurred in the first path. In this case, even if a voltage drop occurs in the second path due to a ground fault in the second path, the current limiting element prevents a large current from flowing through the inter-path switch from the time the ground fault occurs in the second path until the inter-path switch is opened, thereby suppressing a voltage drop in the first path. Therefore, the inter-path switch can be opened before a power supply failure occurs on the first power supply side due to a voltage drop in the first path, and thus it is possible to suppress a problem in controlling the electric load.

[0011] On the other hand, if a ground fault occurs in the first path, a voltage drop occurs in the first path, but the voltage drop in the second path is suppressed by the current limiting element, which also makes it possible to suppress any disruption to the control of the electrical load.

[0012] The second means has, as the current limiting element, a diode provided such that the direction from the first path side to the second path side is the forward direction.

[0013] In the above configuration, a diode as a current suppression element is provided in the connection path such that the forward direction is from the first path to the second path. In this case, the current limiting function of the diode allows current to flow from the first path to the second path in a current-limited state, and the rectifying function of the diode prevents current from flowing from the second path to the first path. This makes it possible to prevent a disruption in the control of the electric load even if a ground fault occurs in either the first path or the second path.

[0014] A third means includes a pair of semiconductor switches that are arranged in series in the connection path and have parasitic diodes oriented in opposite directions, one of the pair of semiconductor switches being the inter-path switch, and the parasitic diode of the other semiconductor switch being the current limiting element.

[0015] In a configuration in which a pair of semiconductor switches are connected back to back or nose to nose in the connection path, one of the pair of semiconductor switches functions as an inter-path switch, and a parasitic diode of the other semiconductor switch functions as a current limiting element. This makes it possible to suppress a disruption in control of the electric load even if a ground fault occurs in either the first path or the second path. Even if one semiconductor switch is opened due to a voltage drop in the first path when one semiconductor switch is closed and the other semiconductor switch is opened, power can be supplied from the second power source to the first control device by closing at least the other semiconductor switch thereafter.

[0016] A fourth means is a control system having the above-mentioned power supply monitoring device, the first control device, the second control device, and the first path and the second path, wherein the first control device performs a first control process to calculate a control command value, and the electrical load is controlled by the control command value calculated by the first control process, while the second control device performs a second control process to calculate a control command value in parallel with the first control process, and when an abnormality occurs in the first control device, the electrical load is controlled by the control command value calculated by the second control device.

[0017] In the control of the electric load, the first control device performs a first control process to calculate a control command value, and the electric load is controlled by the control command value calculated by the first control process, while in parallel with this, the second control device performs a second control process to calculate a control command value. As a result, even if the operation of the first control device stops due to a voltage drop on the first power supply side, it is possible to immediately shift to control by the second control device. In other words, the first control device and the second control device perform control processes in parallel with each other, and when the first control device loses power, it is possible to immediately control the electric load using the control command value calculated by the second control device without waiting for the completion of the initial process for startup by the second control device. As a result, it is possible to preferably suppress the occurrence of a problem in the control of the electric load due to a voltage drop in the first path and the second path.

[0018] In a fifth means, the second control process performed by the second control device and the first control process performed by the first control device differ in at least one of the calculation process and the calculation cycle, and the processing load of the second control process is smaller than the processing load of the first control process.

[0019] In a configuration in which the electric load is controlled using the control command value calculated in the first control process when no abnormality occurs in the first control device, the second control process does not need to be performed in the same calculation process or calculation cycle as the first control process. In the above configuration, the second control process and the first control process differ from each other in at least one of the calculation process and the calculation cycle, and the processing load of the second control process is made smaller than the processing load of the first control process. This makes it possible to simplify the control process in the second control device when the control of the second control device is performed in parallel in addition to the control of the first control device.

[0020] In a sixth means, the electrical load includes a plurality of first path side loads connected to the first path, the first path has branch paths each connected to the plurality of first path side loads, and each branch path is provided with a fuse, and the second control device includes a determination unit which determines that voltage recovery from a voltage drop in the first path has occurred, and a switch control unit which returns the inter-path switch to a closed state when it is determined that the voltage recovery has occurred.

[0021] In a configuration in which a branch path is provided for each of a plurality of first-path loads in the first path and a fuse is provided for each of the branch paths, an excessive current flows in any of the first-path loads in the first path due to a ground fault, and the input / output of power to the first-path load is cut off. Then, as the voltage of the first power source starts to rise with the fuse being cut off, the inter-path switch is returned to the closed state. This allows proper switching from the second power source to the first power source after the voltage of the first power source is restored. [Brief description of the drawings]

[0022] [Figure 1] FIG. 1 is an overall configuration diagram of a control system according to a first embodiment. [Diagram 2] 11 is a flowchart showing the procedure of a first process. [Diagram 3] 10 is a flowchart showing the procedure of a second process. [Figure 4]13 is a time chart showing what happens when a ground fault occurs in the second system during driving assistance. [Diagram 5] 13 is a time chart showing what happens when a ground fault occurs in the first system during driving assistance. [Figure 6] FIG. 11 is an overall configuration diagram of a control system according to a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] (First embodiment) Hereinafter, an embodiment in which a power supply monitoring device according to the present invention is applied to an in-vehicle control system 100 will be described with reference to the drawings. The control system 100 is a system that controls the operation of a vehicle.

[0024] 1, the control system 100 has two power supply systems, and one of the power supply systems, a first system ES1, is provided with a power supply device 10 as a first power source, and the other power supply system, a second system ES2, is provided with a storage battery 16 as a second power source.

[0025] The power supply device 10 and the storage battery 16 are power sources that supply power to the general load 30 and the specific load 32. The power supply device 10 includes a high-voltage storage battery 11, a DCDC converter (hereinafter simply referred to as a converter) 12, and a storage battery 13. Hereinafter, the storage battery 13 is referred to as a first storage battery 13, and the storage battery 16 is referred to as a second storage battery 16. The high-voltage storage battery 11 is a storage battery capable of outputting a voltage (e.g., several hundred V) higher than the rated voltage (e.g., 12 V) of the first storage battery 13 and the second storage battery 16, and is, for example, a lithium-ion storage battery. The converter 12 is a voltage generating unit that steps down the power supplied from the high-voltage storage battery 11 and supplies it to the general load 30 and the specific load 32. The first storage battery 13 is, for example, a lead storage battery. The second storage battery 16 is, for example, a power storage device constituted by a lithium-ion storage battery.

[0026] The general load 30 is an electric load (hereinafter simply referred to as a load) that is not used in driving the vehicle, such as an air conditioner, an audio device, a power window, and the like.

[0027] On the other hand, the specific load 32 is a load that performs at least one function used in driving the vehicle, such as an electric power steering device 50 that steers the vehicle, an electric braking device 51 that applies braking force to the wheels, a driving monitoring device 52 that monitors the conditions around the vehicle, etc.

[0028] The specific load 32 is configured with redundancy for each function, and by having the first load 34 and the second load 36, all of the functions are not lost even if an abnormality occurs in one of the loads 34, 36. Specifically, the electric power steering device 50 has a first steering motor 50A and a second steering motor 50B. The electric brake device 51 has a first brake device 51A and a second brake device 51B. The travel monitoring device 52 has a camera 52A and a laser radar 52B. The first steering motor 50A, the first brake device 51A, and the camera 52A correspond to the first load 34, and the second steering motor 50B, the second brake device 51B, and the laser radar 52B correspond to the second load 36. In this embodiment, a driving assistance device 38 that assists driving of a vehicle is configured by the multiple loads included in the specific load 32. In this embodiment, the first load 34 corresponds to the "first path side load".

[0029] The first load 34 and the second load 36 are provided redundantly for each function, and the first load 34 and the second load 36 cooperate to realize each function, but each load can also realize part of each function independently. For example, in the electric power steering device 50, the first steering motor 50A and the second steering motor 50B enable free steering of the vehicle, and the vehicle can be steered by each of the steering motors 50A and 50B while there are certain limitations on the steering speed, steering range, etc.

[0030] The ECU 40 can implement driving assistance controls such as ACC (Adaptive Cruise Control) and PCS (Pre-Crash Safety) using the above-mentioned specific load 32. The driving assistance controls include burden reduction control, such as ACC, which reduces the operational burden on the driver, and safety control, such as PCS, which avoids a collision between the vehicle and an object present around the vehicle or reduces collision damage.

[0031] The ECU 40 can switch the vehicle's driving mode between an assistance mode that uses driving assistance control and a normal mode that does not use driving assistance control, and the vehicle can run in each driving mode. The ECU 40 switches between the assistance mode and the normal mode in response to a switching command from the driver. The assistance mode is, for example, a driving mode used when the vehicle is automatically driven, and the normal mode is, for example, a driving mode used when the vehicle is manually driven.

[0032] The ECU 40 is connected to an alarm unit 44, an IG switch 45, and an input unit 46. The alarm unit 44 is a device that visually or audibly notifies the driver, and is, for example, a display or a speaker installed in the vehicle cabin. The IG switch 45 is a start switch for the vehicle. The ECU 40 monitors the open / closed state of the IG switch 45. The input unit 46 is a device that accepts operations by the driver, and is, for example, a steering wheel operation input device, a shift lever operation input device, an accelerator pedal operation input device, a brake pedal operation input device, and a voice input device.

[0033] The ECU 40 includes a first control device 41 and a second control device 42 as control devices that perform driving assistance control using the specific load 32. Each of the control devices 41, 42 includes a well-known microcomputer including a CPU, a ROM, a RAM, a flash memory, etc., and the CPU realizes various functions by referring to the calculation program in the ROM. In other words, the ECU 40 is configured to provide redundancy in the control of the specific load 32, and by including the first control device 41 and the second control device 42, the entire control of the specific load 32 is not lost even if an abnormality occurs in one of the control devices 41, 42.

[0034] Specifically, during driving assistance, the first control device 41 performs a first control process to calculate a control command value in driving assistance control, and controls the specific load 32 using the control command value calculated by the first control process. The second control device 42 performs a second control process to calculate a control command value in driving assistance control in parallel with the first control process. That is, the first control device 41 and the second control device 42 perform the control processes of driving assistance in parallel with each other. Note that in this embodiment, in a normal state in which no ground fault occurs in either the first system ES1 or the second system ES2, the specific load 32 is controlled only by the control command value calculated by the first control process, and the control command value calculated by the second control process is not used to control the specific load 32.

[0035] The first control device 41 and the second control device 42 are each capable of independently realizing driving assistance control. For example, the first control device 41 can independently implement a load reduction function and a safety function using the first load 34, and the second control device 42 can independently implement a safety function using the second load 36. In this embodiment, the second control device 42 cannot independently implement a load reduction function. That is, the second control process implemented by the second control device 42 and the first control process implemented by the first control device 41 are different in arithmetic processing, and the processing load of the second control process is smaller than the processing load of the first control process.

[0036] The first control device 41 and the second control device 42 are configured to be able to communicate with each other, and have a function of monitoring each other for abnormalities. The first control device 41 monitors abnormalities in the second control device 42, and when it is unable to communicate with the second control device 42, it determines that an abnormality has occurred in the second control device 42. The second control device 42 monitors abnormalities in the first control device 41, and when it is unable to communicate with the first control device 41, it determines that an abnormality has occurred in the first control device 41.

[0037] In the first system ES1, the power supply device 10 is connected to a general load 30, a first load 34, and a first control device 41 via a first intra-system path LA1 as a first path. In this embodiment, the first system ES1 is configured by the power supply device 10, the general load 30, the first load 34, and the first control device 41 connected by the first intra-system path LA1.

[0038] In the second system ES2, the second storage battery 16 is connected to the second load 36 and the second control device 42 via a second intra-system path LA2 as a second path. In this embodiment, the second system ES2 is configured by the second storage battery 16, the second load 36, and the second control device 42 connected by the second intra-system path LA2.

[0039] The intra-system paths LA1, LA2 are connected to each other by a connection path LB, and an inter-path switch SW is provided on the connection path LB. One end of the connection path LB is connected to a connection point PA of the first intra-system path LA1, and the other end of the connection path LB is connected to a connection point PB of the second intra-system path LA2. In this embodiment, an N-channel MOSFET (hereinafter simply referred to as MOSFET) is used as the inter-path switch SW.

[0040] A voltage sensor 28 that detects the voltage at the connection point PA is provided on the connection path LB. A current sensor 29 that detects the current flowing through the inter-path switch SW is also provided on the connection path LB.

[0041] The first intra-system path LA1 is connected to a plurality of loads included in the first load 34, the general load 30, the first control device 41, and the converter 12 included in the power supply device 10 via branch paths LC, and a fuse FA is provided in each branch path LC. The fuse FA melts when an excessive current flows, and cuts off the input / output of power to the corresponding load, etc. Note that the fuse FA is not limited to a melting fuse, and may be, for example, a semiconductor fuse that cuts off current when an overcurrent is detected, or a chemical fuse.

[0042] The control system 100 has a monitoring unit 21 and a switch operation unit 22. The monitoring unit 21 is connected to a voltage sensor 28, and is a hardware circuit having a built-in voltage determination circuit that determines whether a voltage value detected by the voltage sensor 28 has dropped below a predetermined threshold voltage Vth. The switch operation unit 22 is connected to the monitoring unit 21 and the inter-path switch SW, and is a hardware circuit having a built-in voltage adjustment circuit that adjusts a voltage input to a gate terminal of the inter-path switch SW based on a determination result of the monitoring unit 21. The switch operation unit 22 adjusts the voltage input to the gate terminal of the inter-path switch SW, thereby switching the open / closed state of the inter-path switch SW.

[0043] For example, the monitoring unit 21 monitors a voltage drop in the first-system path LA1 while the inter-path switch SW is closed by the ECU 40. When the monitoring unit 21 determines that a voltage drop has occurred in the first-system path LA1, the switch operation unit 22 opens the inter-path switch SW to electrically insulate the first system ES1 from the second system ES2. This prevents a voltage drop in the first-system path LA1 due to a voltage drop in the second-system path LA2.

[0044] However, when a ground fault occurs in the second intra-system path LA2, a large current flows through the inter-path switch SW from the time the ground fault occurs until the inter-path switch SW is opened. If this large current causes a voltage drop in the first intra-system path LA1 as well, there is a concern that a power failure in the first intra-system path LA1 and the second intra-system path LA2 may cause a disruption to the control of the specific load 32, including the driving assistance control.

[0045] In this embodiment, a diode 23 is provided as a current limiting element in series with the inter-path switch SW in the connection path LB. The diode 23 is provided such that the forward direction is from the first-system path LA1 side toward the second-system path LA2 side.

[0046] In this case, even if a voltage drop occurs in the second-system path LA2 due to a ground fault in the second-system path LA2, the current flow from the first-system path LA1 side to the second-system path LA2 side is limited by the diode 23. Therefore, the voltage drop in the first-system path LA1 is suppressed, and the inter-path switch SW is opened before a power failure occurs in the first-system path LA1, thereby suppressing the occurrence of a disruption in the control of the specific load 32.

[0047] On the other hand, when a ground fault occurs in the first system path LA1, even if a voltage drop occurs in the first system path LA1, the diode 23 blocks current flow from the second system path LA2 side to the first system path LA1 side, and the voltage drop in the second system path LA2 is suppressed. This also makes it possible to suppress the occurrence of a problem in the control of the specific load 32. In this embodiment, the power supply monitoring device 20 is configured by the connection path LB, the inter-path switch SW, the diode 23, the monitoring unit 21, and the switch operation unit 22 provided between the first system ES1 and the second system ES2.

[0048] 2 shows a flowchart of the first process performed by the first control device 41. When the IG switch 45 is closed, the first control device 41 repeatedly performs the first process at a predetermined cycle.

[0049] When the first process starts, first, in step S10, it is determined whether the vehicle's driving mode is an assistance mode that uses driving assistance control. If the driving mode is a normal mode that does not use driving assistance control, the process proceeds to step S11. If the driving mode is an assistance mode, the process proceeds to step S21.

[0050] In step S11, it is determined whether or not a precondition for implementing the support mode is satisfied. The precondition for implementing the support mode is, for example, that the remaining capacity SA of the second storage battery 16 is greater than a predetermined capacity threshold Sth. Here, the remaining capacity SA is, for example, a State Of Charge (SOC) indicating the charge state of the second storage battery 16, and the capacity threshold Sth is a capacity at which the voltage of the second storage battery 16 is higher than the lower limit operating voltage VL by a predetermined value or more.

[0051] If the preconditions for implementing the assistance mode are not met and switching to the assistance mode is not possible, this process is temporarily terminated. If the preconditions for implementing the assistance mode are met and an instruction to switch to the assistance mode is input from the driver via the input unit 46, in step S12, the vehicle driving mode is switched from the normal mode to the assistance mode, and this process is temporarily terminated.

[0052] In step S21, it is determined whether or not the abnormality flag Fg is "1". Here, the abnormality flag Fg is set to "0" when no abnormality occurs in the second control device 42, and is set to "1" when an abnormality occurs in the second control device 42. If the abnormality flag Fg is "0", proceed to step S22. If the abnormality flag Fg is "1", proceed to step S27.

[0053] In step S22, it is determined whether or not an abnormality has occurred in the second control device 42. The first control device 41 determines whether or not an abnormality has occurred in the second control device 42, for example, based on whether or not it can communicate with the second control device 42. If no abnormality has occurred in the second control device 42, it is determined that both the first and second loads 34, 36 are in a usable state. In this case, in step S23, the first control process is performed, and the first and second loads 34, 36 are controlled by the control command value calculated by the first control process, and this process is temporarily terminated.

[0054] On the other hand, if an abnormality occurs in the second control device 42, it is determined that the second load 36 is in an unusable state. In this case, in step S24, the first control process is performed, and the first load 34 is controlled by the control command value calculated by the first control process. That is, in the assistance mode, the driving assistance control is switched from the driving assistance control using the first and second loads 34, 36 to the driving assistance control using only the first load 34.

[0055] In step S25, the abnormality flag Fg is switched to 1. In the following step S26, the driver is notified via the notification unit 44 that the driving assist control will be stopped, and this process is temporarily terminated.

[0056] In step S27, it is determined whether or not a command to switch to the normal mode has been input from the driver via the input unit 46. That is, it is determined whether or not there has been a response from the driver in response to the notification. If a command to switch has not been input from the driver, this process is temporarily terminated. On the other hand, if a command to switch has been input from the driver, in step S28, the vehicle's driving mode is switched from the assistance mode to the normal mode, and this process is temporarily terminated.

[0057] 3 shows a flowchart of the second process performed by the second control device 42. When the IG switch 45 is closed, the second control device 42 repeatedly performs the second process at a predetermined cycle. The predetermined cycle of the second process may be the same as or different from the predetermined cycle of the first process. In this embodiment, the first cycle and the second cycle correspond to a "calculation cycle."

[0058] When the second process starts, first in step S31, it is determined whether or not the abnormality flag Fh is "1". Here, the abnormality flag Fg is set to "0" when no abnormality occurs in the first control device 41, and is set to "1" when an abnormality occurs in the first control device 41. If the abnormality flag Fg is "0", the process proceeds to step S32. If the abnormality flag Fg is "1", the process proceeds to step S41.

[0059] In step S32, the second control process is performed. In the following step S33, it is determined whether or not an abnormality occurs in the first control device 41. If no abnormality occurs in the first control device 41, it is determined that both the first and second loads 34, 36 are in a usable state. In this case, this process is temporarily terminated without controlling the first and second loads 34, 36 by the control command value calculated by the second control process.

[0060] On the other hand, if an abnormality occurs in the first control device 41, it is determined that the first load 34 is in an unusable state. In this case, in step S34, the second load 36 is controlled by the control command value calculated by the second control process. That is, in the assistance mode, the driving assistance control using the first and second loads 34, 36 by the first control device 41 is switched to the driving assistance control using only the second load 36 by the second control device 42. Since the second control device 42 cannot perform load reduction control such as ACC, if the load reduction control is being performed when it is determined that an abnormality occurs in the first control device 41, the load reduction control is stopped.

[0061] In step S35, the abnormality flag Fh is switched to 1. In the following step S36, the driver is notified via the notification unit 44 that the driving assist control will be stopped, and this process is temporarily terminated.

[0062] In step S41, it is determined whether or not a command to switch to the normal mode has been input from the driver via the input unit 46. If a command to switch has been input from the driver, in step S42, the vehicle driving mode is switched from the assistance mode to the normal mode, and this process is temporarily terminated.

[0063] On the other hand, if a switching instruction is not input from the driver, in step S43, it is determined by using the voltage sensor 28 whether or not a voltage recovery from a voltage drop has occurred in the first-system path LA1. In the first system ES1, if a ground fault occurs in at least one of the multiple loads included in the first load 34 and the general load 30, a voltage drop occurs in the first-system path LA1. After that, when an overcurrent flows from the power supply device 10 to the load in which the ground fault has occurred, the fuse FA corresponding to the load melts, and the first voltage V1 rises above the threshold voltage Vth, and the voltage recovery occurs in the first-system path LA1.

[0064] If the voltage recovery occurs in the first system path LA1, in step S44, the inter-path switch SW is returned to the closed state. In the following step S45, the driver is notified of the voltage recovery via the notification unit 44, and this process is temporarily terminated. In this embodiment, the process of step S43 corresponds to the "determination unit", and the process of step S44 corresponds to the "switch control unit".

[0065] Furthermore, in the first-system path LA1, if a ground fault occurs in the converter 12 included in the power supply device 10, voltage recovery does not occur in the first-system path LA1. If voltage recovery does not occur in the first-system path LA1, in step S46, it is determined whether or not a determination period has elapsed since communication with the first control device 41 became impossible. Here, the determination period is set to a period that is a predetermined period shorter than the period during which the vehicle can run in the support mode using only the second storage battery 16.

[0066] If the determination period has elapsed, the process proceeds to step S42. That is, even if there is no response from the driver in response to the notification, the vehicle's driving mode is switched from the assistance mode to the normal mode. In this case, the second control device 42 moves the vehicle to a safe location in the assistance mode, stops the vehicle, and then switches the vehicle's driving mode from the assistance mode to the normal mode. On the other hand, if the determination period has not elapsed, the process is temporarily terminated.

[0067] 4 shows the transition of the first voltage V1 of the first-system path LA1 and the second voltage V2 of the second-system path LA2 when a ground fault occurs in the second system ES2 during driving assistance. The first voltage V1 is the voltage at the connection point PA between the first-system path LA1 and the connection path LB, and is equal to the voltage value detected by the voltage sensor 28. The second voltage V2 is the voltage at the connection point PB between the second-system path LA2 and the connection path LB.

[0068] In Figure 4, (A) shows the transition of the operating state of the first control device 41, (B) shows the transition of the operating state of the second control device 42, (C) shows the transition of the open / close state of the inter-path switch SW, (D) shows the transition of the vehicle's driving mode, and (E) shows the transition of the abnormality flag Fg.

[0069] In addition, (F) shows the transition of the first voltage V1 of the first-system path LA1, (G) shows the transition of the second voltage V2 of the second-system path LA2, (H) shows the transition of the switch current ISW flowing through the inter-path switch SW, and (I) shows the transition of the battery current IB which is the charge / discharge current of the second storage battery 16. The switch current ISW is positive when it flows from the first-system path LA1 side to the second-system path LA2 side, and is equal to the current value detected by the current sensor 29.

[0070] As shown in FIG. 4, during the open period of the IG switch 45 until time t1, i.e., when the control system 100 is in the idle state, the inter-path switch SW is open, and the first control device 41 and the second control device 42 are in a stopped state.

[0071] When the IG switch 45 is closed at time t1, the ECU 40 closes the inter-path switch SW and switches the converter 12 to an operating state. As a result, the first voltage V1 and the second voltage V2 rise above the operating lower limit voltage VL, and after the initial processing for startup, the first control device 41 and the second control device 42 enter an operating state. After that, at time t2, the driver switches the vehicle's driving mode from the normal mode to the assistance mode.

[0072] When the vehicle is traveling in the assistance mode, the first control device 41 executes a first control process, and in parallel with the first control process, the second control device 42 executes a second control process. Then, the first control device 41 controls the first and second loads 34, 36 using the control command values ​​calculated in the first control process.

[0073] When a ground fault occurs in either one of the systems ES1, ES2, the first voltage V1 becomes lower than the threshold voltage Vth, and the switch operation unit 22 opens the inter-path switch SW. In FIG. 4, a ground fault occurs in the second system ES2 at time t3. This causes the second voltage V2 to drop and the battery current IB to increase. When the second voltage V2 drops to the lower limit voltage VL at time t4, the second control device 42 is brought into an operation stop state. As a result, when a communication abnormality occurs between the first control device 41 and the second control device 42 and the first control device 41 determines that a ground fault has occurred in the second system ES2, the abnormality flag Fg is set to "1" and the driver is notified that the driving assistance control will be stopped.

[0074] Furthermore, the switch current ISW increases, and the first voltage V1 also decreases. In this embodiment, since the diode 23 is provided in the connection path LB, the increase in the switch current ISW is suppressed, and accordingly, the decrease in the first voltage V1 is suppressed. As a result, the decrease rate of the first voltage V1 is slower than the decrease rate of the second voltage V2, and the first voltage V1 is suppressed from decreasing below the operating lower limit voltage VL before the inter-path switch SW is opened.

[0075] As a result, at time t4, driving assist control using the first and second loads 34, 36 is switched to driving assist control using only the first load 34. Since the first control device 41 has been performing driving assist control since before time t4, even if the driving assist control is switched as described above, the driving assist control is prevented from being affected.

[0076] At time t5, when the first voltage V1 drops to the threshold voltage Vth, the inter-path switch SW is opened by the switch operation unit 22. After that, at time t6, the driving mode of the vehicle is switched from the assistance mode to the normal mode by the driver.

[0077] Fig. 5 shows the transitions of the first voltage V1 and the second voltage V2 when a ground fault occurs in the first system ES1 during driving assistance. Note that (A) to (I) in Fig. 5 are the same as (A) to (I) in Fig. 4, except that (E) shows the transition of the abnormality flag Fg. Also, the transitions up to time t2 in Fig. 5 are the same as those in Fig. 4, and therefore will not be described.

[0078] In Fig. 5, a ground fault occurs in the first system ES1 at time t13. This causes the first voltage V1 to drop, and when the first voltage V1 drops to the threshold voltage Vth at time t14, the switch operation unit 22 opens the inter-path switch SW. When the first voltage V1 drops to the lower limit voltage VL at time t15, the first control device 41 is brought into an operation stop state. As a result, a communication abnormality occurs between the first control device 41 and the second control device 42, and when the second control device 42 determines that a ground fault has occurred in the first system ES1, the abnormality flag Fh is set to "1" and the driver is notified that the driving assistance control will be stopped.

[0079] Furthermore, the second storage battery 16 starts discharging, and the second voltage V2 drops. In this embodiment, the diode 23 is provided in the connection path LB, so that the switch current ISW is prevented from flowing from the second-system path LA2 side to the first-system path LA1 side. As a result, the rate of drop in the second storage battery 16 becomes gradual in accordance with the power consumption in the second system ES2, and the second voltage V2 is prevented from dropping below the lower limit operating voltage VL at approximately the same time that the first voltage V1 drops below the lower limit operating voltage VL.

[0080] As a result, at time t15, driving assistance control by the first control device 41 is switched to driving assistance control by the second control device 42. The second control device 42 has been performing the second control process since before time t14, and a preparatory process for performing driving assistance control has been performed, so that even if the driving assistance control is switched as described above, the driving assistance control is prevented from being affected.

[0081] In Figure 5, the solid lines show the changes in each value when a ground fault occurs in the first brake device 51A of the first system ES1, and the solid lines show the changes in each value when a ground fault occurs in the converter 12 of the first system ES1.

[0082] 5, when a ground fault occurs in the first braking device 51A, the fuse FA connected to the first braking device 51A melts at time t16, causing the first voltage V1 to rise. Then, at time t17, when the first voltage V1 rises to the lower limit operating voltage VL, the first control device 41 returns to the operating state.

[0083] When the first voltage V1 rises to the threshold voltage Vth at time t18, the second control device 42 determines that the voltage has been restored at time t19, and the inter-path switch SW is returned to the closed state. As a result, the second voltage V2 rises, the switch current ISW flows, and power supply to the second storage battery 16 becomes possible again. The driver is notified that the voltage has been restored. In the example shown by the solid line in FIG. 5, the driver recognizes that it is possible to continue driving in the assistance mode due to the notification, and maintains the vehicle driving mode in the assistance mode.

[0084] 5, when a ground fault occurs in converter 12, even if fuse FA connected to converter 12 is blown at time t16, voltage recovery does not occur. Since the driver is not notified, he recognizes that it is impossible to continue driving in the assistance mode, and inputs an instruction to switch to the normal mode at time t20 before the determination period elapses.

[0085] According to the present embodiment described above in detail, the following effects can be obtained.

[0086] The monitoring unit 21 monitors the voltage drop in the first intra-system path LA1 with the inter-path switch SW closed, and the switch operation unit 22 opens the inter-path switch SW when the monitoring unit 21 determines that the voltage drop in the first intra-system path LA1 has occurred during driving assistance. In this case, even if a voltage drop occurs in the second intra-system path LA2 due to a ground fault in the second intra-system path LA2, the diode 23 suppresses a large current from flowing through the inter-path switch SW from the time the ground fault occurs in the second intra-system path LA2 until the inter-path switch SW is opened, and the voltage drop in the first intra-system path LA1 is suppressed. Therefore, the inter-path switch SW can be opened before a power failure occurs in the first system ES1 due to a voltage drop in the first intra-system path LA1, and thus it is possible to suppress the occurrence of a hindrance to the control of the specific load 32 including the driving assistance control.

[0087] On the other hand, when a ground fault occurs in the first system path LA1, a voltage drop occurs in the first system path LA1, but the voltage drop in the second system path LA2 is suppressed by the diode 23. This also makes it possible to suppress the occurrence of a problem in the control of the specific load 32.

[0088] In particular, in the first control device 41 and the second control device 42, even if the power supply is momentarily stopped, it is necessary to perform an initial process for start-up when restoring, and the control of the specific load 32 is stopped during the period in which the initial process is being performed. In this embodiment, by providing the diode 23 in the connection path LB, even if a ground fault occurs in either of the intra-system paths LA1, LA2, it is possible to prevent the power supply to the first control device 41 and the second control device 42 from being stopped, and to prevent the control of the specific load 32 from being impaired.

[0089] In the control of the specific load 32, the first control device 41 performs a first control process, and each load constituting the driving support device 38 is controlled by a control command value of the first control process. In parallel with this, the second control device 42 performs a second control process. As a result, even if the operation of the first control device 41 stops due to a voltage drop in the first system ES1, the control can be immediately shifted to the control by the second control device 42. In other words, the first control device 41 and the second control device 42 perform the control process of the driving support in parallel with each other, and when the first control device 41 loses power, the control of the specific load 32 can be immediately performed using the control command value calculated by the second control device 42 without waiting for the completion of the initial process for starting up by the second control device 42. As a result, it is possible to suitably suppress the occurrence of a problem in the control of the specific load 32 due to a voltage drop in the first system path LA1 and the second system path LA2.

[0090] When no abnormality occurs in the first control device 41, the specific load 32 is controlled using only the control command value calculated in the first control process, so that the second control process does not need to be performed in the same calculation process or calculation cycle as the first control process. In this embodiment, the second control process and the first control process are different in calculation process, and the processing load of the second control process is made smaller than the processing load of the first control process. This makes it possible to simplify the control process in the second control device 42 when the control of the second control device 42 is performed in parallel in addition to the control of the first control device 41.

[0091] In the first system ES1, a branch path LC is provided for each load included in the first load 34, and a fuse FA is provided for each branch path LC. Therefore, when an earth fault occurs in any of the loads in the first system path LA1, an excessive current flows, and the input / output of power to the load is cut off. Then, the first voltage V1 starts to rise as the fuse FA melts, and the inter-path switch SW is returned to the closed state. As a result, after the first voltage V1 is restored, switching from the second storage battery 16 to the power supply device 10 can be performed, and power can be supplied to the second storage battery 16.

[0092] (Modification of the first embodiment) The monitoring unit 21 may incorporate a current determination circuit that determines whether or not a current value detected by the current sensor 29 has risen above a threshold current Ith, instead of a voltage determination circuit that determines whether or not a voltage value detected by the voltage sensor 28 has fallen below a threshold voltage Vth. As shown in FIG. 4(H), when a ground fault occurs in the second system ES2, the switch current ISW rises to the threshold current Ith at time t5. The monitoring unit 21 may determine that the switch current ISW has risen to the threshold current Ith, and the switch operation unit 22 may open the inter-path switch SW based on the determination result of the monitoring unit 21.

[0093] 5(H), when a ground fault occurs in the first system ES1, the switch current ISW does not increase to the threshold current Ith. Therefore, when a current determination circuit is built into the monitoring unit 21, the inter-path switch SW is not opened even when a ground fault occurs in the first system ES1.

[0094] Second embodiment The second embodiment will be described below with reference to FIG. 6, focusing on the differences from the first embodiment.

[0095] 6, the inter-path switch SW and the diode 23 provided in the connection path LB may be configured with a first switch SWA and a second switch SWB connected in series to the connection path LB. In this embodiment, MOSFETs are used as the first and second switches SWA and SWB.

[0096] The first switch SWA is connected in parallel with a first diode DA as a parasitic diode, and the second switch SWB is connected in parallel with a second diode DB as a parasitic diode. In this embodiment, the first and second diodes DA and DB are connected in series so that the forward direction of the first and second diodes DA and DB is the reverse direction. In detail, the first and second switches SWA and SWB are connected back to back, that is, the anodes of the first and second diodes DA and DB are connected to each other, and the cathode of the first diode DA is connected to the first system ES1 side, and the cathode of the second diode DB is connected to the second system ES2 side.

[0097] The ECU 40 switches the open / closed states of the first and second switches SWA and SWB. In a normal state in which no ground fault occurs in either the first system ES1 or the second system ES2, the ECU 40 closes the first switch SWA and opens the second switch SWB. As a result, the first switch SWA functions as the inter-path switch SW in the first embodiment, and the second diode DB functions as the diode 23 in the first embodiment.

[0098] Furthermore, when a ground fault occurs in the converter 12 of the first system ES1 and the fuse FA connected to the converter 12 is blown, the second control device 42 closes at least the first switch SWA. This allows the first control device 41 and the second control device 42 to perform driving assistance control using power supplied from the second storage battery 16.

[0099] Furthermore, the ECU 40 closes the first and second switches SWA and SWB intermittently, for example, every hour, while the IG switch 45 is open, that is, in the pause state of the control system 100. This allows the first control device 41 to be started at a predetermined cycle in the system stop state, and to perform, for example, equalization processing of the states of charge of the battery cells constituting the second storage battery 16.

[0100] In this embodiment, since the first and second switches SWA and SWB are connected back to back in the connection path LB, one switch (first switch SWA) functions as an inter-path switch SW, and the parasitic diode of the other switch (second switch SWB) functions as a diode 23 as a current limiting element. This makes it possible to suppress the occurrence of a disturbance in the control of the specific load 32, including the driving assistance control, even if a ground fault occurs in either the first intra-system path LA1 or the second intra-system path LA2. In addition, even if the first switch SWA is opened due to the stop of the power supply device 10, it is possible to supply power from the second storage battery 16 to the first control device 41 by closing at least the second switch SWB thereafter.

[0101] (Modification of the second embodiment) The first and second switches SWA, SWB may be connected nose to nose instead of back to back, that is, such that the cathodes of the first and second diodes DA, DB are connected to each other.

[0102] (Other embodiments) The present invention is not limited to the above-described embodiment, and may be implemented as follows.

[0103] Each load 34, 36 may be, for example, the following devices:

[0104] The loads may be a driving motor that provides power for driving the vehicle and a drive circuit for the motor. In this case, the first and second loads 34 and 36 are, for example, a three-phase permanent magnet synchronous motor and a three-phase inverter device, respectively.

[0105] An anti-lock brake device that prevents the wheels from locking during braking may be used. In this case, each of the first and second loads 34, 36 is, for example, an ABS actuator that can independently adjust the brake hydraulic pressure during braking.

[0106] The loads 34, 36 do not necessarily have to be the same in configuration, and may be different types of devices that achieve the same function. The first and second loads 34, 36 do not have to be different loads, but may be the same load. In other words, the first and second loads 34, 36 may be the same load that receives power supply from both the first intra-system path LA1 and the second intra-system path LA2.

[0107] The loads 34, 36 may be components for realizing the same function. In this case, the first and second loads 34, 36 are, for example, an actuator of an electric power steering device and an electric power steering ECU, respectively. In this case, the electric power steering ECU may receive power supply from both the first intra-system path LA1 and the second intra-system path LA2.

[0108] The voltage generating unit of the first power supply is not limited to a converter and may be an alternator. Furthermore, the first power supply does not have to include a voltage generating unit and may include only the first storage battery 13, for example.

[0109] In the above embodiment, the monitoring unit and the switch control unit are configured by hardware circuits having various built-in circuits, but the present invention is not limited to this. They may be configured by a microcomputer including a CPU, a ROM, a RAM, a flash memory, etc.

[0110] In the above embodiment, in a normal state during driving assistance, the first control device 41 controls the first and second loads 34, 36 only with the control command value calculated in the first control process, but this is not limiting. For example, the first load 34 may be controlled by the first control device 41 with the control command value calculated in the first control process, and the second control device 42 may control the second load 36 with the control command value calculated in the second control process.

[0111] In the above embodiment, the second control process performed by the second control device 42 and the first control process performed by the first control device 41 are different in calculation processing, but this is not limited to the above. The second control process and the first control process may have different calculation cycles, and as a result, the processing load of the second control process may be smaller than the processing load of the first control process.

[0112] In the above embodiment, the control system 100 is applied to a vehicle capable of both manual and automatic driving, but is not limited thereto. The control system 100 may be applied to a vehicle capable of only automatic driving, such as a fully automatic vehicle, or may be applied to a vehicle capable of only manual driving.

[0113] In the above embodiment, the second power source is a lithium ion battery, but the present invention is not limited to this. The second power source may be, for example, another type of battery or an electric double layer capacitor. [Explanation of symbols]

[0114] 10...power generation device, 16...second storage battery, 20...power supply monitoring device, 21...monitoring section, 22...switch operation section, 23...diode, 32...specific load, 41...first control device, 42...second control device, 100...control system, LA1...first intra-system path, LA2...second intra-system path, LB...connection path, SW...inter-path switch.

Claims

1. The present invention is applied to a control system (100) including a first control device (41) and a second control device (42) capable of controlling an electric load (32), the control system (100) supplying power from a first power source (10) through a first path (LA1) to the first control device, and supplying power from a second power source (16) through a second path (LA2) to the second control device, a connection path (LB) connecting the first path and the second path; An inter-path switch (SW) provided in the connection path; a current limiting element (23) that is provided in series with the inter-path switch in the connection path, and that allows current to flow from the first path side to the second path side in a current-limited state and blocks current to flow from the second path side to the first path side; a monitoring unit (21) that monitors a voltage drop in the first path while the inter-path switch is closed; a switch operation unit (22) that opens the inter-path switch when the monitoring unit determines that a voltage drop has occurred in the first path; A power supply monitoring device (20).

2. 2. The power supply monitoring device according to claim 1, wherein the current limiting element comprises a diode provided such that a direction from the first path side to the second path side is a forward direction.

3. a pair of semiconductor switches (SWA, SWB) provided in series in the connection path and having parasitic diodes in opposite directions to each other; 3. The power supply monitoring device according to claim 1, wherein one semiconductor switch (SWA) of the pair of semiconductor switches is the inter-path switch, and a parasitic diode of the other semiconductor switch (SWB) is the current limiting element.

4. A power supply monitoring device (20) according to any one of claims 1 to 3; The first control device and the second control device; The first path and the second path; A control system (100) having The first control device performs a first control process to calculate a control command value, and the electric load is controlled by the control command value calculated by the first control process, while the second control device performs a second control process to calculate a control command value in parallel with the first control process; When an abnormality occurs in the first control device, the electric load is controlled by a control command value calculated by the second control device.

5. 5. The control system according to claim 4, wherein the second control process performed by the second control device and the first control process performed by the first control device differ in at least one of calculation processing and calculation cycle, and the processing load of the second control process is smaller than the processing load of the first control process.

6. The electric load includes a plurality of first path side loads (50A, 51A, 52A) connected to the first path, the first path has branch paths connected to the first path side loads, each of the branch paths being provided with a fuse (FA); The second control device is a determination unit that determines whether a voltage recovery from a voltage drop has occurred in the first path; The control system according to claim 4 or 5, further comprising: a switch control unit that returns the inter-path switch to a closed state when it is determined that the voltage recovery has occurred.

Images