Motor control device and motor control system

Abstract

Provided are a motor control device and a motor control system capable of reducing cost in addition to achieving redundancy. The motor control device comprises a first motor drive unit, a second motor drive unit, a first control unit, a second control unit, and a third control unit. The first control unit obtains the detection value of a first rotation sensor for detecting the rotational position of a brake motor and monitors the phase current of the second motor drive unit. The second control unit obtains the detection value of a second rotation sensor for detecting the rotational position of the brake motor and monitors the phase current of the first motor drive unit. The third control unit obtains the detection value of a third rotation sensor for detecting the rotational position of the brake motor and monitors the phase current of the first motor drive unit and the phase current of the second motor drive unit.

Description

[Technical Field]

[0001] The present disclosure relates to a motor control device and a motor control system. [Background technology]

[0002] Patent Document 1 discloses that the motor drive control system is divided into two for redundancy in order to maintain the function of the electric power steering in response to requirements such as automatic driving of the vehicle and functional safety. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-171664 Summary of the Invention [Problem to be solved by the invention]

[0004] In redundant motor drive control such as that described in Patent Document 1, in order to reliably detect abnormalities in each system, it is necessary to incorporate a function capable of self-diagnosing the abnormality detection function into each system, which may increase costs.

[0005] An object of the present invention is to provide a motor control device and a motor control system that are capable of achieving cost reduction while providing redundancy. [Means for solving the problem]

[0006] The present invention preferably comprises: A motor control device, the motor control device comprising:a first motor drive unit that drives a motor; a second motor drive unit that drives the motor; a first control unit connected to the first motor drive unit, the first control unit acquiring a detection value of a first rotational position detection unit that detects a rotational position of the motor and monitoring a phase current of the second motor drive unit; a second control unit connected to the second motor drive unit, the second control unit acquiring a detection value of a second rotational position detection unit that detects the rotational position of the motor and monitoring the phase current of the first motor drive unit; and a third control unit acquiring a detection value of a third rotational position detection unit that detects the rotational position of the motor and monitoring the phase current of the first motor drive unit and the phase current of the second motor drive unit. The third control unit does not have a motor driving function. This is a motor control device.

[0007] The present invention also preferably provides: 1. A motor control system, comprising: a motor and a motor controller for controlling the motor; The motor controller comprises: a first motor drive unit that drives the motor; a second motor drive unit that drives the motor; a first control unit connected to the first motor drive unit, the first control unit acquiring a detection value of a first rotational position detector that detects a rotational position of the motor and monitoring a phase current of the second motor drive unit; a second control unit connected to the second motor drive unit, the second control unit acquiring a detection value of a second rotational position detector that detects the rotational position of the motor and monitoring the phase current of the first motor drive unit; and a third control unit acquiring a detection value of a third rotational position detector that detects the rotational position of the motor and monitoring the phase current of the first motor drive unit and the phase current of the second motor drive unit. The motor control system also a vehicle controller connected to the first control unit, the second control unit, and the third control unit; of, Preparation The third control unit does not have a motor driving function. It is a motor control system.

[0008] According to one embodiment of the present invention, it is possible to achieve cost reduction while achieving redundancy. [Brief explanation of the drawings]

[0009] [Figure 1]1 is a block diagram illustrating a motor control device and a motor control system according to an embodiment. [Figure 2] FIG. 2 is a block diagram showing a first control unit (M_ECU_1), a third control unit (S_ECU), a second control unit (M_ECU_2), a first logic circuit (LC), a first motor drive unit, and the like. [Figure 3] FIG. 2 is a block diagram showing a second control unit (M_ECU_2), a third control unit (S_ECU), a first control unit (M_ECU_1), a second logic circuit (LC), a second motor drive unit, and the like. [Figure 4] 4 is a characteristic diagram showing an example of time variation (waveform) of phase current (U phase, V phase, W phase) by the first motor drive unit or the second motor drive unit. FIG. [Figure 5] 1 is a flowchart showing a process (current monitoring process) performed by a first control unit (M_ECU_1), a second control unit (M_ECU_2), and a third control unit (S_ECU). [Figure 6] FIG. 1 is an explanatory diagram (truth table) showing the relationship between the outputs (L, H) of the first control unit (ECU1), the second control unit (ECU2), and the third control unit (SensECU) and the states (L: OFF, H: ON) of the first fail-safe relay (ECU1_FS relay) and the second fail-safe relay (ECU2_FS relay). DETAILED DESCRIPTION OF THE INVENTION

[0010] The motor control device and motor control system according to the embodiment will be described below with reference to the accompanying drawings, taking as an example a case where they are installed in a four-wheeled vehicle. Note that each step in the flowchart shown in Figure 5 is represented by the letter "S" (for example, step 1 = "S1").

[0011] In Fig. 1, a motor control system 1 mounted on a vehicle (automobile) includes a brake motor 2 as a motor, a motor control device 7 as a motor controller, and a higher-level control device 33 as a vehicle controller (vehicle controller). In the embodiment, the higher-level control device 33 corresponds to an integrated controller that determines motion control of the vehicle. Hereinafter, the higher-level control device 33 will be referred to as the integrated control device 33.

[0012] The brake motor 2 controls (drives) an electric brake mechanism (not shown) that applies a braking force to the vehicle. The electric brake mechanism corresponds, for example, to an electric disc brake equipped with an electric caliper that presses brake pads against a disc rotor using the brake motor 2, which is an electric motor. The brake motor 2 is configured to include a stator 3, which serves as a fixed element, and a rotor 4, which serves as a permanent magnet rotor and is rotatably provided in the center of the stator 3. The rotor 4 of the brake motor 2 is connected, for example, to the rotating shaft of a rotary-to-linear motion conversion mechanism (not shown). The rotation of the brake motor 2 (rotor 4) is converted into linear motion by the rotary-to-linear motion conversion mechanism, causing the brake pads of the electric brake mechanism to move toward or away from the disc rotor.

[0013] The brake motor 2 has two winding sets 5 and 6 to ensure redundancy. That is, the brake motor 2 is configured as a three-phase synchronous motor having a first winding set 5 consisting of star-connected three-phase windings U1, V1, and W1, and a second winding set 6 consisting of similarly star-connected three-phase windings U2, V2, and W2. In other words, the brake motor 2 is configured as a six-phase motor with three-phase double windings (a six-phase motor in which torque is generated by two systems of three-phase coils for one rotor 4). The first winding set 5 and the second winding set 6 are provided on the stator 3 while being insulated from each other.

[0014] The electric brake mechanism (electric brake) is not limited to an electric disc brake, and may be, for example, an electric drum brake equipped with an electric cylinder that applies braking force by pressing a shoe against a drum using an electric motor. The electric brake mechanism (electric brake) may also be a hydraulic disc brake equipped with an electric motor (hydraulic disc brake with an electric parking brake function), or a cable-puller electric parking brake that applies and operates the parking brake by pulling a cable with an electric motor. In other words, any type of electric brake (electric brake mechanism) may be used as long as it is configured to press (propel) a friction member (pad, shoe) against a rotating member (rotor, drum) based on the drive of an electric motor (electric actuator) and apply and release braking force (maintain and release the pressing force).

[0015] The motor control device 7, which serves as a motor controller, controls the brake motor 2, which serves as a motor. More specifically, the motor control device 7 drives and controls the windings U1, V1, and W1 of the first winding set 5 and the windings U2, V2, and W2 of the second winding set 6 of the brake motor 2. To this end, the motor control device 7 includes a first drive control system (first motor drive unit 8, first control unit 9) that drives and controls the first winding set 5 (U1, V1, W1), and a second drive control system (second motor drive unit 10, second control unit 11) that drives and controls the second winding set 6 (U2, V2, W2).

[0016] That is, the motor control device 7 includes a first motor drive unit 8, a first control unit 9, a second motor drive unit 10, and a second control unit 11. The motor control device 7 also includes a third control unit 41, which will be described later. The first drive control system of the motor control device 7 is also referred to as the "primary channel," the "first control unit 9 side," or the "ECU1 side," for example. The second drive control system of the motor control device 7 is also referred to as the "secondary channel," the "second control unit 11 side," or the "ECU2 side," for example.

[0017] The first motor drive unit 8 drives the brake motor 2. The first motor drive unit 8 includes, for example, a first inverter circuit 8A serving as a first bridge circuit and a first fail-safe relay 8B serving as a first relay. The first motor drive unit 8 is connected to a first power source 29 of the vehicle, such as a power storage device (battery), via a first DC power line 17. In this case, the first power source 29 (first DC power line 17) is connected to the first inverter circuit 8A via a first fail-safe relay 8B of the first motor drive unit 8. The first fail-safe relay 8B will be described later. The first motor drive unit 8 (first inverter circuit 8A) is also connected to the windings U1, V1, and W1 of the first winding set 5 of the brake motor 2 via a U1-phase power line 18, a V1-phase power line 19, and a W1-phase power line 20. The first motor drive unit 8 (first inverter circuit 8A) is also connected to a first control unit 9 via a first signal line 25.

[0018] The first inverter circuit 8A includes a plurality of switching elements, such as transistors, field-effect transistors (FETs), insulated gate bipolar transistors (IGBTs), etc. For example, the first inverter circuit 8A corresponds to an inverter (three-phase bridge inverter) composed of six FETs. The opening and closing of each switching element of the first inverter circuit 8A is controlled based on a command signal (e.g., a pulse signal) from the first control unit 9. When the brake motor 2 is driven, the first inverter circuit 8A generates three-phase (U-phase, V-phase, and W-phase) AC power from DC power based on the command signal from the first control unit 9, and supplies the AC power to the first winding set 5 (windings U1, V1, and W1) of the brake motor 2.

[0019] The first control unit 9 is connected to the first motor drive unit 8. The first control unit 9 is also called an ECU (Electronic Control Unit) and includes a microcomputer that serves as a central processing unit (CPU). The first control unit 9 corresponds to the first motor ECU (M_ECU_1). The first control unit 9 includes, for example, a power circuit (Power Management IC), a microcomputer (Micro Controller), a driver circuit (Pre Driver), a regulator (Reg), and the like. The first control unit 9 is connected to a first power source 29 of the vehicle via a first DC power line 17 and is connected to the first motor drive unit 8 via a first signal line 25. The first control unit 9 drives (forward and reverse rotation) the brake motor 2 by controlling (switching control, more specifically, PWM control) the first motor drive unit 8 (first inverter circuit 8A).

[0020] The first control unit 9 is connected to a first rotation sensor 15 for feedback control of the rotation of the rotor 4 of the brake motor 2. The first rotation sensor 15, which serves as a first rotation position detection unit, detects the rotation position (e.g., rotation angle) of the rotor 4 of the brake motor 2. A vehicle data bus 31, which serves as a communication line, is also connected to the first control unit 9. The vehicle data bus 31 constitutes, for example, a Controller Area Network (CAN) as a communication network mounted on the vehicle body. The numerous electronic devices mounted on the vehicle, such as various ECUs such as the motor control unit 7, an integrated control unit 33 described below, a suspension control unit (not shown), and a steering control unit (not shown), perform multiplexed communication within the vehicle via the vehicle data bus 31. Various communication standards, such as CAN (Classic CAN) and CAN FD (CAN with Flexible Data Rate), can be used as the communication standard.

[0021] The second motor drive unit 10 also drives the brake motor 2, similar to the first motor drive unit 8. The second motor drive unit 10 includes, for example, a second inverter circuit 10A as a second bridge circuit unit and a second fail-safe relay 10B as a second relay unit. The second motor drive unit 10 is connected to a second power source 30 of the vehicle, such as a power storage device (battery), via a second DC power line 21. In this case, the second power source 30 (second DC power line 21) is connected to the second inverter circuit 10A via the second fail-safe relay 10B of the second motor drive unit 10. The second fail-safe relay 10B will also be described later. The second motor drive unit 10 (second inverter circuit 10A) is also connected to the windings U2, V2, and W2 of the second winding set 6 of the brake motor 2 via a U2-phase power line 22, a V2-phase power line 23, and a W2-phase power line 24. The second power supply 30 is a power supply separate from the first power supply 29 connected to the first motor drive unit 8 and the first control unit 9 (a power supply of a different system). By providing a dual power supply path in this manner, redundancy is ensured. Furthermore, the second motor drive unit 10 (second inverter circuit 10A) is connected to the second control unit 11 via a second signal line 27.

[0022] The second inverter circuit 10A is also configured to include a plurality of switching elements, such as transistors, field-effect transistors (FETs), insulated gate bipolar transistors (IGBTs), etc. For example, the second inverter circuit 10A corresponds to an inverter (three-phase bridge inverter) configured with six FETs. The opening and closing of each switching element of the second inverter circuit 10A is controlled based on a command signal (e.g., a pulse signal) from the second control unit 11. When the brake motor 2 is driven, the second inverter circuit 10A generates three-phase (U-phase, V-phase, and W-phase) AC power from DC power based on the command signal from the second control unit 11, and supplies the AC power to the second winding set 6 (windings U2, V2, and W2) of the brake motor 2.

[0023] The second control unit 11 is connected to the second motor drive unit 10. The second control unit 11 is also called an ECU (Electronic Control Unit) and includes a microcomputer that serves as a central processing unit (CPU). The second control unit 11 corresponds to the second motor ECU (M_ECU_2). The second control unit 11 includes, for example, a power circuit (Power Management IC), a microcomputer (Micro Controller), a driver circuit (Pre Driver), a regulator (Reg), and the like. The second control unit 11 is connected to a second power source 30 of the vehicle via a second DC power line 21 and is connected to the second motor drive unit 10 via a second signal line 27. The second control unit 11 drives (forward and reverse rotation) the brake motor 2 by controlling (switching control, more specifically, PWM control) the second motor drive unit 10 (second inverter circuit 10A).

[0024] The second control unit 11 is connected to a second rotation sensor 16 for feedback control of the rotation of the rotor 4 of the brake motor 2. The second rotation sensor 16, which serves as a second rotation position detection unit, detects the rotation position (e.g., rotation angle) of the rotor 4 of the brake motor 2. The second rotation sensor 16 is also a rotation sensor separate from the first rotation sensor 15 connected to the first control unit 9. This ensures redundancy. Similarly to the first control unit 9, the second control unit 11 is connected to a vehicle data bus 31. The second control unit 11 and the first control unit 9 are also connected via a communication line 34 (inter-CPU communication line).

[0025] Although not shown, the regulator (Reg) of the first control unit 9 is connected to the first rotation sensor 15, a first logic circuit 43 (described later), and a first phase current monitor circuit 35 (described later). As a result, power is supplied to the first rotation sensor 15, the first logic circuit 43, and the first phase current monitor circuit 35 via the regulator (Reg) of the first control unit 9. Furthermore, the regulator (Reg) of the second control unit 11 is connected to the second rotation sensor 16, a second logic circuit 44 (described later), and a second phase current monitor circuit 36 ​​(described later). As a result, power is supplied to the second rotation sensor 16, the second logic circuit 44, and the second phase current monitor circuit 36 ​​via the regulator (Reg) of the second control unit 11.

[0026] The integrated control device 33 is connected to the first control unit 9 and the second control unit 11. That is, the integrated control device 33 is connected to the first control unit 9 and the second control unit 11 via, for example, a vehicle data bus 31. In this case, the integrated control device 33 is connected to the first control unit 9 and the second control unit 11 via separate systems. That is, the "integrated control device 33 and the first control unit 9" and the "integrated control device 33 and the second control unit 11" are connected via separate communication lines 31A and 31B, respectively. As will be described later, the integrated control device 33 is also connected to the third control unit 41. In this case, the integrated control device 33 is connected to the third control unit 41 via a first communication line 31A connecting the integrated control device 33 and the first control unit 9, and is connected to the third control unit 41 via a second communication line 31B connecting the integrated control device 33 and the second control unit 11. As a result, the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 form a ring network.

[0027] The integrated control device 33 is, for example, an integrated control device (integrated ECU) that determines vehicle motion control for moving the vehicle along a target trajectory obtained from an automatic driving control device (automatic driving ECU). The integrated control device 33 outputs control commands (for example, control commands related to automatic driving) required for each actuator control device (actuator ECU), for example, a motor drive device (motor drive ECU), a brake control device (brake ECU), a steering control device (steering ECU), a suspension control device (suspension ECU), etc.

[0028] Here, the motor control device 7 can function as, for example, both a motor drive device (motor drive ECU) that drives the brake motor 2 and a brake control device (brake ECU) that performs integrated control related to braking. In other words, the motor control device 7 (brake motor control ECU) can be configured as an integrated control device having both a motor drive function and a brake control function. However, without being limited to this, for example, the motor drive device (motor drive ECU) and the brake control device (brake ECU) may be configured separately (as separate entities).

[0029] Meanwhile, the integrated control device 33 is also called a central control device (central ECU) and corresponds to a higher-level control device of the motor control device 7. The integrated control device 33 also includes a microcomputer that serves as a central processing unit (CPU). In this case, the integrated control device 33 is configured with a dual core (dual circuit) so that the same processing can be performed in parallel and the processing results can be monitored for discrepancies. That is, the integrated control device 33 is configured with two control units 33A and 33B (a first central ECU (C_ECU_1) and a second central ECU (C_ECU_2)). The two control units 33A and 33B are connected via communication lines 33C and 33D (inter-CPU communication lines). For example, when applying a braking force to the vehicle, the integrated control device 33 outputs a command for a target motor torque (or a braking force, a piston thrust, or a motor control current value) to the motor control device 7.

[0030] Incidentally, the motor drive control unit described in the aforementioned Patent Document 1 employs a six-phase motor with six sets of windings to ensure redundancy as the motor that generates steering assist torque. In such a configuration, for example, it is conceivable to arrange two completely independent ASILD chipsets (power management IC / microcomputer / pre-driver that monitors the microcomputer) and control each of the three phases of the six-phase motor with a separate ASILD chipset.

[0031] In this case, each system detects its own abnormalities, and if an abnormality is detected, the system will fail open and the other system will generate the remaining 50% of the remaining torque. However, in a fully redundant two-system configuration, to ensure that each system can detect abnormalities reliably, two expensive chipsets with built-in self-test (BIST) circuits that can self-diagnose the abnormality detection function must be prepared. This can increase costs.

[0032] Therefore, in this embodiment, the ECU1 (first control unit 9) of the primary channel (first motor drive unit 8 and first control unit 9), which is one system for ensuring redundant function, and the ECU2 (second control unit 11) of the secondary channel (second motor drive unit 10 and second control unit 11), which is the other system, employ inexpensive chipsets that can achieve their main function (motor control function) even if the safety function is not complete.The ECU1 (first control unit 9) and ECU2 (second control unit 11) of the inexpensive chipsets then check that each other's main function (the function of correctly supplying current to the brake motor 2) is functioning correctly.

[0033] That is, ECU1 (first control unit 9) and ECU2 (second control unit 11) monitor the motor phase current (motor current of UVW phase), which is the final output of the function of the other ECU (electronic component). If an abnormality is detected, that is, if current is not flowing properly to the motor (brake motor 2), the other function is shut down, that is, the other relay (first failsafe relay 8B or second failsafe relay 10B) is turned off.

[0034] However, there is a risk that a failed microcomputer will not be able to correctly detect the failure of the other microcomputer's function. Therefore, if the failed microcomputer mistakenly shuts down the other microcomputer's relay, this, combined with the failure of its own current control function, may result in the motor's remaining output capacity dropping to 0%. To prevent this, in this embodiment, a third control unit and a third detection unit (third rotational position detection unit) are added. That is, in this embodiment, in addition to ECU1 (first control unit 9) and ECU2 (second control unit 11), a sensor ECU (S_ECU) serving as ECU3 (third control unit 41) is provided. ECU3 (SensECU) has function blocks that monitor the "rotational position (rotor angle) of the motor," the "phase current from the primary channel (ECU1)," and the "phase current from the secondary channel (ECU2)."

[0035] The ECU3, as a third party, determines whether the primary channel (ECU1) and the secondary channel (ECU2) are abnormal. If the determination by the ECU3 that "the primary channel is abnormal" coincides with the determination by the secondary channel (ECU2) that "the primary channel is abnormal," the ECU3 shuts off the relay of the primary channel. Also, if the determination by the ECU3 that "the secondary channel is abnormal" coincides with the determination by the primary channel (ECU1), the ECU3 shuts off the relay of the secondary channel. That is, in this embodiment, a majority decision function is added that shuts off the relay based on an AND condition (AND operation, logical product) between the determination result by the ECU3 and the determination result of the primary channel (ECU1) or the secondary channel (ECU2).

[0036] As a result, even if inexpensive microcomputers are used for ECU1 (first control unit 9) and ECU2 (second control unit 11), it is possible to prevent a complete failure of the current output function to the motor (brake motor 2) when an abnormality occurs in the inexpensive microcomputer. That is, in the embodiment, it is possible to adopt inexpensive devices instead of using expensive devices. In addition, inexpensive chipsets without extensive safety functions require small component sizes, so the board size can be reduced. Furthermore, reducing the board size is advantageous for packaging when used in, for example, an electromechanical integrated actuator where space is limited. Moreover, the small and simple board size simplifies assembly. Furthermore, the smaller component size (including the logic circuit size within the IC) reduces the failure rate. These points will be explained in detail below.

[0037] In this embodiment, the motor control device 7 includes a first motor drive unit 8, a second motor drive unit 10, a first control unit 9, a second control unit 11, and a third control unit 41. The first motor drive unit 8 drives a brake motor 2 as a motor. The second motor drive unit 10 also drives the brake motor 2 as a motor. The first control unit 9 is connected to the first motor drive unit 8. The first control unit 9 acquires a detection value from a first rotation sensor 15, which serves as a first rotational position detector that detects the rotational position of the brake motor 2, and monitors the phase current of the second motor drive unit 10. For this purpose, a first phase current monitor circuit 35 is connected to the U2-phase power line 22, the V2-phase power line 23, and the W2-phase power line 24 of the second motor drive unit 10. The first phase current monitor circuit 35 is connected to the first control unit 9, and the first control unit 9 monitors the phase current of the second motor drive unit 10 using the first phase current monitor circuit 35. When the monitored value in the first phase current monitor circuit 35 is outside the normal range, the first control unit 9 determines that the second control unit 11 or the second motor drive unit 10 is abnormal.

[0038] That is, if the waveform of the phase current in second motor drive unit 10 is within the range of the expected current waveform, first control unit 9 determines that second control unit 11 and second motor drive unit 10 are normal, and if the waveform of the phase current in second motor drive unit 10 is outside the range of the expected current waveform, first control unit 9 determines that second control unit 11 or second motor drive unit 10 is abnormal. FIG. 4 shows an example of the time change (waveform) of the phase currents (U phase, V phase, W phase) in second motor drive unit 10. In FIG. 4, the range of the expected current waveform is indicated by a two-dot chain line. The range of the expected current waveform can be set, for example, as the range of the current waveform when second motor drive unit 10, and therefore second control unit 11, are in an appropriate state. In this case, the first control unit 9 can determine the correct current waveform (current phase and peak value) of the UVW three-phase current to be applied to the brake motor 2, for example, based on commands (target motor torque, braking force, piston thrust, motor control current value) from the integrated control device 33, which is a higher-level ECU, and the magnet polarity arrangement obtained from the detection value of the first rotation sensor 15. Then, as shown by "No good" in Fig. 4, if the waveform of the phase current in the second motor drive unit 10 falls outside the range of the expected current waveform (correct current waveform), the first control unit 9 determines that the second control unit 11 or the second motor drive unit 10 is abnormal.

[0039] In this embodiment, the first control unit 9 employs an inexpensive chipset that does not perform self-diagnosis for abnormality detection. The first control unit 9 then determines whether the behavior of the motor phase current of the second motor drive unit 10 connected to the counterpart second control unit 11 is normal or abnormal. If the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform, the first control unit 9 outputs a signal indicating that the second control unit 11 or the second motor drive unit 10 is abnormal, i.e., a signal to stop driving the second motor drive unit 10, to the second failsafe relay 10B via the second logic circuit 44.

[0040] The signal for stopping the drive of the second motor drive unit 10 corresponds to an abnormal command signal (ECU2_Disable signal) for disconnecting the second failsafe relay 10B. That is, the first control unit 9 outputs an abnormal command signal (third abnormal command signal) for disconnecting the second failsafe relay 10B serving as the second relay unit, based on the current phase determined based on the detection value of the first rotation sensor 15 and the phase current value of the second motor drive unit 10. In this case, the abnormal command signal can be set to 1 (High). That is, when the waveform of the phase current in the second motor drive unit 10 is within the range of the expected current waveform, the first control unit 9 outputs 0 (Low), which is a normal command signal, and when the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform, the first control unit 9 outputs 1 (High), which is an abnormal command signal.

[0041] On the other hand, second control unit 11 is connected to second motor drive unit 10. Second control unit 11 acquires the detection value of second rotation sensor 16, which serves as a second rotation position detection unit that detects the rotation position of brake motor 2, and monitors the phase current of first motor drive unit 8. For this purpose, second phase current monitor circuit 36 ​​is connected to U1-phase power line 18, V1-phase power line 19, and W1-phase power line 20 of first motor drive unit 8. Second phase current monitor circuit 36 ​​is connected to second control unit 11, and second control unit 11 monitors the phase current of first motor drive unit 8 using second phase current monitor circuit 36. If the monitored value of second phase current monitor circuit 36 ​​is outside the normal range, second control unit 11 determines that first control unit 9 or first motor drive unit 8 is abnormal.

[0042] That is, if the waveform of the phase current in first motor drive unit 8 is within the range of the expected current waveform, second control unit 11 determines that first control unit 9 and first motor drive unit 8 are normal, and if the waveform of the phase current in first motor drive unit 8 is outside the range of the expected current waveform, second control unit 11 determines that first control unit 9 or first motor drive unit 8 is abnormal. FIG. 4 also corresponds to an example of the time change (waveform) of the phase current (U phase, V phase, W phase) in first motor drive unit 8. The two-dot chain line in FIG. 4, i.e., the range of the expected current waveform, can be set, for example, as the range of the current waveform when first motor drive unit 8, and therefore first control unit 9, are in an appropriate state. In this case, the second control unit 11 can determine the correct current waveform (current phase and peak value) of the UVW three-phase current to be applied to the brake motor 2, for example, based on commands (target motor torque, braking force, piston thrust, motor control current value) from the integrated control device 33, which is a higher-level ECU, and the magnet polarity arrangement obtained from the detection value of the second rotation sensor 16. Then, as shown by "No good" in Fig. 4, if the waveform of the phase current in the first motor drive unit 8 falls outside the range of the expected current waveform (correct current waveform), the second control unit 11 determines that the first control unit 9 or the first motor drive unit 8 is abnormal.

[0043] In this embodiment, second control unit 11 employs an inexpensive chipset that does not perform self-diagnosis for abnormality detection. Second control unit 11 then determines whether the behavior of the motor phase current of first motor drive unit 8, which is connected to its counterpart, first control unit 9, is normal or abnormal. If the waveform of the phase current in first motor drive unit 8 is outside the range of an expected current waveform, second control unit 11 outputs a signal indicating that the first control unit 9 or first motor drive unit 8 is abnormal, i.e., a signal to stop driving first motor drive unit 8, to first failsafe relay 8B via first logic circuit 43.

[0044] The signal for stopping the drive of the first motor drive unit 8 corresponds to an abnormal command signal (ECU1_Disable signal) for disconnecting the first failsafe relay 8B. That is, the second control unit 11 outputs an abnormal command signal (first abnormal command signal) for disconnecting the first failsafe relay 8B serving as the first relay unit, based on the current phase determined based on the detection value of the second rotation sensor 16 and the phase current value of the first motor drive unit 8. In this case, the abnormal command signal can be set to 1 (High). That is, when the waveform of the phase current in the first motor drive unit 8 is within the range of the expected current waveform, the second control unit 11 outputs 0 (Low), which is a normal command signal, and when the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform, the second control unit 11 outputs 1 (High), which is an abnormal command signal.

[0045] Furthermore, the third control unit 41 acquires the detection value of a third rotation sensor 42, which serves as a third rotation position detection unit that detects the rotational position of the brake motor 2, and monitors the phase current of the first motor drive unit 8 and the phase current of the second motor drive unit 10. For this purpose, the third control unit 41 is connected to the third rotation sensor 42. The third rotation sensor 42 detects the rotational position (e.g., rotation angle) of the rotor 4 of the brake motor 2. The third rotation sensor 42 is a separate rotation sensor from the first rotation sensor 15 connected to the first control unit 9 and the second rotation sensor 16 connected to the second control unit 11. This ensures redundancy.

[0046] A third-phase current monitor circuit 37 is connected to the U1-phase power line 18, V1-phase power line 19, and W1-phase power line 20 of the first motor drive unit 8. The third-phase current monitor circuit 37 is connected to a third control unit 41, which monitors the phase currents of the first motor drive unit 8 using the third-phase current monitor circuit 37. A fourth-phase current monitor circuit 38 is connected to the U2-phase power line 22, V2-phase power line 23, and W2-phase power line 24 of the second motor drive unit 10. The fourth-phase current monitor circuit 38 is connected to the third control unit 41, which monitors the phase currents of the second motor drive unit 10 using the fourth-phase current monitor circuit 38.

[0047] The third control unit 41 includes, for example, a microcomputer (Micro Controller) and a regulator (Reg). The third control unit 41 is connected to the first power source 29 of the vehicle via the first DC power line 17. The third control unit 41 is also connected to the second power source 30 of the vehicle via the second DC power line 21. Although not shown, the regulator (Reg) of the third control unit 41 is connected to the third rotation sensor 42, the third phase current monitor circuit 37, and the fourth phase current monitor circuit 38. As a result, power is supplied to the third rotation sensor 42, the third phase current monitor circuit 37, and the fourth phase current monitor circuit 38 via the regulator (Reg) of the third control unit 41. The regulator (Reg) that supplies power may be separate from the third control unit 41. In this case, this separate regulator (Reg) is connected to the first power supply 29 and the second power supply 30, and power is supplied to the third control unit 41, the third rotation sensor 42, the third phase current monitor circuit 37, and the fourth phase current monitor circuit 38 via this separate regulator (Reg).

[0048] The third control unit 41 determines that the first control unit 9 or the first motor drive unit 8 is malfunctioning if the monitored value of the third-phase current monitor circuit 37 is outside the normal range. The third control unit 41 determines that the second control unit 11 or the second motor drive unit 10 is malfunctioning if the monitored value of the fourth-phase current monitor circuit 38 is outside the normal range. The malfunction determination is performed in the same manner as the determination of the phase current waveforms by the first control unit 9 and the second control unit 11. In this case, the third control unit 41 can determine the correct current waveform (current phase and peak value) of the UVW three-phase current applied to the brake motor 2, for example, based on commands (target motor torque, braking force, piston thrust, motor control current value) from the integrated control device 33, which is a higher-level ECU, and the magnet polarity arrangement obtained from the detection value of the third rotation sensor 42.

[0049] In this embodiment, the third control unit 41 can employ a chipset without a motor drive function, i.e., a chipset with low functionality. In other words, the third control unit 41 can employ an inexpensive monitoring microcomputer, thereby reducing costs. Furthermore, the third control unit 41 determines whether the behavior of the motor phase current of the first motor drive unit 8 connected to the first control unit 9 is normal or abnormal. At the same time, the third control unit 41 determines whether the behavior of the motor phase current of the second motor drive unit 10 connected to the second control unit 11 is normal or abnormal. If the waveform of the phase current in the first motor drive unit 8 is outside the range of an expected current waveform, the third control unit 41 outputs a signal to the first failsafe relay 8B via the first logic circuit 43 to stop driving the first motor drive unit 8. The signal to stop driving the first motor drive unit 8 corresponds to an abnormality command signal (ECU1_Disable signal) to shut off the first failsafe relay 8B. Furthermore, when the waveform of the phase current in the second motor drive unit 10 is outside the range of an expected current waveform, the third control unit 41 outputs a signal for stopping the drive of the second motor drive unit 10 to the second failsafe relay 10B via the second logic circuit 44. The signal for stopping the drive of the second motor drive unit 10 corresponds to an abnormality command signal (ECU2_Disable signal) for shutting off the second failsafe relay 10B.

[0050] That is, the third control unit 41 outputs an abnormal command signal (second abnormal command signal) for turning off the first failsafe relay 8B based on the current phase determined based on the detection value of the third rotation sensor 42 and the phase current value of the first motor drive unit 8. The third control unit 41 also outputs an abnormal command signal (fourth abnormal command signal) for turning off the second failsafe relay 10B based on the current phase determined based on the detection value of the third rotation sensor 42 and the phase current value of the second motor drive unit 10. In this case, the abnormal command signal can be set to 1 (High). That is, when the waveform of the phase current in the first motor drive unit 8 is within the range of the expected current waveform, the third control unit 41 outputs 0 (Low) as a normal command signal, and when the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform, the third control unit 41 outputs 1 (High) as an abnormal command signal. In addition, the third control unit 41 outputs 0 (Low), which is a normal command signal, when the waveform of the phase current in the second motor driving unit 10 is within the range of the expected current waveform, and outputs 1 (High), which is an abnormal command signal, when the waveform of the phase current in the second motor driving unit 10 is outside the range of the expected current waveform.

[0051] Next, the first failsafe relay 8B, the second failsafe relay 10B, the first logic circuit 43, and the second logic circuit 44 will be described with reference to FIGS. 2 and 3 in addition to FIG.

[0052] As shown in FIGS. 1 and 2 , the first motor drive unit 8 includes a first inverter circuit 8A serving as a first bridge circuit unit and a first fail-safe relay 8B serving as a first relay unit. The first fail-safe relay 8B switches between connection and disconnection between the first inverter circuit 8A and a first power source 29. The first control unit 9, the second control unit 11, and the third control unit 41 are connected to the first fail-safe relay 8B via a first logic circuit 43. When the output from the first logic circuit 43 is 0 (Low), the first fail-safe relay 8B is turned off (OFF), disconnecting the first inverter circuit 8A from the first power source 29. On the other hand, when the output from the first logic circuit 43 is 1 (High), the first fail-safe relay 8B is turned on (ON), connecting the first inverter circuit 8A to the first power source 29. The first logic circuit 43 corresponds to a relay switching unit (first relay switching unit) that switches the first fail-safe relay 8B between connected (on) and disconnected (off) based on signals (low, high) from the first control unit 9, the second control unit 11, and the third control unit 41.

[0053] On the other hand, as shown in FIGS. 1 and 3, the second motor drive unit 10 includes a second inverter circuit 10A serving as a second bridge circuit unit and a second fail-safe relay 10B serving as a second relay unit. The second fail-safe relay 10B switches between connection and disconnection between the second inverter circuit 10A and a second power source 30. The first control unit 9, the second control unit 11, and the third control unit 41 are connected to the second fail-safe relay 10B via a second logic circuit 44. When the output from the second logic circuit 44 is 0 (Low), the second fail-safe relay 10B is turned off (OFF), disconnecting the second inverter circuit 10A from the second power source 30. On the other hand, when the output from the second logic circuit 44 is 1 (High), the second fail-safe relay 10B is turned on (ON), connecting the second inverter circuit 10A and the second power source 30. The second logic circuit 44 corresponds to a relay switching unit (second relay switching unit) that switches the second failsafe relay 10B between connected (on) and disconnected (off) based on signals (low, high) from the first control unit 9, the second control unit 11, and the third control unit 41.

[0054] As shown in FIG. 2, the first logic circuit 43 includes a NAND circuit 43A and an AND circuit 43B. The input side of the NAND circuit 43A is connected to the output side of the third control unit 41 and the output side of the second control unit 11. The output side of the NAND circuit 43A is connected to the input side of the AND circuit 43B. When the NAND circuit 43A receives a 1 (High) signal indicating an abnormal command signal from both the third control unit 41 and the second control unit 11, the NAND circuit 43A outputs a 0 (Low) signal indicating an abnormal command signal to the AND circuit 43B. In contrast, when the NAND circuit 43A receives a 0 (Low) signal indicating a normal command signal from at least one of the third control unit 41 and the second control unit 11, the NAND circuit 43A outputs a 1 (High) signal indicating a normal command signal to the AND circuit 43B. That is, the NAND circuit 43A outputs a 1 (High) signal indicating a normal command signal unless the NAND circuit 43A receives a 1 (High) signal indicating an abnormal command signal from both the third control unit 41 and the second control unit 11.

[0055] The input side of the AND circuit 43B is connected to the output side of the first control unit 9 and the output side of the NAND circuit 43A. As a result, the third control unit 41 and the second control unit 11 are connected to the AND circuit 43B via the NAND circuit 43A. On the other hand, the output side of the AND circuit 43B is connected to the first failsafe relay 8B of the first motor drive unit 8. Here, the first control unit 9 outputs a signal (Enable signal) to the first logic circuit 43 (AND circuit 43B) to enable driving of the first motor drive unit 8 (first inverter circuit 8A). This signal corresponds to a drive enable signal that enables driving of the first motor drive unit 8, in other words, a signal that enables connection of the first failsafe relay 8B. In this case, the drive enable signal can be set to 1 (High). That is, when the first control unit 9 allows the first motor drive unit 8 (first inverter circuit 8A) to drive, it outputs 1 (High), which is a drive permission signal, and when it does not allow the first motor drive unit 8 (first inverter circuit 8A) to drive, it outputs 0 (Low), which is a drive non-permission signal.

[0056] When the AND circuit 43B receives a 1 (High) signal representing a drive permission signal from the first control unit 9 and a 1 (High) signal representing a normal command signal from the NAND circuit 43A, the AND circuit 43B outputs a 1 (High) signal representing a signal to connect the first failsafe relay 8B to the first failsafe relay 8B. This turns the first failsafe relay 8B on, connecting the first inverter circuit 8A and the first power supply 29. On the other hand, when the AND circuit 43B receives a 0 (Low) signal representing a drive non-permission signal from the first control unit 9 or a 0 (Low) signal representing an abnormality command signal from the NAND circuit 43A, the AND circuit 43B outputs a 0 (Low) signal representing a signal to disconnect the first failsafe relay 8B to the first failsafe relay 8B. This turns the first failsafe relay 8B off, disconnecting the first inverter circuit 8A and the first power supply 29. 6A is a truth table of the first failsafe relay 8B. As shown in FIG. 6A, even if the first control unit 9 outputs a drive permission signal of 1 (High), if both the third control unit 41 and the second control unit 11 output abnormal command signals (first abnormal command signal, second abnormal command signal) of 1 (High), the first failsafe relay 8B is shut off. This stops the drive of the first motor drive unit 8 (first inverter circuit 8A). That is, in this embodiment, if both the first abnormal command signal and the second abnormal command signal are output, the first failsafe relay 8B is shut off.

[0057] 3, the second logic circuit 44 also includes a NAND circuit 44A and an AND circuit 44B. The second logic circuit 44 differs from the first logic circuit 43 in that the input side of the NAND circuit 44A is connected to the output side of the third control unit 41 and the output side of the first control unit 9, the input side of the AND circuit 44B is connected to the output side of the second control unit 11, and the output side of the AND circuit 44B is connected to the second failsafe relay 10B of the second motor drive unit 10. Other than this, the configuration of the second logic circuit 44 is the same as that of the first logic circuit 43, so a detailed description of the second logic circuit 44 will be omitted. FIG. 6B shows a truth table of the second failsafe relay 10B. 6(B), even if the second control unit 11 outputs a drive permission signal of 1 (High), if both the third control unit 41 and the first control unit 9 output abnormal command signals (third abnormal command signal, fourth abnormal command signal) of 1 (High), the second failsafe relay 10B is disconnected. This stops the drive of the second motor drive unit 10 (second inverter circuit 10A). That is, in this embodiment, if both the third abnormal command signal and the fourth abnormal command signal are output, the second failsafe relay 10B is disconnected.

[0058] 1, in this embodiment, the first control unit 9, the second control unit 11, and the third control unit 41 are connected to an integrated control device 33 as a vehicle controller. When the first failsafe relay 8B is interrupted, the second control unit 11 or the third control unit 41 notifies the integrated control device 33 of an abnormality in the first control unit 9 or the first motor drive unit 8. When the second failsafe relay 10B is interrupted, the first control unit 9 or the third control unit 41 notifies the integrated control device 33 of an abnormality in the second control unit 11 or the second motor drive unit 10. Neither the first control unit 9 nor the second control unit 11 has a self-diagnosis function. In other words, the ASIL rating of the first control unit 9 and the ASIL rating of the second control unit are ASIL-B compliant.

[0059] Meanwhile, the integrated control device 33 (control units 33A and 33B) has a self-diagnosis function. In other words, the ASIL rating of the integrated control device 33 (control units 33A and 33B) is, for example, ASIL-D compliant. The third control unit 41 is connected to the integrated control device 33 via a first communication line 31A that connects the first control unit 9 and the integrated control device 33. The third control unit 41 is connected to the integrated control device 33 via a second communication line 31B that connects the second control unit 11 and the integrated control device 33. As a result, the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 form a ring network.

[0060] As described above, in the embodiment, the first control unit 9 and the second control unit 11 employ inexpensive chipsets that do not have a self-diagnostic function for detecting abnormalities. The first control unit 9 and the second control unit 11 then determine whether the behavior of the phase current of the other motor drive unit (the second motor drive unit 10 in the case of the first control unit 9, and the first motor drive unit 8 in the case of the second control unit 11) is normal. The normality of the behavior of the motor phase current can be determined by whether the correct current waveform (current phase and peak value) is obtained.

[0061] That is, the first control unit 9 and the second control unit 11 can understand the magnitude of the control current based on the target motor torque (or braking force, piston thrust, or motor control current value) commanded by communication from the integrated control device 33, which is a higher-level ECU. Furthermore, the first control unit 9 and the second control unit 11 can correctly understand the magnet polarity arrangement of the rotor 4 of the brake motor 2 using the first rotation sensor 15 or the second rotation sensor 16, which are motor rotation angle sensors (angle sensors) connected to them, and can correctly understand the phase of the UVW three-phase current applied to the brake motor 2. This allows the first control unit 9 and the second control unit 11 to determine the correct current waveform (current phase and peak value).

[0062] The first control unit 9 and the second control unit 11 then detect the phase current of the other motor drive unit (second motor drive unit 10 in the case of the first control unit 9, and first motor drive unit 8 in the case of the second control unit 11) using phase current monitor circuits 35, 36, which are current detection circuits (current monitoring circuits). As a result, the first control unit 9 can determine that some kind of abnormality has occurred on the other side if a mismatch occurs between the correct current waveform (current phase and peak value) and the current waveform of second motor drive unit 10 obtained by first phase current monitor circuit 35. The second control unit 11 can determine that some kind of abnormality has occurred on the other side if a mismatch occurs between the correct current waveform (current phase and peak value) and the current waveform of first motor drive unit 8 obtained by second phase current monitor circuit 36.

[0063] When the first control unit 9 and the second control unit 11 find that an abnormality has occurred on the other side, they shut off the other side's relay (first failsafe relay 8B, second failsafe relay 10B). For example, the first control unit 9 shuts off the second failsafe relay 10B of the second motor drive unit 10, stopping the second motor drive unit 10 from driving the brake motor 2. The second control unit 11 shuts off the first failsafe relay 8B of the first motor drive unit 8, stopping the first motor drive unit 8 from driving the brake motor 2. This makes it possible to shut off the bias of power supplied to the brake motor 2 when an abnormality has occurred on the other side.

[0064] If an abnormality occurs in the other microcomputer and the control current of the other microcomputer deviates from the correct current waveform, this can be detected and the other microcomputer's relay can be shut off. In this case, 50% of the remaining braking force can be secured. However, consider a case where an abnormality occurs in one's own microcomputer, causing its own control current to deviate from the correct current waveform and misjudging the other microcomputer's control current. In this case, if one microcomputer shuts off the other microcomputer's normal relay and the other microcomputer shuts off its own relay, both relays may be shut off. This would result in 0% of the remaining braking force, which is undesirable.

[0065] Therefore, in this embodiment, the motor controller includes a simple microcomputer that can be judged by a third party, a motor rotor angle sensor, and a current detection circuit. That is, motor control device 7, which is the motor controller of this embodiment, includes third control unit 41, which is a sensor ECU (SensECU), third rotation sensor 42, third phase current monitor circuit 37, and fourth phase current monitor circuit 38. Third control unit 41 predicts the current (phase current) of first motor drive unit 8 and the current (phase current) of second motor drive unit 10 based on the "command torque (command from upstream) from integrated control device 33" and the "rotational position (angle of the motor rotor) from third rotation sensor 42."

[0066] The third control unit 41 compares the "predicted current (phase current)" with the "current (phase current) detected by the third phase current monitor circuit 37" and the "current (phase current) detected by the fourth phase current monitor circuit 38." If the "current (phase current) detected by the third phase current monitor circuit 37" deviates from the "predicted current (phase current)," the third control unit 41 determines that an abnormality has occurred in the first control unit 9 or the first motor drive unit 8. If the third control unit 41 determines that an abnormality has occurred in the first control unit 9 or the first motor drive unit 8, it outputs an abnormality command signal (1: High) corresponding to the abnormality to the first logic circuit 43 (first failsafe relay 8B side) on the first motor drive unit 8 side. Furthermore, if the "current (phase current) detected by the fourth phase current monitor circuit 38" deviates from the "predicted current (phase current)," the third control unit 41 determines that an abnormality has occurred in the second control unit 11 or the second motor drive unit 10. If the third control unit 41 determines that there is an abnormality in the second control unit 11 or the second motor driving unit 10, it outputs an abnormality command signal (1: High) corresponding to the abnormality to the second logic circuit 44 on the second motor driving unit 10 side (second fail-safe relay 10B side).

[0067] Meanwhile, the first control unit 9 predicts the current (phase current) of the second motor drive unit 10 based on the "command torque (command from upstream) from the integrated control device 33" and the "rotational position (angle of the motor rotor) from the first rotation sensor 15." The first control unit 9 compares the "predicted current (phase current)" with the "current (phase current) detected by the first phase current monitor circuit 35." If the "current (phase current) detected by the first phase current monitor circuit 35" deviates from the "predicted current (phase current)," the first control unit 9 determines that there is an abnormality in the second control unit 11 or the second motor drive unit 10. If the first control unit 9 determines that there is an abnormality in the second control unit 11 or the second motor drive unit 10, it outputs an abnormality command signal (1: High) corresponding to the abnormality to the second logic circuit 44 on the second motor drive unit 10 side (second fail-safe relay 10B side).

[0068] Furthermore, the second control unit 11 predicts the current (phase current) of the first motor drive unit 8 based on the "command torque (command from upstream) from the integrated control device 33" and the "rotational position (angle of the motor rotor) from the second rotation sensor 16." The second control unit 11 compares the "predicted current (phase current)" with the "current (phase current) detected by the second phase current monitor circuit 36." If the "current (phase current) detected by the second phase current monitor circuit 36" deviates from the "predicted current (phase current)," the second control unit 11 determines that there is an abnormality in the first control unit 9 or the first motor drive unit 8. If the second control unit 11 determines that there is an abnormality in the first control unit 9 or the first motor drive unit 8, it outputs an abnormality command signal (1: High) corresponding to the abnormality to the first logic circuit 43 on the first motor drive unit 8 side (first fail-safe relay 8B side).

[0069] If both the first control unit 9 and the third control unit 41 determine that an abnormality has occurred, i.e., if abnormality command signals (1: High) are input from both the first control unit 9 and the third control unit 41 to the second logic circuit 44 on the second failsafe relay 10B side, the second logic circuit 44 outputs a signal (0: Low) to disconnect the second failsafe relay 10B. This disconnects the second failsafe relay 10B, and driving of the brake motor 2 by the second motor driving unit 10 stops. At this time, driving of the brake motor 2 by the first control unit 9 (e.g., 50% output) continues. Also, if both the second control unit 11 and the third control unit 41 determine that an abnormality has occurred, i.e., if abnormality command signals (1: High) are input from both the second control unit 11 and the third control unit 41 to the first logic circuit 43 on the first failsafe relay 8B side, the first logic circuit 43 outputs a signal (0: Low) to disconnect the first failsafe relay 8B. As a result, the first failsafe relay 8B is disconnected, and the first motor drive unit 8 stops driving the brake motor 2. At this time, the second control unit 11 continues to drive the brake motor 2 (for example, at 50% output).

[0070] In this way, the first control unit 9, the second control unit 11, and the third control unit 41 output a signal to shut off the relay when they determine that an abnormality has occurred, i.e., an abnormality command signal (1: High), to the logic circuits 43, 44. The fail-safe relays 8B, 10B are shut off when both a signal from the "first control unit 9 or the second control unit 11" and a signal from the "third control unit 41" are input to the logic circuits 43, 44. That is, the fail-safe relays 8B, 10B are shut off only when the shut-off signal (abnormality command signal) from the first control unit 9 or the second control unit 11 and the shut-off signal (abnormality command signal) from the third control unit 41 satisfy an AND condition. As a result, power supply to the brake motor 2 from the motor drive unit 8, 10 on the side determined to be abnormal is stopped.

[0071] The motor control device and motor control system for a four-wheeled vehicle according to the embodiment has the configuration described above, and its operation will now be described.

[0072] For example, the integrated control device 33 outputs a torque control request command to the first control unit 9 and the second control unit 11, which command drives the brake motor 2. The first control unit 9 and the second control unit 11 use a control map to drive the brake motor 2 with current via the first motor drive unit 8 and the second motor drive unit 10, based on the torque control request command and the rotational position of the first rotation sensor 15 and the second rotation sensor 16. The torque control request command from the integrated control device 33 is also input to the third control unit 41. The third control unit 41 predicts the phase current of the first motor drive unit 8 and the current of the second motor drive unit 10 (expected values ​​of the phase currents) based on the torque control request command and the rotational position of the third rotation sensor 42.

[0073] Here, for example, if a fault occurs in the first control unit 9, the waveforms of the motor phase currents (U, V, W) detected by the second phase current monitor circuit 36 ​​and the third phase current monitor circuit 37 will deviate from expected values. The second control unit 11 determines that a fault has occurred in the first control unit 9 when the motor phase current waveforms detected by the second phase current monitor circuit 36 ​​deviate from expected values. The third control unit 41 also determines that a fault has occurred in the first control unit 9 when the motor phase current waveforms detected by the third phase current monitor circuit 37 deviate from expected values.

[0074] When the motor phase current waveform in first motor drive unit 8 deviates from the expected value, it is assumed that, for example, there is a malfunction in first power supply 29, or a malfunction in the microcomputer or pre-driver of first control unit 9. The deviation of the motor phase current waveform from the expected value due to such a malfunction or malfunction is detected by second phase current monitor circuit 36 ​​and third phase current monitor circuit 37. When second control unit 11 determines that a fault has occurred in first control unit 9, it outputs an abnormality command signal (1: High) to first logic circuit 43 to shut off first failsafe relay 8B. When third control unit 41 determines that a fault has occurred in first control unit 9, it outputs an abnormality command signal (1: High) to first logic circuit 43 to shut off first failsafe relay 8B.

[0075] At this time, the first failsafe relay 8B is shut off according to the truth table of the first failsafe relay 8B shown in FIG. 6A, and power supply from the first motor drive unit 8 to the brake motor 2 is stopped. At the same time, the second control unit 11 or the third control unit 41 notifies the integrated control device 33 that a fault has occurred in the first control unit 9. When the integrated control device 33 receives the notification from the second control unit 11 or the third control unit 41 (that a fault has occurred in the first control unit 9), it transitions to a standby state for degradation control as necessary. Examples of degradation control that can be performed include limiting the vehicle speed, changing the braking balance, and changing the standby position and clearance of the target wheel.

[0076] Here, when a fault occurs in the first control unit 9, the first control unit 9 may output an abnormality command signal (1: High) to the second logic circuit 44 to shut off the second failsafe relay 10B, even though the control current of the second motor drive unit 10 is correct. In this case, however, the third control unit 41 does not output an abnormality command signal (1: High) to the second logic circuit 44 to shut off the second failsafe relay 10B, so the second failsafe relay 10B is not shut off. As described above, in this embodiment, logic circuits (the first logic circuit 43 and the second logic circuit 44) are provided that are based on the consensus of two or more ECUs, and a majority decision is made. This makes it possible to shut off the ECU in which a fault (fault) has occurred, and to prevent erroneous shutoff of an ECU that is operating normally. When a fault occurs in the second control unit 11, the operation is the same as when a fault occurs in the first control unit 9, except that the first control unit 9 and the third control unit 41 shut off the second failsafe relay 10B via the second logic circuit 44. Therefore, a description of when a fault occurs in the second control unit 11 will be omitted.

[0077] 5 shows the control processing (current monitoring processing) performed by the first control unit 9, the second control unit 11, and the third control unit 41. The control processing in FIG. 5 is executed repeatedly, for example, at a predetermined control period (for example, 1 ms). In the following explanation, the processing performed by the first control unit 9 will be explained as a representative example. The processing performed by the second control unit 11 and the processing performed by the third control unit 41 are similar to the processing performed by the first control unit 9 except for the objects to be monitored and the relays to be shut off, so explanations thereof will be omitted.

[0078] For example, when power supply to the first control unit 9 starts, the process of Fig. 5 starts. In S1, the first control unit 9 determines whether a fault (abnormality) has occurred on the side of the second control unit 11. That is, the first control unit 9 determines, via the first phase current monitor circuit 35, whether the waveform of the phase current in the second motor drive unit 10 is outside the range of an expected current waveform. In other words, the first control unit 9 determines, via the first phase current monitor circuit 35, whether the current control value of the second motor drive unit 10 set by the second control unit 11 is inconsistent with the current control value of the first control unit 9, which is the expected value.

[0079] If S1 returns "NO," i.e., if it is determined that the waveform of the phase current in the second motor drive unit 10 is within the range of the expected current waveform, the process returns. That is, the process returns to the start via RETURN, and the processes from S1 onwards are repeated. Note that if S1 returns "NO," the abnormality counter that counts up in S2, which will be described later, is reset. On the other hand, if S1 returns "YES," i.e., if it is determined that the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform, the process proceeds to S2.

[0080] In S2, the abnormality counter is counted up. In S3 following S2, it is determined whether the count value of the abnormality counter is equal to or greater than a threshold value. The count value threshold can be set, for example, as the time period during which it is possible to determine that an abnormality (fault) has occurred, that is, the time period during which it is possible to prevent an abnormality (fault) from being determined to have occurred despite the fact that the current is normal due to a temporary erroneous detection or error in the phase current. If S3 returns "NO," that is, if it is determined that the count value of the abnormality counter is not equal to or greater than the threshold value, the process returns. In this case, the abnormality counter is not reset, and the processes from S1 onwards are repeated.

[0081] On the other hand, if S3 returns "YES," i.e., if it is determined that the count value of the abnormality counter is equal to or greater than the threshold, the process proceeds to S4. In this case, it can be determined that an abnormality (fault) has occurred. Therefore, in S4, a signal to shut off the relay is output. For example, the first control unit 9 outputs a 1 (High) abnormality command signal to the NAND circuit 44A of the second logic circuit 44. At the same time, the first control unit 9 notifies the integrated control device 33 that an abnormality (fault) has occurred on the second control unit 11 side. The second control unit 11 outputs a 1 (High) abnormality command signal to the NAND circuit 43A of the first logic circuit 43. At the same time, the second control unit 11 notifies the integrated control device 33 that an abnormality (fault) has occurred on the first control unit 9 side.

[0082] In the case of the third control unit 41, if the waveform of the phase current on the first control unit 9 side deviates, it outputs an abnormality command signal to the NAND circuit 43A of the first logic circuit 43, and if the waveform of the phase current on the second control unit 11 side deviates, it outputs an abnormality command signal to the NAND circuit 44A of the second logic circuit 44. At the same time, the third control unit 41 notifies the integrated control device 33 that an abnormality (fault) has occurred on the first control unit 9 side or the second control unit 11 side. After outputting the abnormality command signal and notifying the integrated control device 33, which serves as the higher-level ECU, that an abnormality (fault) has occurred, the control returns. At this time, the abnormality counter is not reset. When notified of the occurrence of an abnormality (fault), the integrated control device 33 determines whether degradation control (for example, limiting vehicle speed, changing braking balance, changing the standby position and clearance of the target wheel, etc.) is necessary. When it is determined that degradation control is necessary, the integrated control device 33 performs degradation control such as limiting the vehicle speed, changing the braking balance, and changing the standby position and clearance of the target wheel.

[0083] As described above, according to the embodiment, the vehicle is equipped with three control units (ECUs): the first control unit 9, the second control unit 11, and the third control unit 41. The first control unit 9, the second control unit 11, and the third control unit 41 acquire the rotational position of the brake motor 2 from the first rotation sensor 15, the second rotation sensor 16, and the third rotation sensor 42, which are separate rotational position detectors. Additionally, the first control unit 9, the second control unit 11, and the third control unit 41 mutually monitor the phase currents of the first motor drive unit 8 and the second motor drive unit 10. Therefore, even if the first control unit 9 does not have a self-diagnosis function, the second control unit 11 and the third control unit 41 can determine whether or not the "first control unit 9 or the first motor drive unit 8" is abnormal based on the rotational position and phase currents of the brake motor 2.

[0084] Furthermore, even if the second control unit 11 does not have a self-diagnosis function, the first control unit 9 and the third control unit 41 can determine whether the "second control unit 11 or the second motor drive unit 10" is abnormal based on the rotational position and phase current of the brake motor 2. This allows for reduced costs for the first control unit 9 and the second control unit 11. Furthermore, when an abnormality is determined, the control unit 9 (11) and motor drive unit 8 (10) determined to be abnormal are stopped, and the brake motor 2 can continue to be driven by the control unit 11 (9) and motor drive unit 10 (8) that are not determined to be abnormal. This ensures redundancy. This allows for both low cost and redundancy. In other words, cost reduction can be achieved while achieving redundancy.

[0085] According to the embodiment, the first motor drive unit 8 includes a first fail-safe relay 8B that switches between connection and disconnection between the first inverter circuit 8A and the first power source 29. The second control unit 11 outputs a first abnormality command signal (1: High) for disconnecting the first fail-safe relay 8B based on the current phase determined based on the detection value of the second rotation sensor 16 and the phase current value of the first motor drive unit 8. Additionally, the third control unit 41 outputs a second abnormality command signal (1: High) for disconnecting the first fail-safe relay 8B based on the current phase determined based on the detection value of the third rotation sensor 42 and the phase current value of the first motor drive unit 8. Therefore, the first fail-safe relay 8B of the first motor drive unit 8 can switch between connection and disconnection between the first inverter circuit 8A and the first power source 29 using the two signals, the first abnormality command signal and the second abnormality command signal.

[0086] According to the embodiment, when both the first abnormality command signal (1: High) and the second abnormality command signal (1: High) are output, the first failsafe relay 8B is shut off. Therefore, when both the second control unit 11 and the third control unit 41 determine that the first control unit 9 side is abnormal, the first motor drive unit 8 can stop driving the brake motor 2. Conversely, when either (only one of) the second control unit or the third control unit determines that the first control unit 9 side is abnormal, the first motor drive unit 8 can continue driving the brake motor 2. Therefore, it is possible to accurately determine whether the first control unit 9 side is abnormal, and when it is determined that there is an abnormality, the first motor drive unit 8 can reliably stop driving the brake motor 2. The same applies to the second failsafe relay 10B.

[0087] In the embodiment, the target functions (enable / disable) of the outputs of the first control unit 9, the second control unit 11, and the third control unit 41 are set to high active logic. Also, the safety design concept / policy is such that the enable signal for the main function is recessive and the disable signal for the safety function is dominant.

[0088] According to the embodiment, when the first failsafe relay 8B is interrupted, the second control unit 11 or the third control unit 41 notifies the integrated control device 33 of an abnormality in the first control unit 9 or the first motor drive unit 8. This allows the integrated control device 33 to know that the first failsafe relay 8B has been interrupted. The abnormality notification may be made by both the second control unit 11 and the third control unit 41, or by either the second control unit 11 or the third control unit 41. Furthermore, when the second failsafe relay 10B is interrupted, the first control unit 9 or the third control unit 41 notifies the integrated control device 33 of an abnormality in the second control unit 11 or the second motor drive unit 10. In this case, the abnormality notification may be made by both the first control unit 9 and the third control unit 41, or by either the first control unit 9 or the third control unit 41. When the integrated control device 33 is notified of the abnormality, it can perform necessary control, such as degradation control.

[0089] Whether the first failsafe relay 8B and the first failsafe relay 8B operate normally, i.e., whether they can be properly cut off, can be diagnosed (initial diagnosis) at the start-up of the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33. For example, at the start-up of the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33, all of the eight conditions are operated for each relay according to the truth table shown in FIG. 6 as an initial diagnosis. At this time, by monitoring the voltage value downstream of the relay, it can be determined whether the first failsafe relay 8B and the first failsafe relay 8B operate normally.

[0090] Furthermore, the current control by the first control unit 9 and the first motor drive unit 8, the current control by the second control unit 11 and the second motor drive unit 10, the current detection by the first phase current monitor circuit 35, the current detection by the second phase current monitor circuit 36, the current detection by the third phase current monitor circuit 37, and the current detection by the fourth phase current monitor circuit 38 can also be diagnosed (initial diagnosis) to determine whether they are normal. For example, when the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 are started, as an initial diagnosis, the first control unit 9 outputs a forward torque command to the first motor drive unit and the second control unit 11 outputs a reverse torque command to the second motor drive unit so that the brake motor 2 does not rotate. At this time, by monitoring the rotation and phase current of the brake motor 2, it can be determined whether the current control and current detection are normal.

[0091] According to the embodiment, the first control unit 9 and the second control unit 11 do not have a self-diagnosis function. Therefore, low-cost microcomputers (ECUs) can be used as the first control unit 9 and the second control unit 11. On the other hand, a microcomputer (ECU) for current monitoring can be used as the third control unit 41. That is, the third control unit 41 does not need to control the motor drive (motor driving unit) (control with a short execution cycle and complex control) like a microcomputer (ECU) for motor control. Therefore, the third control unit 41 can also be made low-cost. However, the cost may vary depending on conditions (quantity conditions), such as the number of products in which the device has been adopted. Therefore, a calculation device for motor control may be used as the third control unit 41. In any case, since a calculation device with low functionality can be used as the third control unit 41, cost reduction can be expected.

[0092] According to the embodiment, the ASIL rating of the first control unit 9 and the ASIL rating of the second control unit 11 are ASIL-B compliant. Therefore, it is possible to adopt a low-cost microcomputer (ECU) that is ASIL-B compliant as the first control unit 9 and the second control unit 11.

[0093] According to the embodiment, the first control unit 9, the second control unit 11, and the third control unit 41 are connected to the integrated control device 33. Therefore, the first control unit 9, the second control unit 11, and the third control unit 41 can communicate (transmit, receive) necessary information (signals) with the integrated control device 33.

[0094] According to the embodiment, the integrated control device 33 is an integrated controller that determines vehicle motion control and is equipped with a self-diagnosis function. Therefore, the first control unit 9, the second control unit 11, and the third control unit 41 can be connected to an integrated controller equipped with a self-diagnosis function. On the other hand, neither the first control unit 9 nor the second control unit 11 is equipped with a self-diagnosis function. Therefore, a low-cost microcomputer (ECU) can be used as the first control unit 9 and the second control unit 11.

[0095] According to the embodiment, the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 configure a ring network. Therefore, for example, even if the path (communication line) connecting the first control unit 9 and the integrated control device 33, the path (communication line) connecting the second control unit 11 and the integrated control device 33, the path (communication line) connecting the third control unit 41 and the first control unit 9, or the path (communication line) connecting the third control unit 41 and the second control unit 11 is disconnected (disconnected), necessary information (signals) can be transmitted (sent, received) between the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33.

[0096] That is, the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 can form a ring network by transmitting information between them in a clockwise and counterclockwise direction. Therefore, the information transmitted in a clockwise and counterclockwise direction can be dropped off and loaded at each device (the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33) along the transmission path. This allows information to be transmitted to each device even if one of the paths is interrupted. However, there is a possibility that the delay in information transmission may fluctuate slightly. Therefore, conversely, it is believed that by monitoring the delay in information transmission under normal circumstances, it is also possible to monitor the timing.

[0097] According to the embodiment, the motor driven by the first motor drive unit 8 and the second motor drive unit 10 is the brake motor 2 that controls the electric brake mechanism. Therefore, the brake motor 2 can be driven by the first motor drive unit 8 connected to the first control unit 9 and the second motor drive unit 10 connected to the second control unit 11.

[0098] In the embodiment, the current monitor circuits 35, 36, 37, and 38 are configured to detect currents in three phases: U, V, and W. However, this is not limiting. For example, the currents in two of the three phases may be detected and the current in the remaining phase may be estimated. That is, in a motor star connection, the current flowing in always flows out through the motor path, so the sum of the currents in the U, V, and W phases is always zero. Therefore, if the currents for two phases can be detected, the current in the remaining phase can be estimated. Therefore, the currents in two of the three phases may be detected and the current in the remaining phase may be estimated. Furthermore, while a shunt resistor may be used to monitor the phase currents, the shunt resistor may be non-redundant (one) or redundant (two).

[0099] In the embodiment, the first control unit 9 and the second control unit 11 are described as not having a self-diagnosis function. However, this is not limiting. For example, one or both of the first control unit 9 and the second control unit 11 may be configured to have a low-accuracy (low-function) self-diagnosis function. Furthermore, for example, one or both of the first control unit 9 and the second control unit 11 may be configured to have a high-accuracy (high-function) self-diagnosis function. In this case, the ASIL rating of the first control unit 9 and / or the ASIL rating of the second control unit do not need to be ASIL-B compliant. In other words, the ASIL rating of the first control unit 9 and / or the ASIL rating of the second control unit may be ASIL-A compliant, ASIL-C compliant, or ASIL-D compliant.

[0100] In the embodiment, a dual system including a first control unit 9 (secondary system) and a second control unit 11 (primary system) has been described as an example. However, the present invention is not limited to this and can be used for multiple systems greater than dual systems, such as a triple system or quadruple system.

[0101] In the embodiment, the motor driven by the first motor drive unit 8 and the second motor drive unit 10 is the brake motor 2 that controls an electric brake mechanism that applies braking force to a vehicle. However, the present invention is not limited to this. The motor driven by the first motor drive unit and the second motor drive unit may be, for example, a steering motor that controls (drives) a steering actuator of a vehicle. In this case, the steering motor can be driven by the first motor drive unit connected to the first control unit and the second motor drive unit connected to the second control unit. In either case, the motor driven by the first motor drive unit and the second motor drive unit is not limited to a brake motor or a steering motor, but may also be a motor for driving various actuators mounted on a vehicle (a motor that requires redundancy). In this case, the motor may be, for example, a water pump, an oil pump, a traction motor, or other motor that requires redundant configuration and must continue to be controlled by the remaining system if one system fails. In other words, the motor control device and motor control system of the embodiment can be widely applied as a motor control device and control system that can continue to control the motor using the remaining system (one-fail operation possible) if one system fails to function.

[0102] In the embodiment, the vehicle controller (vehicle controller) is described as an example of an integrated control device 33 (integrated ECU, central ECU) that determines vehicle motion control for moving the vehicle along a target trajectory obtained from an automatic driving control device (automatic driving ECU). However, the vehicle controller (vehicle controller) is not limited to this, and may be a control device other than the integrated control device 33, such as a steering control device or a suspension control device, that is, not a higher-level control device. Various control devices (ECUs) mounted on the vehicle may be used as the vehicle controller (vehicle controller).

[0103] According to the embodiment described above, the motor control device (motor controller) includes three control units: a first control unit, a second control unit, and a third control unit. The first control unit, the second control unit, and the third control unit each acquire the rotational position of the motor from a separate rotational position detection unit (first rotational position detection unit, second rotational position detection unit, and third rotational position detection unit). Additionally, the first control unit, the second control unit, and the third control unit mutually monitor the phase current of the first motor drive unit and the phase current of the second motor drive unit. Therefore, even if the first control unit does not have a self-diagnosis function, the second control unit and the third control unit can determine whether the "first control unit or the first motor drive unit" is abnormal based on the rotational position and phase current of the motor. Furthermore, even if the second control unit does not have a self-diagnosis function, the first control unit and the third control unit can determine whether the "second control unit or the second motor drive unit" is abnormal based on the rotational position and phase current of the motor. This allows for reduced costs for the first control unit and the second control unit.

[0104] Furthermore, when an abnormality is determined, the control unit and motor drive unit determined to be abnormal are stopped, and the motor can be continued to be driven by the control unit and motor drive unit that are not determined to be abnormal. This ensures redundancy. This allows for both low cost and redundancy. In other words, cost can be reduced while achieving redundancy.

[0105] According to this embodiment, the first motor drive unit includes a first relay unit that switches between connection and disconnection of the first bridge circuit unit and the power supply. The second control unit outputs a first abnormality command signal for disconnecting the first relay unit based on the current phase determined based on the detection value of the second rotational position detection unit and the phase current value of the first motor drive unit. Additionally, the third control unit outputs a second abnormality command signal for disconnecting the first relay unit based on the current phase determined based on the detection value of the third rotational position detection unit and the phase current value of the first motor drive unit. Therefore, the first relay unit of the first motor drive unit can switch between connection and disconnection of the first bridge circuit unit and the power supply using the two signals, the first abnormality command signal and the second abnormality command signal.

[0106] According to the embodiment, when both the first abnormality command signal and the second abnormality command signal are output, the first relay unit is shut off. Therefore, when both the second control unit and the third control unit determine that the "first control unit or the first motor drive unit" is abnormal, the driving of the motor by the first motor drive unit can be stopped. Conversely, when one (only one) of the second control unit and the third control unit determines that the "first control unit or the first motor drive unit" is abnormal, the driving of the motor by the first motor drive unit can be continued. Therefore, it is possible to accurately determine whether the "first control unit or the first motor drive unit" is abnormal, and to reliably stop the driving of the motor by the first motor drive unit when it is determined that the "first control unit or the first motor drive unit" is abnormal.

[0107] According to the embodiment, when the first relay unit is disconnected, the second control unit or the third control unit notifies the vehicle controller of an abnormality in the first control unit or the first motor drive unit, so that the vehicle controller can know that the first relay unit is disconnected.

[0108] According to the embodiment, the first control unit and the second control unit do not have a self-diagnosis function, and therefore, a low-cost microcomputer (ECU) can be used as the first control unit and the second control unit.

[0109] According to the embodiment, the ASIL rating of the first control unit and the ASIL rating of the second control unit are ASIL-B compliant. Therefore, a low-cost microcomputer (ECU) that is ASIL-B compliant can be used as the first control unit and the second control unit.

[0110] According to the embodiment, the first control unit, the second control unit, and the third control unit are connected to a controller of the vehicle, and therefore, the first control unit, the second control unit, and the third control unit can transmit (transmit, receive) necessary information (signals) to and from the controller of the vehicle.

[0111] According to the embodiment, the vehicle controller is an integrated controller that determines vehicle motion control and has a self-diagnosis function. Therefore, the first control unit, the second control unit, and the third control unit can be connected to the integrated controller that has the self-diagnosis function. On the other hand, neither the first control unit nor the second control unit has the self-diagnosis function. Therefore, a low-cost microcomputer (ECU) can be used as the first control unit and the second control unit.

[0112] According to the embodiment, the first control unit, the second control unit, the third control unit, and the vehicle controller configure a ring network. Therefore, even if, for example, a path (communication line) connecting the first control unit and the vehicle controller, a path (communication line) connecting the second control unit and the vehicle controller, a path (communication line) connecting the third control unit and the first control unit, or a path (communication line) connecting the third control unit and the second control unit is disconnected (disconnected), necessary information (signals) can be transmitted (sent, received) between the first control unit, the second control unit, the third control unit, and the vehicle controller.

[0113] According to the embodiment, the motor is a brake motor that controls an electric brake mechanism, and therefore the brake motor can be driven by a first motor drive unit connected to the first control unit and a second motor drive unit connected to the second control unit.

[0114] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0115] This application claims priority to Japanese Patent Application No. 2022-117009, filed July 22, 2022. The entire disclosure of Japanese Patent Application No. 2022-117009, filed July 22, 2022, including the specification, claims, drawings, and abstract, is incorporated herein by reference in its entirety. [Explanation of symbols]

[0116] 1. Motor control system 2 Brake motor (motor) 7 Motor control device (motor controller) 8 First motor drive unit 8A 1st inverter circuit (1st bridge circuit) 8B First fail-safe relay (first relay section) 9. First Control Section 10 Second motor drive unit 11 Second control section 15 First rotation sensor (first rotation position detection unit) 16 Second rotation sensor (second rotation position detection unit) 29 1st power supply (power supply) 33 Integrated control device (vehicle controller, vehicle controller, integrated controller) 41 Third Control Section 42 Third rotation sensor (third rotation position detection unit)

Claims

1. A motor control device, the motor control device comprising: a first motor driving unit that drives the motor; a second motor driving unit that drives the motor; a first control unit connected to the first motor drive unit, a first control unit that acquires a detection value of a first rotational position detection unit that detects a rotational position of the motor and monitors a phase current of the second motor drive unit; a second control unit connected to the second motor drive unit, a second control unit that acquires a detection value of a second rotational position detection unit that detects a rotational position of the motor and monitors a phase current of the first motor drive unit; a third control unit that acquires a detection value of a third rotational position detection unit that detects a rotational position of the motor and monitors a phase current of the first motor drive unit and a phase current of the second motor drive unit; Equipped with The third control unit does not have a motor driving function. Motor control device.

2. 2. The motor control device according to claim 1, The first motor driving unit a first bridge circuit portion; a first relay unit that switches between connection and disconnection between the first bridge circuit unit and a power source; Equipped with the second control unit outputs a first abnormality command signal for interrupting the first relay unit based on a current phase determined based on a detection value of the second rotational position detection unit and a phase current value of the first motor drive unit; the third control unit outputs a second abnormality command signal for interrupting the first relay unit, based on a current phase determined based on the detection value of the third rotational position detection unit and a phase current value of the first motor drive unit. Motor control device.

3. 3. The motor control device according to claim 2, When both the first abnormality command signal and the second abnormality command signal are output, the first relay unit is shut off. Motor control device.

4. 4. The motor control device according to claim 3, the first control unit, the second control unit, and the third control unit are connected to a controller of a vehicle; When the first relay unit is interrupted, the second control unit or the third control unit notifies a controller of the vehicle of an abnormality in the first control unit or the first motor drive unit. Motor control device.

5. 2. The motor control device according to claim 1, The first control unit and the second control unit do not have a self-diagnosis function. Motor control device.

6. 2. The motor control device according to claim 1, The ASIL rating of the first control unit and the ASIL rating of the second control unit are ASIL-B compliant. Motor control device.

7. 2. The motor control device according to claim 1, the first control unit, the second control unit, and the third control unit are connected to a controller of a vehicle; Motor control device.

8. 8. The motor control device according to claim 7, the vehicle controller is an integrated controller that determines motion control of the vehicle and has a self-diagnosis function; Neither the first control unit nor the second control unit has a self-diagnosis function. Motor control device.

9. 8. The motor control device according to claim 7, The first control unit, the second control unit, the third control unit, and a vehicle controller configure a ring network. Motor control device.

10. 2. The motor control device according to claim 1, the motor is a brake motor that controls an electric brake mechanism that applies a braking force to the vehicle; Motor control device.

11. 1. A motor control system, comprising: A motor; a motor controller for controlling the motor; The motor controller a first motor driving unit that drives the motor; a second motor driving unit that drives the motor; a first control unit connected to the first motor drive unit, a first control unit that acquires a detection value of a first rotational position detection unit that detects a rotational position of the motor and monitors a phase current of the second motor drive unit; a second control unit connected to the second motor drive unit, a second control unit that acquires a detection value of a second rotational position detection unit that detects a rotational position of the motor and monitors a phase current of the first motor drive unit; a third control unit that acquires a detection value of a third rotational position detection unit that detects a rotational position of the motor and monitors a phase current of the first motor drive unit and a phase current of the second motor drive unit; Equipped with The motor control system also includes: a vehicle controller connected to the first control unit, the second control unit, and the third control unit; Preparation, The third control unit does not have a motor driving function. Motor control system.

Images