Power supply control device and control method for the power supply control device

Abstract

To provide a power supply control device and a control method that suppress the false detection of power supply failures and thereby prevent the function of loads from being restricted.SOLUTION: A power supply control device according to an embodiment comprises an inter-system connection unit, a first detection device, and a second detection device. The inter-system connection unit is capable of breaking an electrical connection between a first system for supplying the electric power of a first power supply to a first load and a second system for supplying the electric power of a second power supply to a second load. The first detection device detects abnormality of the first system or abnormality of the second system when a physical quantity indicating the first system state or second system state exceeds a first threshold for abnormality determination from the normal value side and this state continues for a first detection time, and cuts off the inter-system connection unit. The second detection device specifies as an abnormal system the system, of the first and second systems, which has the physical quantity that exceeds a second threshold for abnormality determination from the normal value side, which continues for a second detection time shorter than the first detection time after the first detection device detects abnormality.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a power control device and a control method for the power control device.

Background Art

[0002] There is a power control device including a first system that supplies power of a first power source to a first load, a second system that supplies power of a second power source to a second load, and an inter-system connection part capable of disconnecting an electrical connection between the first system and the second system.

[0003] When the voltage continuously drops for a first predetermined time in the first system or the second system, the power control device makes a primary determination of the occurrence of a power failure and disconnects the electrical connection between the first system and the second system by the inter-system connection part. Then, after the electrical connection between the first system and the second system is disconnected by the inter-system connection part, when the voltage further continuously drops for a second predetermined time, the power control device makes a secondary determination to confirm the occurrence of a power failure. Then, by supplying power from the system in which no power failure has occurred to the load, fail-safe control is executed by the load connected to the system in which no power failure has occurred (see, for example, Patent Document 1).

[0004] In the above power control device, the first predetermined time is set shorter than the second predetermined time. When the voltage continuously drops for the first predetermined time, for example, when there is a tendency of a ground fault as a power failure in the first system or the second system, the inter-system connection part disconnects the electrical connection between the first system and the second system. Thereby, the power control device suppresses the influence of a ground fault on a normal system.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

[0006] However, conventional power control devices may, for example, incorrectly detect a ground fault in their primary determination if the voltage drops due to voltage fluctuations when no ground fault actually exists. As a result, even if no ground fault is actually present, the load's functionality may be restricted until the secondary determination returns it to its normal state. Furthermore, the load's functionality may be restricted if the energy storage capacity of the backup power supply (one of the first and second power supplies) decreases due to the secondary determination. For example, if the energy storage capacity of the backup power supply decreases, some of the load's functions that are normally executable may be disabled.

[0007] The present invention has been made in view of the above, and aims to suppress the limitation of load functionality by suppressing false detection of power failure. [Means for solving the problem]

[0008] A power control device according to one embodiment comprises an inter-system connection unit, a first detection device, and a second detection device. The inter-system connection unit can disconnect the electrical connection between a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load. The first detection device detects an abnormality in the first system or the second system if a physical quantity indicating the state of the first system or the second system exceeds a first threshold for abnormality determination from the normal value side for a first detection time, and disconnects the inter-system connection unit. After the first detection device detects an abnormality, the second detection device identifies the system among the first and second systems in which a physical quantity exceeds a second threshold for abnormality determination from the normal value side for a second detection time that is shorter than the first detection time as the abnormal system. [Effects of the Invention]

[0009] According to one embodiment, by suppressing false detection of power failure, it is possible to suppress limitations on the function of the load. [Brief explanation of the drawing]

[0010] [Figure 1] Figure 1 is an explanatory diagram showing an example of the configuration of the power control device 1 according to the first embodiment. [Figure 2] Figure 2 shows the normal state when no ground faults occur in the first and second systems. [Figure 3] Figure 3 shows the state where the amount of stored energy in the second power source is less than the first predetermined amount of stored energy. [Figure 4] Figure 4 shows the state when a ground fault occurs in the first system. [Figure 5] Figure 5 shows a state in which a ground fault occurs in the first system, the inter-system connection is turned OFF, and the battery switch is turned ON. [Figure 6] Figure 6 is a flowchart illustrating the error handling process according to the first embodiment. [Figure 7] Figure 7 is a flowchart illustrating the error detection process according to the first embodiment. [Figure 8] Figure 8 is a flowchart illustrating the error handling process according to the first embodiment. [Figure 9] Figure 9 is a flowchart illustrating the error handling process according to the second embodiment. [Figure 10] Figure 10 is a diagram illustrating a second detection device related to a modified example. [Modes for carrying out the invention]

[0011] The power control device and the control method of the power control device according to the embodiment will be described in detail below with reference to the attached drawings. However, this invention is not limited to this embodiment. In the following description, a power control device that is mounted on a vehicle equipped with an autonomous driving function and supplies power to a load will be used as an example, but the power control device according to the embodiment may also be mounted on a vehicle that is not equipped with an autonomous driving function.

[0012] In the following, a case where the vehicle equipped with the power control device is an electric vehicle or a hybrid vehicle will be described. However, the vehicle equipped with the power control device may be an engine vehicle that runs by an internal combustion engine.

[0013] Note that the power control device according to the embodiment may be mounted on any device that backs up the first power source by the power source system of the second power source when an abnormality occurs in the power source system of the first power source. The abnormality includes a power failure. The power failure occurs, for example, due to a ground fault. In the following, a case where the abnormality is a ground fault will be described.

[0014] (First Embodiment) FIG. 1 is an explanatory diagram showing a configuration example of a power control device 1 according to the first embodiment. As shown in FIG. 1, the power control device 1 according to the embodiment is connected to a first power source 10, a first load 101, a general load 102, a second load 103, and an automatic driving control device 100. The power control device 1 includes a first system 110 and a second system 120. The first system 110 supplies the power of the first power source 10 to the first load 101 and the general load 102. The second system 120 supplies the power of a second power source 20, which will be described later, to the second load 103.

[0015] The first load 101 includes loads for automatic driving. For example, the first load 101 includes a steering motor, an electric brake device, and an in-vehicle camera that operate during automatic driving.

[0016] The general load 102 is a load that is not directly involved in automatic driving, and includes, for example, a display, an air conditioner, an audio, a video, and various lights.

[0017] The second load 103 includes a part of the functions for automatic driving provided by the first load 101. For example, the second load 103 includes a steering motor, an electric braking device, and devices that are minimally required for FOP (fail operation) such as a radar. The first load 101, the general load 102, and the second load 103 operate by the electric power supplied from the power supply control device 1. FOP is a control for causing the vehicle to retreat to a safe location by the automatic driving control device 100. FOP is executed using the other system even when a ground fault occurs in either the first system 110 or the second system 120 during automatic driving.

[0018] The automatic driving control device 100 is a device that controls the automatic driving of the vehicle. The automatic driving control device 100 causes the vehicle to travel by automatic driving by operating the first load 101 and the second load 103. Further, when a ground fault occurs in the first system 110 during automatic driving, the automatic driving control device 100 can perform FOP by the second load 103. When a ground fault occurs in the second system 120 during automatic driving, the automatic driving control device 100 can perform FOP by the first load 101.

[0019] The automatic driving control device 100 outputs a signal indicating that it is in the automatic driving state to the power supply control device 1. For example, the automatic driving control device 100 outputs a signal indicating that it is in the automatic driving state to the first detection device 31 of the power supply control device 1 described later. When it is not in the automatic driving state, the automatic driving control device 100 does not output a signal indicating that it is in the automatic driving state to the power supply control device 1. When it is not in the automatic driving state, the automatic driving control device 100 may output a signal indicating that it is not in the automatic driving state to the power supply control device 1.

[0020] The first power supply 10 includes a DC / DC converter (hereinafter referred to as "DC / DC 11") and a lead battery (hereinafter referred to as "PbB 12"). Note that the battery of the first power supply 10 may be any secondary battery other than PbB 12.

[0021] DC / DC11 is connected to a generator (not shown) and a high-voltage battery (not shown) with a voltage higher than PbB12. DC / DC11 steps down the voltages of the generator and the high-voltage battery and outputs them to the first system 110. The generator is, for example, an alternator that generates electricity by converting the kinetic energy of a moving vehicle. The high-voltage battery is, for example, a vehicle drive battery installed in an electric vehicle or a hybrid vehicle.

[0022] When the first power supply 10 is installed in an engine-powered vehicle, an alternator (generator) is provided instead of the DC / DC 11. The DC / DC 11 charges the PbB 12 and supplies power to the first load 101 and the general load 102. The DC / DC 11 also supplies power to the second load 103 and charges the second power supply 20, which will be described later.

[0023] The power control device 1 comprises a second power supply 20, an inter-system connection unit 41, a battery switch 42, a switch drive device 3, a first voltage sensor 51, and a second voltage sensor 52. The second power supply 20 is a backup power supply for when the power supply from the first power supply 10 becomes unavailable. The second power supply 20 is equipped with a lithium-ion battery (hereinafter referred to as "LiB21"). Note that the battery of the second power supply 20 may be any secondary battery other than LiB21.

[0024] The inter-system connection unit 41 is provided on the inter-system line 130 that connects the first system 110 and the second system 120. The inter-system connection unit 41 can disconnect the electrical connection between the first system 110 and the second system 120. The inter-system connection unit 41 is a switch that can connect and disconnect the first system 110 and the second system 120. The inter-system connection unit 41 may also be a DC / DC converter that, when activated, creates conductivity between the first system 110 and the second system 120. If the inter-system connection unit 41 is a DC / DC converter, the connection between the first system 110 and the second system 120 is interrupted by stopping the operation of the DC / DC converter.

[0025] Connecting the inter-system connection 41 means electrically connecting the first system 110 and the second system 120, that is, making them conductive. Conversely, disconnecting the inter-system connection 41 means disconnecting the electrical connection between the first system 110 and the second system 120, that is, interrupting it.

[0026] The battery switch 42 is a switch that connects the second power supply 20 to the second system 120. The battery switch 42 is a switch that can connect and disconnect the second power supply 20 and the second system 120.

[0027] The first voltage sensor 51 is provided in the first system 110. The first voltage sensor 51 detects the voltage of the first system 110. The first voltage sensor 51 outputs the detection result to the switch drive device 3. The second voltage sensor 52 is provided in the second system 120. The second voltage sensor 52 detects the voltage of the second system 120. The second voltage sensor 52 outputs the detection result to the switch drive device 3.

[0028] The switch driver unit 3 includes a microcomputer with a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), and various circuits. The switch driver unit 3 may also include hardware such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

[0029] The switch drive unit 3 controls the operation of the power control device 1. The switch drive unit 3 comprises a first detection device 31 and a second detection device 32. At least some of the functions of the first detection device 31 and the second detection device 32 may be integrated.

[0030] The first detection device 31 is a microcomputer. The first detection device 31 functions by having the CPU execute a program stored in ROM, using RAM as the working area.

[0031] The first detection device 31 detects a ground fault in the first system 110 or the second system 120 based on a physical quantity indicating the state of the first system 110 or the second system 120, a first detection time, and a first threshold. The physical quantity is either voltage or current. The following description will focus on the case where the physical quantity is voltage. Details of the processing in the first detection device 31 will be described later.

[0032] The first detection time is a preset time. The first detection time is the time during which voltage changes in each system 110 and 120 are suppressed from being falsely detected as ground faults, when no ground faults have occurred in either the first system 110 or the second system 120. The first detection time is, for example, 100 ms.

[0033] The first threshold is a preset value. The first threshold is a threshold for anomaly detection. The first threshold is a threshold related to a physical quantity. The first threshold is set relative to the normal value of the physical quantity. The normal value of the physical quantity is the value of the physical quantity when no ground fault occurs in either the first system 110 or the second system 120. For example, the normal value of the physical quantity is the average value of the physical quantity when no ground fault occurs in either the first system 110 or the second system 120. The normal value of the physical quantity is set based on the results of experiments and simulations. If the physical quantity is voltage, the first threshold is a threshold related to voltage. If the physical quantity is voltage, the first threshold is smaller than the normal value of the physical quantity.

[0034] If the voltage detected by the second voltage sensor 52 (hereinafter referred to as "second system voltage V2") exceeds the first threshold from the normal voltage value for a period of time or longer, the first detection device 31 detects a ground fault in the first system 110 or in the second system 120. Specifically, if the second system voltage V2 remains below the first threshold for a period of time or longer, the first detection device 31 detects a ground fault in the first system 110 or in the second system 120. If the second system voltage V2 remains below the first threshold for a period of time or longer, the first detection device 31 makes a provisional determination that a ground fault has occurred.

[0035] The first detection device 31 may also detect a ground fault in the first system 110 or in the second system 120 based on the voltage detected by the first voltage sensor 51 (hereinafter referred to as "first system voltage V1").

[0036] The first detection device 31 controls the inter-system connection unit 41 and the battery switch 42. Details of the processing related to the inter-system connection unit 41 and the battery switch 42 will be described later.

[0037] The first detection device 31 can switch the inter-system connection unit 41 ON or OFF. When the inter-system connection unit 41 is ON, the first system 110 and the second system 120 are electrically connected. When the inter-system connection unit 41 is OFF, the first system 110 and the second system 120 are electrically disconnected.

[0038] The first detection device 31 can switch the battery switch 42 ON or OFF. When the battery switch 42 is ON, the second power supply 20 and the second system 120 are electrically connected. When the battery switch 42 is OFF, the second power supply 20 and the second system 120 are electrically disconnected.

[0039] The second detection device 32 is a microcomputer. The second detection device 32 functions by having the CPU execute a program stored in ROM, using RAM as the working area. The second detection device 32 may also be composed of hardware circuits.

[0040] The second detection device 32 identifies the faulty system where a ground fault has occurred in the first system 110 and the second system 120 based on the physical quantity, the second detection time, and the second threshold. The second detection device 32 identifies the faulty system after the first detection device 31 has detected a ground fault in the first system 110 or in the second system 120, and the electrical connection between the first system 110 and the second system 120 has been disconnected by the inter-system connection unit 41. Details of the processing in the second detection device 32 will be described later.

[0041] The second detection time is a preset time. The second detection time is shorter than the first detection time. The second detection time is the time after the first detection device 31 detects a ground fault, during which a voltage drop is detected, allowing for early confirmation of the occurrence of a ground fault. For example, the second detection time is 4 ms.

[0042] The second threshold is a preset value. The second threshold is used for anomaly detection. The second threshold is a threshold related to a physical quantity. The second threshold is set relative to the normal value of the physical quantity. If the physical quantity is voltage, the second threshold is a threshold related to voltage. If the physical quantity is voltage, the second threshold is smaller than the normal value of the physical quantity. For example, the second threshold is the same value as the first threshold.

[0043] If the voltage V1 of the first system exceeds the second threshold from the normal voltage range for a period of time greater than the second detection time, the second detection device 32 detects a ground fault in the first system 110. Specifically, if the voltage V1 of the first system remains below the second threshold for a period of time greater than the second detection time, the second detection device 32 detects a ground fault in the first system 110. The second detection device 32 then identifies the first system 110 as an abnormal system where a ground fault has occurred. The second detection device 32 makes a final determination of the occurrence of a ground fault.

[0044] If the first system voltage V1 remains below the second threshold for a period of time greater than the second detection time, the second detection device 32 does not detect a ground fault in the first system 110. If the first system voltage V1 is equal to or greater than the second threshold, the second detection device 32 does not detect a ground fault in the first system 110. In other words, the second detection device 32 determines that the first system 110 is normal. For example, if the first system voltage V1 becomes equal to or greater than the second threshold during the second detection time, the second detection device 32 determines that the first system 110 is normal.

[0045] If the voltage V2 of the second system exceeds the second threshold from the normal voltage range for a period of time greater than the second detection time, the second detection device 32 detects a ground fault in the second system 120. Specifically, if the voltage V2 of the second system remains below the second threshold for a period of time greater than the second detection time, the second detection device 32 detects a ground fault in the second system 120. The second detection device 32 then identifies the second system 120 as an abnormal system where a ground fault has occurred. The second detection device 32 makes a final determination of the occurrence of a ground fault.

[0046] If the second system voltage V2 remains below the second threshold for a period of time greater than the second detection time, the second detection device 32 does not detect a ground fault in the second system 120. If the second system voltage V2 is above the second threshold, the second detection device 32 does not detect a ground fault in the second system 120. In other words, the second detection device 32 determines that the second system 120 is normal. For example, if the second system voltage V2 becomes above the second threshold during the second detection time, the second detection device 32 determines that the second system 120 is normal.

[0047] If the second detection device 32 determines that both the first system 110 and the second system 120 are normal, it determines that the ground fault detection by the first detection device 31 is a false positive. The provisional determination by the first detection device 31 is then canceled. The provisional determination by the first detection device 31 is canceled by the first detection device 31 based on the result of the false positive determination by the second detection device 32.

[0048] The second detection device 32 controls the inter-system connection unit 41 and the battery switch 42. Details of the processing related to the inter-system connection unit 41 and the battery switch 42 will be described later.

[0049] The second detection device 32 can switch the inter-system connection section 41 ON or OFF. The second detection device 32 can switch the battery switch 42 ON or OFF.

[0050] When the power control device 1 is started, the first detection device 31 turns on the inter-system connection unit 41 and turns off the battery switch 42. If no ground fault is detected in each system 110 and 120, that is, if each system 110 and 120 is functioning normally, the first detection device 31 turns on the inter-system connection unit 41 and turns off the battery switch 42.

[0051] Furthermore, if both systems 110 and 120 are functioning normally, and the amount of charge stored in the second power supply 20 is less than a preset first predetermined amount of charge, the first detection device 31 turns on the battery switch 42. As a result, power is supplied from the first power supply 10 to the second power supply 20, thereby charging the second power supply 20. The first predetermined amount of charge is the amount of charge that allows for FOP (Fault-on Operation) to be performed by supplying power from the second power supply 20 to the second load 103 in the event of a ground fault in the first system 110 during automatic operation.

[0052] Furthermore, when charging of the second power supply 20 begins and the amount of charge stored in the second power supply 20 becomes greater than a preset second predetermined amount of charge, the first detection device 31 turns off the battery switch 42. The second predetermined amount of charge is greater than the first predetermined amount of charge. The amount of charge is, for example, SOC (State of Charge). Instead of the amount of charge, the charge rate and remaining capacity may be used.

[0053] Furthermore, at least part of the control of the inter-system connection section 41 and the battery switch 42 described above may be performed by the second detection device 32.

[0054] When the first detection device 31 detects a ground fault in the first system 110 or in the second system 120, it turns off the inter-system connection part 41 and turns on the battery switch 42.

[0055] When a ground fault is detected in the second system 120, the second detection device 32 turns off the battery switch 42 while keeping the inter-system connection 41 OFF.

[0056] If the first detection device 31 has not detected a ground fault in the first system 110 or the second system 120, it outputs an automatic operation permission signal to the automatic operation control device 100 indicating that automatic operation is possible. Specifically, if no ground fault has been detected in the first system 110 or the second system 120, and the amount of stored energy in the second power supply 20 is equal to or greater than the first predetermined amount of stored energy, the first detection device 31 outputs an automatic operation permission signal to the automatic operation control device 100.

[0057] Even if the first detection device 31 has not detected a ground fault in the first system 110 or the second system 120, if the amount of stored energy in the second power supply 20 is less than the first predetermined amount of stored energy, the first detection device 31 will not output an automatic operation permission signal to the automatic operation control device 100. In this case, the first detection device 31 will output an automatic operation prohibition signal to the automatic operation control device 100 indicating that automatic operation is not possible.

[0058] When the first detection device 31 detects a ground fault in the first system 110 or the second system 120, it outputs a preliminary FOP (Field On-the-Plate) judgment signal to the automatic operation control device 100 indicating that a ground fault has been detected in the first system 110 or the second system 120. Upon outputting the preliminary FOP judgment signal to the automatic operation control device 100, the automatic operation control device 100 operates the first load 101 using power supplied from the first power supply 10. Upon outputting the preliminary FOP judgment signal to the automatic operation control device 100, the automatic operation control device 100 operates the second load 103 using power supplied from the second power supply 20.

[0059] When the second detection device 32 identifies a ground fault in the first system 110 or the second system 120, it outputs an FOP (Fault Operation) determination signal to the automatic operation control device 100 indicating that a ground fault has been identified in the first system 110 or the second system 120. Upon outputting the FOP determination signal to the automatic operation control device 100, the automatic operation control device 100 executes FOP using the system in which no ground fault has been identified. In other words, the second detection device 32 initiates FOP by outputting the FOP determination signal to the automatic operation control device 100.

[0060] Next, the operation of the switch drive device 3 will be explained with reference to Figures 2 to 5.

[0061] In normal operation when no ground faults occur in the first system 110 and the second system 120, the first detection device 31 turns OFF the battery switch 42 and ON the inter-system connection part 41, as shown in Figure 2. Figure 2 shows the normal operation when no ground faults occur in the first system 110 and the second system 120. Note that Figure 2 shows the state when the amount of stored energy in the second power supply 20 is equal to or greater than the first predetermined amount of stored energy. In this case, power is supplied from the first power supply 10 to the first load 101, the general load 102, and the second load 103. The first detection device 31 outputs an automatic operation permission signal to the automatic operation control device 100.

[0062] Even under normal conditions where no ground faults occur in the first system 110 and the second system 120, if the amount of charge stored in the second power supply 20 is less than the first predetermined amount, the first detection device 31 turns on the battery switch 42, as shown in Figure 3. Figure 3 shows the state in which the amount of charge stored in the second power supply 20 is less than the first predetermined amount. Note that the inter-system connection part 41 is ON. As a result, power is supplied from the first power supply 10 to the second power supply 20, and the second power supply 20 is charged. The first detection device 31 outputs an automatic operation prohibition signal to the automatic operation control device 100.

[0063] If a ground fault occurs in the first system 110 or the second system 120, for example, if a ground fault 200 occurs in the first system 110 as shown in Figure 4, an overcurrent flows towards the ground fault point. As a result, the voltages detected by the first voltage sensor 51 and the second voltage sensor 52 decrease. Figure 4 shows the state when a ground fault 200 occurs in the first system 110. If the voltage remains below the first threshold for a period of time greater than the first detection time, the first detection device 31 detects a ground fault in the first system 110 or the second system 120. When the first detection device 31 detects a ground fault 200, it turns on the battery switch 42 and turns off the inter-system connection part 41, as shown in Figure 5. The first detection device 31 outputs an FOP provisional judgment signal to the automatic operation control device 100. Figure 5 shows the state in which a ground fault 200 occurs in the first system 110, the inter-system connection 41 is turned OFF, and the battery switch 42 is turned ON.

[0064] If, after a ground fault is detected by the first detection device 31, the voltage of the first system 110 remains below the second threshold for a period of time greater than the second detection time, the second detection device 32 detects a ground fault in the first system 110. In other words, the second detection device 32 identifies the first system 110 as an abnormal system. When the second detection device 32 identifies an abnormal system, it turns on the battery switch 42 and keeps the inter-system connection 41 OFF, as shown in Figure 5. The second detection device 32 outputs an FOP (Fast Operation Point) determination signal to the automatic operation control device 100. As a result, the automatic operation control device 100 controls the second load 103 based on the power of the second power supply 20 to perform FOP.

[0065] Furthermore, if, after a ground fault is detected by the first detection device 31, the voltage of the second system 120 remains below the second threshold for a period of time greater than the second detection time, the second detection device 32 detects a ground fault in the second system 120. In other words, the second detection device 32 identifies the second system 120 as an abnormal system.

[0066] Next, the abnormality detection process according to the first embodiment will be described with reference to Figures 6 to 8. Figures 6 to 8 are flowcharts illustrating the abnormality detection process according to the first embodiment. This abnormality detection process implements the first detection device 31 and the second detection device 32 using a single microcomputer.

[0067] The first detection device 31 turns on the inter-system connection unit 41 when the power control device 1 is started (S100). Next, the first detection device 31 turns off the battery switch 42 (S101). As a result, the first load 101, the general load 102, and the second load 103 are supplied with power from the first power supply 10.

[0068] Next, the first detection device 31 determines whether or not the vehicle is in automatic driving mode (S102). The first detection device 31 determines whether or not it has received a signal from the automatic driving control device 100 indicating that the vehicle is in automatic driving mode. If the first detection device 31 has received a signal indicating that the vehicle is in automatic driving mode, it determines that the vehicle is in automatic driving mode. If the first detection device 31 has not received a signal indicating that the vehicle is in automatic driving mode, it determines that the vehicle is not in automatic driving mode. If the first detection device 31 has not received a signal indicating that the vehicle is in automatic driving mode, it determines that the vehicle is in manual driving mode.

[0069] If the first detection device 31 determines that the vehicle is not in automatic operation mode (S102: No), it repeats the determination of whether or not the vehicle is in automatic operation mode (S102).

[0070] If the first detection device 31 determines that automatic operation is in progress (S102: Yes), it determines whether the second system voltage V2 is below the first threshold (S103). That is, the first detection device 31 determines whether a voltage drop has occurred in the first system 110 or the second system 120.

[0071] If the first detection device 31 determines that the second system voltage V2 is below the first threshold (S103: Yes), it increments the temporary abnormality timer (S104). The first detection device 31 has a temporary abnormality timer. The value of the temporary abnormality timer is initially set to "0". The value of the temporary abnormality timer indicates the duration for which the second system voltage V2 is below the first threshold. In other words, the first detection device 31 measures the time for which the second system voltage V2 is continuously below the first threshold using the temporary abnormality timer.

[0072] If the first detection device 31 determines that the second system voltage V2 is equal to or greater than the first threshold (S103: No), it clears the temporary abnormality timer (S105). That is, if the first detection device 31 determines that the second system voltage V2 is equal to or greater than the first threshold, it resets the value of the temporary abnormality timer to its initial value. After clearing the temporary abnormality timer, the first detection device 31 returns to step S103 and repeats the above process.

[0073] Next, the first detection device 31 determines whether the value of the temporary abnormality timer is equal to or greater than the first detection time (S106). That is, the first detection device 31 determines whether the time during which the second system voltage V2 is below the first threshold continues for longer than the first detection time. More specifically, the first detection device 31 determines whether the voltage drop in the first system 110 or the second system 120 continues for longer than the first detection time.

[0074] If the first detection device 31 determines that the value of the temporary abnormality timer is not equal to or greater than the first detection time (S106: No), it returns to step S103 and repeats the above process.

[0075] The first detection device 31 determines that the value of the temporary abnormality timer is equal to or greater than the first detection time (S106; Yes), and performs a temporary abnormality determination (S107). The temporary abnormality determination indicates that a ground fault has been detected in either the first system 110 or the second system 120. In other words, the first detection device 31 detects a ground fault in either the first system 110 or the second system 120.

[0076] Next, if the first detection device 31 determines that there is a temporary anomaly, it turns OFF the inter-system connection unit 41 (S108). Also, if the first detection device 31 determines that there is a temporary anomaly, it turns ON the battery switch 42 (S109). In other words, if a ground fault is detected in the first system 110 or the second system 120, the first detection device 31 turns OFF the inter-system connection unit 41 and turns ON the battery switch 42.

[0077] Note that steps S108 and S109 may be performed simultaneously.

[0078] When the inter-system connection unit 41 is turned OFF and the battery switch 42 is turned ON, power is supplied to the first load 101 and the general load 102 from the first power supply 10. Also, when the inter-system connection unit 41 is turned OFF and the battery switch 42 is turned ON, power is supplied to the second load 103 from the second power supply 20.

[0079] After the inter-system connection unit 41 is turned OFF (S108) and the battery switch 42 is turned ON (S109), the second detection device 32 determines whether the first system voltage V1 is below the second threshold (S110). That is, the second detection device 32 determines whether a voltage drop has occurred in the first system 110 after the inter-system connection unit 41 has been turned OFF.

[0080] If the second detection device 32 determines that the first system voltage V1 is less than the second threshold (S110: Yes), it increments the first abnormal timer (S111). The second detection device 32 has a first abnormal timer. The value of the first abnormal timer is initially set to "0". The value of the first abnormal timer indicates the duration for which the first system voltage V1 is less than the second threshold. In other words, the second detection device 32 measures the time for which the first system voltage V1 is continuously less than the second threshold using the first abnormal timer.

[0081] Next, the second detection device 32 clears the first normal timer (S112). The second detection device 32 has a first normal timer. The value of the first normal timer is initially set to "0". The value of the first normal timer indicates the duration for which the first system voltage V1 is equal to or greater than the second threshold. If the second detection device 32 determines that the voltage detected by the first voltage sensor 51 is less than the second threshold, it resets the first normal timer to its initial value.

[0082] Note that the order of steps S111 and S112 may be reversed. Also, steps S111 and S112 may be performed simultaneously.

[0083] The second detection device 32 determines whether the value of the first abnormal timer is equal to or greater than the second detection time (S113). That is, the second detection device 32 determines whether the time during which the first system voltage V1 is below the second threshold continues for a period of time equal to or greater than the second detection time. More specifically, after the inter-system connection unit 41 is turned OFF, the second detection device 32 determines whether the state in the first system 110 where the voltage is below the second threshold continues for a period of time equal to or greater than the second detection time.

[0084] If the second detection device 32 determines that the value of the first abnormality timer is less than the second detection time (S113: No), it performs the process of step S120 described later.

[0085] If the second detection device 32 determines that the value of the first abnormality timer is equal to or greater than the second detection time (S113: Yes), it sets the first abnormality determination flag to "1" (S114). The second detection device 32 has a first abnormality determination flag. The first abnormality determination flag is a flag that indicates whether or not a ground fault has been detected in the first system 110. When the first abnormality determination flag is "1", the first abnormality determination flag indicates that a ground fault has been detected in the first system 110. The first abnormality determination flag is initially set to "0". If the second detection device 32 determines that the value of the first abnormality timer is equal to or greater than the second detection time, it detects the occurrence of a ground fault in the first system 110. In other words, if the second detection device 32 determines that the value of the first abnormality timer is equal to or greater than the second detection time, it identifies the first system 110 as an abnormal system.

[0086] Next, the second detection device 32 turns on the battery switch 42 (S115). This enables fail-safe control, supplying power from the second power supply 20 to the second load 103, and the automatic operation control device 100 performs FOP (Fast Operation Program). If the battery switch 42 is already ON, step S115 is skipped.

[0087] If the second detection device 32 determines that the first system voltage V1 is equal to or greater than the second threshold (S110: No), it increments the first normal timer (S116). In other words, the second detection device 32 measures the time during which the first system voltage V1 remains equal to or greater than the second threshold using the first normal timer.

[0088] The second detection device 32 clears the first abnormality timer (S117). That is, if the second detection device 32 determines that the first system voltage V1 is equal to or greater than the second threshold, it resets the first abnormality timer to its initial value. More specifically, if the first system voltage V1 falls below the second threshold and then rises to or above the second threshold within the second detection time, the second detection device 32 resets the first abnormality timer to its initial value.

[0089] Note that the order of steps S116 and S117 may be reversed. Also, steps S116 and S117 may be performed simultaneously.

[0090] Next, the second detection device 32 determines whether the value of the first normal timer is equal to or greater than the third detection time (S118). That is, the second detection device 32 determines whether the time during which the first system voltage V1 is equal to or greater than the second threshold is equal to or greater than the third detection time. The third detection time is a preset time. The third detection time is the time at which the first detection device 31 confirms the false detection of a ground fault. For example, the third detection time is the same as the second detection time.

[0091] If the second detection device 32 determines that the value of the first normal timer is less than the third detection time (S118: No), it performs the process of step S120 described later.

[0092] If the second detection device 32 determines that the value of the first normal timer is equal to or greater than the third detection time (S118: Yes), it sets the first normal determination flag to "1" (S119). The second detection device 32 has a first normal determination flag. The first normal determination flag is a flag that indicates whether or not a ground fault has occurred in the first system 110. When the first normal determination flag is "1", the first normal determination flag indicates that a ground fault has not occurred in the first system 110. The first normal determination flag is initially set to "0". If the second detection device 32 determines that the value of the first normal timer is equal to or greater than the third detection time, it determines that a ground fault has not occurred in the first system 110. In other words, the second detection device 32 confirms that the first system 110 is normal.

[0093] The second detection device 32 determines whether the voltage V2 of the second system is below the second threshold (S120). That is, the second detection device 32 determines whether a voltage drop has occurred in the second system 120 after the inter-system connection 41 has been turned OFF.

[0094] If the second detection device 32 determines that the second system voltage V2 is below the second threshold (S120: Yes), it increments the second abnormal timer (S121). The second detection device 32 has a second abnormal timer. The value of the second abnormal timer is initially set to "0". The value of the second abnormal timer indicates the duration for which the second system voltage V2 is below the second threshold. In other words, the second detection device 32 measures the time for which the second system voltage V2 is continuously below the second threshold using the second abnormal timer.

[0095] Next, the second detection device 32 clears the second normal timer (S122). The second detection device 32 has a second normal timer. The value of the second normal timer is initially set to "0". The value of the second normal timer indicates the duration for which the second system voltage V2 is equal to or greater than the second threshold. If the second detection device 32 determines that the voltage detected by the second voltage sensor 52 is less than the second threshold, it resets the second normal timer to its initial value.

[0096] Note that the order of steps S121 and S122 may be reversed. Also, steps S121 and S122 may be performed simultaneously.

[0097] Next, the second detection device 32 determines whether the value of the second abnormal timer is equal to or greater than the second detection time (S123). That is, the second detection device 32 determines whether the time during which the second system voltage V2 is below the second threshold continues for a period of time equal to or greater than the second detection time. More specifically, after the inter-system connection unit 41 is turned OFF, the second detection device 32 determines whether the state in the second system 120 where the voltage is below the second threshold continues for a period of time equal to or greater than the second detection time.

[0098] If the second detection device 32 determines that the value of the second abnormality timer is less than the second detection time (S123: No), it performs the process of step S130 described later.

[0099] If the second detection device 32 determines that the value of the second abnormal timer is equal to or greater than the second detection time (S123: Yes), it sets the second abnormal determination flag to "1" (S124). The second detection device 32 has a second abnormal determination flag. The second abnormal determination flag is a flag that indicates whether or not a ground fault has been detected in the second system 120. When the second abnormal determination flag is "1", the second abnormal determination flag indicates that a ground fault has been detected in the second system 120. The second abnormal determination flag is initially set to "0". If the second detection device 32 determines that the value of the second abnormal timer is equal to or greater than the second detection time, it detects the occurrence of a ground fault in the second system 120. In other words, if the second detection device 32 determines that the value of the second abnormal timer is equal to or greater than the second detection time, it identifies the second system 120 as an abnormal system.

[0100] Next, the second detection device 32 turns off the battery switch 42 (S125). As a result, power is not supplied from the second power supply 20 to the second load 103. This triggers a fail-safe control that supplies power from the first power supply 10 to the first load 101 and the general load 102, and the automatic operation control device 100 performs FOP (Fast Operation Program).

[0101] If the second detection device 32 determines that the second system voltage V2 is equal to or greater than the second threshold (S120: No), it increments the second normal timer (S126). In other words, the second detection device 32 measures the time during which the second system voltage V2 remains equal to or greater than the second threshold using the second normal timer.

[0102] Next, the second detection device 32 clears the second abnormality timer (S127). That is, if the second detection device 32 determines that the second system voltage V2 is equal to or greater than the second threshold, it resets the second abnormality timer to its initial value. More specifically, if the second system voltage V2 falls below the second threshold and then rises to or above the second threshold within the second detection time, the second detection device 32 resets the second abnormality timer to its initial value.

[0103] Note that the order of steps S126 and S127 may be reversed. Also, steps S126 and S127 may be performed simultaneously.

[0104] Next, the second detection device 32 determines whether the value of the second normal timer is equal to or greater than the third detection time (S128). That is, the second detection device 32 determines whether the time during which the second system voltage V2 is equal to or greater than the second threshold continues for longer than the third detection time.

[0105] If the second detection device 32 determines that the value of the second normal timer is less than the third detection time (S128: No), it performs the process of step S130 described later.

[0106] If the second detection device 32 determines that the value of the second normal timer is equal to or greater than the third detection time (S128: Yes), it sets the second normal determination flag to "1" (S129). The second detection device 32 has a second normal determination flag. The second normal determination flag is a flag that indicates whether or not a ground fault has occurred in the second system 120. When the second normal determination flag is "1", the second normal determination flag indicates that no ground fault has occurred in the second system 120. The second normal determination flag is initially set to "0". If the second detection device 32 determines that the value of the second normal timer is equal to or greater than the third detection time, it determines that no ground fault has occurred in the second system 120. In other words, the second detection device 32 confirms that the second system 120 is normal.

[0107] Note that the order of the processes from step S120 to step S129 and the processes from step S110 to step S119 may be reversed.

[0108] The second detection device 32 determines whether either the first abnormality determination flag or the first normality determination flag of the first system 110 is confirmed to be "1", and whether either the second abnormality determination flag or the second normality determination flag of the second system 120 is confirmed to be "1" (S130). In other words, the second detection device 32 determines whether the first system 110 is normal or abnormal, and whether the second system 120 is normal or abnormal. If the second detection device 32 has not determined whether either system is normal or abnormal (S130: No), it returns to step S110 and repeats the above process. In other words, the process from step S110 to step S130 is repeated until the normality or abnormality of the first system 110 and the second system 120 is confirmed.

[0109] The second detection device 32 determines whether the normal or abnormal status of the first system 110 and the second system 120 is confirmed (S130: Yes), that is, if either the first abnormality determination flag or the first normality determination flag is "1", and either the second abnormality determination flag or the second normality determination flag is "1", then it determines whether the normality determination flags for both systems are set to "1" (S131). More specifically, the second detection device 32 determines whether the normality determination flags for both the first system 110 and the second system 120 are set to "1". In other words, the second detection device 32 determines whether a ground fault has occurred in each system 110 and 120 and whether it has been confirmed that they are normal.

[0110] If each normal determination flag is set to "1" (S131: Yes), that is, if it is confirmed that there is no ground fault in the first system 110 and the second system 120 and that they are normal, the second detection device 32 determines that the voltage drop detected by the first detection device 31 is due to a temporary overload and turns on the inter-system connection part 41 (S132). The second detection device 32 also turns off the battery switch 42 (S133).

[0111] As a result, the first system 110 and the second system 120 are electrically connected, returning to their normal state, and power is supplied from the first power supply 10 to the first load 101, the general load 102, and the second load 103.

[0112] Note that the order of processing in steps S132 and S133 may be reversed. Also, the processing in steps S132 and S133 may be performed simultaneously.

[0113] The second detection device 32 terminates the current process if at least one of the normal determination flags is not set to "1" (S131: No). In other words, if it is determined to be "No" in step S131, it indicates that either the first abnormal determination flag or the second abnormal determination flag is set to "1". The second detection device 32 maintains the current state of the inter-system connection 41 and the current state of the battery switch 42. As a result, the switch drive device 3 performs fail-safe control using the normal system while keeping the inter-system connection 41 disconnected.

[0114] If the first detection device 31 determines that a ground fault has occurred in either the first system 110 or the second system 120, the inter-system connection unit 41 turns OFF, and the electrical connection between the first system 110 and the second system 120 is disconnected. Power is then supplied from the first power supply 10 to the first load 101 and the general load 102. Power is also supplied from the second power supply 20 to the second load 103. This allows the second detection device 32 to make a final determination of which system has the ground fault. As a result, power is consumed from the backup power supply, the second power supply 20, for this determination, and the amount of stored energy decreases.

[0115] If the second detection device 32 determines that no ground faults have occurred in the first system 110 and the second system 120, that is, if the ground fault detected by the first detection device 31 was a false detection, the inter-system connection unit 41 turns ON, enabling automatic operation.

[0116] However, if the amount of energy stored in the second power supply 20 is less than the first predetermined amount of energy, which is the threshold for allowing automatic operation, automatic operation is prohibited. For example, if the first detection device 31 repeatedly detects a ground fault, the amount of energy stored in the second power supply 20 may decrease and fall below the first predetermined amount of energy.

[0117] In this case, even if the second detection device 32 determines that no ground faults have occurred in the first system 110 and the second system 120, and the inter-system connection unit 41 is turned ON, automatic operation is prohibited. Thus, if the first detection device 31 falsely detects a ground fault, the function of the load is limited.

[0118] The power control device 1 according to this embodiment includes an inter-system connection unit 41, a first detection device 31, and a second detection device 32. The inter-system connection unit 41 can disconnect the electrical connection between the first system 110, which supplies power from the first power supply 10 to the first load 101, and the second system 120, which supplies power from the second power supply 20 to the second load 103. The first detection device 31 detects an abnormality in the first system 110 or the second system 120 if the voltage indicating the state of the first system 110 or the state of the second system 120 exceeds a first threshold for abnormality determination from the normal value side for a first detection period of time, and shuts off the inter-system connection unit 41. After the first detection device 31 detects an abnormality, the second detection device 32 identifies the system among the first system 110 and the second system 120 as the abnormal system if the voltage has remained above the second threshold for abnormality determination from the normal value for a second detection time that is shorter than the first detection time.

[0119] As a result, the power control device 1 can suppress false detection of ground faults by the first detection device 31. For example, if the voltage detected by the second voltage sensor 52 temporarily drops due to a voltage fluctuation rather than a ground fault, the voltage will return to its original state within a relatively long first detection time. As a result, the first detection device 31 will not detect a ground fault, and false detection of ground faults can be suppressed. Therefore, the power control device 1 can suppress the supply of power from the second power supply 20 to the second load 103, thereby suppressing a decrease in the amount of charge stored in the second power supply 20. The power control device 1 can suppress the prohibition of automatic operation after the amount of charge stored in the second power supply 20 has decreased until the second power supply 20 is recharged. In other words, the power control device 1 can suppress the restriction of the functions of the first load 101 and the second load 103. The power control device 1 can increase the opportunities for automatic operation to be performed.

[0120] The first detection device 31 and the second detection device 32 are composed of microcomputers.

[0121] This allows the power control device 1 to improve the degree of freedom in setting the ground fault detection conditions for each detection device 31, 32.

[0122] The first detection device 31 and the second detection device 32 may be composed of separate microcomputers. Specifically, the first detection device 31 may be composed of one microcomputer, and the second detection device 32 may be composed of another microcomputer. In this case, when the first detection device 31 detects a ground fault, it notifies the second detection device 32 of the occurrence of the ground fault. The second detection device 32 then performs the final determination upon receiving this notification.

[0123] (Second Embodiment) Next, the power control device 1 according to the second embodiment will be described. The following description will focus on aspects that differ from the first embodiment. Descriptions of the same configuration and processes as in the first embodiment will be omitted.

[0124] In the first embodiment, the first detection device 31 detected a ground fault only after the second system voltage V2 had remained below a first threshold for a period of time or longer. Therefore, there was a risk that detection of a true ground fault would be delayed if it occurred in the first system 110 or the second system 120. The second embodiment prevents false detections due to temporary voltage drops while enabling quick detection of a true ground fault.

[0125] In the second embodiment, the first detection device 31 detects a ground fault in the first system 110 or in the second system 120 when the second system voltage V2 is less than the third threshold. The third threshold is a preset value. The third threshold is smaller than the first threshold. That is, the difference between the third threshold and the normal voltage value is greater than the difference between the first threshold and the normal voltage value.

[0126] The first detection device 31 detects a ground fault in the first system 110 or the second system 120 without waiting for the first detection time to elapse, if the second system voltage V2 is less than the third threshold.

[0127] Next, the error handling process according to the second embodiment will be described with reference to Figures 9, 7, and 8. Figure 9 is a flowchart illustrating the error handling process according to the second embodiment. Note that in the error handling process according to the first embodiment, the processes shown in Figures 7 and 8 are the same as those in the error handling process according to the second embodiment.

[0128] The processing in steps S100 to S105 in Figure 9 is the same as the processing in steps S100 to S105 in Figure 6.

[0129] After the processing in step S104, the first detection device 31 determines whether the second system voltage V2 is less than the third threshold (S200).

[0130] If the first detection device 31 determines that the second system voltage V2 is less than the third threshold (S200: Yes), it performs a provisional abnormality determination without waiting for the first detection time to elapse (S107).

[0131] The first detection device 31 determines whether the value of the temporary abnormality timer is equal to or greater than the first detection time if the second system voltage V2 is equal to or greater than the third threshold (step S200: No) (S106). The first detection device 31 determines whether the value of the temporary abnormality timer is equal to or greater than the first detection time if the second system voltage V2 is less than the first threshold and equal to or greater than the third threshold.

[0132] Note that the order of processing in steps S104 and S200 may be reversed.

[0133] The process from step S106 to step S109 in Figure 9 is the same as the process from step S106 to step S109 in Figure 6.

[0134] The first detection device 31 detects a ground fault in either the first system 110 or the second system 120 if the second system voltage V2 remains below the first threshold for a period of time equal to or longer than the first detection time. On the other hand, if the second system voltage V2 falls below the third threshold, the first detection device 31 detects a ground fault in either the first system 110 or the second system 120 without waiting for the first detection time to elapse. The difference between the third threshold and the normal voltage value is greater than the difference between the first threshold and the normal voltage value. In other words, the third threshold is smaller than the first threshold.

[0135] As a result, if a ground fault occurs and the voltage of the second system V2 drops significantly, that is, if there is a high probability that a ground fault has actually occurred, the first detection device 31 can quickly turn off the inter-system connection 41, allowing the second detection device 32 to quickly complete the identification of the ground fault and preventing power loss of the first power supply 10 or the second power supply 20 due to the ground fault. Therefore, FOP can be implemented early, and the vehicle can move to a safe location quickly and reliably. Thus, the power control device 1 can improve safety.

[0136] The second detection device 32 may also be configured by hardware circuits. For example, as shown in Figure 10, the second detection device 32 includes a first comparator 32a and a second comparator 32b. The first comparator 32a is a comparator that compares the first system voltage V1 with a second threshold. The second comparator 32b is a comparator that compares the second system voltage V2 with a second threshold. Figure 10 is a diagram illustrating a modified version of the second detection device 32.

[0137] Since the second detection device 32 is configured with hardware circuitry, it can quickly detect and identify the occurrence of a ground fault. Therefore, when a ground fault occurs, FOP (Field On Response) is performed early. Because FOP is performed early, the vehicle can move to a safe location early. Thus, the power control device 1 can improve safety. In this case, the second detection time for ground fault detection in the second detection device 32 is the time from when the voltage sensors 51 and 52 drop below the second threshold until the comparators 32a and 32b reverse from the normal side to the abnormal side, and is effectively zero.

[0138] In the above embodiment, an example was described in which the first threshold and the second threshold are the same value, but the embodiment is not limited to this. The first threshold and the second threshold may be different values.

[0139] The first and second thresholds may be set such that the first threshold is more sensitive to detecting anomalies than the second threshold. In this case, the difference between the first threshold and the normal value of the physical quantity is smaller than the difference between the second threshold and the normal value of the physical quantity. If the physical quantity is voltage, the first threshold is greater than the second threshold.

[0140] As a result, the first detection device 31 can detect a ground fault in the first system 110 or the second system 120 at an early stage, and the second detection device 32 can more reliably identify the location of the ground fault. Therefore, FOP (Forward Operation) can be performed earlier, and the vehicle can move to a safe location earlier. Consequently, the power control device 1 can improve safety.

[0141] Furthermore, the first and second thresholds may be set such that the first threshold has a lower sensitivity to detecting anomalies than the second threshold. In that case, the difference between the first threshold and the normal value of the physical quantity is greater than the difference between the second threshold and the normal value of the physical quantity. If the physical quantity is voltage, the first threshold is smaller than the second threshold.

[0142] As a result, the first detection device 31 can suppress false detection of a ground fault when the voltage drops due to voltage fluctuations or other reasons when no ground fault is actually occurring. Therefore, the power control device 1 can suppress the supply of power from the second power supply 20 to the second load 103 due to false detection of a ground fault, and suppress the decrease in the amount of charge stored in the second power supply 20. Consequently, the power control device 1 can suppress the prohibition of automatic operation due to a decrease in the amount of charge stored in the second power supply 20. In other words, the power control device 1 can increase the opportunities for automatic operation to be performed.

[0143] Furthermore, although the above embodiment describes an example where the physical quantity is voltage, it is not limited to this. The physical quantity may also be electric current. When the physical quantity is electric current, the first threshold and the second threshold are greater than the normal value of the current. Also, when the physical quantity is electric current, the third threshold is greater than the first threshold.

[0144] As an addendum, the features of the present invention are as follows. (1) An inter-system connection unit capable of disconnecting the electrical connection between a first system supplying power from a first power source to a first load and a second system supplying power from a second power source to a second load, A first detection device detects an abnormality in the first system or the second system and disconnects the inter-system connection if the physical quantity indicating the state of the first system or the second system exceeds a first threshold for abnormality determination from the normal value for a first detection period of time. After the first detection device detects an abnormality, the second detection device identifies the system in which the physical quantity has exceeded the second threshold for abnormality determination from the normal value side for a second detection time that is shorter than the first detection time as an abnormal system. A power control device equipped with the following features. (2) The first detection device is comprised of a microcomputer, The second detection device is the power control device described in (1) above, which is composed of hardware circuits. (3) The power control device according to (1), wherein the first detection device and the second detection device are configured by a microcomputer. (4) The power control device according to any one of (1) to (3) above, wherein the difference between the first threshold and the normal value of the physical quantity is smaller than the difference between the second threshold and the normal value of the physical quantity. (5) The power control device according to any one of (1) to (3) above, wherein the difference between the first threshold and the normal value of the physical quantity is greater than the difference between the second threshold and the normal value of the physical quantity. (6) The first detection device is If the physical quantity exceeds the third threshold from the normal value before the state in which the physical quantity exceeds the first threshold from the normal value continues for more than the first detection time, an abnormality in the first system or the second system is detected without waiting for the first detection time to elapse. The power control device according to any one of (1) to (5) above, wherein the difference between the third threshold and the normal value of the physical quantity is greater than the difference between the first threshold and the normal value of the physical quantity. (7) If a physical quantity indicating the state of the first system supplying power from the first power source to the first load, or the state of the second system supplying power from the second power source to the second load, exceeds a first threshold for abnormality detection from the normal value for a first detection period, an abnormality in the first system or the second system is detected, and the inter-system connection part that can disconnect the electrical connection between the first system and the second system is shut off. A control method for a power supply control device, in which, after detecting an abnormality in the first system or the second system, the system in which the physical quantity exceeds a second threshold for abnormality determination from the normal value for a second detection time shorter than the first detection time is identified as the abnormal system.

[0145] Further effects and modifications can be readily derived by those skilled in the art. Therefore, broader aspects of the present invention are not limited to the specific details and representative embodiments expressed and described above. Accordingly, various modifications are possible without departing from the spirit or scope of the overall concept of the invention as defined by the appended claims and their equivalents. [Explanation of Symbols]

[0146] 1 Power supply control device 3. Switch drive device 10 1st power supply 20 2nd power supply 31 First detection device 32 Second detection device 32a First comparator 32b Second comparator 41 Inter-system connection section 42 Battery Switch 51. First voltage sensor 52 Second Voltage Sensor 100 Automatic Driving Control System 101 1st load 103 2nd load 110 1st system 120 2nd system 200 Ground fault

Claims

1. An inter-system connection unit capable of disconnecting the electrical connection between a first system supplying power from a first power source to a first load and a second system supplying power from a second power source to a second load, A first detection device detects an abnormality in the first system or the second system and disconnects the inter-system connection when a physical quantity indicating the state of the first system or the second system exceeds a first threshold for abnormality determination from the normal value for a first detection period of time. After the first detection device detects an abnormality, the second detection device identifies the system in which the physical quantity has exceeded the second threshold for abnormality determination from the normal value side for a second detection time that is shorter than the first detection time as an abnormal system. A power control device equipped with the following features.

2. The first detection device is composed of a microcomputer, The power control device according to claim 1, wherein the second detection device is configured by a hardware circuit.

3. The power control device according to claim 1, wherein the first detection device and the second detection device are configured by a microcomputer.

4. The power control device according to claim 1, wherein the difference between the first threshold and the normal value of the physical quantity is smaller than the difference between the second threshold and the normal value of the physical quantity.

5. The power control device according to claim 1, wherein the difference between the first threshold and the normal value of the physical quantity is greater than the difference between the second threshold and the normal value of the physical quantity.

6. The first detection device is If the physical quantity exceeds the third threshold from the normal value before the state in which the physical quantity exceeds the first threshold from the normal value continues for more than the first detection time, an abnormality in the first system or the second system is detected without waiting for the first detection time to elapse. The power control device according to claim 1, wherein the difference between the third threshold and the normal value of the physical quantity is greater than the difference between the first threshold and the normal value of the physical quantity.

7. If a physical quantity indicating the state of the first system supplying power from the first power source to the first load, or the state of the second system supplying power from the second power source to the second load, exceeds a first threshold for abnormality detection from the normal value for a first detection period, an abnormality in the first system or the second system is detected, and the inter-system connection part that can disconnect the electrical connection between the first system and the second system is shut off. A control method for a power supply control device, in which, after detecting an abnormality in the first system or the second system, the system in which the physical quantity exceeds the second threshold for abnormality determination from the normal value for a second detection time shorter than the first detection time is identified as the abnormal system.

Images