JP6914003B2 - Electronic control device - Google Patents

Description

The present invention relates to an electronic control device that requires high reliability and safety, such as for vehicles.

Conventionally, in this type of electronic control device, in a configuration in which a sensor is provided outside the housing of an ECU (Electronic Control Unit), there is a possibility that the power supply line may be vertically entangled on the harness. Therefore, even if the power supply line of the sensor is top-bottomed, the power supply voltage for the microcomputer and the power supply voltage for the sensor are generated by separate regulators so that the degenerate operation can be performed using another sensor and a microcomputer (abbreviated as a microcomputer). is doing. In this way, by providing a regulator dedicated to each function, it is possible to avoid a common cause failure.

Japanese Unexamined Patent Publication No. 2011-152027

However, the degenerate operation in the event of a failure inevitably deteriorates in performance with respect to the original function, and the number of monitors for the power supply voltage increases by providing a large number of regulators, so that the processing load of the microcomputer, which is the main control device, also increases. It will increase.
Moreover, in recent years, as a measure for automatic operation, even if a single failure (including a failure of a power supply or a microcomputer) occurs, it is required to continue the assist operation, so each circuit is systematized into two systems. For example, Patent Document 1 discloses a system in which a failure of one system can be tolerated by forming two systems of inverters for driving an assist motor in an electric power steering (EPS) device.
However, if two systems are used in a configuration that avoids common cause failures, the number of regulators existing in one system will be doubled, resulting in an increase in cost.

The present invention has been made in view of the above circumstances, and an object of the present invention is an electronic control device capable of suppressing a decrease in performance in the event of a failure while suppressing an increase in cost and a processing load of a main control device. Is to provide.

The electronic control device of the present invention is an electronic control device used in a system in which two inverters for driving an electric motor are systematized, and the electronic control device connects a housing and wiring in the housing to the housing. A connector connected to a first functional element that performs a predetermined functional operation outside the body, and a first redundant functional element that performs a redundant operation of the first functional element outside the housing, and inside the housing. A second functional element provided and performing a predetermined functional operation different from the first functional element, a second redundant functional element provided inside the housing and performing a redundant operation of the second functional element, and the above. A main power supply circuit provided in the housing to supply operating power to the second functional element and supply operating power to the first functional element via the connector, and a second power supply circuit provided in the housing. A redundant power supply circuit that supplies operating power to the redundant functional element and supplies operating power to the first redundant functional element via the connector, and outputs of the first and second functional elements provided in the housing. Based on the above, a first microcomputer that outputs a signal for driving the inverter of the first system, and a second system based on the outputs of the first and second redundant functional elements provided in the housing. A second microcomputer that outputs a signal for driving an inverter is provided, and when an abnormality occurs in the power supply from the main power supply circuit, the main power supply circuit is stopped and the redundant power supply circuit is used as described. An operating power supply is supplied to the first and second redundant functional elements, and the functional operations of the first and second functional elements are continued by the first and second redundant functional elements.

According to the present invention, the first and second functional elements are supplied with power from the main power supply circuit, and the first and second redundant functional elements are supplied with power from the redundant power supply circuit. Compared with the case where power is supplied to the two functional elements from separate power supply circuits and this configuration is systematized into two systems, the power supply circuits can be reduced and the increase in cost can be suppressed. In addition, by making two systems, the operation of one system can be stopped in the event of a failure and the same functional operation can be continued in the other system, so that the performance deteriorates due to the degenerate operation and the processing load of the microcomputer increases. It is possible to suppress the degeneracy. Therefore, it is possible to suppress a decrease in performance at the time of failure while suppressing an increase in cost and an increase in processing load of the main controller.

It is a block diagram of the electronic control device which concerns on the reference example of this invention. It is a schematic block diagram of the EPS apparatus to which the electronic control apparatus shown in FIG. 1 is applied. It is a block diagram of the electronic control device which concerns on embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[Reference example]
FIG. 1 shows a configuration example of an electronic control device according to a reference example of the present invention, and FIG. 2 shows a schematic configuration of an EPS device to which this electronic control device is applied. First, the EPS device will be briefly described, and then an electronic control device that controls a motor (electric actuator) that assists the steering force in the EPS device will be described.

As shown in FIG. 2, the EPS device includes a steering wheel 10, a steering torque sensor 11, a steering torque sensor 32 for redundancy, a steering angle sensor 12, a steering angle sensor 33 for redundancy, a motor 13 for assist, and the motor. It is configured to include an electronic control device 14 and the like for controlling 13. Further, in the steering column 16 including the steering shaft 15, steering torque sensors 11 and 32, steering angle sensors 12 and 33, and a speed reducer 17 are provided.

Then, when the driver performs the steering operation, the steering torque generated on the steering shaft 15 is detected by the steering torque sensor 11 (or the steering torque sensor 32 for redundancy), and the steering angle is determined by the steering angle sensor 12 (or the redundancy). It is detected by the steering angle sensor 33). The electronic control device 14 drives and controls the motor 13 based on the steering torque signal S1 and the steering angle signal S2 obtained from these sensors 11 and 12 (or the sensors 32 and 33), the vehicle speed signal S3 detected by the vehicle, and the like. By doing so, a steering assist force according to the traveling state of the vehicle is generated from the motor 13. As a result, when the pinion gear 18 provided at the tip of the steering shaft 15 rotates, the rack shaft 19 moves horizontally to the left and right in the traveling direction, so that the driver's steering operation is transmitted to the wheels (tires) 20 of the vehicle. Turn around.

Next, the electronic control device according to the reference example of the present invention will be described in detail with reference to FIG. The voltage of the battery 21 (for example, 12V) is a 6V regulator (6VREG) 23, a predriver 24, an inverter 25, a motor current sensor 26, and a motor current sensor 27 for redundancy provided in the housing of the electronic control device 14. Is supplied to each. The 6V internal voltage generated by stepping down by the regulator 23 is applied to the 5V regulator (5VREG) 28, the 5V regulator (5VREG) 29, the 5V regulator (5VREG) 30, and the 1V regulator (1VREG) 31, respectively. It is supplied and dropped to the voltage for each function.

The regulator 28 functions as a main power supply circuit for the sensor, and supplies 5V operating power to the steering torque sensor 11, the steering angle sensor 12, the motor current sensor 26, and the motor angle sensor 22 via the power supply line, respectively. The regulator 29 functions as a redundant power supply circuit for the sensor, and has a power supply line for the steering torque sensor 32 for redundancy, the steering angle sensor 33 for redundancy, the motor current sensor 27 for redundancy, and the motor angle sensor 34 for redundancy, respectively. 5V operating power is supplied via.

The steering torque sensor 11, the steering angle sensor 12, the redundant steering torque sensor 32, and the redundant steering angle sensor 33 are provided outside the housing of the electronic control device 14. The housing is provided with connectors, and the sensors 11, 12, 32, and 33 are mounted on the housing via these connectors. The wiring length from the connector to the regulator 28 or 29 is shorter than the wiring length from the microcomputer 35 to the connector.

Further, the regulator 30 functions as a main power supply circuit for an arithmetic processing unit (or an integrated circuit device), and supplies an operating power supply of 5 V to the A / D converter 36 and the CAN driver 37 in the microcomputer 35. As shown by the broken arrow, the A / D converter 36 A / D converts the voltage supplied from the regulator 28 to the sensors 11 and 12, and A / D converts the voltage supplied from the regulator 29 to the sensors 32 and 33. The / D conversion is performed, and the output voltages of the regulators 28 and 29 are monitored by the microcomputer 35. The CAN driver 37 communicates with another external ECU 38 and the microcomputer 35 to exchange data.
Further, the regulator 31 is configured to supply an operating power supply of 1 V to the arithmetic unit 39 in the microcomputer 35.

In the above configuration, in the normal assist operation, the microcomputer 35 outputs the PWM signal to the pre-driver 24. Based on the PWM signal, each of the H-side driver and the L-side driver in the pre-driver 24 supplies a drive signal based on the PWM signal to the control ends of the upper arm switch element and the lower arm switch element in the inverter 25, respectively. Selectively control on / off.

Then, when the motor 13 is driven by the inverter 25, the operation amount is calculated based on the steering torque signal S1 and the steering angle signal S2 detected by the sensors 11 and 12, the vehicle speed signal S3 detected by the vehicle, and the like, and the calculation result is obtained. The duty of the PWM signal is changed according to the amount of operation of the above, and the assist force is changed by controlling the output torque of the motor 13. At this time, the motor current sensor 26 and the motor angle sensor 22 detect the state change of the motor 13.

During the assist operation, the microcomputer 35 monitors the output voltage of each regulator 28 by using the A / D converter 36. For example, the power supply line that supplies the operating power from the regulator 28 to the steering torque sensor 11 or the steering angle sensor 12. When it is detected that a top-bottom fault has occurred, the regulator 28 is stopped, and the steering torque signal S1 and the steering angle signal S2 output from the sensors 11 and 12 are not used. Then, the regulator 29 supplies the operating power to the steering torque sensor 32 or the steering angle sensor 33, and the assist is continued by using the redundant sensors 32 and 33. In this case, instead of the motor current sensor 26 and the motor angle sensor 22, the redundant motor current sensor 27 and the redundant motor angle sensor 34 are used to detect the state change of the motor 13.

According to such a configuration, since the steering torque sensor and the steering angle sensor, the regulator, the motor current sensor, and the motor angle sensor are provided in two systems, even if an abnormality occurs in one system, the original system should be used. The motor can be controlled in the same way as the function, and the assist operation can be continued. Therefore, in the event of a failure, the degenerate operation does not cause a decrease in performance. Further, since the microcomputer 35 only needs to monitor the output voltage of the regulator 28 or 29 that supplies the operating power to the sensors 11 and 12 or the sensors 32 and 33, the processing load of the microcomputer does not increase.

Further, since the regulators 30 and 31 that supply the operating power supply to the microcomputer 35 are provided with only one system instead of simply forming two systems, the increase in cost can be suppressed. This configuration is possible because the power supply line from the regulators 30 and 31 to the microcomputer 35 and the CAN driver 37 is formed only inside the housing of the electronic control device 14, and the possibility of a top-bottom fault is low.
Therefore, it is possible to suppress a decrease in performance at the time of failure while minimizing an increase in cost and an increase in processing load of the main controller.

[ Embodiment]
FIG. 2 shows a configuration example of the electronic control device according to the embodiment of the present invention. In the above-mentioned reference example , one microcomputer controls one motor, but in the present embodiment, two microcomputers control two motors. The voltage of the battery 21 (for example, 12V) is determined by the 6V regulator (6VREG) 23a, the 6V regulator (6VREG) 23b, the predriver 24a, the inverters 25a, 25b, and the motor current sensor provided in the housing of the electronic control device 14. It is supplied to 26 and the motor current sensor 27 for redundancy, respectively. The 6V internal voltage generated by stepping down by the regulator 23a is supplied to the 5V regulator (5VREG) 28 and the 1V regulator (1VREG) 31a, respectively. Further, the 6V internal voltage generated by stepping down by the regulator 23b is supplied to the 5V regulator (5VREG) 29 and the 1V regulator (1VREG) 31b, respectively.

The regulator 28 functions as a main power supply circuit, and supplies an operating power supply of 5 V from the power supply line to the steering torque sensor 11 and the steering angle sensor 12 via resistors R1 and R2, respectively. Further, 5V operating power is supplied to the CAN driver 37a and the A / D converter 36a in the microcomputer 35a via the power supply line. Further, the regulator 28 supplies the motor current sensor 26 and the motor angle sensor 22 with an operating power supply of 5 V via a power supply line, respectively.

Similarly, the regulator 29 functions as a redundant power supply circuit, and supplies 5 V of operating power to the redundant steering torque sensor 32 and the redundant steering angle sensor 33 from the power supply line via resistors R3 and R4, respectively. Further, 5V operating power is supplied to the CAN driver 37b and the A / D converter 36b in the microcomputer 35b via the power supply line. Further, the regulator 29 supplies a 5V operating power supply to the redundant predriver 24b, the redundant motor current sensor 27, and the redundant motor angle sensor 34, respectively, via the power supply line.
The resistors R1 to R4 are for preventing a surge from being applied to the inside of the housing from a connector provided in the housing.

The A / D converter 36a A / D converts the voltage supplied from the regulator 28 to the sensors 11 and 12. Further, the A / D converter 36b A / D converts the voltage supplied from the regulator 29 to the sensors 32 and 33. The microcomputers 35a and 35b monitor the output voltages of the regulators 28 and 29 based on the A / D conversion results, respectively. The CAN drivers 37a and 37b communicate with each other external ECUs 38a and 38b and the microcomputers 35a and 35b to exchange data, respectively.
The steering torque sensor 11, the steering angle sensor 12, the redundant steering torque sensor 32, and the redundant steering angle sensor 33 are provided outside the housing of the electronic control device 14.

Further, the regulator 31a acts as a power supply circuit for the arithmetic unit 39a in the microcomputer 35a and supplies an operating power supply of 1V. Further, the regulator 31b is configured to act as a power supply circuit for the arithmetic unit 39b in the microcomputer 35b and supply an operating power supply of 1V.
Then, the microcomputer 35a drives and controls the motor 13a from the pre-driver 24a via the inverter 25a, and the microcomputer 35b drives and controls the motor 13b from the pre-driver 24b via the inverter 25b. In this way, the two motors 13a and 13b are independently driven by the two circuits.

That is, in the normal assist operation, the microcomputer 35a outputs a PWM signal to the pre-driver 24a. Based on the PWM signal, each of the H-side driver and the L-side driver in the pre-driver 24a supplies a drive signal based on the PWM signal to the control ends of the upper arm switch element and the lower arm switch element in the inverter 25a, respectively. Selectively control on / off.

Then, when the motor 13a is driven by the inverter 25a, the operation amount is calculated based on the steering torque signal S1 and the steering angle signal S2 detected by the sensors 11 and 12, the vehicle speed signal S3 detected by the vehicle, and the like, and the calculation result is obtained. The duty of the PWM signal is changed according to the amount of operation of the above, and the assist force is changed by controlling the output torque of the motor 13a. At this time, the motor current sensor 26 and the motor angle sensor 22 detect the state change of the motor 13.

During the assist operation, the microcomputer 35a monitors the output voltage of the regulator 28 by using the A / D converter 36a. For example, the regulator 28 connects the regulator 28 to the power supply line that supplies the operating power to the steering torque sensor 11 or the steering angle sensor 12. When it is detected that a top-bottom fault has occurred, the regulator 28 is stopped, and the steering torque signal S1 and the steering angle signal S2 output from the sensors 11 and 12 are not used. Then, the regulator 29 supplies the operating power to the steering torque sensor 32 or the steering angle sensor 33, and the assist is continued by using the redundant sensors 32 and 33.

When the system is switched, the microcomputer 35b outputs a PWM signal to the pre-driver 24b. Based on the PWM signal, each of the H-side driver and the L-side driver in the pre-driver 24b supplies a drive signal based on the PWM signal to the control ends of the upper arm switch element and the lower arm switch element in the inverter 25b, respectively. Selectively control on / off.
When the motor 13b is driven by the inverter 25b, the operation amount is calculated based on the steering torque signal S1 and the steering angle signal S2 detected by the sensors 32 and 33, the vehicle speed signal S3 detected by the vehicle, and the operation of the calculation result. The duty of the PWM signal is changed according to the amount, and the assist force is changed by controlling the output torque of the motor 13b. In this case, instead of the motor current sensor 26 and the motor angle sensor 22, the redundant motor current sensor 27 and the redundant motor angle sensor 34 are used to detect the state change of the motor 13b.

According to such a configuration, in the event of a failure, the redundant function can be used simply by switching the system. Since it has a two-system configuration, it does not increase the processing load of the microcomputer and does not cause a decrease in performance with respect to the original function. Further, not only when one of the various functions fails, but also when either the main power supply circuit or the redundant power supply circuit fails, the operation can be continued with the minimum performance deterioration.
Therefore, it is possible to suppress a decrease in performance at the time of failure while minimizing an increase in cost and an increase in processing load of the main controller.

The present invention is not limited to the embodiments described above, but can be implemented in various modifications. For example, in the embodiment, the case where the circuits of two systems are mounted in one housing has been described as an example, but it is needless to say that the circuits of two systems may be mounted in two housings for each system.

11 ... Steering torque sensor, 12 ... Steer angle sensor, 13, 13a, 13b ... Motor (electric actuator), 14 ... Electronic control device, 23 ... Regulator, 28 ... Regulator (main power supply circuit), 29 ... Regulator (redundant power supply circuit) ), 30, 31 ... Regulator, 32 ... Redundant steering torque sensor, 33 ... Redundant steering angle sensor, 35, 35a, 35b ... Microcomputer (main controller)

Claims (3)

An electronic control device used in a system in which two inverters are used to drive an electric motor.
The electronic control device is
With the housing
The wiring inside the housing is connected to a first functional element that performs a predetermined functional operation outside the housing and a first redundant functional element that performs a redundant operation of the first functional element outside the housing. With the connector
A second functional element provided inside the housing and performing a predetermined functional operation different from the first functional element,
A second redundant functional element provided inside the housing and performing a redundant operation of the second functional element,
A main power supply circuit provided in the housing, supplying operating power to the second functional element and supplying operating power to the first functional element via the connector.
A redundant power supply circuit provided in the housing, which supplies an operating power supply to the second redundant functional element and supplies an operating power supply to the first redundant functional element via the connector.
A first microcomputer provided in the housing and outputting a signal for driving the inverter of the first system based on the outputs of the first and second functional elements.
A second microcomputer provided in the housing and outputting a signal for driving the inverter of the second system based on the outputs of the first and second redundant functional elements.
Equipped with
When an abnormality occurs in the power supply from the main power supply circuit , the main power supply circuit is stopped, and the redundant power supply circuit supplies operating power to the first and second redundant functional elements .
An electronic control unit, characterized in that to continue the functional operation of the first and second functional element in said first and second redundant functional elements. In the electronic control device of claim 1,
The electric motor is for assisting in an electric power steering device, and is configured so that a failure of one system can be tolerated by forming two systems of inverters for driving the electric motor.
The first functional element includes a first sensor that detects a parameter used for calculating the operation amount of the assist motor.
The second functional element includes a second sensor that detects a state parameter different from the parameter used for the manipulated variable calculation detected by the first sensor.
The main power supply circuit is the first regulator,
The redundant power supply circuit is the second regulator.
When at least one power supply line of the first functional element and the second functional element is top-bottomed from the first regulator, the second is a redundant functional element corresponding to the functional element connected to the top-bottomed power supply line. An electronic control device characterized in that power is supplied from a regulator and operation is continued by the first and second redundant functional elements in place of the first and second functional elements. In the electronic control device of claim 1,
The first functional element includes a first sensor that detects a parameter used for calculating the operation amount of the first electric motor.
The first redundant functional element is an electronic control device including a second sensor that detects a parameter used for calculating the operation amount of the second electric motor.

Images