CN113371057A

CN113371057A - Motor control device

Info

Publication number: CN113371057A
Application number: CN202110205597.3A
Authority: CN
Inventors: 大岛忠介
Original assignee: Nidec Elesys Corp
Current assignee: Nidec Elesys Corp
Priority date: 2020-02-25
Filing date: 2021-02-24
Publication date: 2021-09-10
Anticipated expiration: 2041-02-24
Also published as: CN113371057B; JP2021136735A

Abstract

The invention provides a motor control device. In the motor control device adopting the redundant structure, even if signal communication failure occurs between the control parts, the auxiliary operation can be continued. In a motor control device for driving an electric motor by a control unit (CPU) provided for each of a plurality of control systems, when a communication failure between central control units is determined based on the communication state of a control signal via a 1 st communication means and a watchdog signal via a 2 nd communication means, the assist control of the electric motor is continued by a control system which normally operates among the 1 st control system and the 2 nd control system.

Description

Motor control device

Technical Field

The present invention relates to a motor control device for electric power steering, for example, having a redundant configuration including a plurality of motor control circuits.

Background

As the automatic driving of vehicles progresses, it is required to continue the automatic driving even if a component of an Electronic Control Unit (ECU) fails, and for example, it is required to continue the steering even if a failure occurs in a steering device (electric power steering device) in the automatic driving.

The electric power steering apparatus is configured by a motor control apparatus as an Electronic Control Unit (ECU), but fault detection is important for safety requirements and the like. Therefore, for example, in the electronic control device of patent document 1, abnormality information based on a monitoring result of an execution cycle of a task periodically executed by a main microcomputer is communicated with a clock monitoring circuit and an operation monitoring circuit provided in a monitoring circuit for monitoring a clock abnormality of the main microcomputer and provided in the main microcomputer via a clock monitoring signal line and an operation monitoring signal line, and the operation monitoring circuit monitors an abnormality of an operation circuit of the main microcomputer.

In addition, in the electric power steering apparatus, the following redundant configuration is known: the motor control system has two inverter circuits for independently driving two coil windings provided in the motor, and the control circuits other than the inverter circuits are dual systems, so that even when an abnormality (failure) occurs in one system, the motor control can be continued by the other system which operates normally.

For example, patent document 2 discloses a motor control device that: each electronic component of the two systems is provided independently for each system, and the two systems are configured to have a redundant structure of a complete dual system including two independent element groups, and signal communication between the plurality of microcomputers is possible.

Patent document 1: japanese patent No. 5477654

Patent document 2: japanese patent laid-open publication No. 2019-4682

In the electronic control device of patent document 1, when an abnormality of the main microcomputer is detected, a reset signal is output to restart the main microcomputer, or a drive permission signal of the pre-driver is turned off to stop the pre-driver drive to the drive circuit of the motor. Therefore, there is a problem that steering assistance cannot be continued when a failure occurs.

The motor control device described in patent document 2 immediately stops the assistance by its own microcomputer when an abnormality occurs in the communication between the microcomputers. That is, when the stop determination unit determines that the operation of the microcomputer is to be stopped when the communication between the microcomputers or the communication unit is abnormal, the motor drive by the microcomputer is stopped. Thus, even if the device has a redundant configuration, when an abnormality occurs in the communication between the microcomputers, there is a problem that the assistance by the degeneration of one system cannot be continued.

Disclosure of Invention

The present invention has been made in view of the above problems, and an object of the present invention is to provide a motor control device that can continue motor control even when a signal communication failure between control units occurs in a motor control device that employs a redundant configuration including a plurality of systems.

The above object is achieved by the following means. That is, an exemplary 1 st aspect of the present invention is a motor control device including a plurality of control systems, the motor control device driving an electric motor by a central control unit provided for each of the control systems, the motor control device including: a 1 st communication unit that is capable of communicating a control signal between the 1 st control system and the central control unit of the 2 nd control system of the plurality of control systems; a 2 nd communication unit capable of transmitting and receiving an abnormality monitoring signal between the central control units; and a failure determination unit that determines whether or not there is a communication failure between the central control units based on a communication state of the control signal and the abnormality monitoring signal, wherein when the failure determination unit determines that the communication failure has occurred, the drive control of the electric motor is continued by a normally operating control system of the 1 st control system and the 2 nd control system.

An exemplary 2 nd aspect of the present invention is an electric power steering control device including a central control unit provided for each of a plurality of control systems, the electric power steering control device assisting a steering wheel operation of a driver of a vehicle or the like, the electric power steering control device including: an electric motor that assists steering of the driver; and driving and controlling the electric motor by the motor control device according to the above-described exemplary 1 st aspect.

An exemplary 3 rd invention of the present application is an electric power steering system including the electric power steering control device of the above exemplary 2 nd invention.

According to the present invention, in the motor control device having a redundant configuration, when a signal communication failure occurs between the control units, a failure point can be identified at low cost, and the motor control corresponding to the identified failure point can be continued.

Drawings

Fig. 1 is a diagram showing a schematic configuration of an electric power steering system in which a motor control unit for electric power steering is mounted.

Fig. 2 is a configuration diagram of an electric power steering control device (EPS) as a motor control unit of the embodiment.

Fig. 3 is a block diagram showing an intercommunication structure between CPUs.

Fig. 4 is a flowchart showing an example of control processing in the motor control unit.

Fig. 5 shows an example of a failure handling processing sequence in the case where an abnormality occurs in the inter-CPU communication due to a failure of the TXD line as an abnormality of the communication IC.

Fig. 6 is an example of a failure handling processing sequence in the case where an abnormality occurs in communication between CPUs due to a failure of an RXD line as an abnormality of a communication IC.

Fig. 7 shows an example of a failure handling processing sequence in the case where an abnormality occurs in the inter-CPU communication due to a failure of the CPU-1.

Fig. 8 is an example of a failure handling processing sequence in the case where an abnormality occurs in the inter-CPU communication due to a failure of the CPU-2.

Fig. 9 is a sequence diagram showing a failure handling process at the time of clock abnormality (1).

Fig. 10 is a sequence diagram showing the failure handling processing at the time of the clock abnormality (2).

Fig. 11 is a sequence diagram showing the failure handling processing at the time of the clock abnormality (3).

Fig. 12 is a diagram showing the steering assist control of the motor control unit in the case where the torque sensor of the 2 nd system has failed.

Fig. 13 is a diagram showing the steering assist control of the motor control unit in the case where the torque sensor of the 1 st system has failed.

Description of the reference symbols

1: a motor control unit; 1a, 1 b: a motor control device; 2: a steering wheel; 3: a rotating shaft; 4: a reduction gear; 6: a pinion gear; 7: a rack shaft; 9a, 9 b: a torque sensor; 10: an electric power steering system; 11a, 11 b: an angle sensor; 12a, 12 b: a control unit (CPU); 13a, 13 b: an inverter control unit; 14a, 14 b: an inverter circuit; 15: an electric motor; 15a, 15 b: a three-phase winding; 16a, 16 b: a clock oscillation unit; 19a, 19 b: CANI/F; 20a, 20 b: a power supply unit; 21a, 21 b: a power supply management unit; 24a, 24 b: an IG voltage detection unit; 27H, 27L: a CAN signal line; 27Ha, 27 Hb: a CAN-H line; 27La, 27 Lb: a CAN-L line; 29a, 29 b: a Battery (BT) voltage monitoring unit; 30. 30a, 30 b: isolating the IC; 31: an ignition switch (IG-SW); BT: a battery.

Detailed Description

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Fig. 1 is a schematic configuration of an electric power steering system in which an electric power steering control device (EPS) as a motor control unit according to an embodiment of the present invention is mounted. As shown in fig. 1, the electric power steering system 10 includes

motor control devices

1a and 1b corresponding to two control systems constituting a motor control unit, a steering wheel 2 as a steering member, a rotary shaft 3 connected to the steering wheel 2, a pinion gear 6, a rack shaft 7, and the like.

The rotary shaft 3 is engaged with a pinion 6 provided at a front end thereof. The rotational motion of the rotary shaft 3 is converted into a linear motion of the rack shaft 7 by the pinion 6, and the pair of

wheels

5a and 5b provided at both ends of the rack shaft 7 are steered to an angle corresponding to the displacement amount of the rack shaft 7.

Torque sensors

9a and 9b for detecting a steering torque when the steering wheel 2 is operated are provided on the rotary shaft 3, and the detected steering torque is transmitted to the motor control unit 1. The motor control unit 1 generates a motor drive signal based on signals such as steering torque acquired by the

torque sensors

9a and 9b and a vehicle speed from a vehicle speed sensor (not shown), and outputs the signal to the electric motor 15 for electric power steering.

An assist torque for assisting steering of the steering wheel 2 is output from the electric motor 15 to which the motor drive signal is input, and the assist torque is transmitted to the rotary shaft 3 via the reduction gear 4. As a result, the rotation of the rotation shaft 3 is assisted by the torque generated by the electric motor 15, thereby assisting the steering wheel operation of the driver.

Next, the motor control unit of the present embodiment will be explained. Fig. 2 is a configuration diagram of an electric power steering control device (EPS) as a motor control unit of the present embodiment. As shown in fig. 2, the motor control unit 1 has a redundant structure composed of two control systems (

motor control devices

1a, 1b) having the same constituent elements (circuit components).

The redundant configuration is not limited to two systems, and may be developed for a redundant configuration including three systems, four systems, and other multiple systems.

The

motor control devices

1a and 1b are composed of a 1 st system and a 2 nd system independent of each other, and the 1 st system and the 2 nd system have control units (CPUs) 12a and 12b, respectively. The

motor control devices

1a and 1b have a double-inverter structure including an electric motor 15 and two sets of

inverter circuits

14a and 14b, wherein the electric motor 15 has a structure in which two sets of three-phase windings (Ua, Va, Wa)15a and three-phase windings (Ub, Vb, Wb)15b are coaxially provided, and the two sets of

inverter circuits

14a and 14b supply drive currents to the two sets of three-phase windings, respectively. The electric motor 15 is, for example, a three-phase brushless DC motor.

The electric motor 15 is mounted with rotation sensors (angle sensors) 11a and 11b for detecting a rotational position of a rotor of the motor, respectively, in correspondence with the three-

phase windings

15a and 15 b. Output signals from the

rotation sensors

11a and 11b are transmitted to the

CPUs

12a and 12b as rotation information, respectively.

The

motor control devices

1a and 1b independently drive the electric motor 15 in accordance with sensor outputs from sensors, drive and control signals, and the like. Here, a component including the motor control device 1a and the three-phase winding 15a is referred to as a 1 st system, and a component including the motor control device 1b and the three-phase winding 15b is referred to as a 2 nd system.

The motor control device 1a constituting the 1 st system includes: a control unit (CPU)12a, which is constituted by a microprocessor, for example, and is responsible for controlling the entire apparatus; an inverter control unit 13a that generates a motor drive signal based on a control signal from the CPU 12a and functions as an FET drive circuit; and an inverter circuit 14a as a motor driving section that supplies a driving current to three-phase windings (Ua, Va, Wa)15a of the electric motor 15.

The motor control device 1b constituting the 2 nd system includes, similarly to the motor control device 1 a: a control unit (CPU)12b that controls the entire apparatus; an inverter control unit 13b that generates a motor drive signal based on a control signal from the CPU 12b and functions as an FET drive circuit; and an inverter circuit 14b that supplies a predetermined drive current to the three-phase windings (Ub, Vb, Wb)15b of the electric motor 15.

The control units (CPUs) 12a and 12b execute control operations, calculation operations, and the like based on operation clocks of predetermined frequencies output from the

clock oscillation units

16a and 16b, respectively. Further, the clock frequency may be multiplied in the control units (CPUs) 12a and 12 b.

The

CPUs

12a and 12b of the

motor control apparatuses

1a and 1b are configured to be able to perform mutual communication in real time via an isolated IC 30 (details will be described later). The

motor control devices

1a and 1b perform data communication with another control unit (ECU) via CAN signal lines (CAN communication buses) 27H and 27L connected to a CAN (Controller Area Network) that transmits and receives various information of the vehicle.

The

CAN signal lines

27H and 27L are two-wire communication lines each composed of a CAN-H line 27Ha and a CAN-L line 27La constituting the 1 st system and a CAN-H line 27Hb and a CAN-L line 27Lb constituting the 2 nd system.

The inverter circuit 14a is supplied with power for driving the motor from the external battery BT via a filter, not shown, which absorbs noise and the like contained in the supplied power to smooth the power supply voltage, and a power supply relay. Similarly, a power supply for driving the motor is supplied from the external battery BT to the inverter circuit 14b via a filter and a power supply relay, not shown.

The inverter circuit 14a is a FET bridge circuit including semiconductor switching elements (FETs) corresponding to the three-phase windings (Ua, Va, Wa)15a of the electric motor 15. The inverter circuit 14b is a FET bridge circuit including semiconductor switching elements (FETs) corresponding to the three-phase windings (Ub, Vb, Wb)15b of the electric motor 15.

These switching elements (FETs) are also called power elements, and for example, Semiconductor switching elements such as MOSFETs (Metal-Oxide Semiconductor Field-Effect transistors) and IGBTs (Insulated Gate Bipolar transistors) are used.

The ignition switch (IG-SW)31 has one end connected to the battery BT and the other end connected to the power supply management units 21a and 21b of the power supply units 20a and 20b, respectively. The other end of the IG-SW 31 is also connected to IG voltage detection units 24a and 24 b.

When the ignition switch (IG-SW)31 is turned on, the power supply management units 21a and 21b activate the power supply units 20a and 20 b. The power supply units 20a and 20B convert the battery voltage + B supplied from the battery BT into a predetermined voltage (for example, a voltage of a logic level +5V), and supply operating power to control circuits such as the control units (CPUs) 12a and 12B, the BT voltage monitoring units 29a and 29B, and the inverter control units 13a and 13B.

The IG voltage detection units 24a and 24b AD-convert an Ignition (IG) voltage value, and input the converted digital voltage value to the

CPUs

12a and 12b as an actual voltage value of the IG voltage of the 1 st system and the 2 nd system, respectively. The IG voltage detection units 24a and 24b may be disposed in the

CPUs

12a and 12b, respectively.

The Battery (BT) voltage monitoring units 29a and 29B receive the battery voltage (+ B) of the battery BT and perform AD conversion, and input the converted digital voltage value to the CPUs 12a and 12B as a Battery (BT) voltage value. The Battery (BT) voltage monitoring unit 29 determines whether or not the battery voltage value is equal to or higher than a predetermined voltage value (whether or not a voltage value that can operate a control circuit or the like is satisfied).

Fig. 3 is a block diagram showing the mutual communication structure between the

CPUs

12a, 12 b. As shown in fig. 3, a pair of communication lines (TXD line, RXD line) for asynchronous serial communication of control information and the like and a pair of communication lines (WDP1 line, WDP2 line) for exchanging WDP (watchdog pulse) signals are provided between the

CPUs

12a, 12 b. The number of signal lines required for mutual communication can be minimized, and a low-cost configuration can be realized.

The communication system via the TXD line and the RXD line is UART (Universal Asynchronous Receiver-transmitter), and is configured to enable real-time mutual communication between the

CPUs

12a and 12 b. Compared to the clock synchronization method, the UART can be used to reduce the number of signal lines.

As shown in fig. 3, the isolation IC 30 (see fig. 1) for electrically isolating the

CPUs

12a and 12b from each other is composed of an isolation IC 30a for electrically isolating the TXD line and the RXD line and an isolation IC 30b for electrically isolating the WDP1 line and the WDP2 line.

The

isolation ICs

30a and 30b are semiconductor circuit elements capable of transmitting high-frequency signals while maintaining electrical insulation between the input side and the output side of the communication paths (TXD line, RXD line, WDP1 line, WDP2 line). By isolating the

ICs

30a, 30b, it is possible to prevent the propagation of a fault to the counterpart system.

In the example shown in fig. 3, for example, in order to prevent a common cause failure, a total of two isolation ICs having a channel number of 2 are arranged in correspondence with a pair of communication lines (TXD line, RXD line) and a pair of communication lines (WDP1 line, WDP2 line), respectively, but the present invention is not limited thereto. For example, four isolation ICs with the number of channels of 1 may be arranged on separate communication lines. By disposing an isolation IC for each signal line, more complicated failure determination (double failure, etc.) can be performed.

Next, the operation of the motor control unit of the present embodiment will be described. Fig. 4 is a flowchart showing an example of control processing in the motor control unit 1.

When the power supply units 20a and 20b generate +5V and supply power to the

CPUs

12a and 12b, the OS boot process is performed in step S11 in fig. 4. That is, the Operating System (OS) stored In advance In the storage unit (not shown) is started, the control units (CPUs) 12a and 12b of the respective systems of the motor control unit 1 confirm that the state of the ignition switch (IG state) of the own System is IG-on, the checksum In the storage unit (not shown) In which the control program and the like are stored, the Self-diagnosis based on the diagnostic function BIST (Built-In Self-Test) of the

CPUs

12a and 12b, the initialization of the functions of the CPUs, the reset operation of the external Watchdog (WD) not shown, and the like, based on the voltage detection result of the IG voltage detection units 24a and 24 b.

In step S12 after the OS is started, a watchdog signal is transmitted and received between the

CPUs

12a and 12 b. In the subsequent step S13, the

CPUs

12a, 12b each start inter-CPU communication.

In step S15, an initial diagnostic sequence is started in each system. Then, in step S16, as an initial diagnosis a, for example, a current detection unit, not shown, diagnoses the presence or absence of a short-circuit fault in the inverter circuit.

The CPU of each system determines the state of the partner system in step S17. When it is determined that the partner system has shifted to the predetermined failure operation state, the initial diagnosis of the own system is stopped in step S35.

When the partner system is not in the failure operation state, the CPU of each system starts inter-CPU communication diagnosis with the CPU of the partner system in step S18. Here, since the inter-CPU communication diagnosis is started after the initial diagnosis is performed to some extent, in step S19 after the initial diagnosis a is performed and after the inter-CPU communication diagnosis is started, the initial diagnosis B is performed (for example, whether or not an overcurrent is flowing to the electric motor is determined).

In the motor control unit of the present embodiment, in consideration of, for example, a case where only the other system is reset and communication between CPUs cannot be established due to a voltage drop caused by startup (cranking), at step S20, waiting for at least the Worst Time (Worst Time) required for the other system to start the OS restart is started. Then, in the subsequent step S21, the CPU of each system determines whether or not the inter-CPU communication with the CPU of the other system is established.

If there is no UART overtime, UART checksum abnormity, UART alive counter (alive counter) abnormity or the like, the communication between the CPUs is judged to be normal. However, considering the case where, for example, another system reset occurs due to startup, and transmission is not possible for both UART and WD, it is not necessary to consider an abnormality when UART timeout and WD abnormality occur simultaneously.

If the inter-CPU communication between the systems is not established (no in step S21), in step S22, the

CPUs

12a and 12b determine whether both the UART and WD are in the unreceived state. When either one of the UART and WD is received, a determination of a failure mode (failure diagnosis) described later is performed in step S23. In the following step S25, the malfunction operation (1) corresponding to the malfunction mode determined in step S23 is performed. The details of the malfunction (1) will be described later.

On the other hand, when it is determined in step S22 that both the UART and the WD have not received the signal, it is determined in step S27 whether or not the time accumulated since the start of the Operating System (OS) has elapsed. When the worst time (e.g., 200ms) required for the OS to start has elapsed, it is determined that there is a problem in the initial diagnostic sequence described above, communication diagnosis by both systems (counterpart system failure) cannot be performed, and the process proceeds to the failure operation (2) of step S29, and control using the own system is performed.

If the accumulated worst time period has not elapsed (no in step S27), the process returns to the process of determining whether or not the CPU-to-CPU communication with the partner system is established (step S21).

If it is determined in step S21 that the inter-CPU communication is established, in step S28, for example, a deviation diagnosis is performed for a predetermined sensor as the initial diagnosis C. Then, the initial diagnostic sequence is ended in step S31, and normal control (steering assist control) is started in step S33.

By independently activating each system as described above, a spare communication line for hand-shaking is not required, and the motor control unit can be configured at low cost.

Further, by starting the inter-CPU communication diagnosis in the middle of the initial diagnosis sequence in consideration of the worst time, it is possible to grasp the presence or absence of a failure in inter-CPU communication as early as possible. Further, since the control is performed in consideration of the elapse of the accumulated time after each system is independently started, it is possible to wait until the timing at which the two systems can reliably communicate.

Next, a control operation (failure handling process) in the motor control unit according to the present embodiment, which is associated with a failure in inter-CPU communication, will be described. In the following description, the

CPUs

12a and 12b are referred to as CPU-1 and CPU-2, respectively, the inverter control unit 13a and the inverter circuit 14a are referred to as INV-1, and the inverter control unit 13b and the inverter circuit 14b are referred to as INV-2.

< handling of failure in case of abnormality of communication IC >

A failure handling process in the case where it is determined that an abnormality occurs in the communication IC (isolated IC 30) as a failure mode in the inter-CPU communication diagnosis at the time of the failure diagnosis at step S23 shown in fig. 4, in the normal assist control at and after the start of the assist control at step S33, and in the failure operation at and after steps S25 and S29, will be described. The failure mode here includes an abnormal operation of the circuit element as the isolation IC 30, and also includes a disconnection or sticking failure of the TXD line or the RXD line.

Fig. 5 shows an example of a failure handling processing sequence in the case where an abnormality occurs in the inter-CPU communication due to a failure of the TXD line as an abnormality of the communication IC. Fig. 6 is an example of a failure handling processing sequence in the case where an abnormality occurs in the inter-CPU communication due to a failure of the RXD line.

As shown in fig. 5, in the case where the TXD line as the communication path between the CPUs is failed, and the RXD line, the WDP1 line, and the WDP2 line as the other communication paths are normal, in step S41, the CPU-2 detects a communication abnormality with the CPU-1 due to the interruption of information from the CPU-1. Then, in step S43, the CPU-2 notifies the CPU-1 of the detection of the communication abnormality, and in step S45, stops the operation of INV-2.

The CPU-1 receives the communication abnormality notification from the CPU-2 (step S43), and in step S47, performs steering assist control of the motor output by INV-1 to maintain 50% of the normal state as the above-described malfunction operation (1). This is to continue the assist control of the motor drive by one of the two systems.

On the other hand, as shown in fig. 6, in the case where the RXD line as the communication path between the CPUs is failed, and the TXD line, the WDP1 line, and the WDP2 line as the other communication paths are normal, in step S51, the CPU-1 detects a communication abnormality with the CPU-2 due to the interruption of information from the CPU-2. Then, in step S53, the CPU-1 notifies the CPU-2 of the detection of the communication abnormality.

If there is an abnormality in the communication with the CPU-1, the CPU-2 stops the operation of the INV-2 in step S55. On the other hand, in step S57, the CPU-1 performs the steering assist control for maintaining the motor output of 50% at the normal time by INV-1 as the above-described failed operation (1). In this case, the failed operation of continuing the motor drive by one of the two systems is also performed.

< handling of failure handling in case of CPU abnormality >

The failure handling process in the case where an operation abnormality of the CPU itself is determined as a failure mode of the inter-CPU communication will be described.

Fig. 7 shows an example of a failure handling processing sequence in the case where an abnormality occurs in the inter-CPU communication due to a failure of the CPU-1. Fig. 8 is an example of a failure handling processing sequence in the case where an abnormality occurs in the inter-CPU communication due to a failure of the CPU-2.

When the signal output from the TXD line and the signal output from the WDP1 line are also stopped due to a failure of the CPU-1 as shown in fig. 7, for example, a normal signal is transmitted from the CPU-2 operating normally through the RXD line and the WDP2 line.

In this case, since the control information from the other CPU (CPU-1) is interrupted and the watchdog pulse WDP1 indicating whether or not the CPU-1 is operating is not outputted from the CPU-1, the CPU-2 detects in step S61 that an operation abnormality of the CPU-1 has occurred.

Thus, when the CPU-1 has failed, the CPU-2 performs the steering assist control for maintaining the motor output of 50% of the normal state by the INV-2 as the above-described failed operation (1) in step S63.

In addition, the CPU-1 detects its own abnormality in step S65, and stops the operation of INV-1 in step S67.

When the CPU-2 fails, as shown in fig. 8, the signal output from the RXD line is stopped, and the signal output from the WDP2 line is also stopped. In this case, since the CPU-1 normally operates, a normal signal is transmitted through the TXD line and the WDP1 line.

Since the control information from the other CPU (CPU-2) is interrupted and the watchdog pulse WDP2 indicating whether or not the CPU-2 is operating is not outputted from the CPU-2, the CPU-1 detects in step S71 that an operation abnormality of the CPU-2 has occurred.

Thus, when the CPU-2 has failed, the CPU-1 performs the steering assist control for maintaining the motor output of 50% of the normal state by the INV-1 as the above-described failed operation (1) in step S73.

On the other hand, the CPU-2 detects its own abnormality in step S75, and stops the operation of INV-2 in step S77.

Further, regarding the failure of the CPU, the CPU that normally operates may be notified of a reset operation abnormality or an operation abnormality of the output arithmetic unit detected by a watchdog timer (WDT) provided inside the CPU or an external watchdog timer, a memory abnormality based on a check result of a checksum with respect to a control program or the like, an abnormality detected by a diagnostic function BIST of the CPU, a clock abnormality detected by a clock monitoring function of the CPU, or the like, through CAN communication.

< handling of failure handling in case of CPU clock abnormality >

The failure handling process in the case where an abnormality of a clock signal supplied from the outside to the CPU (an abnormality of an operation clock of the CPU) is determined as a failure mode of inter-CPU communication will be described. Here, the in-vehicle network (CAN) of the motor control device 1a shown in fig. 2 is CAN-1, and the in-vehicle network (CAN) of the motor control device 1b is CAN-2. The

clock oscillators

16a, 16b are CLK-1, CLK-2, respectively.

Fig. 9 to 11 show the failure coping process corresponding to the degree of abnormality (for example, deviation of clock cycle) occurring in the clock signal supplied from CLK-1 to CPU-1.

< clock Exception (1) >

Fig. 9 is a sequence diagram showing a failure handling process at the time of clock abnormality (1). Fig. 9 is a failure handling processing sequence in the following case: the communication between the CPU-1 and the CPU-2 via the TXD line, the RXD line, the WDP1 line and the WDP2 line is normal, but the CAN signal between the CAN-1 and the CPU-1 is stopped, and the CAN-1 operation is detected to be stopped (step S81), and the CAN-2 is normal.

As described above, even if the inter-CPU communication is normal, the operation of CAN-1, which requires a highly accurate operation clock, is stopped, and therefore, in step S83, the CPU-1 determines that a deviation of, for example, 2% has occurred in the clock signal output from the clock oscillation unit 16a (CLK-1) and supplied to CAN-1, or the like, as a clock failure.

In the above case, even if CPU-1 detects an abnormality of CAN-1, CAN-2 receiving a supply of CLK-2 independently of CLK-1 is not affected by a clock abnormality of CLK-1. Therefore, CAN-2 operates normally, so CPU-1 receives CAN information from CPU-2 via the RXD line (step S87).

According to the CAN information described above, even if there is a clock abnormality (1), i.e., a clock signal has a deviation of, for example, 2%, the CPU-1 executes normal control (100% assist control) by INV-1 in step S85.

On the other hand, since CAN-2 is normal, normal control (100% assist control) is performed by the CPU-2 through INV-2 in step S88.

< clock Exception (2) >

Fig. 10 is a sequence diagram showing the failure handling processing at the time of the clock abnormality (2). That is, the failure handling processing sequence of fig. 10 deals with the following cases: the communication between the CPU-1 and the CPU-2 via the TXD line and the RXD line is stopped, and even if the communication via the WDP1 line and the WDP2 line is normal, the CAN signal between the CAN-1 and the CPU-1 is stopped, and the CAN-2 is normal when the operation of the CAN-1 is detected to be stopped (step S91).

In this case, as indicated by the broken line in fig. 10, since the communication via the TXD line and the RXD line is stopped and the operation of CAN-1 is stopped, the CPU-1 determines in step S92 of fig. 10 that a deviation of, for example, 5% occurs in the clock signal output from CLK-1 as a clock failure.

Then, the CPU-1 intentionally stops the WDP1 transmitted to the CPU-2 in step S93. Then, the CPU-1 stops the operation of INV-1 in step S95.

On the other hand, since the WDP1 from the CPU-1 is stopped as described above, the CPU-2 detects an inter-CPU communication abnormality and an abnormality of the WDP1 in step S97. Therefore, the CPU-2 performs the steering assist control for maintaining the motor output of 50% at the normal time by INV-2 in step S99.

< clock Exception (3) >

Fig. 11 is a sequence diagram showing the failure handling processing at the time of the clock abnormality (3). In the case of the clock abnormality (3), as shown by the broken line in fig. 11, the communication via the TXD line, RXD line, and WDP1 line is stopped, the CAN signal between CAN-1 and CPU-1 is also stopped, and the operation of CAN-1 is stopped.

On the other hand, CAN-2 receiving the supply of CLK-2 independently of CLK-1 is not affected by the clock abnormality of CLK-1, so CAN-2 operates normally and WDP2 also operates normally.

In the above case, the CPU-1 determines that a deviation of, for example, 20% is generated as a clock failure in the clock signal output from the CLK-1 in step S101 of FIG. 11. Then, the CPU-1 stops the operation of INV-1 in step S103.

In the case where the clock deviation is 20% as described above, the clock monitoring function of the CPU detects the clock abnormality and resets the clock abnormality, whereby the inter-CPU communication and the communication of the WDP signal are stopped.

On the other hand, since the transmission information (TXD) from the CPU-1 is interrupted and the watchdog pulse WDP1 is not output, the CPU-2 detects an abnormality of the CPU-1 in step S105. Therefore, in step S107, the CPU-2 performs the steering assist control for maintaining the motor output of 50% at the normal time by the INV-2.

The failure handling processing in the case where a deviation of, for example, 2%, 5%, or 20% occurs in the clock signal supplied from CLK-2 to CPU-2 is the same as the failure handling processing for the clock abnormality in CPU-1 described above. That is, the operation of CAN-2 is stopped due to the clock abnormality, and CPU-1 performs the assist control of maintaining the motor output of 50% at the normal time by INV-1.

Thus, illustration and description of the failure handling processing in the case where there is an abnormality in the clock signal supplied from CLK-2 are omitted.

In each of the above-described failure handling processes corresponding to the failure of the inter-CPU communication, in the steering assist control for maintaining the motor output of 50% at the normal time, for example, the motor control is performed in accordance with an output characteristic in which the same gradient as the output characteristic (gradient of the characteristic curve) of the motor when all the systems are normal and the steering assist of 100% is performed is limited to 50% (limited).

In this way, when the failure response is performed, the assist control can be performed at the motor output in the normal state (normal state) up to 50% at maximum, and the change in the responsiveness caused by changing the slope of the output characteristic at the time of the assist can be avoided.

In the motor control unit of the present embodiment, when another sensor not directly related to the inter-CPU communication, for example, a torque sensor has failed, the system to which the torque sensor belongs is stopped, and assist control by another system is performed, or 100% steering assist is continued based on information detected by the torque sensor of another system.

Fig. 12 is a diagram showing the steering assist control of the motor control unit in the case where the torque sensor of the 2 nd system has failed. As shown in fig. 12 (a), when the torque sensor is not faulty, the motor control device 1a of the 1 st system transmits the target torque Tt1 calculated by the CPU 12a based on the instruction torque Tq1 to the CPU 12b of the motor control device 1b of the 2 nd system by inter-CPU communication. In the motor control device 1b of the 2 nd system, the CPU 12b also calculates a target torque Tt2 based on the input instructed torque Tq 2.

In this case, the CPU 12a of the 1 st system performs drive control of the electric motor 15 using the target torque Tt1, and the CPU 12b of the 2 nd system performs assist control for drive controlling the electric motor 15 by selecting, by the selection unit, any one of the target torque Tt1 transmitted from the 1 st system through inter-CPU communication and the target torque Tt2 calculated by the CPU 12 b.

On the other hand, as shown in fig. 12 (b), when the torque sensor of the 2 nd system fails, the CPU 12a of the motor control device 1a of the 1 st system transmits the target torque Tt1 calculated from the input instruction torque (steering torque) Tq1 to the CPU 12b of the motor control device 1b of the 2 nd system through inter-CPU communication.

Thus, the 1 st system performs drive control of the electric motor 15 based on the torque control information based on the target torque Tt1 calculated in the system itself, and the 2 nd system performs assist control for drive-controlling the electric motor 15 by using the target torque Tt1 calculated in the 1 st system as it is as the torque control information.

Fig. 13 is a diagram showing the steering assist control of the motor control unit in the case where the torque sensor of the 1 st system has failed. Fig. 13 (a) shows the steering assist control of the motor control unit in the case where the torque sensor has not failed, as in fig. 12 (a).

As shown in fig. 13 (b), when the torque sensor of the 1 st system fails, the control device 1a of the 1 st system does not calculate the target torque by the CPU 12 a. Thus, in the motor control device 1b of the 2 nd system, the CPU 12b calculates the target torque Tt2 based on the input instructed torque Tq 2. As a result, the motor control device 1b of the 2 nd system performs assist control for maintaining, for example, a motor output of 50% at the normal time.

As described above, the motor control device of the present embodiment is configured by the 1 st and 2 nd control systems, and drives the electric motor by the control unit (CPU) provided for each of the plurality of control systems, and has the following configuration: when a communication failure between the central control units is determined based on the communication states of the control signal via the 1 st communication unit and the watchdog signal via the 2 nd communication unit, the assist control of the electric motor is continued by the normally operating control system of the 1 st control system and the 2 nd control system.

Thus, in a motor control device having a redundant configuration, the CPU communication between the control units (CPUs) of a plurality of control systems and the transmission and reception of a watchdog signal (WDP) are used in combination, and a failure can be monitored mutually even when the communication between the CPUs is interrupted.

Even if one control system is determined to be in the failure mode, the drive control of the electric motor can be continued by the other control system which is normal in accordance with the failure mode (failure site), and the electric motor can be reliably shifted to the failure operation state.

Further, by configuring the control system to specify the occurrence of a failure due to an abnormality of the operation clock of the control unit (CPU) based on the presence or absence of a stop of communication by the TXD line, the RXD line, and the CAN communication unit, it is easy to specify a failure mode (failure portion) based on the CAN communication requiring a highly accurate operation clock. In addition, even when the communication by the 1 st communication unit is stopped, the failure CAN be determined by the CAN communication.

For example, in the motor control device for electric power steering, the motor control device having the redundant configuration described above is configured to drive and control the electric motor, so that even if one control system fails, the other control system can drive and control the electric motor to continue steering assistance.

In addition, for example, in the electric power steering system including the electric power steering motor control device, even if one control system of the electric power steering control device fails, the steering assist can be continued by the other control system, as described above.

The present invention is not limited to the above embodiment, and various modifications are possible. Hereinafter, a modified example will be described.

< modification 1 >

When the communication by the 1 st communication unit (TXD line, RXD line) is stopped, or when the communication by the 2 nd communication unit (WDP1 line, WDP2 line) is stopped, the assist control may be requested to the motor control device of the 1 st system, for example.

When it is not possible to determine which of the plurality of control systems has failed and communication has stopped, the motor control device of the 1 st system performs assist control, thereby enabling reliable fail-safe operation. In addition, when one of the plurality of control systems is used as a master system and the other system is used as a slave system, it is possible to reliably perform the assist control (fail operation) by any of the master and slave control systems at the time of failure.

< modification 2 >

The control system in which the failure occurs may also be determined using CAN communication on the side of the control system different from the control system in which CAN communication based on a vehicle-mounted network (CAN) is stopped. Thus, the CAN communication that operates normally is replaced to identify the failure mode (failure point), and the assistance CAN be continued.

Claims

1. A motor control device is composed of a plurality of control systems, and drives an electric motor by a central control unit provided for each control system,

the motor control device comprises:

a 1 st communication unit that is capable of communicating a control signal between the 1 st control system and the central control unit of the 2 nd control system of the plurality of control systems;

a 2 nd communication unit capable of transmitting and receiving an abnormality monitoring signal between the central control units; and

a failure determination unit that determines whether or not there is a communication failure between the central control units based on a communication state of the control signal and the abnormality monitoring signal,

when the failure determination means determines that the communication is failed, the drive control of the electric motor is continued by a control system that normally operates out of the 1 st control system and the 2 nd control system.

2. The motor control apparatus according to claim 1,

the communication failure includes at least a failure of the central control unit, a failure of a communication integrated circuit element constituting the 1 st communication unit and the 2 nd communication unit, a disconnection or sticking failure of the 1 st communication unit, a disconnection or sticking failure of the 2 nd communication unit, and a failure due to an abnormality of an operation clock of the central control unit.

3. The motor control apparatus according to claim 2,

when the communication by the 1 st communication means is stopped and the communication by the 2 nd communication means is normal between the central control units, the failure determination means determines that a failure is caused by an abnormality in an operation clock of the central control unit or that a disconnection or sticking failure of the 1 st communication means occurs.

4. The motor control apparatus according to claim 2,

the failure determination means determines that the central control unit has failed when communication between the central control units based on the 1 st communication means and the 2 nd communication means is stopped.

5. The motor control apparatus according to claim 2,

the failure determination unit determines that the 2 nd communication unit is broken or stuck in failure when communication based on the 1 st communication unit is normal and communication based on the 2 nd communication unit is stopped between the central control portions.

6. The motor control device according to any one of claims 1 to 5,

the motor control device further includes a CAN communication unit configured to be able to communicate with the central control unit,

the failure determination unit specifies the control system in which the failure due to the abnormality of the operation clock of the central control unit has occurred, based on whether or not the communication between the 1 st communication unit and the CAN communication unit has been stopped.

7. The motor control apparatus according to claim 1,

the failure determination unit may request the 1 st control system to control driving of the electric motor when communication by the 1 st communication unit is stopped or when communication by the 2 nd communication unit is stopped.

8. The motor control apparatus according to claim 1,

when it is determined that the communication failure has occurred, the drive control of the electric motor is requested to either one of the 1 st control system and the 2 nd control system.

9. The motor control apparatus according to claim 6,

the control device stops the drive control of the electric motor by the 1 st control system when the CAN communication on the 1 st control system side is stopped, and stops the drive control of the electric motor by the 2 nd control system when the CAN communication on the 2 nd control system side is stopped.

10. The motor control apparatus according to claim 6,

the failure determination unit determines the control system in which the failure has occurred using CAN communication on the side of the control system different from the control system in which the CAN communication has stopped.

11. The motor control apparatus according to claim 1,

the central control unit of the 1 st control system and the central control unit of the 2 nd control system are individually activated at the time of activation, and wait until a timing at which these central control units can communicate with each other.

12. The motor control apparatus according to claim 1,

the 1 st communication unit communicates the control signal by asynchronous communication.

13. The motor control apparatus according to claim 1,

the 1 st communication unit and the 2 nd communication unit are each formed by a two-wire signal line.

14. The motor control apparatus according to claim 13,

the 1 st communication unit and the 2 nd communication unit have an isolation unit that implements electrical insulation at each of the signal lines or at each of the communication units.

15. The motor control apparatus according to any one of claims 1 to 14, wherein

The anomaly monitoring signal is a watchdog pulse signal.

16. An electric power steering control device having a central control unit provided for each of a plurality of control systems, the electric power steering control device assisting a steering wheel operation of a driver of a vehicle or the like,

the electric power steering control device includes:

an electric motor that assists steering of the driver; and

a unit that drive-controls the electric motor by the motor control device according to any one of claims 1 to 15.

17. An electric power steering system having the electric power steering control device according to claim 16.

18. A method for determining a failure point in a motor control device which is composed of a plurality of control systems and drives an electric motor by a central control unit provided for each of the control systems,

the method for determining a failure point in the motor control device includes the steps of:

determining a failure due to an abnormality of an operation clock of the central control unit, or a disconnection or sticking failure of the 1 st communication unit, when communication between the central control units based on the 1 st communication unit capable of communicating a control signal is stopped and communication between the central control units based on the 2 nd communication unit capable of transmitting and receiving an abnormality monitoring signal is normal;

determining that the central control unit is faulty when communication between the central control units based on the 1 st communication unit and the 2 nd communication unit is stopped; and

when the communication by the 1 st communication unit is normal and the communication by the 2 nd communication unit is stopped between the central control units, it is determined that the 2 nd communication unit is broken or stuck.