JP2007145208A - Electronic control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic control device with little voltage lowering in outputting electric power of an auxiliary electric power source and compatible with high reliability. <P>SOLUTION: This electronic control device serially provided with a first switch 17 and a second switch 18 of a relay and an FET between an electronic control part 10 and the auxiliary electric power source 16 determines that both of the switches 17, 18 do not short when voltage V2 in putting off both of the switches 17, 18 is lower than a specified value, determines that the first switch 17 does not open-fail when V1 and V2 are almost equal when the first switch 17 is put on and the second switch 18 is put off and determines that the second switch 18 does not open-fail when both of the switches 17, 18 are reversely put on and off and V2 and V3 are roughly equal, and consequently, it is possible to almost eliminate the voltage lowering by both of the switches 17, 18, to determine failure of both of the switches 17, 18 and to provide high reliability. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an electronic control device that performs power backup in an emergency for an electronic control unit.

  In recent years, the development of hybrid cars and electric cars has been rapidly progressing, and accordingly, various proposals from conventional mechanical hydraulic control to electrical hydraulic control have also been made for vehicle braking.

  Generally, a battery is used as a power source to electrically control the hydraulic pressure of the vehicle. In this case, if the power supply is cut off for some reason, the hydraulic control cannot be performed and the vehicle cannot be braked. There is a possibility.

  Therefore, an electronic control device has been proposed that can supply drive power to an electronic control unit that performs electrical hydraulic control in an emergency by mounting a large-capacity capacitor or the like as an auxiliary power source in addition to the battery.

  In particular, with the spread of personal computers, there is an increasing demand for emergency power supplies for preventing data loss at the time of a power failure. For example, power is stored in a large-capacity capacitor or the like. There has also been proposed an electronic control device that instantaneously supplies power from a capacitor or the like to a personal computer (corresponding to the electronic control unit).

  As an example of such an electronic control device, a power supply backup power supply circuit for an electronic control unit such as a timepiece or a semiconductor memory mounted on a vehicle is known (Patent Document 1).

  FIG. 6 shows a schematic circuit diagram in which the power supply backup portion of this power supply circuit is extracted. In FIG. 6, a portion surrounded by a dotted line corresponds to the circuit diagram shown in Patent Document 1.

  First, a circuit portion surrounded by a dotted line will be described.

  A switch means 2 as an ignition switch is connected to the battery 1 corresponding to the main power source. When the switch means 2 is turned on when the vehicle is started, the power of the voltage VCC is supplied to the entire vehicle through the diode 2a connected in series therewith.

  On the other hand, for the timepiece and the semiconductor memory that always need to be driven regardless of the use of the vehicle, the output of the battery 1 is branched and the voltage VDD is always supplied via the diode 2b and the resistor 2c.

  In addition, a capacitor 3 is connected as an auxiliary power source so that the VDD output is maintained even if the battery 1 is removed for replacement or the like. Thereby, since the capacitor 3 supplies power, the timepiece and the semiconductor memory can be continuously driven.

  Next, the case where the power backup circuit having such a configuration is applied as an emergency power source to the above-described electronic control unit for vehicle braking or a personal computer (electronic control unit) will be described. The schematic circuit diagram is as shown in FIG.

  That is, VCC is connected to the electronic control unit 4 as it is, and VDD including the output of the capacitor 3 is connected to the electronic control unit via the switch unit 5 interlocked with the switch unit 2 and the diode 6 as indicated by the hatched line. 4 is connected.

  Therefore, this corresponds to the fact that two power sources are connected to the electronic control unit 4.

  The switch means 2 and 5 may be provided in the immediate vicinity of the output of the battery 1. This makes it possible to use one switch means. In this case, since the capacitor 3 is naturally discharged while the switch means is off, the capacitor 3 is charged after the switch means is turned on.

  The operation as an emergency power supply is as follows. The description will be made assuming that two switch means are used in conjunction with each other as shown in FIG. Therefore, since the battery 1 is always connected to the capacitor 3, the capacitor 3 is in a fully charged state.

  When the switch means 2 and 5 are turned on in this state, VCC is supplied to the electronic control unit 4 if the VCC of the battery 1 is normal.

  This is because VCC is equal to VDD if the voltage drops of the diodes 2a and 2b are equal to each other. However, since the diode 6 is further connected to the VDD side, VCC is larger by the voltage drop of the diode 6. As a result, VDD is not output and VCC is preferentially supplied to the electronic control unit 4.

  Here, if for some reason the voltage VCC of the battery 1 drops below VDD, the voltages at both ends of the diodes 2a and 6 are reversed, so that the diode 2a is turned off and the diode 6 is turned on. As a result, the voltage VDD of the capacitor 3 is supplied to the electronic control unit 4.

By such an operation, even if the battery 1 becomes abnormal and the voltage drops, the voltage VDD of the capacitor is automatically supplied to the electronic control unit 4 by the action of the diodes 2a and 6, and the driving is stopped. Things will disappear.
Utility Model Registration No. 2565018

  The power supply circuit as described above can continue to drive the electronic control unit 4 that cannot be stopped even when the battery 1 is abnormal, but the diodes 2a and 6 are used to automatically switch between VCC and VDD. Therefore, a voltage drop (about 0.7 V) in this part is inevitable.

  Therefore, particularly for the capacitor 3, it is necessary to increase the number of capacitors 3 in consideration of a voltage drop due to the diode 6 so that the electronic control unit 4 can be sufficiently driven.

  At this time, in general, in order to increase the voltage, the capacitor 3 may be increased in series. However, the capacitance is decreased. Then, in order to secure a necessary and sufficient capacity, it is necessary to connect the capacitors 3 in parallel, and the number of the capacitors 3 is greatly increased as a whole.

  Therefore, there has been a problem that a configuration in which a voltage drop in the diode 6 does not occur is required.

  Furthermore, especially for the electronic control unit 4 for vehicle braking, since extremely high reliability is required, the system must be able to determine the failure of the diode 6 at an early stage.

  However, the failure of the diode 6 cannot be determined with the circuit configuration of FIG.

  Therefore, as shown in the circuit diagram of the dotted line in FIG. 6, a configuration in which redundancy is increased by connecting two diodes 6 in parallel can be considered, but the possibility that both of the diodes 6 may fail cannot be completely denied. There was a problem.

  SUMMARY OF THE INVENTION The present invention solves the above-described conventional problems, and an object thereof is to provide an electronic control device that has almost no voltage drop when outputting the power of an auxiliary power source and is compatible with extremely high reliability. And

  In order to solve the above-described conventional problems, an electronic control device of the present invention is provided with a first switch and a second switch in series instead of a diode between a main power supply and an auxiliary power supply, and the first switch and the first switch As a failure determination operation of two switches, a voltage between the first switch and the second switch when the first switch and the second switch are turned off is obtained by the voltage detection circuit, and the voltage is predetermined. If it is less than the value, it is determined that the first switch and the second switch are not short-circuited, and the first switch is turned on when the first switch is turned on and the second switch is turned off. Is obtained by the voltage detection circuit, and if the voltages at the both ends are substantially equal, it is determined that the first switch does not have an open failure. When the switch is turned off and the second switch is turned on, the voltages at both ends of the second switch are obtained by the voltage detection circuit, so that if the voltages at the both ends are substantially equal, the second switch It is determined that there is no open failure.

  With this configuration, there is almost no voltage drop in the first switch and the second switch, and the failure of both can be determined. As a result, the object can be achieved.

  According to the electronic control device of the present invention, it is possible to achieve both of eliminating almost no voltage drop in the output from the auxiliary power supply and obtaining extremely high reliability by determining the failure of the first switch and the second switch.

  The best mode for carrying out the present invention will be described below with reference to the drawings. Here, as an example, an emergency electronic control device during vehicle braking will be described.

(Embodiment 1)
FIG. 1 is a block circuit diagram of the electronic control unit according to Embodiment 1 of the present invention. FIG. 2 is a flowchart showing the operation of the electronic control device according to Embodiment 1 of the present invention.

  In FIG. 1, a main power supply 13 that is a battery is connected to an electronic control unit 10 that controls vehicle braking via a main power switch 11 formed of a diode.

  In addition, the electronic control unit 10 includes a power backup unit 14 (supplementarily supplying drive power to the electronic control unit 10 when the main power supply 13 becomes lower than a predetermined voltage at which the electronic control unit 10 cannot be driven. 1 (shown by a dotted line in FIG. 1) is connected.

  Next, details of the power backup unit 14 will be described.

  The power backup unit 14 incorporates an auxiliary power supply 16 to which a plurality of electric double layer capacitors are connected as an emergency power source.

  A first switch 17 and a second switch 18 are connected in series between the electronic control unit 10 and the auxiliary power supply 16 in order from the electronic control unit 10 side.

  The first switch 17 and the second switch 18 are configured so that on / off can be controlled by an external signal, and in the first embodiment, a relay is used. Thereby, since there is almost no voltage drop at the time of ON, it becomes unnecessary to comprise the auxiliary power supply 16 with many capacitors in anticipation of the voltage drop of a diode like the past.

  A voltage V1 between the electronic control unit 10 and the first switch 17, a voltage V2 between the first switch 17 and the second switch 18, and a voltage V3 between the second switch 18 and the auxiliary power supply 16 are respectively a voltage detection circuit 19. It is comprised so that it can measure by.

  The voltages V1 to V3 can be switched and sequentially measured in the voltage detection circuit 19.

  On / off control of the first switch 17 and the second switch 18 is performed by the control circuit 20. The voltage output of the voltage detection circuit 19 is transmitted to the control circuit 20.

  The control circuit 20 is also connected to a vehicle control CPU (not shown) so that signals can be input and output.

  Further, a discharge circuit 21 made of a resistor having a high resistance value of about several kΩ is connected between the first switch 17 and the second switch 18. The other end of the discharge circuit 21 is connected to the ground.

  As a result, when both the first switch 17 and the second switch 18 are OFF, the voltage V2 is at a land level. Therefore, in the first embodiment, the predetermined value of V2 necessary for determining a short-circuit failure is set to the ground level. That is, although details will be described later, if V2 is at the ground level, it is determined that there is no short circuit failure.

  Note that the predetermined value of V2 is not limited to the ground level, but a predetermined value may be set, and if it is less than that, it may be determined that a short circuit failure has not occurred.

  Next, the operation of such an electronic control device will be described with reference to the flowchart of FIG.

  FIG. 2 shows a flowchart of the failure determination software stored in the control circuit 20 in advance, and includes a main routine and an interrupt routine executed by interrupting at regular time intervals.

  First, the main routine will be described.

  When the vehicle is started, although not shown in FIG. 1, the auxiliary power supply 16 is charged by another line of wiring from the main power supply 13 to the auxiliary power supply 16, and then the main routine of FIG. 2 is executed.

  At this time, both the first switch 17 and the second switch 18 are off.

  By executing the main routine, first, the operation of the interrupt routine is permitted (step number S1). Thereby, even during execution of the main routine, the interrupt routine is executed at regular time intervals.

  Details of the interrupt routine will be described later.

  Next, the voltage V1 is read by the voltage detection circuit 19, and it is determined whether or not it is larger than the predetermined voltage (S2). Here, the predetermined voltage is a minimum voltage capable of driving the electronic control unit 10.

  Therefore, if V1 (corresponding to the voltage of the main power supply 13) is equal to or lower than the predetermined voltage (No in S2), the main power supply 13 is abnormal from the beginning, so that the type of abnormality signal is the main power supply abnormality (S3). A signal is output to the vehicle control CPU (S4).

  In response to this, the vehicle control CPU issues a warning to the driver and prompts repair at the maintenance shop. At this stage, the vehicle cannot travel because the main power supply 13 is abnormal. Therefore, it is not necessary to supply auxiliary power from the power backup unit 14 to the electronic control unit 10.

  Since it is not necessary to operate the interrupt routine after outputting the abnormal signal, the interrupt is prohibited (S5) and the main routine is terminated.

  On the other hand, if V1 is larger than the predetermined voltage (Yes in S2), it is determined that the main power supply 13 is normal, and thereafter, the failure determination operation for the first switch 17 and the second switch 18 is performed.

  First, both the first switch 17 and the second switch 18 are turned off (S6).

  Next, the voltage V2 is read by the voltage detection circuit 19 (S7). The read voltage is transmitted to the control circuit 20.

  The circuit portion of the voltage V2 is connected to the ground via the discharge circuit 21. Therefore, if both the first switch 17 and the second switch 18 are off, the charge in the V2 portion is discharged to the ground by the discharge circuit 21, so that the voltage V2 is at the ground level which is the default value of the first embodiment. Must be.

  Therefore, it is determined whether or not V2 is at the ground level (GND) (S8).

  If V2 is not GND (No in S8), the first switch 17 and / or the second switch 18 is short-circuited (still on), and as a result, the voltages V1 and V3 are in the V2 portion. It will depend.

  Accordingly, the type of the abnormal signal is set as a short fault (S9), and the process jumps to S4 and the operation after the abnormal signal is output.

  In S8, it is impossible to distinguish which one of the first switch 17 and the second switch 18 or both are short-circuited.

  However, since a short circuit failure itself should not occur, it is necessary to warn the driver of the fact that a short circuit failure has occurred as soon as possible even if the failed switch cannot be identified.

  Further, when repairing, both the first switch 17 and the second switch 18 are exchanged, so that it is not necessary to distinguish the failed switch and the reliability is improved.

  For these reasons, no distinction is made between switches that are short-circuited.

  Next, the first switch 17 is turned on and the second switch 18 is turned off (S10). Thus, since the first switch 17 is not a conventional diode, no voltage drop occurs, and the voltage V1 corresponding to the main power supply 13 is also applied to almost V2. However, since the second switch 18 is OFF, V2 is not applied to the auxiliary power supply 16 side (V3).

  In addition, although the discharge circuit 21 is connected to the circuit part of V2, this is comprised from the resistance of high resistance value. Accordingly, since the current flowing through the discharge circuit 21 is extremely small, it is possible to suppress useless current consumption.

  Next, the voltages V1 and V2 across the first switch 17 are read by the voltage detection circuit 19 in the state of S10 (S11). The read voltage is transmitted to the control circuit 20.

  Next, V1 and V2 are compared. As a result, if the voltages at both ends are substantially equal, it is determined that the first switch 17 has not failed. If not, the first switch 17 has not been turned on for some reason. Is determined to have occurred.

  If there is a failure (No in S12), the type of the abnormal signal is set as an open failure of the first switch 17 (S13), the process jumps to S4 and the operation after the abnormal signal is output is performed.

  If there is no failure (Yes in S12), the first switch 17 is then turned off (S14).

  Thereafter, it waits for a predetermined time (0.1 seconds in the first embodiment) (S15). Thereby, the electric charge of the V2 portion can be discharged to the ground by the discharge circuit 21.

  Next, the second switch is turned on (S16).

  As a result, since the second switch 18 is not a conventional diode, a voltage drop does not occur, and the voltage V3 corresponding to the auxiliary power supply 16 is also applied to almost V2. However, since the first switch 17 is off, V2 is not applied to the main power supply 13 side (V1).

  In this state, the voltages V2 and V3 across the second switch 18 are read by the voltage detection circuit 19 (S17). The read voltage is transmitted to the control circuit 20.

  Next, V2 and V3 are compared. As a result, if the voltages at both ends are substantially equal, it is determined that the second switch 18 has not failed. Otherwise, the second switch 18 has not been turned on for some reason. Is determined to have occurred.

  If there is a failure (No in S18), the type of the abnormal signal is set as an open failure of the second switch 18 (S19), the process jumps to S4 and the operation after the abnormal signal is output is performed.

  If there is no failure (Yes in S18), the second switch 18 is turned off (S20). As a result, both the first switch 17 and the second switch 18 are turned off.

  Here, it is not necessary to perform the failure determination operation many times in a short period of time, and it is sufficient to perform it every predetermined time (for example, 10 minutes order).

  Therefore, it waits until the predetermined time elapses (S21).

  Note that the voltage V3 is applied to V2 by S16. However, by turning off the second switch in S20, the charge in the V2 portion is discharged to the ground via the discharge circuit 21 while waiting for the predetermined time to elapse in S21. Therefore, V2 is at the ground level.

  When the predetermined time has elapsed, the process returns to S7, and the failure determination operation of the first switch 17 and the second switch 18 is repeated again. As a result, the failure determination operation is performed every predetermined time during the operation of the power supply backup unit 14, so that the reliability is improved.

  The above is the operation of the main routine. An interrupt routine executed at regular time intervals during this operation will be described below.

  The main role of the interrupt routine is to quickly switch to the auxiliary power supply 16 whenever an abnormality occurs in the main power supply 13.

  In order to realize this, interrupt processing is used. As a result, it is possible to deal with the abnormality determination of the main power supply 13 independently of the execution of the main routine.

  As for the specific operation of the interrupt routine, first, the control circuit 20 always counts a fixed time (for example, a fraction of a second), and generates a signal every time a fixed time elapses.

  Therefore, the control circuit 20 is configured such that an interrupt is permitted in the main routine, and when the signal is output, the control circuit 20 jumps to the interrupt routine no matter where the main routine is executed.

  When the interrupt routine is executed, the interrupt is first prohibited (S50), and then V1 corresponding to the voltage of the main power supply 13 is read into the control circuit 20 through the voltage detection circuit 19 (S51).

  Next, it is determined whether or not V1 is larger than a predetermined voltage as the main power supply 13 (S52).

  If V1 is larger than the predetermined voltage (Yes in S52), the main power supply 13 is normal, and after jumping to S60 and permitting the interrupt, the process returns from the interrupt routine. Thereby, the execution of the main routine is continued again from the place interrupted by the interrupt process during the execution of the main routine.

  On the other hand, if V1 is equal to or lower than the predetermined voltage (No in S52), the main power supply 13 is abnormal in voltage, so immediately after the first switch 17 and the second switch 18 are turned on (S53), the main power supply 13 is abnormal. A signal is output (S54, S55).

  At this time, it is known that the first switch 17 and the second switch 18 are normal by the failure determination operation. This is because if there is an abnormality, the interrupt is prohibited in S5 of the main routine, so S53 is not executed. That is, the fact that S53 can be executed means that the first switch 17 and the second switch 18 are normal.

  Therefore, both switches can be reliably turned on, and extremely high reliability can be obtained.

  Thereby, the electric power of the auxiliary power supply 16 is supplied to the electronic control unit 10. Note that since the main power supply 13 is equal to or lower than the predetermined voltage, the voltage of the auxiliary power supply 16 is higher than the voltage of the main power supply 13, so that the power of the auxiliary power supply 16 is supplied to the main power supply 13 by the main power switch 11. Absent.

  From these things, since the electronic control unit 10 is continuously driven, the driver can safely brake the vehicle and stop based on the warning by the abnormal signal output in S55.

  Here, the voltage of the main power supply 13 may recover while the power of the auxiliary power supply 16 is being supplied to the electronic control unit 10.

  In response to this, the operations after S56 of the interrupt routine are performed.

  First, the voltage V1 of the main power supply 13 is read in S56.

  Next, as in S52, V1 is compared with a predetermined voltage (S57).

  If V1 is larger than the predetermined voltage (Yes in S57), since the voltage of the main power supply 13 has been recovered, an abnormality release signal is output to the vehicle control CPU (S58).

  Thereafter, by turning off both the first switch 17 and the second switch 18 (S59), the power supply source to the electronic control unit 10 is switched from the auxiliary power supply 16 to the main power supply 13.

  Next, since the main power supply 13 has been restored, an interrupt is permitted to return to the normal operation (S60), and then the process returns to the main routine.

  On the other hand, if V1 is equal to or lower than the predetermined voltage (No in S57), the voltage V1 of the main power supply 13 remains abnormal, and the power of the auxiliary power supply 16 is continuously supplied to the electronic control unit 10.

  As a result, the voltage V3 of the auxiliary power supply 16 decreases. Next, V3 is read (S61), and if V3 becomes equal to or lower than a predetermined voltage that is the lower limit for driving the electronic control unit 10 (No in S62), the auxiliary An abnormality in the remaining amount of the power supply 16 can be detected.

  In this case, the type of the abnormality signal is set as an auxiliary power supply abnormality (S63), and the process jumps to S4 of the main routine to output the abnormality.

  On the other hand, if V3 is larger than the predetermined voltage (Yes in S62), the auxiliary power supply 16 is normal, and the process returns to the operation after S56 in order to determine again whether the main power supply 13 has recovered.

  Since the interrupt routine described above is executed every 1 second, even if the failure determination operation of the first switch 17 or the second switch 18 is being performed, if the output voltage of the main power supply 13 becomes equal to or lower than the predetermined voltage, It is possible to switch to the auxiliary power supply 16 by immediately stopping the failure determination operation and turning on the first switch and the second switch very early.

  Further, when the voltage of the main power supply 13 is restored, the main power supply 13 can be immediately switched to, so that these operations provide extremely high reliability as an electronic control device.

  With the above configuration and operation, when the power of the auxiliary power supply 16 is output, switching is performed with two switches consisting of relays instead of diodes, so that there is almost no voltage drop and the failure judgment operation of the two switches is possible. As a result, an extremely high reliability can be obtained, so that an electronic control device that can achieve both a low voltage drop and high reliability can be realized.

  In the first embodiment, as the failure determination operation, first, a short failure of the first switch 17 and the second switch 18 is determined, then an open failure of the first switch 17 is determined, and then the second switch 18 is determined. The order in which the open failures are determined is any order.

  However, as described in S15 of FIG. 2, if the first switch 17 and the second switch 18 are not broken when the first switch 17 and the second switch 18 are not broken, the first switch 17 and the second switch 18 are turned off. Then, it is necessary to wait for a predetermined time (0.1 second in the first embodiment).

(Embodiment 2)
FIG. 3 is a block circuit diagram of the electronic control unit according to Embodiment 2 of the present invention.

  3, the same components as those in FIG. 1 are denoted by the same reference numerals, and detailed description thereof is omitted.

  That is, the characteristic part of the second embodiment is that the first switch 17 and the second switch 18 are connected by inverting the directions of the two P-channel FETs 17a and 18a as shown in FIG. This is the point.

  Therefore, since the first switch 17 and the second switch 18 each use a pair of FETs 17a and 18a, both switches are constituted by a total of four FETs.

  Further, since the pair of two FETs 17a and 18a are connected with their directions reversed, the directions of the parasitic diodes 17b and 18b of each pair of FETs 17a and 18a are reversed.

  On / off control of the two FETs 17a, 18a is wired by the control circuit 20 so as to be simultaneously performed for each group.

  Since the FETs 17a and 18a are used in this way, a switch configuration with almost no voltage drop at the time of ON can be obtained.

  Furthermore, since the parasitic diodes 17b and 18b are connected so as to reverse the direction as described above, in the failure determination operation, for example, the first switch 17 is turned on and the second switch 18 is turned off. Then, if the first switch 17 has not failed, V1≈V2, but since the direction of the parasitic diode 18b is reversed, no inrush current flows from V2 to V3, and the voltage of V2 Instability can be prevented.

  As a result, the reliability of failure determination can be improved.

  The failure determination operation is exactly the same as that in FIG. 2 of the first embodiment, and thus detailed description thereof is omitted.

  With the above configuration and operation, when the power of the auxiliary power supply 16 is output, the first switch and the second switch, each consisting of a set of two FETs, are used instead of the diode, so that there is almost no voltage drop, and 2 Since it is possible to have an extremely high reliability by enabling the operation of judging the failure of each switch, it is possible to realize an electronic control device that can achieve both a low voltage drop and high reliability.

  In the second embodiment, the P-channel FET is used for the switch, but this may be an N-channel FET.

  Further, since the FET has no mechanical contact compared to the relay used in the first embodiment, further improvement in reliability can be realized.

  Further, the failure determination operation may be performed in any order as in the first embodiment.

(Embodiment 3)
FIG. 4 is a block circuit diagram of the electronic control unit according to Embodiment 3 of the present invention. FIG. 5 is a flowchart showing the operation of the electronic control unit according to Embodiment 3 of the present invention.

  4, the same components as those in FIG. 3 are denoted by the same reference numerals, and detailed description thereof is omitted.

  In FIG. 5, the same operations as those in FIG. 2 are denoted by the same step numbers, and detailed description thereof is omitted.

  That is, the characteristic part of the configuration of the third embodiment is that the first switch 17 and the second switch 18 are respectively one P-channel FET 17a and 18a as shown in FIG.

  As a result, the total number of FETs can be halved compared to the second embodiment, and the cost can be reduced.

  However, this configuration causes a problem of inrush current.

  That is, for example, in the failure determination operation, the first switch 17 is turned on and the second switch 18 is turned off. In this case, if the first switch 17 has not failed, V1≈V2.

  However, since the parasitic diode 18b is present in the second switch 18 in the direction shown in FIG. 4, V2 and V3 are brought into conduction by the parasitic diode 18b when V2> V3.

  Therefore, if V2> V3, an inrush current flows from V2 to V3, and the voltage of V2 becomes unstable. Therefore, the reliability of failure determination becomes low.

  This problem can occur in the same manner even when the first switch 17 is off and the second switch 18 is on.

  Therefore, in order to avoid the above problem, the absolute value (= |) of the voltage difference between the voltage V1 between the electronic control unit 10 and the first switch 17 and the voltage V3 between the second switch 18 and the auxiliary power supply 16 is obtained. If V1-V3 |) is equal to or greater than a predetermined value (minimum voltage difference through which inrush current flows), the open failure determination operation of the first switch 17 and the second switch 18 is not performed.

  Thereby, for example, under the switch condition (the first switch 17 is on and the second switch 18 is off), the open failure determination is performed only when the absolute value of the difference between V1 and V3 is less than a predetermined value, that is, both are substantially equal. It turns out that.

  As a result, if V1≈V2 is obtained by setting the above switch condition on the premise of V1≈V3, V2≈V3 because V1≈V3. Therefore, since the voltage across the parasitic diode 18b is almost equal, no inrush current flows.

  Therefore, it is possible to determine a failure while V2 is stable.

  On the other hand, when the absolute value of the difference between V1 and V3 is greater than or equal to a predetermined value, open failure determination is not performed and only short failure determination is performed.

  Since the drive voltage is determined by the specification of the electronic control unit 10 as a load, V1≈V3 must be satisfied when the electronic control device is normal. Therefore, in practice, it is assumed that there are very few cases where the open failure determination is not performed even in the configuration of the third embodiment, and the configuration of FIG. 4 can achieve the object of this patent.

  Next, a specific operation for determining a failure under the above conditions will be described with reference to the flowchart of FIG.

  First, step numbers S1 to S8 in the main routine are the same as those in FIG.

  After the determination of the short failure in S8, if there is no short failure (Yes in S8), the voltages V1 and V3 are read by the voltage detection circuit 19 and transmitted to the control circuit 20 (S100).

  Next, the absolute value of the difference between V1 and V3 is calculated, and it is determined whether or not it is equal to or greater than a predetermined value (S101).

  If it is equal to or greater than the predetermined value (Yes in S101), an inrush current will flow if the next open fault determination is made and correct determination cannot be made, so the open fault determination routine (S10 to S20) is skipped and executed. I try not to.

  Therefore, if Yes in S101, the process jumps to S21 to execute the operation after waiting for a predetermined time.

  On the other hand, if the absolute value of the difference between V1 and V3 is less than the predetermined value (No in S101), an inrush current does not flow, so an open failure determination is continued (S10 and later).

  The open failure determination operation (S10 to S20) is the same as in FIG.

  The operation of the interrupt routine is exactly the same as in FIG.

  Such an operation is performed only when an open failure can be determined accurately, so that a highly reliable failure determination is possible.

  With the above configuration and operation, when the power of the auxiliary power supply 16 is output, the voltage is almost eliminated because the switching is performed by the first switch and the second switch made of FETs instead of the diodes, and the operating conditions are limited. However, since it is possible to have a very high reliability by enabling the failure judgment operation of both switches, an electronic control device that can achieve both a low voltage drop and high reliability can be realized.

  In the third embodiment, N-channel FETs may be used for both switches.

  Further, the failure determination operation may be performed in any order as in the first embodiment.

  In the electronic control device according to the present invention, there is almost no voltage drop at the switch, and it is not necessary to increase the number of capacitors, and high reliability can be obtained at the same time by the failure determination operation of the switch. Useful for power backup in case of emergency.

1 is a block circuit diagram of an electronic control device according to Embodiment 1 of the present invention. The flowchart which shows operation | movement of the electronic controller in Embodiment 1 of this invention. Block circuit diagram of the electronic control unit in Embodiment 2 of the present invention Block circuit diagram of an electronic control unit according to Embodiment 3 of the present invention The flowchart which shows operation | movement of the electronic controller in Embodiment 3 of this invention. Block diagram of a conventional electronic control unit

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Electronic control part 11 Main power switch 13 Main power supply 14 Power supply backup unit 16 Auxiliary power supply 17 1st switch 18 2nd switch 19 Voltage detection circuit 20 Control circuit

Claims (8)

An electronic control unit;
A main power supply for supplying driving power to the electronic control unit via a main power switch;
An electronic control device comprising a power supply backup unit that supplementarily supplies the driving power to the electronic control unit when the main power source becomes a predetermined voltage or less,
The power backup unit is
Auxiliary power,
A first switch and a second switch connected in series from the electronic control unit in series between the electronic control unit and the auxiliary power source,
A discharge circuit connected between the first switch and the second switch;
A voltage detection circuit for measuring voltages between the electronic control unit and the first switch, between the first switch and the second switch, and between the second switch and the auxiliary power source;
A control circuit connected to the first switch, the second switch, and the voltage detection circuit;
The control circuit includes:
As a failure determination operation of the first switch and the second switch,
The voltage detection circuit obtains a voltage between the first switch and the second switch when the first switch and the second switch are turned off. If the voltage is equal to or lower than a predetermined value, the first switch It is determined that one switch and the second switch are not short-circuited,
When the first switch is turned on and the second switch is turned off, the voltage at both ends of the first switch is obtained by the voltage detection circuit. 1 Determine that the switch is not open failure,
When the first switch is turned off and the second switch is turned on, the voltages at both ends of the second switch are obtained by the voltage detection circuit, respectively. 2 It is judged that the switch is not open failure,
An electronic control device that turns on the first switch and the second switch when the voltage of the main power source obtained by the voltage detection circuit is equal to or lower than a predetermined voltage. The electronic control device according to claim 1, wherein the discharge circuit is configured to be connected to a ground level via a resistor having a high resistance value. The electronic control device according to claim 1, wherein the first switch and the second switch are relays. The electronic control device according to claim 1, wherein the first switch and the second switch are FETs. 5. The electronic control device according to claim 4, wherein the first switch and the second switch are configured by inverting and connecting two N-channel FETs or two P-channel FETs. 6. In the voltage between the electronic control unit and the first switch, and the voltage between the second switch and the auxiliary power supply, if the absolute value of the voltage difference is equal to or less than a predetermined value, the first switch and the second switch are open. The electronic control device according to claim 4, wherein no determination operation is performed. The electronic control device according to claim 1, wherein the failure determination operation is performed every predetermined time during the operation of the power backup unit. 2. The electronic control device according to claim 1, wherein when the output voltage of the main power source becomes equal to or lower than a predetermined voltage during the failure determination operation, the failure determination operation is immediately stopped and the first switch and the second switch are turned on.

Images