JP2009234436A - Vehicular control device, electric vehicle, and method for detecting trouble of vehicular control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a vehicular control device capable of reliably detecting a trouble of a switch and a method for detecting the trouble, and an electric vehicle having the vehicular control device. <P>SOLUTION: A CPU determines whether or not a trouble determination signal is input from a signal generation circuit for detecting a trouble (step S12). When the trouble determination signal is input into the CPU from the signal generation circuit for detecting the trouble within a predetermined time (YES in a step S12), the CPU determines that a second switch is in trouble (step S14), and the result of determination indicating that the second switch is in trouble is written in a memory as information on trouble occurrence (step S15). <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a vehicle control device that supplies power from a power supply source to a microcomputer that controls a system in the vehicle via the power supply line by turning on a switch provided in the power supply line, and a failure detection method therefor The present invention also relates to an electric vehicle including the vehicle control device.

  Conventionally, in an electronic control device (vehicle control device) mounted on a vehicle, a power supply relay (switch) is turned on due to at least one of a key switch and an ignition switch being turned on. Supply power. In addition, the vehicle control device is configured to supply power until the microcomputer completes a predetermined process (stop process for the system in the vehicle) and stops operating even when the key switch or the ignition switch is turned off. It has a power supply self-holding function that keeps the relay on and continues to supply power to the microcomputer (see Patent Document 1).

  In this case, in the vehicle control device, the power supply holding time from the start of the system stop process due to the key switch or the ignition switch being turned off to the stop of the operation of the microcomputer is set at regular intervals. The counter value in the flash ROM is counted up, and then, when the key switch or the ignition switch is turned on, if the counter value is smaller than the first determination value, it is determined that the power supply self-holding function is abnormal, On the other hand, if the counter value is larger than the second determination value, a failure detection process for the power supply relay is performed in which it is determined that the power cut-off function for stopping the power supply by turning off the power supply relay is abnormal.

JP 2006-347441 A

  The counter value used for the failure detection process described above corresponds to the power holding time from the start of the system stop process due to the key switch or ignition switch being turned off until the microcomputer stops operating. When the required time (stop processing time) changes, the counter value also changes according to the change in the stop processing time. As a result, when the stop processing time becomes long and the counter value becomes large, it is determined that the power shut-off function is normal but abnormal. That is, there is a possibility that a failure of the power supply relay (switch) is erroneously detected.

  The present invention has been made in consideration of such problems, and is capable of reliably detecting a switch failure, a failure detection method thereof, and an electric vehicle including the vehicle control device. The purpose is to provide.

The vehicle control device according to the present invention includes:
The power supply source, the microcomputer for controlling the system in the vehicle, the rising signal generation circuit, the power supply source, the microcomputer and the rising signal generation circuit are connected via a switch, and the switch is turned on to A power supply line for supplying power from the power supply source to the microcomputer and the rising signal generation circuit via the switch,
The rising signal generation circuit generates a rising signal resulting from the power supply delayed from turning on the switch,
The microcomputer determines that the switch is out of order if the rising signal is generated within a predetermined time from the start time when the microcomputer is started by the power supply, and on the other hand, within the predetermined time If the rising signal is not generated, the switch is determined to be normal.

Further, a failure detection method for a vehicle control device according to the present invention includes:
When the switch is turned on, power is supplied from the power supply source to the microcomputer that controls the system in the vehicle and the rising signal generation circuit via the power supply line, so that the rising signal generation circuit is delayed from the turning on of the switch. When generating a rising signal due to power supply,
If the rising signal is generated within a predetermined time from the startup time when the microcomputer is started by the power supply, it is determined that the switch is malfunctioning, while the rising signal is within the predetermined time. If not generated, the switch is determined to be normal.

  According to these inventions, when power is supplied to both the microcomputer and the rising signal generation circuit by turning on the switch, if the rising signal is generated within the predetermined time, a failure of the switch On the other hand, if the rising signal is not generated within the predetermined time, it is determined that the switch is normal.

  That is, if the switch has failed before the microcomputer is activated, the microcomputer and the rising signal are generated from the power supply source via the switch regardless of whether the microcomputer is activated or not. Since the power is supplied to the circuit, the rising signal generation circuit generates the rising signal based on the power supply at the start-up time of the microcomputer.

  Therefore, the microcomputer can reliably detect that the switch has failed by confirming the generation of the rising signal within the predetermined time from the activation time.

  The rising signal generation circuit includes a resistor connected to the power supply line and a capacitor connected to the resistor, and the power is supplied from the power supply line to the capacitor via the resistor. Supply is performed, and the rising signal is generated when the voltage of the capacitor becomes equal to or higher than a predetermined voltage.

  As a result, the rising signal generation circuit that generates the rising signal with a delay from turning on the switch can be configured easily and simply, and the cost of the vehicle control device can be reduced.

  In this case, the rising signal generation circuit outputs the generated rising signal to the microcomputer, and the microcomputer causes the voltage of the capacitor to be the predetermined voltage due to normal switching on from the start time. If the rising signal is input within the predetermined time set shorter than the above time, it is determined that the switch has failed. On the other hand, if the rising signal is not input, the switch Is preferably determined to be normal.

  As a result, the microcomputer can easily and reliably determine whether or not the switch has failed by simply checking whether or not the rising signal is input within the predetermined time.

  Further, it is preferable that when the microcomputer determines that the switch has failed, it warns the outside of the switch failure.

  Accordingly, when the vehicle is started, a user such as a passenger of the vehicle is notified of the presence or absence of the failure of the switch, and the user is prompted to repair the vehicle equipped with the vehicle control device. It becomes possible. That is, since the switch failure detection process is performed by the vehicle control device, it is not necessary for the user to confirm the occurrence of the switch failure.

  Here, the vehicle control device further includes storage means for storing a determination result relating to the failure of the switch determined by the microcomputer, and the storage means is built in the microcomputer and the power It is preferable that the memory is supplied with power from a supply source, or is a non-volatile memory arranged outside the microcomputer.

  Thereby, even if the operation of the microcomputer is stopped due to the stop of the power supply, the determination result stored in the storage means is not erased. As a result, it is possible to read out the determination result from the storage means after the operation is stopped and determine whether or not the switch is out of order.

  In this case, the microcomputer refers to the determination result stored in the storage means at the next start-up, and determines that the determination result is a determination result indicating a failure of the switch. It is preferable to warn the outside of the failure.

  Accordingly, when the vehicle is started next time, the user can be notified of the failure of the switch, and the user can be prompted to repair the vehicle equipped with the vehicle control device. That is, since the failure detection process of the switch is performed by the vehicle control device, it is unnecessary to confirm the occurrence of the switch failure by the user, and if the switch is broken, the next start of the vehicle is performed. Occasionally, the occurrence of the failure is notified to the user, so that when the vehicle is stopped, the user can immediately leave the vehicle even during the stop process for the system of the vehicle. Become.

  The switch is preferably a power supply self-holding switch that switches from off to on by an on command from the microcomputer, and switches from on to off by an off command from the microcomputer.

  Here, the electric vehicle according to the present invention includes the vehicle control device, the power supply source is a power storage device that supplies power to the electrical equipment mounted on the vehicle, and the system is configured to drive the vehicle. It is the vehicle drive system provided with the electric power source for operation.

  Accordingly, when another electronic circuit is connected to the switch, power is supplied from the power storage device to the other electronic circuit via the switch when the electric vehicle is stopped due to the failure of the switch. As a result, it is possible to reliably prevent the voltage of the power storage device from decreasing.

  In this case, it is preferable that the power source for driving the vehicle is a fuel cell, and the vehicle driving system is a fuel cell system including the fuel cell.

  By performing the switch failure detection process during the start-up process of the fuel cell system, it is possible to efficiently detect the switch failure regardless of the length of the stop process time of the fuel cell system.

  Further, when the outside air temperature is lower than a predetermined temperature, the microcomputer controls the fuel cell system to perform the scavenging process in the gas flow path of the fuel cell during the stop process for the fuel cell system. Good.

  In the fuel cell system, the power in the system needs to be covered by its own power generation function, so that the amount of power that can be used when power generation is stopped (when the electric vehicle is stopped) is limited. In addition, since the water generated by the power generation remains in the gas flow path due to the stoppage of power generation, the remaining water freezes in an environment below freezing point, which hinders the supply and discharge of the reaction gas (hydrogen, air). Thus, the starting performance of the fuel cell at low temperatures may be reduced. Therefore, by performing the scavenging process during the stop process of the electric vehicle, the scavenging process can be performed efficiently and the starting performance of the fuel cell can be maintained even at a low temperature.

  Further, by performing the scavenging process at the time of the stop process, the time required for the system stop process in the microcomputer becomes long, but by performing the switch failure detection process during the start-up time of the fuel cell system, Regardless of the length of time required for the scavenging process and the system stop process, the failure of the switch can be detected efficiently.

  According to the present invention, when power is supplied to both the microcomputer and the rising signal generation circuit by turning on the switch, if the rising signal is generated within a predetermined time, it is determined that the switch is faulty, If the rising signal is not generated within the predetermined time, it is determined that the switch is normal.

  That is, when the switch has failed before the microcomputer is activated, the microcomputer and the rising signal generation circuit are connected from the power supply source via the switch regardless of whether the microcomputer is activated or not. Therefore, the rising signal generation circuit generates the rising signal based on the power supply at the startup time of the microcomputer.

  Therefore, the microcomputer can reliably detect that the switch has failed by confirming the generation of the rising signal within the predetermined time from the activation time.

  FIG. 1 is a circuit diagram of a vehicle control apparatus 10 according to this embodiment.

  The vehicle control device 10 controls a system in the vehicle {for example, a fuel cell system (vehicle drive system) 52 of a fuel cell vehicle (electric vehicle) 50 shown in FIG. 6 to be described later). And a battery (power supply source, power storage device) 16 connected to the terminals 14a and 14d of the control unit 12, and a first switch 18 for connecting the positive electrode of the battery 16 and the terminal 14b of the control unit 12. Note that the terminal 14c of the control unit 12 and the negative electrode of the battery 16 are each grounded.

  The first switch 18 is a key switch or an ignition switch of the vehicle, and is turned on or off due to an operation of a passenger of the vehicle. The battery 16 is a 12V battery mounted on the vehicle, for example.

  In the control unit 12, a CPU (microcomputer) 20, a diode 22, a second switch 24, a failure detection signal generation circuit (rise signal generation circuit) 26, a capacitor 28, and an OR circuit 30 are arranged. Has been.

  The CPU 20 is connected to the positive electrode of the battery 16 via the first switch 18 and the terminal 14b, is connected to the positive electrode of the battery 16 via the terminal 14d and the diode 22, and is further connected to the battery via the terminal 14a and the second switch 24. 16 positive electrodes are connected.

  The OR circuit 30 has one input terminal connected to the terminal 14 b and the CPU 20, the other input terminal connected to the CPU 20, and an output terminal connected to the second switch 24. In this case, when a DC voltage is applied from the battery 16 to the OR circuit 30 and the CPU 20 via the first switch 18 and the terminal 14b by turning on the first switch 18, the OR circuit 30 uses the DC voltage as a self-holding request signal. (ON command) Output to the second switch 24 as S2. The OR circuit 30 also outputs a self-holding command signal S3 from the CPU 20 to the second switch 24 as a self-holding request signal S2.

  The second switch 24 switches from OFF to ON due to the input of the self-holding request signal S2 from the OR circuit 30, while it switches from ON to OFF due to the stop (OFF command) of the self-holding request signal S2. A power supply self-holding switch (a power supply relay as a power supply self-holding circuit) that switches. In this case, when the second switch 24 is turned on, the battery 16 is connected to the CPU 20 and the failure detection signal generation circuit 26 via the terminal 14a and the second switch 24, and the power input terminal Vcc of the CPU 20 and the failure detection signal generation are generated. A DC voltage is applied to the input side (resistor 32 side) of the circuit 26. That is, the DC voltage is an input voltage for supplying power from the battery 16 to the CPU 20 and the failure detection signal generation circuit 26. Accordingly, a line including the terminal 14a and the second switch 24 from the positive electrode side of the battery 16 to the CPU 20 is a power supply line (main power line) 21 for the CPU 20, and in FIG. It is indicated by.

  The CPU 20 receives a DC voltage from the battery 16 via the first switch 18 and the terminal 14b when the first switch 18 is turned on (the activation signal S1 is supplied), and the terminal from the battery 16 when the second switch 24 is turned on. It starts when a DC voltage is applied to the power input terminal Vcc via 14a and the second switch 24. Further, the CPU 20 outputs a self-holding command signal S3 to the OR circuit 30 at the time of activation. Further, when the DC voltage is no longer applied due to the first switch 18 being turned off, the CPU 20 regards the start signal S1 (DC voltage) that has become substantially 0 level as the system stop request signal S5 and executes the system stop process for the system. Then, the operation is stopped {transition to the low power consumption mode (sleep mode)}. In this case, since the supply of the activation signal S1 to one input terminal of the OR circuit 30 is stopped, the output of the self-holding command signal S3 from the CPU 20 to the OR circuit 30 is stopped, so that the OR circuit 30 transfers to the second switch 24. The output of the self-holding request signal S2 is also stopped, and the second switch 24 is switched from on to off. As a result, power supply from the battery 16 to the CPU 20 is stopped.

  When the second switch 24 is turned on, power is supplied not only to the CPU 20 and the failure detection signal generation circuit 26 but also to other electronic circuits in the control unit 12. The capacitor 28 is connected in parallel to the battery 16, the CPU 20, and the failure detection signal generation circuit 26 between the second switch 24, the CPU 20, and the failure detection signal generation circuit 26.

  The failure detection signal generation circuit 26 includes a resistor 32 connected to the second switch 24 and the power input terminal Vcc of the CPU 20, a capacitor 34 connected to the resistor 32, a capacitor 34 side of the resistor 32, and a second one. A diode 36 connected between the switch 24 and a Schmitt trigger gate 38 connected between the capacitor 34 and the diode 36 and the CPU 20.

  In this case, when power is supplied from the battery 16 to the failure detection signal generation circuit 26 via the second switch 24 when the second switch 24 is turned on, the voltage of the capacitor 34 is changed to the resistor 32 as time passes. Gradually increases based on the time constant determined by the resistance value and the capacitance of the capacitor 34 (see FIG. 3). Since the voltage of the capacitor 34 is the input voltage of the Schmitt trigger gate 38, when the voltage value of the input voltage becomes equal to or higher than the upper limit threshold (predetermined voltage) Vth of the Schmitt trigger gate 38, the Schmitt trigger gate 38 generates a failure determination signal S4. Is output to the CPU 20. Note that the Schmitt trigger gate 38 stops the generation of the failure determination signal S4 when the voltage value becomes equal to or lower than the lower threshold (the voltage of the capacitor 34 at substantially zero level) due to the second switch 24 being turned off.

  That is, the failure detection signal generation circuit 26 generates the failure determination signal S4 after the start of the operation of the CPU 20 with the second switch 24 turned on as a trigger (the failure determination signal S4 rises), while the second switch The generation of the failure determination signal S4 is immediately stopped by turning off (failure determination signal S4 falls).

  Further, the CPU 20 performs a failure detection process of the second switch 24 when the CPU 20 is activated by the input of the activation signal S1 and the power supply via the power supply line 21. Specifically, when the failure determination signal S4 is input from the failure detection signal generation circuit 26 within a predetermined time T from the time t2 (see FIG. 3) which is the activation time to the time t4, the second switch 24, it is determined that a failure has occurred (that is, a failure that does not switch from ON to OFF even if it is an OFF command, and the second switch 24 is welded ON). The generated information is stored in the memory 40 built in the CPU 20.

  Since the memory 40 is always supplied with power from the battery 16 via the terminal 14d, even if the power supply from the battery 16 to the CPU 20 is stopped when the second switch 24 is switched from ON to OFF by the OFF command, The failure occurrence information stored in the memory 40 is not erased.

  The vehicle control device 10 according to this embodiment is configured as described above. Next, a failure detection process (failure detection method) of the vehicle control device 10 performed when the vehicle is started will be described with reference to FIG. This will be described with reference to the flowchart of FIG. 3 and the time charts of FIGS. FIG. 3 shows a case where the second switch 24 performs a normal operation (operation that switches from on to off due to an off command), while FIG. 4 shows that the second switch 24 operates abnormally ( This shows the case of performing an operation when the switch is not switched from ON to OFF even when an OFF command is issued. 2 is a failure detection process applicable to both the normal operation and the abnormal operation.

  First, the case where the second switch 24 performs a normal operation will be described with reference to FIGS.

  At time t1, when the first switch 18 is turned on due to the operation of the vehicle occupant (step S10), the battery 16 applies a DC voltage to the OR circuit 30 and the CPU 20 via the first switch 18 and the terminal 14b. Apply (supply start signal S1). The OR circuit 30 outputs the activation signal S1 to the second switch 24 as a self-holding request signal S2. The second switch 24 switches from off to on at time t2 due to the input of the self-holding request signal S2.

  As a result, power is supplied from the battery 16 to the CPU 20 and the failure detection signal generation circuit 26 via the terminal 14a and the second switch 24, and the CPU 20 performs the startup process due to the input of the startup signal S1 and the power supply. Is started (step S11). On the other hand, the voltage of the capacitor 34 in the failure detection signal generation circuit 26 gradually increases from time t2 based on the time constant determined by the resistance value of the resistor 32 and the capacitance of the capacitor 34 over time. To rise.

  After outputting the self-holding command signal S3 to the OR circuit 30 at the time t3 during the activation process, the CPU 20 starts the failure determination process after step S12.

  That is, in step S12, the CPU 20 determines whether or not the failure determination signal S4 is input from the failure detection signal generation circuit 26. Specifically, the CPU 20 determines whether or not the failure determination signal S4 is input from the failure detection signal generation circuit 26 within a time T from time t2 to time t4, which is the activation time of the CPU 20.

  Here, the time T is from time t2 when the second switch 24 is normal and power is supplied from the battery 16 to the failure detection signal generation circuit 26 by turning on the second switch 24. This is a time set shorter than the time up to time t5. That is, the voltage value of the capacitor 34 rises as time elapses from time t2 when the second switch 24 is turned on, and reaches the upper threshold value Vth of the Schmitt trigger gate 38 at time t5. The generation of the failure determination signal S4 is started at time t5, which is delayed from the time t2 when the operation of the CPU 20 starts (starts up) (the failure determination signal S4 rises). Therefore, the CPU 20 determines whether or not the failure determination signal S4 is input within a time T shorter than the time from the time t2 to the time t5 when the voltage value of the capacitor 34 reaches the upper limit threshold value Vth.

  When the second switch 24 is normal, the voltage value of the capacitor 34 does not reach the upper threshold value Vth within the time T (see FIG. 3), so that the failure determination signal S4 is sent from the Schmitt trigger gate 38 to the CPU 20. It is never output. Therefore, if the failure determination signal S4 is not input within the time T (NO in step S12), the CPU 20 is normal, and the second switch 24 is normally turned on when the previous operation of the CPU 20 was stopped. Is determined to have been switched off (blocked) (step S13).

  When the vehicle is stopped, the following processing is performed and the operation of the CPU 20 is stopped.

  First, when the first switch 18 is turned off due to the operation of the vehicle occupant, the application of the DC voltage from the battery 16 to the OR circuit 30 and the CPU 20 (supply of the start signal S1) is stopped. The CPU 20 regards the activation signal S1 that has become substantially 0 level as the system stop request signal S5 and executes the system stop process for the system, and then stops the operation (shifts to the sleep mode). In this case, since the supply of the activation signal S1 to one input terminal of the OR circuit 30 is stopped, the OR circuit 30 causes the second switch 24 to stop when the output of the self-holding command signal S3 from the CPU 20 to the OR circuit 30 is stopped. The output of the self-holding request signal S2 is stopped, and the second switch 24 is switched from on to off. As a result, the power supply from the battery 16 to the CPU 20 and the failure detection signal generation circuit 26 is stopped, and the generation of the failure determination signal S4 is also stopped (the failure determination signal S4 falls).

  Next, the case where the second switch 24 performs an abnormal operation will be described with reference to FIGS. Even if the output of the self-holding request signal S2 is stopped (even if there is an off command), the abnormal operation continues to hold the second switch 24 on without being switched from on to off (power supply self-holding state). To continue to maintain). In this case, the CPU 20 performs the same process as in the normal operation (see FIG. 3) until immediately before the failure determination process in step S12 (before time t3 in FIG. 4). Processing after t3 will be described.

  In step S <b> 12, the CPU 20 determines whether or not the failure determination signal S <b> 4 is input from the failure detection signal generation circuit 26. In this case, the second switch 24 is not switched from on to off at the time of the previous stop of the vehicle, and the second switch 24 continues to be kept on after that, so that the voltage value of the capacitor 34 is equal to the upper threshold value Vth. Thus, the failure determination signal S4 is continuously output from the Schmitt trigger gate 38 (the failure determination signal S4 does not fall).

  Therefore, since the failure determination signal S4 is input to the CPU 20 within the time T from the time t2 to the time t4 (YES in step S12), the CPU 20 determines that the second switch 24 has failed ( In step S14), a determination result indicating that the second switch 24 has failed is written in the memory 40 as failure occurrence information (step S15).

  The above is the description of the failure determination process in the vehicle control device 10. After step S15, the CPU 20 writes the failure occurrence information in the memory 40 and then detects the failure of the second switch 24 by sound or screen display. A user such as a passenger may be warned (notified) (step S16).

  As described above, according to the above-described embodiment, when power is supplied to both the CPU 20 and the failure detection signal generation circuit 26 by turning on the second switch 24, the failure determination signal is generated within a predetermined time T. If S4 is generated and input to the CPU 20, it is determined that the second switch 24 has failed (a failure that does not switch from on to off even if an off command is issued due to welding of the second switch 24). If the failure determination signal S4 is not generated and is not input to the CPU 20, it is determined that the second switch 24 is normal.

  That is, if the second switch 24 has failed before the CPU 20 is activated, the CPU 20 and the failure detection signal generation are generated from the battery 16 via the terminal 14a and the second switch 24 regardless of whether the CPU 20 is activated. Since power is supplied to the circuit 26, the failure detection signal generation circuit 26 generates the failure determination signal S4 based on the power supply at the startup time (time t2) of the CPU 20. .

  Therefore, the CPU 20 can surely detect that the second switch 24 has failed by confirming the generation and input of the failure determination signal S4 within the time T from time t2 to time t4. That is, if the failure determination signal S4 is input to the CPU 20 within the time T, it is determined that the second switch 24 is in failure. Therefore, it is possible to easily and reliably determine whether the second switch 24 has failed.

  By the way, in the technique described in Patent Document 1, the counter value in the flash ROM is counted up every certain time within the power holding time from the start of the system stop process to the stop of the operation of the microcomputer, and then the key switch or When the ignition switch is turned on, it is determined whether or not the power self-holding function and the power shut-off function are abnormal based on the counter value, so that the microcomputer is restarted after entering the sleep mode. It is impossible to detect a failure of the power supply relay in the sleep mode time zone.

  In contrast, in this embodiment, as described above, if the failure determination signal S4 is input to the CPU 20 within the time T, the CPU 20 determines that the second switch 24 has failed. The failure of the second switch 24 in the time zone can be reliably detected.

  The failure detection signal generation circuit 26 includes a resistor 32, a capacitor 34, and a Schmitt trigger gate 38. Power is supplied to the capacitor 34 via the resistor 32, and the voltage value of the capacitor 34 has an upper threshold value. Since the failure determination signal S4 is generated when Vth becomes equal to or higher than Vth, the failure detection signal generation circuit 26 that generates the failure determination signal S4 after the second switch 24 is turned on can be configured easily and simply. Thus, the cost of the vehicle control device 10 can be reduced.

  That is, when the second switch 24 is turned on as a trigger, the failure determination signal S4 rises after the start of operation of the CPU 20 (time t2), while the failure determination signal S4 quickly rises due to the second switch being turned off. Therefore, in this embodiment, the failure determination signal S4 can be generated and the failure detection process can be performed with a simple circuit configuration.

  In addition, when it is determined that the second switch 24 is malfunctioning, the user is alerted (notified) to the user such as a vehicle occupant by sound or screen display of the malfunction of the second switch 24. It is also possible to prompt repair of the vehicle on which the vehicle control device 10 is mounted. That is, if power is continuously supplied from the battery 16 to the control unit 12 due to the failure of the second switch 24, the output voltage (DC voltage) of the battery 16 may decrease and the battery may run out. By giving the warning to the user, it is possible to reliably prevent the battery from being generated and the battery 16 from being deteriorated due to the battery being discharged. That is, since the vehicle control device 10 performs the failure detection process of the second switch 24, it is not necessary for the user to confirm the occurrence of the failure of the second switch 24.

  Further, since the failure occurrence information is stored in the memory 40, the failure occurrence information stored in the memory 40 is not erased even if the operation of the CPU 20 is stopped due to the stop of the power supply. As a result, the failure occurrence information can be read from the memory 40 after the operation is stopped, and it can be determined whether or not the second switch 24 is broken.

  Therefore, when the CPU 20 determines that the information stored in the memory 40 is the failure occurrence information at the next start-up, the failure of the second switch 24 is notified to the user such as a vehicle passenger by sound or screen display. By giving warning (notification), it is possible to prompt the user to repair the vehicle on which the vehicle control device 10 is mounted. That is, since the failure detection processing of the second switch 24 is performed by the vehicle control device 10, it is unnecessary to confirm the occurrence of the failure of the second switch 24 by the user, and if the second switch 24 is broken, Since the occurrence of the failure is notified to the user at the next start of the vehicle, the user can immediately leave the vehicle even during the system stop process when the vehicle is stopped. It becomes.

  The vehicle control device 10 according to this embodiment is not limited to the above description, and can be changed to various configurations.

  That is, as shown in FIG. 5, a nonvolatile memory 42 may be arranged outside the CPU 20 instead of the memory 40 (see FIG. 1).

  Thereby, when failure occurrence information is stored in the memory 42, even if the operation of the CPU 20 is stopped due to the stop of the power supply to the CPU 20, the failure occurrence information stored in the memory 42 is not erased. Accordingly, even in this case, the same effect as the memory 40 described above can be obtained.

  FIG. 6 shows a case where the vehicle control device 10 is applied to control of the fuel cell system 52 in the fuel cell vehicle 50.

  The fuel cell vehicle 50 includes a fuel cell system 52 as a hybrid power source system including a fuel cell 54, a temperature sensor 62, an air compressor 60 and a battery 66, and an electric current (electric power) from the fuel cell system 52 is an inverter 56. And a downverter 68 that steps down the voltages of the fuel cell 54 and the battery 66, and an auxiliary machine (electric equipment) 64 that receives power supply from the battery 16. In this case, the voltage stepped down by the downverter 68 is supplied to the battery 16 and stored, or is supplied to the auxiliary machine 64.

  The fuel cell 54 has, for example, a stack structure in which cells formed by sandwiching a solid polymer electrolyte membrane between an anode electrode and a cathode electrode from both sides are stacked, and hydrogen (fuel gas) as a reaction gas and air (oxidant) The generated current generated by the electrochemical reaction of gas) is supplied to the inverter 56 and / or the battery 66 side. The temperature sensor 62 measures the temperature of the fuel cell 54 and outputs the measured temperature (measured value) to the control unit 12.

  When the CPU 20 determines that the outside air temperature is lower than the threshold temperature during the system stop process for the fuel cell system 52, the CPU 20 drives the air compressor 60 to the anode and cathode in the fuel cell 54 and the reaction gas flow path. A scavenging process is performed.

  That is, even when the power generation of the fuel cell 54 is stopped, the water generated by the power generation remains in the gas flow path of the fuel cell 54. Therefore, in the environment below freezing point, the remaining water freezes. As a result, supply and discharge of the reaction gas (hydrogen, air) may be hindered, and the starting performance of the fuel cell 54 at low temperatures may be deteriorated. .

  Therefore, in this embodiment, when the outside air temperature is lower than the threshold temperature during the stop process, the air compressor 60 is driven to perform the scavenging process on the fuel cell 54. That is, in the fuel cell system 52, since the power in the fuel cell system 52 needs to be covered by its own power generation function, the amount of power that can be used when power generation is stopped (when the fuel cell vehicle 50 is stopped) is limited. is there. Therefore, by performing the scavenging process during the operation of the fuel cell vehicle 50, the scavenging process can be performed efficiently and the starting performance of the fuel cell 54 can be maintained even at a low temperature.

  Further, by performing the above-described scavenging process at the time of the system stop process, the time required for the system stop process in the CPU 20 becomes longer. However, during the startup time of the fuel cell system 52 (during the start process of the CPU 20), the second switch 24 Since the failure detection process is performed, the failure of the second switch 24 can be efficiently detected regardless of the length of time required for the scavenging process and the system stop process.

  Since the scavenging process performed in the fuel cell 54 is publicly known (see, for example, Japanese Patent Application Laid-Open No. 2005-302515), detailed description thereof is omitted in this specification.

  Note that the present invention is not limited to the above-described embodiment, and it is needless to say that various configurations can be adopted based on the contents described in this specification.

It is a circuit diagram of a control device for vehicles concerning one embodiment of this invention. It is a flowchart which shows the failure detection process of the control apparatus for vehicles. It is a time chart at the time of normal operation of the 2nd switch. It is a time chart at the time of abnormal operation of the 2nd switch. It is a circuit diagram of the control apparatus for vehicles provided with the non-volatile memory. FIG. 2 is a block diagram of a fuel cell vehicle to which the vehicle control device of FIG. 1 is applied.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Vehicle control apparatus 12 ... Control unit 14a-14d ... Terminal 16, 66 ... Battery 18 ... 1st switch 20 ... CPU
DESCRIPTION OF SYMBOLS 21 ... Power supply line 22, 36 ... Diode 24 ... 2nd switch 26 ... Fault detection signal generation circuit 28 ... Capacitor 30 ... OR circuit 32 ... Resistor 34 ... Capacitor 38 ... Schmitt trigger gate 40, 42 ... Memory 50 ... Fuel Battery vehicle 52 ... Fuel cell system 54 ... Fuel cell 56 ... Inverter 58 ... Motor 60 ... Air compressor 62 ... Temperature sensor 64 ... Auxiliary device 68 ... Downverter

Claims (13)

A power supply,
A microcomputer for controlling the system in the vehicle;
A rising signal generation circuit;
The power supply source is connected to the microcomputer and the rising signal generation circuit via a switch, and when the switch is turned on, power is supplied from the power supply source to the microcomputer and the rising signal generation circuit via the switch. A power supply line to perform,
Have
The rising signal generation circuit generates a rising signal resulting from the power supply delayed from turning on the switch,
The microcomputer determines that the switch is out of order if the rising signal is generated within a predetermined time from the start time when the microcomputer is started by the power supply, and on the other hand, within the predetermined time If the rising signal is not generated, it is determined that the switch is normal. The vehicle control device according to claim 1,
The rising signal generation circuit includes a resistor connected to the power supply line and a capacitor connected to the resistor, and the power supply is supplied from the power supply line to the capacitor via the resistor. The vehicle control device is characterized in that the rising signal is generated when the voltage of the capacitor is equal to or higher than a predetermined voltage. The vehicle control device according to claim 2,
The rising signal generation circuit outputs the generated rising signal to the microcomputer,
The microcomputer is configured to input the rising signal within the predetermined time set shorter than the time from the startup time to when the voltage of the capacitor becomes equal to or higher than the predetermined voltage due to normal turning on of the switch. If there is, it is determined that the switch is malfunctioning. On the other hand, if there is no input of the rising signal, it is determined that the switch is normal. The vehicle control device according to any one of claims 1 to 3,
When the microcomputer determines that the switch has failed, the microcomputer warns the outside of the switch failure. In the vehicle control device according to any one of claims 1 to 4,
The vehicle control device further comprising storage means for storing a determination result relating to the failure of the switch determined by the microcomputer. The vehicle control device according to claim 5, wherein
The vehicle control device, wherein the storage means is a memory built in the microcomputer and supplied with power from the power supply source. The vehicle control device according to claim 5, wherein
The vehicle control device, wherein the storage means is a non-volatile memory arranged outside the microcomputer. In the vehicle control device according to any one of claims 5 to 7,
The microcomputer refers to the determination result stored in the storage means at the next start-up, and determines that the failure of the switch is external when the determination result is a determination result indicating the failure of the switch. A vehicle control device characterized by warning the vehicle. The vehicle control device according to any one of claims 1 to 8,
The vehicle control device according to claim 1, wherein the switch is a power supply self-holding switch that is switched from off to on by an on command from the microcomputer, and that is switched from on to off by an off command from the microcomputer. A vehicle control device according to any one of claims 1 to 9, comprising:
The power supply source is a power storage device that supplies power to electrical equipment mounted on the vehicle,
The electric system according to claim 1, wherein the system is a vehicle drive system including a vehicle drive power source. The electric vehicle according to claim 10, wherein
The vehicle driving power source is a fuel cell,
The electric vehicle characterized in that the vehicle drive system is a fuel cell system including the fuel cell. The electric vehicle according to claim 11, wherein
When the outside air temperature is lower than a predetermined temperature, the microcomputer controls the fuel cell system so as to perform a scavenging process in the gas flow path of the fuel cell during a stop process for the fuel cell system. Electric vehicle to do. When the switch is turned on, power is supplied from the power supply source to the microcomputer that controls the system in the vehicle and the rising signal generation circuit via the power supply line, so that the rising signal generation circuit is delayed from the turning on of the switch. When generating a rising signal due to power supply,
If the rising signal is generated within a predetermined time from the startup time when the microcomputer is started by the power supply, it is determined that the switch is malfunctioning, while the rising signal is within the predetermined time. If it is not generated, it is determined that the switch is normal. A failure detection method for a vehicle control device.

Images