JP2021136735A - Motor controller - Google Patents

Abstract

To enable continuation of assist operation even if a signal communication failure between control units occurs in a motor controller having a redundant configuration.SOLUTION: A motor controller for driving an electric motor by control units (CPU) provided in a plurality of control systems continues assist control of the electric motor by a normally-operating one of a first control system and a second control system when a communication failure between central control units is determined based on the communication condition of a control signal through first communication means and the communication condition of a watchdog signal through second communication means.SELECTED DRAWING: Figure 2

Description

The present invention relates to, for example, a motor control device for electric power steering, which has a redundant configuration including a plurality of systems of motor control circuits.

With the progress of automatic driving of vehicles, it is required to continue automatic driving even if a part of an electronic control unit (ECU) breaks down. For example, regarding a steering device (electric power steering device) during automatic driving, It is required that steering can be continued even if a failure occurs.

The electric power steering device is composed of a motor control device as an electronic control unit (ECU), but failure detection is important due to safety requirements and the like. Therefore, for example, in the electronic control device of Patent Document 1, abnormality information based on the monitoring result of the execution cycle of the task periodically executed by the main computer is transmitted via the clock monitoring signal line and the arithmetic monitoring signal line. It communicates with the clock monitoring circuit for monitoring the clock abnormality of the main microcomputer provided in the monitoring circuit and the arithmetic monitoring circuit for monitoring the abnormality of the arithmetic circuit of the main microcomputer.

Furthermore, the electric power steering device is provided with two sets of inverter circuits that independently drive two sets of coil windings provided in the motor, and by making the control circuit other than the inverter circuit a dual system, one system can be used. A redundant configuration has been conventionally known in which motor control is continued by the other system that is operating normally even in the event of an abnormality (in the event of a failure).

For example, Patent Document 2 has a complete two-system redundant configuration in which each electronic component for two systems is provided independently for each system, and the two systems are composed of two sets of independent element groups, and a plurality of systems are used. It discloses a motor control device that enables signal communication between microcomputers.

Japanese Patent No. 5477654 Japanese Unexamined Patent Publication No. 2019-4682

In the electronic control device of Patent Document 1, when an abnormality of the main microcomputer is detected, a reset signal is output to restart the main microcomputer, or a pre-driver drive permission signal is sent to the drive circuit of the motor. It is turned off and the pre-driver drive is stopped. Therefore, there is a problem that steering assist cannot be continued in the event of a failure.

The motor control device described in Patent Document 2 immediately stops assist by its own microcomputer when communication between microcomputers is abnormal. That is, in the event of communication between microcomputers or an abnormality in the communication means, when it is determined by the stop determination unit that the operation of the own microcomputer is about to be stopped, the motor drive by the own microcomputer is stopped. Therefore, even if the device has a redundant configuration, when the communication between the microcomputers is abnormal, the assist failure that the degenerate assist continuation by one system is not performed occurs.

The present invention has been made in view of the above-mentioned problems, and an object of the present invention is to control a motor even when a signal communication failure occurs between control units in a motor control device having a redundant configuration composed of a plurality of systems. It is to provide a motor control device that enables continuation.

The following configuration is provided as a means for achieving the above object and solving the above-mentioned problem. That is, the exemplary first invention of the present application is a motor control device composed of a plurality of control systems and in which an electric motor is driven by a central control unit provided for each control system, and the first of the plurality of control systems. A first communication means that enables communication of a control signal between the control system and the central control unit of the second control system, and a second communication that enables transmission and reception of an abnormality monitoring signal between the central control units. When the means and the failure determining means for determining the presence or absence of a communication failure between the central control units based on the communication state of the control signal and the abnormality monitoring signal are provided, and the communication failure is determined by the failure determining means. The drive control of the electric motor is continued by the normally operating control system of the first control system and the second control system.

An exemplary second invention of the present application is an electric power steering control device that has a central control unit provided for each of a plurality of control systems and assists a driver's steering operation of a vehicle or the like. It is characterized by including an electric motor that assists steering and means for driving and controlling the electric motor by the motor control device according to the above-exemplified first invention.

The third exemplary invention of the present application is an electric power steering system, characterized in that the motor control device for electric power steering according to the second exemplary invention is provided.

According to the present invention, when a signal communication failure occurs between control units in a motor control device having a redundant configuration, the failure site can be specified at low cost, and motor control can be continued according to the specified failure site.

FIG. 1 is a diagram showing a schematic configuration of an electric power steering system equipped with a motor control unit for electric power steering. FIG. 2 is a configuration diagram of an electric power steering control device (EPS) as a motor control unit according to the embodiment. FIG. 3 is a block diagram showing a mutual communication configuration between CPUs. FIG. 4 is a flowchart showing an example of control processing in the motor control unit. FIG. 5 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of the TXD line as an abnormality of the communication IC. FIG. 6 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of the RXD line as an abnormality of the communication IC. FIG. 7 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of CPU-1. FIG. 8 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of CPU-2. FIG. 9 is a sequence diagram showing a failure handling process in the clock abnormality (1). FIG. 10 is a sequence diagram showing a failure handling process in the clock abnormality (2). FIG. 11 is a sequence diagram showing a failure handling process in the clock abnormality (3). FIG. 12 is a diagram showing steering assist control by the motor control unit when the torque sensor of the second system fails. FIG. 13 is a diagram showing steering assist control by the motor control unit when the torque sensor of the first system fails.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a schematic configuration of an electric power steering system equipped with an electric power steering control device (EPS) as a motor control unit according to an embodiment of the present invention. As shown in FIG. 1, the electric power steering system 10 includes motor control devices 1a and 1b corresponding to two control systems constituting the motor control unit, a steering handle 2 as a steering member, and a rotation shaft connected to the steering handle 2. 3. A pinion gear 6, a rack shaft 7, and the like are provided.

The rotating shaft 3 meshes with a pinion gear 6 provided at its tip. The pinion gear 6 converts the rotational motion of the rotary shaft 3 into a linear motion of the rack shaft 7, and a pair of wheels 5a, 5b provided at both ends of the rack shaft 7 at an angle corresponding to the amount of displacement of the rack shaft 7. Is steered.

The rotating shaft 3 is provided with torque sensors 9a and 9b for detecting the steering torque when the steering handle 2 is operated, and the detected steering torque is sent to the motor control unit 1. The motor control unit 1 generates a motor drive signal based on signals such as steering torque acquired from torque sensors 9a and 9b and vehicle speed from a vehicle speed sensor (not shown), and transmits the signal to an electric motor 15 for electric power steering. Output.

An auxiliary torque for assisting the steering of the steering handle 2 is output from the electric motor 15 to which the motor drive signal is input, and the auxiliary torque is transmitted to the rotating shaft 3 via the reduction gear 4. As a result, the torque generated by the electric motor 15 assists the rotation of the rotating shaft 3, thereby assisting the driver in operating the steering wheel.

Next, the motor control unit according to this embodiment will be described. FIG. 2 is a configuration diagram of an electric power steering control device (EPS) as a motor control unit according to the present embodiment. As shown in FIG. 2, the motor control unit 1 has a redundant configuration including two control systems (motor control devices 1a and 1b) having the same component (circuit component).

The redundant configuration is not limited to two systems, and it is possible to develop a redundant configuration consisting of multiple systems such as three systems and four systems.

The motor control devices 1a and 1b are composed of a first system and a second system that are independent of each other, and each has a control unit (CPU) 12a and 12b. The motor control devices 1a and 1b include an electric motor 15 having a configuration in which two sets of three-phase windings (Ua, Va, Wa) 15a and three-phase windings (Ub, Vb, Wb) 15b are coaxially provided. It has a double inverter configuration consisting of two sets of inverter circuits 14a and 14b that supply drive current to each of the two sets of three-phase windings. The electric motor 15 is, for example, a three-phase brushless DC motor.

The electric motor 15 is equipped with rotation sensors (angle sensors) 11a and 11b that detect the rotation position of the rotor of the motor corresponding to the three-phase windings 15a and 15b, respectively. The output signals from the rotation sensors 11a and 11b are transmitted to the CPUs 12a and 12b as rotation information, respectively.

Each of the motor control devices 1a and 1b independently drives the electric motor 15 based on the sensor output from the sensors, the drive / control signal, and the like. Here, the component including the motor control device 1a and the three-phase winding 15a is referred to as the first system, and the component including the motor control device 1b and the three-phase winding 15b is referred to as the second system.

The motor control device 1a constituting the first system generates a motor drive signal from control signals from, for example, a control unit (CPU) 12a composed of a microprocessor and a CPU 12a, which controls the entire device, and functions as an FET drive circuit. The inverter control unit 13a and the inverter circuit 14a, which is a motor drive unit that supplies a drive current to the three-phase windings (Ua, Va, Wa) 15a of the electric motor 15, are provided.

Similar to the motor control device 1a, the motor control device 1b constituting the second system generates a motor drive signal from the control signals (CPU) 12b and the CPU 12b that control the entire device, and serves as an FET drive circuit. A functioning inverter control unit 13b and an inverter circuit 14b for supplying a predetermined drive current to the three-phase windings (Ub, Vb, Wb) 15b of the electric motor 15 are provided.

The control units (CPU) 12a and 12b execute control operations, calculation operations, and the like based on the operation clocks of predetermined frequencies output from the clock oscillation units 16a and 16b, respectively. The clock frequency may be multiplied in the control units (CPU) 12a and 12b.

The CPUs 12a and 12b of the motor control devices 1a and 1b are configured to enable real-time mutual communication via an isolation IC 30 (details will be described later). Further, the motor control devices 1a and 1b are connected to other control units (ECU) via CAN signal lines (CAN communication bus) 27H and 27L connected to an in-vehicle network (CAN) that exchanges various vehicle information. Data communication is performed between the two using the CAN protocol.

The CAN signal lines 27H and 27L are two-wire systems each consisting of the CAN-H line 27Ha and CAN-L line 27La constituting the first system and the CAN-H line 27Hb and CAN-L line 27Lb constituting the second system. Communication line.

The inverter circuit 14a is supplied with power for driving the motor from the external battery BT via a filter (not shown) and a power relay that absorb noise and the like contained in the power supply and smooth the power supply voltage. Similarly, the inverter circuit 14b is supplied with power for driving the motor from the external battery BT via a filter and a power relay (not shown).

The inverter circuit 14a is a FET bridge circuit composed of semiconductor switching elements (FETs) corresponding to each of the three-phase windings (Ua, Va, Wa) 15a of the electric motor 15. Further, the inverter circuit 14b is a FET bridge circuit composed of semiconductor switching elements (FETs) corresponding to each of the three-phase windings (Ub, Vb, Wb) 15b of the electric motor 15.

These switching elements (FETs) are also called power elements, and for example, semiconductor switching elements such as MOSFET (Metal-Oxide Semiconductor Field-Effect Transistor) and IGBT (Insulated Gate Bipolar Transistor) are used.

One end of the ignition switch (IG-SW) 31 is connected to the battery BT, and the other end is connected to the power supply management units 21a and 21b of the power supply units 20a and 20b, respectively. The other end of the IG-SW31 is further connected to the IG voltage detection units 24a and 24b.

The power supply management units 21a and 21b activate the power supply units 20a and 20b when the ignition switch (IG-SW) 31 is ON. The power supply units 20a and 20b convert the battery voltage + B supplied from the battery BT into a predetermined voltage (for example, logic level voltage + 5V), and convert it into the control units (CPU) 12a and 12b and the BT voltage monitoring unit 29a. , 29b, and supplies as an operating power source for control circuits such as inverter control units 13a and 13b.

The IG voltage detection units 24a and 24b perform AD conversion of the ignition (IG) voltage value, and input the converted digital voltage value to the CPUs 12a and 12b as the actual voltage value of the IG voltage in each of the first system and the second system. do. The IG voltage detection units 24a and 24b may be arranged in the CPUs 12a and 12b, respectively.

The battery (BT) voltage monitoring units 29a and 29b input the battery voltage (+ B) of the battery BT, perform AD conversion, and input the converted digital voltage value to the CPUs 12a and 12b as the battery (BT) voltage value. Further, the battery (BT) voltage monitoring unit 29 determines whether or not the battery voltage value is equal to or higher than the specified voltage value (whether or not the voltage value that enables the control circuit or the like to operate is satisfied).

FIG. 3 is a block diagram showing a mutual communication configuration between the CPUs 12a and 12b. As shown in FIG. 3, a pair of communication lines (TXD, RXD lines) for asynchronously serially communicating control information and the like and a pair of WDP (watchdog pulse) signals are exchanged between the CPUs 12a and 12b. Communication lines (WDP1, WDP2 lines) are provided. An inexpensive configuration can be realized by minimizing the number of signal lines required for mutual communication.

The communication method via the TXD and RXD lines is a UART (Universal Asynchronous Receiver-Transceiver), which enables real-time mutual communication between the CPUs 12a and 12b. Compared to the clock synchronization method, the UART can be used to configure the configuration with a smaller number of signal lines.

As shown in FIG. 3, the isolation IC 30 that electrically insulates the CPUs 12a and 12b (see FIG. 1) electrically insulates the TXD and RXD lines from the isolation IC 30a and the WDP1 and WDP2 lines. It is composed of an isolation IC 30b that insulates.

Isolation ICs 30a and 30b are semiconductor circuit elements capable of transmitting high frequency signals while maintaining electrical insulation between the input side and the output side of the above communication paths (TXD, RXD line, WDP1, WDP2 line). .. The isolation ICs 30a and 30b can prevent the failure from propagating to the partner system.

In the example shown in FIG. 3, for example, in order to prevent a common cause failure, the pair of communication lines (TXD, RXD lines) and the pair of communication lines (WDP1, WDP2 lines) correspond to each other, and the number of channels is 2. A total of two isolation ICs are arranged, but the present invention is not limited to this. For example, each of the four isolation ICs having one channel may be arranged on individual communication lines. By arranging the isolation IC for each signal line, more complicated failure determination (double fail, etc.) becomes possible.

Next, the operation of the motor control unit according to the present embodiment will be described. FIG. 4 is a flowchart showing an example of control processing in the motor control unit 1.

When the power supply units 20a and 20b generate + 5V and power is supplied to the CPUs 12a and 12b, the OS boot process is performed in step S11 of FIG. That is, the operating system (OS) stored in the storage unit (not shown) is started in advance, and the control units (CPU) 12a and 12b of each system of the motor control unit 1 activate the IG voltage detection units 24a and 24b. Based on the voltage detection result by, check that the ignition switch state (IG state) of the own system is IG-ON, check the checksum in the storage unit (not shown) in which the control program etc. are stored, Self-diagnosis by the diagnostic function BIST (Built-In Self-Test) of the CPUs 12a and 12b, initialization of the functions of the CPU, confirmation of the reset operation of the external watchdog (WD) (not shown), and the like are performed.

In step S12 after the OS is started, the watchdog signal is transmitted and received between the CPUs 12a and 12b. In the following step S13, each of the CPUs 12a and 12b starts inter-CPU communication.

In step S15, the initial diagnostic sequence is started in each system. Then, in step S16, as the initial diagnosis A, for example, the presence or absence of a short-circuit failure of the inverter circuit by the current detection unit (not shown) is diagnosed.

The CPU of each system determines the state of the partner system in step S17. When it is determined that the partner system has shifted to the predetermined fail operation state, the initial diagnosis of the own system is stopped in step S35.

When the partner system is not in the fail operation state, the CPU of each system starts the communication diagnosis between the CPU of the partner system and the CPU in step S18. Here, since the CPU-to-CPU communication diagnosis is started from the point where the initial diagnosis has progressed to some extent, the initial diagnosis B (for example, to the electric motor) is performed in step S19 after the execution of the initial diagnosis A and after the start of the CPU-to-CPU communication diagnosis. Judgment of the presence or absence of overcurrent).

In the motor control unit according to the present embodiment, for example, in consideration of the case where only the other system is reset due to the voltage drop due to cranking and the communication between the CPUs cannot be established, at least the other system is restarted in the OS in step S20. Start waiting for the worst time required for startup. Then, in the following step S21, the CPU of each system determines whether or not the communication between the CPU of the partner system and the CPU is established.

Communication between CPUs is judged to be normal if, for example, there is no UART timeout, UART checksum abnormality, UART alive counter abnormality, or the like. However, in consideration of the case where another system is reset by cranking and neither UART nor WD can be transmitted, when a UART timeout and a WD abnormality occur at the same time, it may not be regarded as an abnormality.

When the CPU-to-CPU communication between the systems is not established (NO in step S21), the CPUs 12a and 12b determine in step S22 whether both the UART and the WD are in the unreceived state. When either UART or WD is received, in step S23, a failure mode determination (failure diagnosis) described later is performed. In the following step S25, the fail operation (1) according to the failure mode determined in step S23 is executed. The details of the fail operation (1) will be described later.

On the other hand, if it is determined in step S22 that both UART and WD have not been received, in step S27, it is determined whether or not the accumulated time has elapsed since the operating system (OS) was started. If the worst time required to boot the OS (for example, 200 ms) has elapsed, it is determined that there is a problem with the above-mentioned initial diagnosis sequence and communication diagnosis by both systems is impossible (the other system is out of order). The process proceeds to the fail operation (2) in step S29, and control is performed in the own system.

If the worst stacking time has not elapsed (NO in step S27), the process returns to the determination process (step S21) of whether or not the CPU-to-CPU communication with the partner system is established.

When it is determined in step S21 that communication between CPUs is established, in step S28, for example, offset diagnosis is performed for predetermined sensors as initial diagnosis C. Then, in step S31, the initial diagnosis sequence is completed, and in step S33, normal control (steering assist control) is started.

Since each system starts up independently as described above, a backup communication line for handshaking becomes unnecessary, and the motor control unit can be made into an inexpensive configuration.

Further, by starting the inter-CPU communication diagnosis in the middle of the initial diagnosis sequence in consideration of the worst time, it is possible to grasp the presence or absence of the failure of the inter-CPU communication at an early stage. Further, since each system is independently activated and then controlled in consideration of the passage of the stacking time, it is possible to meet at the timing when both systems are surely communicating.

Next, a control operation (fault handling process) corresponding to a failure of communication between CPUs in the motor control unit according to the present embodiment will be described. In the following description, the CPUs 12a and 12b are referred to as CPU-1 and CPU-2, respectively, the inverter control unit 13a and the inverter circuit 14a are referred to as INV-1, and the inverter control unit 13b and the inverter circuit 14b are referred to as INV-2.

<Failure handling process in case of communication IC error>
The failure mode in the failure diagnosis in step S23 shown in FIG. 4, at the start of the normal assist control in step S33 and during the subsequent assist control, and in the inter-CPU communication diagnosis during the fail operation in steps S25 and S29 and the subsequent fail operation, respectively. The failure handling process when it is determined that the communication IC (isolation IC30) is abnormal will be described. The failure mode here includes an operation abnormality of the isolation IC 30 as a circuit element, as well as a disconnection or sticking failure of the TXD line and the RXD line.

FIG. 5 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of the TXD line as an abnormality of the communication IC. Further, FIG. 6 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of the RXD line.

As shown in FIG. 5, when the TXD line, which is a communication path between CPUs, fails and the RXD line, WDP1, and WDP2 lines, which are other communication paths, are normal, the CPU-2 performs the CPU-1 in step S41. Since the information from the CPU-1 is interrupted, an abnormality in communication with the CPU-1 is detected. Then, in step S43, the CPU-2 notifies the CPU-1 that a communication abnormality has been detected, and in step S45, the operation of the INV-2 is stopped.

The CPU-1 receives the above-mentioned communication abnormality notification from the CPU-2 (step S43), and in step S47, as the above-mentioned fail operation (1), maintains 50% of the motor output in the normal state by the INV-1. Performs steering assist control. This is an assist control in which the motor drive is continued by one of the two systems.

On the other hand, as shown in FIG. 6, when the RXD line, which is a communication path between CPUs, fails and the TXD line, WDP1 and WDP2 lines, which are other communication paths, are normal, the CPU-1 performs the CPU in step S51. Since the information from -2 is interrupted, an abnormality in communication with the CPU-2 is detected. Then, the CPU-1 notifies the CPU-2 that a communication abnormality has been detected in step S53.

The CPU-2 stops the operation of the INV-2 in step S55 on the assumption that there is an abnormality in the communication with the CPU-1. On the other hand, in step S57, the CPU-1 performs steering assist control for maintaining 50% of the normal motor output by the INV-1 as the above-mentioned fail operation (1). In this case as well, a fail operation for continuing the motor drive is executed by one of the two systems.

<Failure handling process in case of CPU error>
As a failure mode of communication between CPUs, a failure handling process when an operation abnormality of the CPU itself is determined will be described.

FIG. 7 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of CPU-1. Further, FIG. 8 is an example of a failure handling processing sequence when an abnormality occurs in communication between CPUs due to a failure of CPU-2.

When the signal output from the TXD line is stopped and the signal output from the WDP1 line is also stopped due to the failure of the CPU-1, for example, as shown in FIG. A normal signal is transmitted by the WDP2 line.

In this case, the CPU-2 loses control information from the other CPU (CPU-1), and the watchdog pulse WDP1 indicating whether or not the CPU-1 is operating is not output from the CPU-1, so that step S61 Detects that an operation abnormality of the CPU-1 has occurred.

Therefore, when the CPU-1 fails, in step S63, the CPU-2 performs steering assist control for maintaining 50% of the normal motor output by the INV-2 as the above-mentioned fail operation (1).

The CPU-1 detects its own abnormality in step S65, and stops the operation of the INV-1 in step S67.

When the CPU-2 fails, the signal output from the RXD line is stopped and the signal output from the WDP2 line is also stopped as shown in FIG. In this case, since the CPU-1 is operating normally, a normal signal is transmitted by the TXD line and the WDP1 line.

In the CPU-1, the control information from the other CPU (CPU-2) is interrupted, and the watchdog pulse WDP2 indicating whether or not the CPU-2 is operating is not output from the CPU-2. Therefore, in step S71, the CPU-1 -Detects the occurrence of an abnormal operation of -2.

Therefore, when the CPU-2 fails, in step S73, the CPU-1 performs steering assist control for maintaining 50% of the normal motor output by the INV-1 as the above-mentioned fail operation (1). ..

On the other hand, the CPU-2 detects its own abnormality in step S75 and stops the operation of INV-2 in step S77.

Regarding the CPU failure, it depends on the reset operation abnormality detected by the watchdog timer (WDT) provided inside the CPU or the external watchdog timer, the operation abnormality of the output calculation unit, the check sum confirmation result for the control program, etc. The detection result of a memory abnormality, an abnormality detected by the CPU diagnostic function BIST, a clock abnormality detected by the clock monitor function of the CPU, or the like may be notified to a normally operating CPU by CAN communication.

<Failure handling process in case of CPU clock error>
As a failure mode of communication between CPUs, a failure handling process when an abnormality of a clock signal supplied to the CPU from the outside (an abnormality of the operating clock of the CPU) is determined will be described. Here, the vehicle-mounted network (CAN) of the motor control device 1a shown in FIG. 2 is CAN-1, and the vehicle-mounted network (CAN) of the motor control device 1b is CAN-2. Further, the clock oscillators 16a and 16b are designated as CLK-1,2, respectively.

9 to 11 show failure handling processing according to the degree of abnormality (for example, clock cycle deviation) generated in the clock signal supplied from CLK-1 to the CPU-1.

<Clock error (1)>
FIG. 9 is a sequence diagram showing a failure handling process in the clock abnormality (1). In FIG. 9, communication between the CPUs 1 and 2 via the TXD, RXD lines, WDP1 and WDP2 lines is normal, but the CAN signal between the CAN-1 and the CPU-1 is stopped and the CAN-1 is operated. This is a failure response processing sequence when a stop is detected (step S81) and CAN-2 is normal.

As described above, even if the communication between the CPUs is normal, the operation of the CAN-1 which requires a highly accurate operation clock is stopped. Therefore, in the step S83, the CPU-1 performs the clock oscillation unit 16a ( It is determined that the clock signal output from CLK-1) and supplied to CAN-1 or the like has a deviation of, for example, 2% as a clock failure.

In the above case, even if the CPU-1 detects an abnormality of CAN-1, CAN-2, which receives the supply of CLK-2 independent of CLK-1, is not affected by the clock abnormality of CLK-1. Therefore, since the CAN-2 operates normally, the CPU-1 receives the CAN information from the CPU-2 via the RXD line (step S87).

Based on the above CAN information, the CPU-1 executes normal control (100% assist control) by INV-1 in step S85 even if there is a clock abnormality (1), that is, there is a deviation of, for example, 2% in the clock signal. do.

On the other hand, since CAN-2 is normal, CPU-2 executes normal control (100% assist control) by INV-2 in step S88.

<Clock error (2)>
FIG. 10 is a sequence diagram showing a failure handling process in the clock abnormality (2). That is, in the failure handling sequence of FIG. 10, even if the communication between the CPUs-1 and 2 via the TXD and RXD lines is stopped and the communication via the WDP1 and WDP2 lines is normal, the CAN-1 and the CPU- Corresponds to the case where the CAN signal between 1 is stopped, the operation stop of CAN-1 is detected (step S91), and CAN-2 is normal.

In this case, as shown by the dotted line in FIG. 10, since the communication via the TXD and RXD lines is stopped and the operation of CAN-1 is stopped, the CPU-1 is CLK-in step S92 of FIG. It is determined that the clock signal output from 1 has a deviation of, for example, 5% as a clock failure.

Then, in step S93, the CPU-1 intentionally stops the WDP1 transmitted to the CPU-2. After that, the CPU-1 stops the operation of the INV-1 in step S95.

On the other hand, the CPU-2 detects the communication abnormality between the CPUs and the abnormality of the WDP1 in step S97 because the WDP1 from the CPU-1 is stopped as described above. Therefore, in step S99, the CPU-2 performs steering assist control by INV-2 to maintain a motor output of 50% of the normal state.

<Clock error (3)>
FIG. 11 is a sequence diagram showing a failure handling process in the clock abnormality (3). In the case of clock abnormality (3), as shown by the dotted line in FIG. 11, communication via the TXD, RXD line, and WDP1 line is stopped, and the CAN signal between CAN-1 and CPU-1 is also stopped, and CAN-1 The operation stops.

On the other hand, CAN-2, which receives the supply of CLK-2 independent of CLK-1, is not affected by the clock abnormality of CLK-1, so CAN-2 operates normally and WDP2 is also normal.

In the above case, the CPU-1 determines in step S101 of FIG. 11 that the clock signal output from the CLK-1 has a deviation of, for example, 20% as a clock failure. Then, the CPU-1 stops the operation of the INV-1 in step S103.

If the clock shifts by 20% as described above, the clock monitor function of the CPU detects a clock abnormality and resets it, thereby stopping the communication between the CPUs and the WDP signal. Detects its own abnormality before stopping.

On the other hand, the CPU-2 detects an abnormality in the CPU-1 in step S105 because the transmission information (TXD) from the CPU-1 is interrupted and the watchdog pulse WDP1 is not output. Therefore, in step S107, the CPU-2 performs steering assist control by INV-2 to maintain a motor output of 50% of the normal state.

The failure handling process when a deviation of, for example, 2%, 5%, or 20% occurs in the clock signal supplied from the CLK-2 to the CPU-2 is the failure handling process for the clock abnormality in the CPU-1 described above. Is similar to. That is, the operation of CAN-2 is stopped due to a clock abnormality, and the CPU-1 performs assist control by INV-1 to maintain 50% of the motor output in the normal state.

Therefore, the illustration and description of the failure handling process when there is an abnormality in the clock signal supplied from the CLK-2 will be omitted.

In each failure handling process corresponding to the failure of communication between CPUs described above, in the steering assist control that maintains 50% of the motor output in the normal state, for example, in the steering assist control when all the systems are normal and 100% steering assist is performed. Motor control is performed with output characteristics in which the characteristics with the same inclination as the output characteristics (inclination of the characteristic curve) are limited by 50% (with a limit applied).

By doing so, assist control can be performed with the motor output in the normal state (normal state) up to 50% at the time of troubleshooting, and it is possible to avoid a change in responsiveness due to changing the inclination of the output characteristic at the time of assist.

In the motor control unit according to the present embodiment, when other sensors that are not directly connected to CPU-to-CPU communication, such as a torque sensor, fail, the system to which the torque sensor belongs is stopped and assist control is performed by another system. , 100% steering assist is continued based on the information detected by the torque sensors of other systems.

FIG. 12 is a diagram showing steering assist control by the motor control unit when the torque sensor of the second system fails. As shown in FIG. 12A, when there is no failure in the torque sensor, the target torque Tt1 calculated by the CPU 12a based on the indicated torque Tq1 in the motor control device 1a of the first system is second by inter-CPU communication. It is transmitted to the CPU 12b of the system motor control device 1b. Also in the second system motor control device 1b, the CPU 12b calculates the target torque Tt2 from the input indicated torque Tq2.

In this case, the CPU 12a of the first system drives and controls the electric motor 15 using the target torque Tt1, and the CPU 12b of the second system has the target torque Tt1 and the CPU 12b transmitted from the first system by inter-CPU communication. One of the calculated target torques Tt2 is selected by the selection unit, and assist control for driving and controlling the electric motor 15 is performed.

On the other hand, as shown in FIG. 12B, when the torque sensor of the second system fails, the CPU 12a in the motor control device 1a of the first system calculates from the input indicated torque (steering torque) Tq. The target torque Tt is transmitted to the CPU 12b of the motor control device 1b of the second system by inter-CPU communication.

As a result, the first system drives and controls the electric motor 15 based on the torque control information based on the target torque Tt calculated by the own system, and the second system directly uses the target torque Tt calculated by the first system as the torque control information. To perform assist control for driving and controlling the electric motor 15.

FIG. 13 is a diagram showing steering assist control by the motor control unit when the torque sensor of the first system fails. FIG. 13A shows steering assist control by the motor control unit when there is no failure in the torque sensor, as in FIG. 12A.

As shown in FIG. 13B, when the torque sensor of the first system fails, the motor control device 1a of the first system does not calculate the target torque by the CPU 12a. Therefore, in the motor control device 1b of the second system, the CPU 12b calculates the target torque Tt2 from the input indicated torque Tq2. As a result, the motor control device 1b of the second system performs assist control for maintaining, for example, 50% of the motor output in the normal state.

As described above, the motor control device according to the present embodiment includes first and second control systems, and is a motor control device in which an electric motor is driven by a control unit (CPU) provided for each of the plurality of control systems. , When a communication failure between the central control units is determined based on the communication states of the control signal via the first communication means and the watchdog signal via the second communication means, the first control system and Among the second control systems, the control system that is operating normally has a configuration in which the assist control of the electric motor is continued.

As a result, in a motor control device having a redundant configuration, CPU communication between control units (CPUs) of a plurality of control systems and transmission / reception of a watchdog signal (WDP) are used together, and even if communication between CPUs is interrupted, mutual communication is performed. Failure monitoring becomes possible.

Then, even if one control system is determined to be in the failure mode, the other normal control system continues to assist the drive control of the electric motor according to the failure mode (failure location) to ensure the fail operation state. Can be migrated.

In addition, a highly accurate operation clock is configured to identify the control system in which a failure occurs due to an abnormality in the operation clock of the control unit (CPU) based on the presence or absence of communication stop by the TXD, RXD line and the CAN communication unit. It becomes easy to identify the failure mode (failure location) based on the CAN communication required. Further, even when the communication by the first communication means is stopped, the failure can be identified by the CAN communication.

For example, in the motor control device for electric power steering, the electric motor is driven and controlled by the motor control device having the above-mentioned redundant configuration. Therefore, even if one control system fails, the electric motor is operated by the other control system. It is possible to continue steering assist by driving and controlling.

Further, for example, in the electric power steering system provided with the above-mentioned motor control device for electric power steering, even if a failure occurs in one control system of the electric power steering control device as described above, the other control system may be used. Steering assist can be continued.

The present invention is not limited to the above embodiment, and various modifications are possible. Hereinafter, a modified example will be described.

<Modification example 1>
When communication by the first communication means (TXD, RXD line) is stopped, or when communication by the second communication means (WDP1, WDP2 line) is stopped, for example, the motor control device of the first system is assisted. Control may be entrusted.

When it is not possible to determine whether communication is stopped due to a failure of any of the plurality of control systems, a reliable fail operation can be performed by performing assist control by the motor control device of the first system. Further, when one of the plurality of control systems is the main system and the other is the slave system, assist control (fail operation) can be reliably performed by one of the master and slave control systems in the event of a failure.

<Modification 2>
The CAN communication on the control system side different from the control system in which the CAN communication by the in-vehicle network (CAN) is stopped may be used to identify the control system in which the failure has occurred. As a result, the assist can be continued by switching to CAN communication with normal operation and identifying the failure mode (failure location).

1 Motor control unit 1a, 1b Motor control device 2 Steering handle 3 Rotating shaft 4 Reduction gear 6 Pinion gear 7 Rack shaft 9a, 9b Torque sensor 10 Electric power steering system 11a, 11b Angle sensor 12a, 12b Control unit (CPU)
13a, 13b Inverter control unit 14a, 14b Inverter circuit 15 Electric motor 15a, 15b Three-phase winding 16a, 16b Clock oscillator 19a, 19b CANI / F
20a, 20b Power supply unit 21a, 21b Power supply management unit 24a, 24b IG voltage detection unit 27H, 27L CAN signal line 27Ha, 27Hb CAN-H line 27La, 27Lb CAN-L line 29a, 29b Battery (BT) voltage monitoring unit 30, 30a, 30b isolation IC
31 Ignition switch (IG-SW)
BT battery

Claims (18)

A motor control device consisting of a plurality of control systems and driving an electric motor by a central control unit provided for each control system.
A first communication means that enables communication of control signals between the first control system of the plurality of control systems and the central control unit of the second control system, and
A second communication means that enables transmission and reception of an abnormality monitoring signal between the central control units, and
A failure determining means for determining the presence or absence of a communication failure between the central control units based on the communication state of the control signal and the abnormality monitoring signal.
With
A motor control device that continues drive control of the electric motor by a control system that is operating normally among the first control system and the second control system when the communication failure is determined by the failure determination means. The communication failure includes at least a failure of the central control unit, a failure of the communication integrated circuit element constituting the first communication means and the second communication means, and a disconnection or sticking failure of the first communication means. The motor control device according to claim 1, further comprising a failure due to a disconnection or sticking failure of the second communication means, or a failure due to an abnormality in the operating clock of the central control unit. When the communication by the first communication means is stopped between the central control units and the communication by the second communication means is normal, the failure determination means causes a failure due to an abnormality in the operation clock of the central control unit, or the first. The motor control device according to claim 2, wherein the motor control device is determined to be a disconnection or sticking failure of the communication means of 1. The motor control device according to claim 2, wherein the failure determining means determines that the central control unit has a failure when communication by the first communication means and the second communication means is stopped between the central control units. .. When the communication by the first communication means is normal and the communication by the second communication means is stopped between the central control units, the failure determination means determines that the second communication means is disconnected or stuck. The motor control device according to claim 2. A CAN (Controller Area Network) communication unit configured to be able to communicate with the central control unit is further provided.
Claims 1 to 5 for identifying a control system in which a failure occurs due to an abnormality in the operation clock of the central control unit, based on the presence or absence of communication stop by the first communication means and the CAN communication unit. The motor control device according to any one of the above items. A claim that the failure determining means entrusts the drive control of the electric motor to the first control system when the communication by the first communication means is stopped or when the communication by the second communication means is stopped. The motor control device according to 1. The motor control device according to claim 1, wherein when the communication failure is determined, the drive control of the electric motor is entrusted to either one of the first control system and the second control system. When the CAN communication on the first control system side is stopped, the drive control of the electric motor by the first control system is stopped, and when the CAN communication on the second control system side is stopped. Is the motor control device according to claim 6, wherein the drive control of the electric motor by the second control system is stopped. The motor control device according to claim 6, wherein the failure determination means uses CAN communication on the control system side different from the control system in which the CAN communication has stopped to identify the control system in which the failure has occurred. The first aspect of claim 1, wherein the central control unit of the first control system and the central control unit of the second control system start up individually at the time of activation, and wait at a timing when these central control units can communicate with each other. Motor control device. The motor control device according to claim 1, wherein the first communication means communicates the control signal by asynchronous communication. The motor control device according to claim 1, wherein the first communication means and the second communication means each consist of two signal lines. The motor control device according to claim 13, wherein the first communication means and the second communication means have an isolation means for electrically insulating each signal line or each communication means. The motor control device according to any one of claims 1 to 14, wherein the abnormality monitoring signal is a watchdog pulse signal. It is an electric power steering control device that has a central control unit provided for each of a plurality of control systems and assists the steering wheel operation of a driver such as a vehicle.
An electric motor that assists the driver in steering and
A means for driving and controlling the electric motor by the motor control device according to any one of claims 1 to 15.
An electric power steering control device equipped with. An electric power steering system including the electric power steering control device according to claim 16. It is a method of identifying a failure part in a motor control device that is composed of a plurality of control systems and that drives an electric motor by a central control unit provided for each control system.
Communication by the first communication means that enables communication of control signals between the central control units is stopped, and communication by the second communication means that enables transmission and reception of abnormality monitoring signals between the central control units is normal. In this case, the step of determining the failure due to the operation clock abnormality of the central control unit, or the disconnection or sticking failure of the first communication means.
When communication by the first communication means and the second communication means is stopped between the central control units, a step of determining a failure of the central control unit and a step of determining the failure of the central control unit.
When communication by the first communication means is normal and communication by the second communication means is stopped between the central control units, a step of determining a disconnection or sticking failure of the second communication means, and
A method of identifying a faulty part in a motor control device comprising.

Images