JP2022072398A - Backup power supply system, failure diagnosis method for backup power supply system, and program - Google Patents

Abstract

To reduce the possibility of erroneous diagnosis of whether there is a failure or not in a second switch circuit which electrically connects and disconnects a second power supply path connecting an auxiliary power supply with a load.SOLUTION: A first switch circuit 26 electrically connects and disconnects a first power supply path L1 connecting a first auxiliary power supply 22 and a load 5. A second switch circuit 27 electrically connects and disconnects a second power supply path L2 connecting a second auxiliary power supply 3 having a capacity smaller than that of the first auxiliary power supply 22 and the load 5. A diagnosis unit 211 diagnoses the presence or absence of an open failure of the second switch circuit 27 with a voltage exceeding a determination threshold value for determining the presence/absence of an open failure of the second switch circuit 27 being applied from the second auxiliary power supply 3 to a point of connection between the second switch circuit 27 and the second auxiliary power supply 3.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to a backup power supply system, a failure diagnosis method for the backup power supply system, and a program. More specifically, the present disclosure relates to a backup power supply system capable of supplying power to a load in the event of a main power failure, a failure diagnosis method for the backup power supply system, and a program.

Patent Document 1 discloses a redundant power supply system (backup power supply system). This redundant power supply system includes a main power supply, an auxiliary power supply (auxiliary power supply), first to fourth relays (switch circuit, switching element), a regulator, and a DCDC converter. The DCDC converter is provided between the main power supply and the first load. The first relay connects the DCDC converter and the auxiliary power supply so that they can be energized and cut off. The second relay connects the DCDC converter and the second load so as to be able to be energized and cut off. The third relay connects the main power supply and the DCDC converter so as to be able to be energized and cut off. The fourth relay connects the main power supply and the second load so as to be able to be energized and cut off. The regulator connects the auxiliary power supply and the first load.

In this system, in the engine restart process, the first relay and the fourth relay are cut off, the second relay and the third relay are energized, the second load is connected to the main power supply via the DCDC converter, and the second relay is connected. 1 Connect the load to the auxiliary power supply via the regulator. If the main power supply fails in the engine restart process, the first relay is energized and the second to fourth relays are cut off, the second load is disconnected from the main power supply, and the first load is converted to a DCDC converter. Connect to the secondary power supply via.

Japanese Unexamined Patent Publication No. 2020-26215

In the above redundant power supply system, in order to stably supply power from the secondary power supply, a relay (second switch circuit) such as a first relay that controls the power supply from the secondary power supply (second auxiliary power supply) to the load. It is desirable to be able to diagnose the failure of.

An object of the present disclosure is a failure of a backup power supply system or a backup power supply system that can reduce the possibility of misdiagnosing the presence or absence of a failure of the second switch circuit that conducts and cuts off the second power supply path that connects the second auxiliary power supply and the load. To provide diagnostic methods and programs.

The backup power supply system of one aspect of the present disclosure includes a first auxiliary power supply, a first switch circuit, a second switch circuit, and a diagnostic unit. The first auxiliary power source is a power source for supplying electric power to a load when the main power source fails. The first switch circuit conducts and cuts off the first power supply path connecting the first auxiliary power supply and the load. The second switch circuit conducts and cuts off the second power supply path connecting the second auxiliary power supply and the load. The second auxiliary power source is a power source for supplying electric power to the load when the main power source fails, and has a smaller capacity than the first auxiliary power source. The diagnostic unit diagnoses the presence or absence of a failure of the second switch circuit. In a state where a voltage exceeding the determination threshold value for determining the presence or absence of an open failure of the second switch circuit is applied from the second auxiliary power supply to the connection point between the second switch circuit and the second auxiliary power supply. , The diagnostic unit diagnoses the presence or absence of an open failure of the second switch circuit.

The failure diagnosis method of the backup power supply system according to one aspect of the present disclosure is a failure diagnosis method of a backup power supply system provided with a first auxiliary power supply capable of supplying power to a load when the main power supply fails, and is a first switching method. It includes a step, a second switching step, and a diagnostic step. In the first switching step, the first power supply path connecting the first auxiliary power supply and the load is conducted and cut off by the first switch circuit. In the second switching step, the second switch circuit conducts and cuts off the second power supply path connecting the second auxiliary power supply and the load. The second auxiliary power source is a power source for supplying electric power to the load when the main power source fails, and has a smaller capacity than the first auxiliary power source. In the diagnostic step, the presence or absence of failure of the second switch circuit is diagnosed. In the diagnostic step, a voltage exceeding the determination threshold value for determining the presence or absence of an open failure of the second switch circuit is applied from the second auxiliary power supply to the connection point between the second switch circuit and the second auxiliary power supply. In this state, the presence or absence of an open failure of the second switch circuit is diagnosed.

The program of one aspect of the present disclosure is a program for causing one or more computer systems to execute the failure diagnosis method of the backup power supply system.

According to the present disclosure, it is possible to reduce the possibility of erroneously diagnosing the presence or absence of a failure in conducting and interrupting the second power supply path connecting the auxiliary power supply and the load.

FIG. 1 is a diagram showing a schematic configuration of a drive system using the backup power supply system according to the embodiment. FIG. 2 is a side view of a part of the vehicle equipped with the backup power supply system of the same as above. FIG. 3 is a timing chart illustrating the operation of the backup power supply system as described above. FIG. 4 is a flowchart illustrating the operation of the backup power supply system as described above. FIG. 5 is a flowchart illustrating the operation of the backup power supply system as described above. FIG. 6 is a flowchart illustrating the operation of the backup power supply system as described above. FIG. 7 is a flowchart illustrating the operation of the backup power supply system of the first modification.

(Embodiment)
The embodiments and modifications described below are merely examples of the present disclosure, and the present disclosure is not limited to the following embodiments and modifications. Other than the following embodiments and modifications, various changes can be made according to the design and the like as long as they do not deviate from the technical idea of the present disclosure.

(1) Overview First, an overview of the backup power supply system 1 according to the embodiment will be described with reference to FIGS. 1 and 2.

The backup power supply system 1 according to the present embodiment is mounted on, for example, a vehicle 9 (see FIG. 2), and when the main power supply 4 provided in the vehicle 9 fails, power is supplied to the load mounted on the vehicle 9. Used to supply. That is, the backup power supply system 1 is mounted on the vehicle 9 having the main power supply 4 and the load. The term "when the main power supply 4 fails" as used in the present disclosure means that the power supply from the main power supply 4 to the load or the like is stopped due to a failure, deterioration, disconnection, or the like of the main power supply 4.

The vehicle 9 includes a drive system 10 and a vehicle body (vehicle body) 91 on which the drive system 10 is mounted. The drive system 10 includes a backup power supply system 1, a main power supply 4, an ECU (Electronic Control Unit) 7, and a load 5.

The main power source 4 is, for example, a battery (as an example, a lead storage battery) mounted on a vehicle 9 capable of automatic driving. The vehicle 9 is equipped with a plurality of types of loads (for example, a brake system, a shift-by-wire system, an electric power steering system, etc.) to which electric power is supplied from the main power source 4. In the present embodiment, a case where the load 5 to be supplied with power by the backup power supply system 1 when the main power supply 4 fails is a brake system (hereinafter, also referred to as “brake system 5”) will be described. That is, the load 5 is mounted on the vehicle 9 capable of automatic driving.

The brake system 5 is a system that electrically operates the brake mechanism provided on each wheel of the vehicle 9. The brake system 5 includes a drive control unit 51 and an actuator 52. The drive control unit 51 controls the drive of the actuator 52 by outputting a control signal to the actuator 52 based on the amount of operation of the brake pedal by the driver. The actuator 52 is configured to operate a brake mechanism provided on each wheel to apply a brake to each wheel in response to a control signal from the drive control unit 51. The brake system 5 is configured to operate on the power supplied from the main power supply 4 or the backup power supply system 1. The actuator 52 may include a hydraulic actuator that generates a braking force by hydraulic pressure, or may generate a braking force according to a control signal by electrically controlling the hydraulic actuator.

When the main power supply 4 is normal, power is supplied from the main power supply 4 to the load 5 (that is, the brake system 5). On the other hand, when the main power supply 4 fails, power is supplied from the backup power supply system 1 to the load 5. Therefore, even when the main power supply 4 fails, the load 5 can operate according to the operation of the driver.

The backup power supply system 1 includes a first auxiliary power supply 22, a first switch circuit 26, a second switch circuit 27, and a diagnostic unit 211. The first auxiliary power source 22 is a power source for supplying electric power to the load 5 when the main power source 4 fails. The first switch circuit 26 conducts and cuts off the first power supply path L1 connecting the first auxiliary power supply 22 and the load 5. The second switch circuit 27 conducts and cuts off the second power supply path L2 connecting the second auxiliary power supply 3 and the load 5. The second auxiliary power source 3 is a power source for supplying electric power to the load 5 when the main power source 4 fails, and has a smaller capacity than the first auxiliary power source 22. The diagnosis unit 211 diagnoses the presence or absence of a failure of the second switch circuit 27.

The diagnostic unit 211 uses the second switch circuit 27 in a state where a voltage exceeding the determination threshold value is applied from the second auxiliary power supply 3 to the connection point (input terminal T2) between the second switch circuit 27 and the second auxiliary power supply 3. Diagnose the presence or absence of open failure. The determination threshold value is a threshold value for determining the presence or absence of an open failure of the second switch circuit 27.

Here, the backup power supply system 1 includes a control circuit 21 that controls continuity and disconnection of the first switch circuit 26 and the second switch circuit 27. The "open failure" of the second switch circuit 27 is such that the second switch circuit 27 is kept off (open state) even though the control circuit 21 controls the second switch circuit 27 to be on. It is a malfunction.

The second auxiliary power supply 3 is a secondary battery charged by the main power supply 4, and when the second auxiliary power supply 3 is not sufficiently charged, it is applied from the second auxiliary power supply 3 to the connection point (input terminal T2). The voltage may be below the judgment threshold. When the voltage applied from the second auxiliary power supply 3 to the connection point (input terminal T2) is equal to or less than the determination threshold value, the voltage at the connection point (midpoint P1) between the second switch circuit 27 and the second auxiliary power supply 3 is Since it becomes equal to the voltage of the second auxiliary power supply 3, the voltage at the connection point (midpoint P1) is lower than the determination threshold value. In this case, in order to diagnose the open failure of the second switch circuit 27, the second switch circuit 27 is controlled to be turned on, and even if the second switch circuit 27 is normally turned on, the connection point (midpoint P1). Since the voltage of the second switch circuit 27 is lower than the determination threshold value, the diagnostic unit 211 may erroneously diagnose that an open failure in which the second switch circuit 27 does not switch on has occurred.

In the present embodiment, the diagnostic unit 211 diagnoses the presence or absence of an open failure of the second switch circuit 27 in a state where a voltage exceeding the determination threshold value is applied to the input terminal T2 which is the connection point (midpoint P1). It is possible to suppress misdiagnosis that occurs because the voltage of the second auxiliary power supply 3 is equal to or less than the determination threshold value. Therefore, it is possible to provide the backup power supply system 1 that can reduce the possibility of erroneously diagnosing the presence or absence of failure of the second switch circuit 27.

In the following, a mode in which the second switch circuit 27 has a series circuit of the first switching element SW3 and the second switching element SW4 connected in series between the load 5 and the second auxiliary power supply 3 will be described. The first switching element SW3 and the second switching element SW4 each have a body diode. Here, the "open failure" of the first switching element SW3 means that the first switching element SW3 remains off (open state) even though the control circuit 21 controls the first switching element SW3 to be on. It is a failure like that. Similarly, the "open failure" of the second switching element SW4 is such that the second switching element SW4 is maintained in the off state even though the control circuit 21 controls the second switching element SW4 to be ON. It is a malfunction. In the following, the first switching element SW3 and the second switching element SW4 may be simply referred to as a switch.

(2) Details Next, the details of the backup power supply system 1 according to the embodiment will be described with reference to FIG.

As shown in FIG. 1, the backup power supply system 1 according to the present embodiment includes a backup power supply device 2 and a second auxiliary power supply 3. That is, the backup power supply system 1 of the present embodiment further includes a second auxiliary power supply 3.

The backup power supply device 2 includes a control circuit 21, a first auxiliary power supply 22, a power supply circuit 23, a first drive circuit 24, a second drive circuit 25, and a latch circuit 31 (five in FIG. 1). The switches SW1 to SW5, the comparison circuit 28, the compulsory circuit 29, and a plurality of diodes D1 to D4 (four in FIG. 1) are provided. Further, the backup power supply device 2 further includes a plurality of (two in FIG. 1) input terminals T1 and T2, and one output terminal T3. That is, in the backup power supply system 1 according to the present embodiment, the first auxiliary power supply 22 and the second auxiliary power supply 3 are separately provided. The switches SW1 and SW2 constitute the first switch circuit 26, and the switches SW3 and SW4 constitute the second switch circuit 27.

(2.1) Terminal The input terminal T1 is connected to the main power supply 4 via the ignition switch 8. The input terminal T1 is a terminal for inputting the electric power supplied from the main power supply 4 to the backup power supply device 2 when the ignition switch 8 is on.

The input terminal T2 is connected to the second auxiliary power supply 3. The input terminal T2 is a terminal for inputting the power supplied from the second auxiliary power supply 3 to the backup power supply device 2.

The output terminal T3 is connected to the brake system 5. The output terminal T3 is a terminal for outputting the electric power supplied from the first auxiliary power source 22 or the second auxiliary power source 3 to the brake system 5.

Further, the main power supply 4 is connected to the brake system 5 via the ignition switch 8. Therefore, in the brake system 5, power is supplied from the main power supply 4 when the main power supply 4 is normal and the ignition switch 8 is on.

(2.2) Auxiliary power supply The first auxiliary power supply 22 and the second auxiliary power supply 3 are backup (that is, auxiliary or spare) power supplies for the main power supply 4. In other words, the first auxiliary power source 22 and the second auxiliary power source 3 are auxiliary power sources capable of supplying electric power to the load 5 when the main power source 4 fails.

The first auxiliary power supply 22 is connected between the branch point N2 of the power supply path 101 inside the backup power supply device 2 and the power supply circuit 23. The second auxiliary power supply 3 is connected between the ignition switch 8 and the input terminal T2. The outputs of the first auxiliary power supply 22 and the second auxiliary power supply 3 are controlled by, for example, the ECU 7 mounted on the vehicle 9.

Each of the first auxiliary power supply 22 and the second auxiliary power supply 3 is, for example, an electric double layer capacitor (EDLC). Each of the first auxiliary power supply 22 and the second auxiliary power supply 3 may be a secondary battery such as a lithium ion capacitor (LIC: Lithium Ion Capacitor) or a lithium ion battery (LIB: Lithium Ion Battery). In a lithium ion capacitor, a positive electrode is formed of a material similar to EDLC (for example, activated carbon), and a negative electrode is formed of a material similar to LIB (for example, a carbon material such as graphite).

Further, each of the first auxiliary power supply 22 and the second auxiliary power supply 3 is not limited to the electric double layer capacitor, and may be, for example, an electrochemical device having the configuration described below. The electrochemical device referred to here includes a positive electrode member, a negative electrode member, and a non-aqueous electrolyte solution. The positive electrode member has a positive electrode current collector and a positive electrode material layer supported on the positive electrode current collector and containing a positive electrode active material. The positive electrode material layer contains a conductive polymer as a positive electrode active material that is doped and dedoped with anions (dopants). The negative electrode member has a negative electrode material layer containing a negative electrode active material. The negative electrode active material is, for example, a substance in which a redox reaction accompanied by storage and release of lithium ions proceeds, and specifically, a carbon material, a metal compound, an alloy, a ceramic material, or the like. The non-aqueous electrolyte solution has lithium ion conductivity as an example. This type of non-aqueous electrolyte contains a lithium salt and a non-aqueous solution that dissolves the lithium salt. An electrochemical device having such a configuration has a higher energy density than an electric double layer capacitor or the like.

Further, each of the first auxiliary power supply 22 and the second auxiliary power supply 3 is composed of two or more power storage devices (for example, an electric double layer capacitor) electrically connected in parallel, in series, or in parallel and in series. May be. That is, one first auxiliary power supply 22 and one second auxiliary power supply 3 may be realized by a parallel circuit or a series circuit of two or more power storage devices, or a combination thereof.

Here, in the backup power supply system 1 according to the present embodiment, the first auxiliary power supply 22 and the second auxiliary power supply 3 are charged by the electric power supplied from the main power supply 4. Specifically, the first auxiliary power supply 22 is supplied with electric power from the main power supply 4 when the ignition switch 8 is turned on and the switch SW5 is turned on, and is charged by this electric power. Further, the second auxiliary power supply 3 is supplied with electric power from the main power supply 4 when the ignition switch 8 is turned on, and is charged by this electric power. The second auxiliary power supply 3 includes a smoothing capacitor 32, a DC / DC converter 33, a control unit 34, and a switch SW6. When the ignition switch 8 is turned on and power is supplied from the main power supply 4 to the second auxiliary power supply 3, the DC / DC converter 33 converts the voltage value of the DC voltage supplied from the main power supply 4 to a smoothing capacitor. 32 is charged. The switch SW6 is conducted and cut off by the control unit 34 provided in the second auxiliary power supply 3. For example, when a remote parking execution signal indicating that remote parking is to be performed is input from the brake system 5, the control unit 34 conducts the switch SW 6 so that power can be supplied from the second auxiliary power source 3 to the brake system 5. .. When the user (driver or passenger) of the vehicle 9 instructs the ECU 7 of the vehicle 9 to park by automatic driving using, for example, a dedicated remote controller, the ECU 7 controls the vehicle 9 to perform desired parking. Remote parking is performed to park the vehicle 9 at the position. When the ECU 7 parks the vehicle 9 by automatic operation, it is necessary to operate the brake system 5 even when the main power supply 4 fails. Therefore, when the main power supply 4 fails during remote parking, the backup power supply system 1 brakes. It supplies power to the system 5. In the present embodiment, the backup power supply system 1 supplies electric power to the brake system 5 when the vehicle 9 performs remote parking, but the automatic driving operation performed by the vehicle 9 is not limited to remote parking. The backup power supply system 1 may supply power to the load of the vehicle 9 when the vehicle 9 performs an automatic driving operation other than remote parking (for example, constant speed cruising, lane change, etc.). The control unit 34 may also conduct the switch SW6 for a predetermined period after the ignition switch 8 is turned on. The above predetermined period is a period for performing failure diagnosis of the first switch circuit 26 and the second switch circuit 27 after the ignition switch 8 is turned on, that is, after the main power supply 4 is turned on (hereinafter, this period is used as this period). It is also called "initial diagnosis timing"), and is a period of about 10 seconds, for example.

Here, the "failure diagnosis" of the first switch circuit 26 and the second switch circuit 27 includes the diagnosis of the failure (open failure) of the switch SW3 constituting the second switch circuit 27. "Failure diagnosis" may include diagnosis of a short-circuit failure of the switch SW3, an open failure of the switch SW4, or a short-circuit failure of the switch SW4. Further, the "failure diagnosis" may include a diagnosis of a failure (open failure or short failure) of the switches SW1 or SW2 constituting the first switch circuit 26.

Further, the first auxiliary power supply 22 and the second auxiliary power supply 3 are configured to discharge when the ignition switch 8 is turned off. Therefore, when the ignition switch 8 is turned on again, the first auxiliary power supply 22 and the second auxiliary power supply 3 are in an uncharged state. The "uncharged state" as used in the present disclosure means a fully charged state, that is, a state in which the remaining amount of electric energy is less than a state in which electric energy is sufficiently stored.

(2.3) Power supply circuit The power supply circuit 23 is a circuit that generates the operating voltage of the control circuit 21. The power supply circuit 23 lowers the output voltage of the main power supply 4 input via the input terminals T1 and the diodes D1 and D3 to a predetermined voltage (for example, 5V) and outputs the output voltage to the control circuit 21. Further, the power supply circuit 23 lowers the output voltage of the first auxiliary power supply 22 input via the diode D2 to a predetermined voltage (for example, 5V) and outputs the output voltage to the control circuit 21. Further, the power supply circuit 23 lowers the output voltage of the second auxiliary power supply 3 input via the diode D4 to a predetermined voltage (for example, 5V) and outputs the output voltage to the control circuit 21. The control circuit 21 can be operated by the output power of the power supply circuit 23.

(2.4) Drive Circuit The drive circuit that conducts and cuts off the switches SW1 to SW5 includes a first drive circuit 24 and a second drive circuit 25.

The first drive circuit 24 is configured to drive the two switches SW1 and SW2 together. Specifically, the first drive circuit 24 generates a drive signal for turning on (conducting) / off (cutting off) the switches SW1 and SW2 according to the output signal of the comparison circuit 28, and the generated drive signal is used as the switch SW1. , Output to SW2. The switches SW1 and SW2 are turned on / off according to the drive signal from the first drive circuit 24.

The second drive circuit 25 is configured to control the switches SW3 to SW5 separately. Specifically, the second drive circuit 25 is a third to fifth drive signal for turning on (conducting) / off (cutting off) the switches SW3 to SW5 according to the third to fifth control signals from the control circuit 21. Is created, and the created third to fifth drive signals are output to switches SW3 to SW5. The switches SW3 to SW5 are turned on / off according to the third to fifth drive signals from the second drive circuit 25.

(2.5) Latch circuit The latch circuit 31 is a circuit for preventing chattering and the like of switches SW1 and SW2 by the first drive circuit 24. The latch circuit 31 controls the signal input from the comparison circuit 28 to the first drive circuit 24 according to the control from the control circuit 21 (that is, in terms of software). The control circuit 21 monitors the output signal (that is, the H level signal or the L level signal) of the comparison circuit 28. More specifically, when the output signal of the comparison circuit 28 fluctuates, the control circuit 21 changes from the comparison circuit 28 to the first drive circuit 24 by the latch circuit 31 when the fluctuation is within a short time. The input signal is maintained (latched) to the signal before the fluctuation. This prevents chattering of the switches SW1 and SW2. Further, when the output signal of the comparison circuit 28 fluctuates, the control circuit 21 does not maintain the signal input from the comparison circuit 28 to the first drive circuit 24 unless the fluctuation is within a short period of time. As a result, the first drive circuit 24 can drive the switches SW1 and SW2 according to the output signal of the comparison circuit 28. It is not essential that the backup power supply device 2 includes the latch circuit 31, and it can be omitted as appropriate.

(2.6) Switching element Each of the plurality of switches SW1 to SW5 included in the backup power supply device 2 is, for example, an enhancement type P-channel MOSFET (Metal Oxide Semiconductor Field Effect Transistor). The plurality of switches SW1 to SW5 are turned on (conducting) / off (cutting off) according to the drive signal output from the first drive circuit 24 or the second drive circuit 25.

The switches SW1 and SW2 are provided between the first auxiliary power supply 22 and the output terminal T3 in the power supply path 101 connecting the input terminal T1 and the output terminal T3. That is, the power supply path 101 constitutes a part of the first power supply path L1 that connects the main power supply 4 and the load 5. The switches SW1 and SW2 are connected in series with each other in the power supply path 101. The source of the switch SW1 is connected to the first auxiliary power supply 22, and the drain of the switch SW1 is connected to the drain of the switch SW2. The source of the switch SW2 is connected to the output terminal T3. The gates of the switches SW1 and SW2 are both connected to the first drive circuit 24. By turning on the switches SW1 and SW2 together in response to the drive signal of the first drive circuit 24, the electric power stored in the first auxiliary power supply 22 can be supplied to the brake system 5 via the switches SW1 and SW2.

The switches SW3 and SW4 are provided in the power supply path 102 connecting the input terminal T2 and the output terminal T3. That is, the power supply path 102 constitutes a part of the second power supply path L2 that connects the second auxiliary power supply 3 and the load 5. The switches SW3 and SW4 are connected in series with each other in the power supply path 102. The source of the switch SW4 is connected to the input terminal T2, and the drain of the switch SW4 is connected to the drain of the switch SW3. Further, the source of the switch SW3 is connected to the output terminal T3. Then, by turning on the switches SW3 and SW4 together, the electric power stored in the second auxiliary power supply 3 can be supplied to the brake system 5 via the switches SW3 and SW4.

Here, the backup power supply system 1 according to the present embodiment is configured to supply power to the brake system 5 from one of the auxiliary power supplies of the first auxiliary power supply 22 and the second auxiliary power supply 3. Therefore, when the switches SW1 and SW2 are turned on so that power can be supplied from the first auxiliary power source 22 to the brake system 5, the switches SW3 and SW4 are turned off to stop the power supply from the second auxiliary power source 3. Further, when the switches SW3 and SW4 are turned on so that power can be supplied from the second auxiliary power supply 3 to the brake system 5, the switches SW1 and SW2 are turned off to stop the power supply from the first auxiliary power supply 22.

In the backup power supply system 1 according to the present embodiment, the switches SW1 and SW2 constitute the first switch circuit 26, and the switches SW3 and SW4 constitute the second switch circuit 27. That is, the backup power supply system 1 according to the present embodiment includes a first switch circuit 26 that conducts and cuts off the first power supply path L1 and a second switch circuit 27 that conducts and cuts off the second power supply path L2. ..

The switch SW5 is provided between the input terminal T1 and the first auxiliary power supply 22 in the power supply path 101 connecting the input terminal T1 and the output terminal T3. The source of the switch SW5 is connected to the input terminal T1 via the diode D1, and the drain of the switch SW5 is connected to the first auxiliary power supply 22. When the ignition switch 8 is turned on and the operating voltage is supplied from the power supply circuit 23 to the control circuit 21, the control circuit 21 turns on the switch SW5. In the backup power supply system 1 of the present embodiment, when the ignition switch 8 is turned on and the switch SW5 is turned on, the first auxiliary power supply 22 is charged by the power supplied from the main power supply 4.

(2.7) Comparison circuit The comparison circuit 28 compares the voltage dividing voltage V1 obtained by dividing the DC voltage of the feeding path 101 by the voltage dividing circuit 30 with the reference voltage Vref, and the first drive circuit 24 according to the comparison result. By controlling the above, the on (conduction) / off (disconnection) of the switches SW1 and SW2 is controlled. As a result, when the main power supply 4 fails, power can be supplied from the first auxiliary power supply 22 to the load 5 under the control of the comparison circuit 28 (that is, in terms of hardware). The comparison circuit 28 monitors the failure and restoration of the main power supply 4 by comparing the voltage dividing voltage V1 and the reference voltage Vref. Since the switches SW1 and SW2 constitute the first switch circuit 26, the first switch circuit 26 is controlled according to the control of the comparison circuit 28 (in other words, according to the failure and / or restoration of the main power supply 4). To.

More specifically, when the voltage dividing voltage V1 is equal to or higher than the reference voltage Vref, the comparison circuit 28 determines that the main power supply 4 has not failed, and transmits the H level signal to the first drive circuit 24. By outputting to, both switches SW1 and SW2 are turned on. Further, when the voltage dividing voltage V1 is less than the reference voltage Vref, the comparison circuit 28 determines that the main power supply 4 has failed and outputs the L level signal to the first drive circuit 24. Turn off both switches SW1 and SW2 with.

The comparison circuit 28 has a first input unit (that is, an input unit on the + side), a second input unit (that is, an input unit on the − side), and an output unit. The reference voltage Vref is input to the first input unit. The second input unit is connected to the branch point N1 of the power supply path 101 via the voltage dividing circuit 30. The branch point N1 is located between the first auxiliary power supply 22 and the first switch circuit 26 in the power supply path 101. The voltage dividing circuit 30 has two electric resistance components R1 and R2. The two electrical resistance components R1 and R2 are connected side by side in series between the branch point N1 and the grounding point. The second input portion of the comparison circuit 28 is connected between the two electric resistance components R1 and R2. The output unit of the comparison circuit 28 is connected to the first drive circuit 24, and outputs the above-mentioned H level signal and L level signal.

(2.8) Forced circuit The forced circuit 29 forcibly turns on (conducts) / turns off (conducts) switches SW1 and SW2 via the first drive circuit 24 according to the control from the control circuit 21 (that is, in terms of software). Shut off). As a result, when the switches SW1 and SW2 and the switches SW3 and SW4 are both turned on, the switches SW1 and SW2 are forcibly turned off by the forced circuit 29, so that the switches SW1 and SW2 and the switches SW3 and SW4 become Can be avoided from being turned on together. As a result, it is possible to suppress the flow of a through current between the first auxiliary power supply 22 and the second auxiliary power supply 3 via the switches SW1 to SW4. The above "forced" means that when the control of the first drive circuit 24 by the comparison circuit 28 and the control of the first drive circuit 24 by the forced circuit 29 overlap, the first drive circuit 24 by the forced circuit 29 is used. It means that the control of is prioritized.

For example, when the control circuit 21 turns on the switches SW3 and SW4 in order to supply the electric power from the second auxiliary power source 3 to the load 5 at the request from the vehicle side (for example, the ECU 7), the control circuit 21 fails in the main power source 4. Is assumed. In this case, if there is no compulsory circuit 29, the control circuit 21 turns on the SW3 and SW4 at the request from the vehicle side, and further, by the comparison circuit 28 that detects the failure of the main power supply 4 (that is, in terms of hardware). ) Switches SW1 and SW2 are turned on. That is, the switches SW1 to SW4 are both turned on. However, in the present embodiment, since the compulsory circuit 29 is provided, when the switches SW1 to SW4 are both turned on as in the above case, the compulsory circuit 29 forcibly turns off the switches SW1 and SW2. As a result, it is suppressed that the switches SW1 and SW2 and the switches SW3 and SW4 are both turned on.

(2.9) Control circuit The control circuit 21 is composed of, for example, a microcomputer having a processor and a memory. That is, the control circuit 21 is realized in a computer system having a processor and a memory. Then, when the processor executes an appropriate program, the computer system functions as the control circuit 21. The program may be pre-recorded in a memory, may be recorded through a telecommunication line such as the Internet, or may be recorded and provided on a non-temporary recording medium such as a memory card.

The control circuit 21 controls the first drive circuit 24, the second drive circuit 25, the latch circuit 31, and the compulsory circuit 29. By this control, the control circuit 21 controls the switches SW1 to SW5.

More specifically, the control circuit 21 controls on / off of the switches SW3 and SW4 via the second drive circuit 25 according to a signal from the vehicle side (for example, ECU 7). The ECU 7 is an example of an “external device”. At that time, when the control circuit 21 controls the switches SW3 and SW4 to be ON via the second drive circuit 25, the control circuit 21 first controls the first drive circuit 24 via the forced circuit 29 to switch the switches SW1 and SW2. Forcibly turn off. After that, the control circuit 21 turns on the switches SW3 and SW4 via the second drive circuit 25. As a result, it is possible to suppress the occurrence of a period in which the switches SW1 to SW4 are turned on at the same time. As a result, it is possible to suppress the generation of a through current between the first auxiliary power supply 22 and the second auxiliary power supply 3.

Further, in the control circuit 21, when the switches SW3 and SW4 should be controlled to be turned off via the second drive circuit 25, the main power supply 4 has a failure and the first auxiliary power supply 22 is sufficiently. When it is not charged, the switches SW1 and SW2 are forcibly turned off by the control of the first drive circuit 24 by the forced circuit 29, and the switches SW3 and SW4 are turned on via the second drive circuit 25. Continue control. As a result, electric power can be supplied from the second auxiliary power source 3 to the load 5, and it is possible to prevent the electric power from being supplied to the load 5.

Then, when the failure of the main power supply 4 is restored or the first auxiliary power supply 22 is sufficiently charged, the control circuit 21 controls the switches SW3 and SW4 to be turned off via the second drive circuit 25, and then controls the switches SW3 and SW4 to off. , The forced control of the first drive circuit 24 by the forced circuit 29 is released.

Further, the control circuit 21 turns off the switches SW3 and SW4 via the second drive circuit 25 when the main power supply 4 has not failed or the first auxiliary power supply 22 is sufficiently charged. .. After that, the control circuit 21 releases the forced control of the first drive circuit 24 by the forced circuit 29.

The control circuit 21 monitors the output voltage of the main power supply 4 and the output voltage of the first auxiliary power supply 22. As a result, the control circuit 21 monitors whether or not the main power supply 4 has failed and whether or not the first auxiliary power supply 22 is sufficiently charged. The fact that the first auxiliary power supply 22 is sufficiently charged means that the charging voltage (output voltage) of the first auxiliary power supply 22 is equal to or higher than a predetermined charging voltage.

Further, the control circuit 21 has a diagnostic unit 211 for diagnosing a failure of the second switch circuit 27. The diagnosis unit 211 diagnoses the failure of the second switch circuit 27 by using the output voltage of the second auxiliary power supply 3. The diagnosis unit 211 diagnoses the failure of the second switch circuit 27 during the power supply period in which the power can be supplied from the second auxiliary power supply 3 to the load 5. The diagnosis unit 211 is configured to diagnose a failure of the second switch circuit 27 when the output voltage of the second auxiliary power supply 3 exceeds a predetermined determination threshold value during the power supply period. Here, the determination threshold value is a threshold value for diagnosing the presence or absence of an open failure of the first switching element and the second switching element.

The above power supply period is preferably a fixed period. Since the power supply period is a fixed period, it is possible to limit the power supply period during which the diagnosis unit 211 can supply power from the second auxiliary power source 3 in order to perform a failure diagnosis. As a result, waste of the second auxiliary power supply 3 can be suppressed.

In the present embodiment, the diagnosis unit 211 diagnoses the presence or absence of a failure (for example, an open failure and a short failure) of the switches SW3 and SW4 in the failure diagnosis of the second switch circuit 27.

The diagnosis unit 211 diagnoses the open failure of the switch SW3 as follows. When the output voltage of the second auxiliary power supply 3 exceeds the determination threshold value during the power supply period of the second auxiliary power supply 3, the diagnostic unit 211 turns off the switch SW4 via the second drive circuit 25 and switches SW3. Is controlled to be on. The diagnostic unit 211 detects the voltage of the midpoint P2 of the switches SW3 and SW4 in this control state, and compares the high and low of the voltage of the midpoint P2 with the determination threshold value. The diagnostic unit 211 determines that the switch SW3 is not an open failure when the voltage of the midpoint P2 exceeds the determination threshold, and determines that the switch SW3 is an open failure when the voltage of the midpoint P2 is equal to or less than the determination threshold. judge. In other words, the diagnostic unit 211 is in a state where the control signal for conducting the switch SW3 (first switching element) is input to the switch SW3 and the cutoff signal for blocking the switch SW4 (second switching element) is input to the switch SW4. , The presence or absence of an open failure of the switch SW3 is diagnosed based on the high and low of the voltage of the midpoint P2 of the switches SW3 and SW4 and the determination threshold value. In this way, the diagnostic unit 211 detects the voltage of the midpoint P2 of the switch SW3 and SW4, and compares the high and low of the voltage of the midpoint P2 with the determination threshold to diagnose the presence or absence of an open failure of the switch SW3. be able to.

Further, the diagnosis unit 211 diagnoses the open failure of the switch SW4 as follows. The diagnostic unit 211 controls the switch SW3 to be turned off and the switch SW4 to be turned on via the second drive circuit 25 during the power supply period of the second auxiliary power supply 3. In this control state, the diagnostic unit 211 detects the voltage across the switch SW4, that is, the voltage at the midpoint P1 between the switch SW4 and the second auxiliary power supply 3, and the voltage at the midpoint P2 of the switches SW3 and SW4. .. If the voltages across the switch SW4 (the voltage at the midpoint P1 and the voltage at the midpoint P2) are at the same potential, the diagnostic unit 211 determines that the switch SW4 is not an open failure. If there is a voltage difference between the voltages across the switch SW4, the diagnostic unit 211 determines that the switch SW4 is an open failure.

Further, the diagnosis unit 211 diagnoses a short-circuit failure of the switch SW3 as follows. That is, the diagnostic unit 211 controls the switches SW1 and SW2 to be turned on via the first drive circuit 24 and turns off the switches SW3 and SW4 via the second drive circuit 25 during the power supply enable period of the second auxiliary power supply 3. , Switch SW5 is controlled to be on. In this control state, the diagnostic unit 211 detects the voltage across the switch SW3 (the voltage at the midpoint P3 between the switch SW3 and the output terminal T3 and the voltage at the midpoint P2). As a result of this detection, the diagnostic unit 211 determines that the switch SW3 is not a short-circuit failure when there is a voltage difference between the voltages across the switch SW3, and when the voltages across the switch SW3 are the same voltage, the switch SW3 Is determined to be a short failure.

Further, the diagnosis unit 211 diagnoses a short-circuit failure of the switch SW4 as follows. That is, the diagnostic unit 211 controls the switches SW3 and SW4 to be turned off via the second drive circuit 25 during the power supply enable period of the second auxiliary power supply 3, and in this controlled state, the voltage across the switch SW4 (midpoint P1). (Voltage of and voltage of midpoint P2) is detected. As a result of this detection, the diagnostic unit 211 determines that the switch SW4 is not a short-circuit failure when there is a voltage difference between the voltages across the switch SW4, and when the voltages across the switch SW4 are the same voltage, the switch SW4 Is determined to be a short failure.

In the present embodiment, the second auxiliary power supply 3 is controlled by a device other than the control circuit 21 (for example, the ECU 7 of the vehicle 9). The second auxiliary power supply 3 has a voltage (that is, electric power) for a certain period of time from the time when the control circuit 21 is started (the timing when the ignition switch 8 is turned on) under the control of the ECU 7 for the failure diagnosis of the second switch circuit 27. Is output. The diagnosis unit 211 of the control circuit 21 performs a failure diagnosis of the second switch circuit 27 in accordance with this fixed time. That is, the diagnosis unit 211 performs a failure diagnosis of the second switch circuit 27 at the initial diagnosis timing after the ignition switch 8 is turned on and the main power supply 4 is turned on. As a result, the diagnosis unit 211 can perform a failure diagnosis of the second switch circuit 27 according to the power supply period of the second auxiliary power supply 3.

Further, the control circuit 21 is set at the timing when the second auxiliary power supply 3 switches to a power supply capable state in which the load 5 can be supplied with power based on the signal (signal Sig1) from the external device (for example, the ECU 7 of the vehicle 9). 2 Perform failure diagnosis of the switch circuit 27 (that is, execute the diagnosis mode). Here, the "signal from the external device" is, for example, a signal for causing the vehicle 9 to perform a predetermined automatic driving operation, and specifically, a signal for remotely parking the vehicle 9 (for example, a remote described later). It is a request signal requesting the implementation of parking). When the vehicle 9 is remotely parked, the first auxiliary power source 22 and the first auxiliary power source 22 and the second auxiliary power source 22 can supply power to the load 5 from either the first auxiliary power source 22 or the second auxiliary power source 3 when the main power source 4 fails. 2 It is necessary to make it possible to supply power to the load 5 from any of the auxiliary power sources 3. Therefore, when the vehicle 9 is remotely parked, the diagnosis unit 211 of the backup power supply system 1 performs a failure diagnosis of the second switch circuit 27 before making it possible to supply power from the second auxiliary power supply 3 to the load 5. conduct.

That is, the diagnostic unit 211 of the present embodiment has a second switch in either a fixed period (initial diagnosis timing) from the start of the control circuit 21 or a period based on a signal from an external device thereafter. Failure diagnosis of the circuit 27 is possible. The control circuit 21 monitors the presence or absence of the voltage output (power supply) of the second auxiliary power supply 3, and after confirming that the voltage is output from the second auxiliary power supply 3, the second switch circuit 27 fails. Make a diagnosis.

(2.10) Diode The diode D1 is provided between the input terminal T1 and the switch SW5 in the feeding path 101 connecting the input terminal T1 and the output terminal T3. The anode of the diode D1 is connected to the input terminal T1 and the cathode of the diode D1 is connected to the source of the switch SW5.

The diode D2 is provided between the first auxiliary power supply 22 and the power supply circuit 23. The anode of the diode D2 is connected to the first auxiliary power supply 22, and the cathode of the diode D2 is connected to the power supply circuit 23.

The diode D3 is provided between the connection point of the diode D1 and the switch SW5 and the power supply circuit 23. The anode of the diode D3 is connected to the connection point of the diode D1 and the switch SW5, and the cathode of the diode D3 is connected to the power supply circuit 23.

The diode D4 is provided between the input terminal T2 and the power supply circuit 23. The anode of the diode D4 is connected to the input terminal T2, and the cathode of the diode D4 is connected to the power supply circuit 23.

Here, when the output voltage of the main power supply 4 is higher than the output voltages of the first auxiliary power supply 22 and the second auxiliary power supply 3, the diodes D1 and D3 are conductive and the diodes D2 and D4 are non-conducting, so that the main power supply 4 becomes conductive. The output voltage of is input to the power supply circuit 23 via the diodes D1 and D3. Then, the power supply circuit 23 steps down the input output voltage of the main power supply 4 to a predetermined voltage (for example, 5V) and outputs it to the control circuit 21.

Further, when the output voltage of the first auxiliary power supply 22 is higher than the output voltages of the main power supply 4 and the second auxiliary power supply 3, the diode D2 becomes conductive and the diodes D1, D3, D4 become non-conducting, so that the first auxiliary power supply becomes non-conducting. The output voltage of 22 is input to the power supply circuit 23 via the diode D2. Then, the power supply circuit 23 lowers the input output voltage of the first auxiliary power supply 22 to a predetermined voltage (for example, 5V) and outputs it to the control circuit 21.

Further, when the output voltage of the second auxiliary power supply 3 is higher than the output voltages of the main power supply 4 and the first auxiliary power supply 22, the diode D4 conducts and the diodes D1, D2, D3 become non-conducting, so that the second auxiliary power supply becomes non-conducting. The output voltage of 3 is input to the power supply circuit 23 via the diode D4. Then, the power supply circuit 23 lowers the input output voltage of the second auxiliary power supply 3 to a predetermined voltage (for example, 5V) and outputs it to the control circuit 21.

(3) Operation The operation of the backup power supply system 1 will be described below.

(3.1) Basic Operation When the ignition switch 8 is turned on and power is supplied from the main power supply 4 to the backup power supply system 1, charging of the first auxiliary power supply 22 and the second auxiliary power supply 3 is started. When power is supplied from the main power supply 4 to the backup power supply system 1 and the backup power supply system 1 is started, it is assumed that the voltages of the first auxiliary power supply 22 and the second auxiliary power supply 3 are reduced to approximately 0V. do.

When the control circuit 21 of the backup power supply system 1 receives a remote parking execution request from the brake system 5 or the ECU 7 of the vehicle 9 until the charging of the first auxiliary power supply 22 is completed, the control circuit 21 is the first. It is possible to supply electric power to the brake system 5 from the second auxiliary power source 3 which has a smaller capacity and a shorter charging time than the auxiliary power source 22. That is, the control circuit 21 turns off the switches SW1 and SW2 and turns on the switches SW3 and SW4 to conduct the second power supply path L2 connecting the second auxiliary power supply 3 and the brake system 5. Since the control circuit 21 cannot directly control the start of power supply from the second auxiliary power supply 3, when power is supplied from the second auxiliary power supply 3 to the brake system 5, the second power supply is supplied even when the main power supply 4 is not failed. Conducts the path L2. When the main power supply 4 fails, the second auxiliary power supply 3 starts power supply in response to a command from, for example, the brake system 5, and the brake system 5 is started from the second auxiliary power supply 3 via the second power supply path L2. Is supplied with power. In other words, if the charging of the first auxiliary power supply 22 is not completed when the main power supply 4 fails, the load (brake system 5) is supplied with power from the second auxiliary power supply 3 via the second power supply path L2. As described above, the second auxiliary power supply 3 actually supplies power to the brake system 5 when the main power supply 4 fails.

When the charging of the first auxiliary power supply 22 is completed without the failure of the main power supply 4, the control circuit 21 turns off the switches SW1 to SW4 and monitors the failure of the main power supply 4. The control circuit 21 keeps the switches SW1 to SW4 off even when the remote parking execution request is received from the brake system 5 or the ECU 7 of the vehicle 9. Then, when the control circuit 21 detects the failure of the main power supply 4, the switches SW1 and SW2 are turned on to conduct the first power supply path L1 connecting the first auxiliary power supply 22 and the brake system 5, and the first. Power is supplied to the brake system 5 from the auxiliary power supply 22.

(3.2) Failure diagnosis operation As described above, the backup power supply system 1 supplies electric power to the brake system 5 when the main power supply 4 fails when the vehicle 9 performs remote parking. In order to confirm whether the switches SW1 to SW4 operate normally, the failure diagnosis of the switches SW1 to SW4 is performed once while the vehicle 9 operates once.

Hereinafter, the failure diagnosis operation performed by the backup power supply system 1 will be described with reference to FIGS. 3 to 6.

FIG. 4 is a flowchart showing an operation when the second auxiliary power source 3 is controlled to be able to supply power to the load 5 only when the vehicle 9 performs remote parking. Further, in FIG. 3, "F1" is a flag indicating the charging state of the first auxiliary power supply 22. If the value of the flag F1 is Lo, it indicates that the charging of the first auxiliary power supply 22 is not completed, and if the value of the flag F1 is Hi, it indicates that the charging of the first auxiliary power supply 22 is completed. “Sig2” is, for example, a remote parking execution signal input from the brake system 5 to the control circuit 21. If the value of the remote parking execution signal Sig2 is Lo, the remote parking is not instructed, and if the value of the remote parking execution signal Sig2 is Hi, the remote parking is instructed. "SBIN" is a flag indicating the output state of the second auxiliary power supply 3. The period in which the value of the flag SBIN is Hi is a period in which a voltage exceeding the determination threshold value is input from the second auxiliary power supply 3. “Bout” is a flag indicating the output state of the voltage from the backup power supply system 1 to the load 5. The period in which the value of the flag Bout is Hi is the period in which the voltage is output from the backup power supply system 1 to the load 5.

When the ignition switch 8 is turned on at the time point t1, power is supplied from the main power supply 4 to the backup power supply system 1 and the control circuit 21 is activated (step S1). When the backup power supply system 1 is started, it is assumed that the voltages of the first auxiliary power supply 22 and the second auxiliary power supply 3 are reduced to approximately 0V. When power is supplied from the main power supply 4 to the second auxiliary power supply 3, the DC / DC converter 33 of the second auxiliary power supply 3 starts charging the smoothing capacitor 32. When the backup power supply system 1 is started, the control circuit 21 turns off the switch SW5, and at this point, charging of the first auxiliary power supply 22 is not started.

When the control circuit 21 communicates with the ECU of the brake system 5 and receives permission from the ECU of the brake system 5 to execute the short failure diagnosis of the switches SW2 and SW3, the diagnosis unit 211 performs the short failure diagnosis of the switches SW2 and SW3. Execute (step S2).

The diagnostic unit 211 controls the switch SW2 to be turned off during the period from the time points t2 to t3, and diagnoses whether or not a short-circuit failure has occurred in the switch SW2 based on the voltage of the midpoint P4 of the switches SW1 and SW2. Since the voltage is applied to the output terminal T3 from the main power supply 4, the diagnostic unit 211 determines that the switch SW has not failed if the voltage at the midpoint P4 is lower than the determination threshold value. The determination threshold is set to a voltage lower than the voltage of the main power supply 4 and lower than the voltages of the first auxiliary power supply 22 and the second auxiliary power supply 3 at the time of charging completion.

Further, the diagnostic unit 211 controls the switch SW3 to be off during the period from the time point t3 to t4, and diagnoses whether or not a short-circuit failure has occurred in the switch SW3 based on the voltage of the midpoint P2 of the switches SW3 and SW4. do. If the voltage at the midpoint P2 is lower than the determination threshold value, the diagnostic unit 211 determines that a short-circuit failure has not occurred in the switch SW.

If a short failure has occurred in the short failure diagnosis in step S2 (step S3: No), the control circuit 21 has detected an abnormality in the switches SW2 and SW3, and therefore terminates abnormally (step S14). When abnormally terminated, the control circuit 21 stores a flag indicating a short-circuit failure of the switches SW2 and SW3 in the memory. The control circuit 21 supplies power to the brake system 5 even when the remote parking execution signal Sig2 is input from the brake system 5 while the flag indicating the short-circuit failure of the switches SW2 and SW3 is stored in the memory. Instead, the vehicle 9 stops the implementation of remote parking.

If no short failure has occurred in the short failure diagnosis in step S2 (step S3: Yes), the control circuit 21 turns on the switch SW5 via the second drive circuit 25 at the time point t5, and the first auxiliary power supply 22 Start charging. Then, the control circuit 21 determines whether or not the remote parking execution signal Sig2 input from the brake system 5 is Hi (step S4).

After that, when the remote parking execution signal Sig2 for executing the remote parking becomes Hi at the time point t6 (step S4: Yes), the diagnostic unit 211 determines whether or not the value of the flag SBIN is Hi, that is, the second auxiliary power supply 3. It is determined whether or not a voltage exceeding the determination threshold is input from (step S5).

When the remote parking execution signal Sig2 becomes Hi at the time point t6, the control unit 34 of the second auxiliary power source 3 turns on the switch SW6 so that the brake system 5 can be supplied with power, and the value of the flag SBIN is the time point. It switches from Lo to Hi at t6. Therefore, the diagnosis unit 211 determines in step S5 that the value of the flag SBIN is Hi (step S5: Yes), and diagnoses the failure of the switches SW3 and SW4. Here, the diagnosis unit 211 performs a failure diagnosis of the open failure of the switch SW3 and a failure diagnosis of the open failure and the short failure of the switch SW4 (step S6). In the present embodiment, at the timing when the vehicle 9 performs a predetermined automatic driving operation (for example, remote parking), the diagnostic unit 211 performs the switches SW3 and SW4 (for example, before the second switch circuit 27 conducts the second power supply path L2. Diagnose the presence or absence of open failure of the first switching element and the second switching element).

The diagnosis unit 211 controls the switch SW3 to be on and the switch SW4 to be off during the period from the time point t7 to the time point t8, and diagnoses the presence or absence of an open failure of the switch SW3. At this time, the diagnostic unit 211 determines that the open failure of the switch SW3 has not occurred if the voltage of the midpoint P2 is equal to or higher than the determination threshold, and if the voltage of the midpoint P2 is lower than the determination threshold, the switch SW3 Judge that an open failure has occurred.

Further, the diagnostic unit 211 controls both the switches SW3 and SW4 to be turned off during the period from the time point t8 to the time point t9, and determines whether or not there is a short-circuit failure of the switch SW4. At this time, a voltage exceeding the determination threshold is applied to the midpoint P1 from the second auxiliary power supply 3. Therefore, the diagnostic unit 211 determines that the short circuit failure of the switch SW4 has not occurred if the voltage of the midpoint P2 is lower than the determination threshold value, and if the voltage of the midpoint P2 is equal to or higher than the determination threshold value, the switch SW4 Judge that a short-circuit failure has occurred.

Further, the diagnostic unit 211 controls the switch SW3 to be turned off and the switch SW4 to be turned on during the period from the time point t9 to the time point t10, and determines whether or not the switch SW4 has an open failure. At this time, the diagnostic unit 211 determines that the open failure of the switch SW4 has not occurred if the voltage of the midpoint P2 is equal to or higher than the determination threshold value, and if the voltage of the midpoint P2 is lower than the determination threshold value, the switch SW4 Judge that an open failure has occurred.

When it is diagnosed that there is an abnormality in the switch SW3 or SW4 in the failure diagnosis in step S6 (step S7: No), the diagnosis unit 211 ends abnormally (step S14). When abnormally terminated, the control circuit 21 stores in the memory a flag indicating that there is an abnormality in the switch SW3 or SW4. The control circuit 21 supplies power to the brake system 5 even when the remote parking execution signal Sig2 is input from the brake system 5 while the flag indicating that there is an abnormality in the switch SW3 or SW4 is stored in the memory. Without doing so, the vehicle 9 stops the implementation of remote parking.

When the switches SW3 and SW4 are diagnosed as normal in the failure diagnosis in step S6 (step S7: Yes), the control unit 21 turns on both the switches SW3 and SW4 at the time point t11, and the second auxiliary power supply 3 The brake system 5 can be supplied with power.

For example, when the vehicle 9 is automatically discharged from the parking lot by remote parking, it is necessary to secure a power source for operating the brake system 5. That is, in case the main power supply 4 fails, the backup power supply system 1 switches to a state in which power can be supplied to the brake system 5, but the charging of the first auxiliary power supply 22 is completed immediately after the main power supply 4 is started. Therefore, the brake system 5 can be supplied with power from the second auxiliary power supply 3. Then, when the second auxiliary power source 3 can supply power to the brake system 5, the ECU 7 of the vehicle 9 causes the vehicle 9 to perform remote parking (step S8).

When the remote parking execution signal Sig2 input from the brake system 5 at the time point t12 becomes Lo, that is, when the remote parking is completed (step S9: Yes), the control unit 21 turns off the switches SW3 and SW4 to provide the second auxiliary. Switch to the state where the power supply from the power supply 3 is stopped. Then, the diagnostic unit 211 determines whether or not the voltage V22 of the first auxiliary power supply 22 is equal to or higher than a predetermined threshold value (for example, 8V) (step S10).

After that, when the voltage V22 of the first auxiliary power supply 22 becomes equal to or higher than the threshold value (step S10: Yes), the diagnosis unit 211 performs a failure diagnosis of the switches SW1 and SW2. Here, the diagnosis unit 211 performs a failure diagnosis of an open failure and a short failure of the switch SW1 and a failure diagnosis of an open failure of the switch SW2 (step S11).

The diagnosis unit 211 controls the switch SW1 to be turned off and the switch SW2 to be turned on during the period from the time point t13 to the time point t14, and diagnoses the presence or absence of an open failure of the switch SW2. At this time, if the voltage of the midpoint P4 of the switches SW1 and SW2 is equal to or higher than the determination threshold value, the diagnostic unit 211 determines that the open failure of the switch SW2 has not occurred, and the voltage of the midpoint P4 is higher than the determination threshold value. If it is low, it is determined that an open failure of the switch SW2 has occurred.

Further, the diagnostic unit 211 controls both the switches SW1 and SW2 to be turned off during the period from the time point t14 to the time point t15, and determines whether or not there is a short-circuit failure of the switch SW1. At this time, the diagnostic unit 211 determines that a short-circuit failure of the switch SW1 has not occurred if the voltage of the midpoint P4 is lower than the determination threshold value, and if the voltage of the midpoint P4 is equal to or higher than the determination threshold value, the switch SW1 Judge that a short-circuit failure has occurred.

Further, the diagnostic unit 211 controls the switch SW2 to be turned off and the switch SW1 to be turned on during the period from the time point t15 to the time point t16, and determines whether or not the switch SW1 has an open failure. At this time, the diagnostic unit 211 determines that the open failure of the switch SW1 has not occurred if the voltage of the midpoint P4 is equal to or higher than the determination threshold value, and if the voltage of the midpoint P4 is lower than the determination threshold value, the switch SW1 Judge that an open failure has occurred.

As described above, the failure diagnosis of the switches SW1 and SW2 is performed. However, when it is diagnosed that there is an abnormality in the switch SW1 or SW2 in the failure diagnosis in step S11 (step S12: No), the diagnosis unit 211 is performed. Abnormal termination (step S15). When abnormally terminated, the control circuit 21 stores a flag indicating that there is an abnormality in the switch SW1 or SW2 in the memory. The control circuit 21 supplies power to the brake system 5 even when the remote parking execution signal Sig2 is input from the brake system 5 while the flag indicating that the switch SW1 or SW2 has an abnormality is stored in the memory. Do not do.

Further, in the failure diagnosis in step S11, when the switches SW1 and SW2 are diagnosed as normal (step S12: Yes), the diagnosis unit 211 normally ends the diagnosis process (step S13).

At the subsequent time point t17, when the charging voltage of the first auxiliary power supply 22 reaches a predetermined threshold value and charging is completed, the backup power supply system 1 changes from the first auxiliary power supply 22 to the brake system 5 during the subsequent remote parking. It will be in a state of supplying power. Even after the charging voltage of the first auxiliary power supply 22 reaches a predetermined threshold value, the control unit 21 keeps the switch SW5 on, and the charging of the first auxiliary power supply 22 is continued.

In the operation shown in the flowchart of FIG. 4, if the voltage exceeding the determination threshold value is not supplied from the second auxiliary power supply 3 in step S5, the failure diagnosis of the switches SW3 and SW4 in step S6 is not executed. In this case, when the remote parking is executed in step S8, the diagnosis unit 211 executes the failure diagnosis of the switches SW3 and SW4. The failure diagnosis operation at this time will be described with reference to the flowchart of FIG.

When the remote parking execution signal Sig2 input from the brake system 5 to the control circuit 21 becomes Hi (step S21) in a state where the failure diagnosis of the switches SW3 and SW4 has not been performed, the value of the flag SBIN of the diagnosis unit 211 is Hi. It is determined whether or not it is (step S22).

If the value of the flag SBIN is Hi, that is, a voltage exceeding the determination threshold value is input from the second auxiliary power supply 3 (step S22: Yes), the diagnosis unit 211 performs failure diagnosis of the switches SW3 and SW4. Here, the diagnosis unit 211 performs a failure diagnosis of the open failure of the switch SW3 and a failure diagnosis of the open failure and the short failure of the switch SW4 (step S23). Since the failure diagnosis of the open failure of the switch SW3 and the failure diagnosis of the open failure and the short failure of the switch SW4 are the same as the process of step S6, the description thereof will be omitted.

When it is diagnosed that there is an abnormality in the switch SW3 or SW4 in the failure diagnosis in step S23 (step S24: No), the diagnosis unit 211 ends abnormally (step S26). When abnormally terminated, the control circuit 21 stores a flag indicating that there is an abnormality in the switch SW3 or SW4 in the memory. The control circuit 21 does not supply power to the brake system 5 while the flag indicating that there is an abnormality in the switch SW3 or SW4 is stored in the memory, and the vehicle 9 stops the remote parking.

When the switches SW3 and SW4 are diagnosed as normal in the failure diagnosis in step S24 (step S24: Yes), the control unit 21 turns on both the switches SW3 and SW4 and brakes the brake system from the second auxiliary power supply 3. 5 is in a state where power can be supplied. When the second auxiliary power supply 3 of the backup power supply system 1 becomes capable of supplying power, the ECU 7 of the vehicle 9 causes remote parking to be performed (step S25).

When it is determined in step S22 that a voltage exceeding the determination threshold value has not been input from the second auxiliary power supply 3 (step S22; No), the diagnostic unit 211 does not perform failure diagnosis of the switches SW3 and SW4. , Abnormal termination (S26).

Further, in the backup power supply system 1 of the present embodiment, it is diagnosed whether or not there is a short circuit in which the second power supply path L2 of the power supply paths between the first auxiliary power supply 22 and the second auxiliary power supply 3 is short-circuited. The diagnostic operation will be described with reference to FIG.

While the backup power supply system 1 is executing steady processing (step S51), the control circuit 21 is instructed by the brake system 5 to execute remote parking, in other words, the remote parking execution signal Sig2 from the brake system 5 is OFF. It is determined whether or not it is (step S52).

If the remote parking execution signal Sig2 is ON (step S52: No), the diagnostic unit 211 has a first timer and a second timer for determining that there is no short-circuit abnormality in the second power supply path L2, that is, it is normal. After clearing the counters of the second timers for determining that there is a short circuit abnormality in the power supply path L2 (step S58), the process returns to step S52.

If the remote parking execution signal Sig2 is OFF, the diagnostic unit 211 determines whether the value of the flag SBIN indicating the output state of the second auxiliary power supply 3 is Hi or Lo (step S53).

If the value of the flag SBIN is Hi in step S53 (step S53: Yes), the diagnostic unit 211 diagnoses whether or not there is a short circuit between the input terminal T2 and the output terminal T3 (step S54). The diagnostic unit 211 controls the switches SW3 and SW4 to be turned off. Here, if the switches SW3 and SW4 are normally turned off, the second auxiliary power supply 3 does not apply a voltage to the input terminal T2 (midpoint P1) which is a connection point, so that the voltage at the midpoint P1 is It becomes lower than the judgment threshold. On the other hand, when a short-circuit failure occurs in the switches SW3 and SW4, the voltage from the main power supply 4 is input to the midpoint P1, so that the voltage at the midpoint P1 becomes equal to or higher than the determination threshold value. Therefore, the diagnostic unit 211 is in a short state between the input terminal T2 and the output terminal T3 based on the voltage of the midpoint P1 (input terminal T2 which is the connection point) in the state where the switches SW3 and SW4 are controlled to be off. Can be diagnosed as to whether or not is occurring.

When the diagnosis in step S54 is completed, the diagnosis unit 211 determines whether or not the second timer has finished counting for a certain period of time in the short state after clearing the counter of the first timer (step S55) (step S56). ). Here, if it is diagnosed in step S54 that the short state is not performed, or if the short state does not continue for a certain period of time (step S56: No), the diagnosis unit 211 returns to step S52.

On the other hand, when the second timer finishes counting for a certain period of time in the short state in step S54 (step S56: Yes), the diagnostic unit 211 determines that a short-circuit abnormality has occurred between the input terminal T2 and the output terminal T3. (Step S57). In this case, even if the remote parking execution signal Sig2 is input to the control circuit 21 from the brake system 5, the control circuit 21 does not supply power to the brake system 5 from the first auxiliary power supply 22 and the second auxiliary power supply 3, so that the remote is remote. Parking is not performed.

If the value of the flag SBIN is Lo in step S53 (step S53: No), has the diagnostic unit 211 counted up for a certain period of time after clearing the counter of the second timer (step S59)? It is determined whether or not (step S60). Here, if the first timer has not completed the count-up for a certain period of time (step S61: No), the process returns to the process of step S52. When the first timer finishes counting up for a certain period of time (step S61: Yes), the diagnostic unit 211 determines that a short circuit error between the input terminal T2 and the output terminal T3 has not occurred and is normal. End the process.

As described above, in the diagnostic unit 211, the connection point (input terminal T2) is in a state where the main power supply 4 has not failed and the second auxiliary power supply 3 has not applied a voltage to the connection point T2 (second state). ), The presence or absence of a short circuit failure of the second switch circuit 27 is diagnosed. Since the diagnosis unit 211 diagnoses the presence or absence of a short-circuit failure in the second switch circuit 27, the control circuit 21 confirms that a short-circuit failure has not occurred in the second switch circuit 27, and then the first auxiliary power supply 22. Can supply power to the load (brake system 5) via the first power supply path L1. Therefore, when the switches SW1 and SW2 are turned on to supply power from the first auxiliary power supply 22, it is possible to suppress the flow of a through current between the first auxiliary power supply 22 and the second auxiliary power supply 3.

(4) Modifications The above embodiment is only one of the various embodiments of the present disclosure. The above-described embodiment can be variously modified depending on the design and the like as long as the object of the present disclosure can be achieved.

(4.1) Modification 1
In the backup power supply system 1 of the first modification, the second auxiliary power supply 3 applies a voltage to the input terminal T2 which is a connection point in a predetermined period after the main power supply 4 is turned on. Then, the diagnostic unit 211 diagnoses the presence or absence of an open failure of the first switching element (switch SW3) and the second switching element (switch SW4) during this predetermined period, and in this respect, the first modification and the above-described embodiment. Is different. Since the configuration of the backup power supply system 1 according to the first modification is the same as that of the above embodiment, the common components are designated by the same reference numerals and the description thereof will be omitted.

The operation of the backup power supply system 1 of the first modification will be described with reference to the flowchart of FIG.

Since the operations of steps S31 to S33 in FIG. 7 are the same as the operations of steps S1 to S3 of FIG. 4, the description thereof will be omitted.

If a short failure has occurred in the short failure diagnosis in step S32 (step S33: No), the control circuit 21 has detected an abnormality in the switches SW2 and SW3, so that the control circuit 21 terminates abnormally (step S41).

If a short failure has not occurred in the short failure diagnosis in step S32 (step S33: Yes), the control circuit 21 turns on the switch SW5 via the second drive circuit 25 to charge the first auxiliary power supply 22. Let's get started. Then, the diagnostic unit 211 determines whether or not the value of the flag SBIN is Hi, that is, whether or not a voltage exceeding the determination threshold value is input from the second auxiliary power supply 3 (step S34).

If the value of the flag SBIN is Hi in step S34 (step S34: Yes), the diagnostic unit 211 performs failure diagnosis of the switches SW3 and SW4. Here, the diagnosis unit 211 performs a failure diagnosis of the open failure of the switch SW3 and a failure diagnosis of the open failure and the short failure of the switch SW4 (step S35).

When the switches SW3 and SW4 are diagnosed as normal in the failure diagnosis in step S35 (step S36: Yes), the diagnosis unit 211 determines that the voltage V22 of the first auxiliary power supply 22 is equal to or higher than a predetermined threshold value (for example, 8V). It is determined whether or not there is (step S37).

If the value of the flag SBIN is Lo in step S34 (step S34: No), the diagnostic unit 211 does not perform failure diagnosis of the switches SW3 and SW4, and proceeds to the process of step S37. That is, if the voltage applied from the second auxiliary power supply 3 to the connection point (input terminal T2) is equal to or less than the determination threshold value in the predetermined period after the main power supply 4 is turned on, the diagnostic unit 211 has the switches SW3 and SW4. The presence or absence of open failure of (first switching element and second switching element) is not diagnosed. As a result, it is possible to diagnose the presence or absence of an open failure of the switches SW3 and SW4 in a state where a voltage exceeding the determination threshold value is applied from the second auxiliary power supply 3 to the connection point (input terminal T2), and the presence or absence of an open failure. The possibility of misdiagnosis can be reduced.

When the first auxiliary power supply 22 is charged and the voltage V22 of the first auxiliary power supply 22 becomes equal to or higher than the threshold value (step S37: Yes), the diagnosis unit 211 performs a failure diagnosis of the switches SW1 and SW2. Here, the diagnosis unit 211 performs a failure diagnosis of an open failure and a short failure of the switch SW1 and a failure diagnosis of an open failure of the switch SW2 (step S38).

When it is diagnosed that there is an abnormality in the switch SW1 or SW2 in the failure diagnosis in step S38 (step S39: No), the diagnosis unit 211 ends abnormally (step S42).

When the switches SW1 and SW2 are diagnosed as normal in the failure diagnosis in step S38 (step S39: Yes), the diagnosis unit 211 normally ends the diagnosis process (step S40).

As described above, in the backup power supply system 1 of the modification 1, it is possible to diagnose the presence or absence of an open failure of the switches SW3 and SW4 within a predetermined period (initial diagnosis timing) after the main power supply 4 is turned on.

In the first modification, when the diagnosis of the open failure of the switches SW3 and SW4 is not performed in the predetermined period after the main power supply 4 is turned on, the switch is switched at the timing when the vehicle 9 performs remote parking as in the above embodiment. Diagnosis of open failure of SW3 and SW4 is performed. That is, at the timing of performing a predetermined automatic operation operation (for example, remote parking), before the second switch circuit 27 conducts the second power supply path L2, the diagnostic unit 211 performs the switches SW3 and SW4 (the first switching element and the first switching element and the first). 2 Diagnose the presence or absence of open failure of the switching element). As a result, the diagnosis unit 211 can diagnose the presence or absence of an open failure of the switches SW3 and SW4 before starting the automatic driving operation (for example, remote parking).

(4.2) Other Modifications The same function as the backup power supply system 1 according to the above-described embodiment is performed by a failure diagnosis method of the backup power supply system 1, a computer program, a non-temporary recording medium on which the computer program is recorded, or the like. It may be embodied.

The failure diagnosis method of the backup power supply system 1 according to one aspect is a failure diagnosis method of the backup power supply system 1 provided with a first auxiliary power supply 22 capable of supplying power to the load 5 when the main power supply 4 fails. The failure diagnosis method includes a first switching step, a second switching step, and a diagnosis step. In the first switching step, the first power supply path L1 connecting the first auxiliary power supply 22 and the load 5 is conducted and cut off by the first switch circuit 26. In the second switching step, the second switch circuit 27 conducts and cuts off the second power supply path L2 connecting the second auxiliary power supply 3 and the load 5. The second auxiliary power source 3 is a power source having a smaller capacity than the first auxiliary power source 22 for supplying electric power to the load 5 when the main power source 4 fails. In the diagnosis step, the presence or absence of failure of the second switch circuit 27 is diagnosed. In the diagnostic step, the second switch circuit 27 is in a state where a voltage exceeding the determination threshold value is applied from the second auxiliary power supply 3 to the connection point (input terminal T2) between the second switch circuit 27 and the second auxiliary power supply 3. Diagnose the presence or absence of open failure. The determination threshold value is a threshold value for determining the presence or absence of an open failure of the second switch circuit 27.

The program according to one aspect is a program for causing one or more processors to execute the above-mentioned failure diagnosis method of the backup power supply system 1.

The backup power supply system 1 in the present disclosure includes, for example, a computer system in a control circuit 21 or the like. The computer system mainly consists of a processor and a memory as hardware. When the processor executes the program recorded in the memory of the computer system, the function as the backup power supply system 1 in the present disclosure is realized. The program may be pre-recorded in the memory of the computer system, may be provided through a telecommunications line, and may be recorded on a non-temporary recording medium such as a memory card, optical disk, hard disk drive, etc. that can be read by the computer system. May be provided. The processor of a computer system is composed of one or more electronic circuits including a semiconductor integrated circuit (IC) or a large scale integrated circuit (LSI). The integrated circuit such as IC or LSI referred to here has a different name depending on the degree of integration, and includes an integrated circuit called a system LSI, VLSI (Very Large Scale Integration), or ULSI (Ultra Large Scale Integration). Further, an FPGA (Field-Programmable Gate Array) programmed after the LSI is manufactured, or a logical device capable of reconstructing the junction relationship inside the LSI or reconfiguring the circuit partition inside the LSI should also be adopted as a processor. Can be done. A plurality of electronic circuits may be integrated on one chip, or may be distributed on a plurality of chips. The plurality of chips may be integrated in one device, or may be distributed in a plurality of devices. The computer system referred to here includes a microcontroller having one or more processors and one or more memories. Therefore, the microprocessor is also composed of one or a plurality of electronic circuits including a semiconductor integrated circuit or a large-scale integrated circuit.

Further, it is not an essential configuration for the backup power supply system 1 that a plurality of functions in the backup power supply system 1 are integrated in one housing, and the components of the backup power supply system 1 are dispersed in the plurality of housings. It may be provided. In the above embodiment, the backup power supply device 2 and the second auxiliary power supply 3 are provided in separate housings, but the backup power supply device 2 and the second auxiliary power supply 3 are provided in one housing. You may have.

In the above embodiment, the second switch circuit 27 includes a series circuit of the first switching element SW3 and the second switching element SW4, but the second switch circuit 27 is a triac or the like capable of cutting off bidirectional current. It may be composed of the semiconductor switch of the above, or may be configured by the contact of a relay or the like.

In the above embodiment, the first switch circuit 26 is controlled by hardware and the second switch circuit 27 is controlled by software, but the first switch circuit 26 is controlled by software and the second switch. The circuit 27 may be controlled by hardware.

In the comparison of the two values in the above embodiment, the place where "greater than or equal to" may be "greater than or equal to". That is, in the comparison of the two values, whether or not the two values are equal can be arbitrarily changed depending on the setting of the reference value or the like, so there is no technical difference between "greater than or equal to" and "greater than". Similarly, what is "less than" may be "less than or equal to".

(summary)
As described above, the backup power supply system (1) of the first aspect includes the first auxiliary power supply (22), the first switch circuit (26), the second switch circuit (27), and the diagnostic unit (211). ) And. The first auxiliary power source (22) is a power source for supplying electric power to the load (5) when the main power source (4) fails. The first switch circuit (26) conducts and cuts off the first power supply path (L1) connecting the first auxiliary power supply (22) and the load (5). The second switch circuit (27) conducts and cuts off the second power supply path (L2) connecting the second auxiliary power supply (3) and the load (5). The second auxiliary power source (3) is a power source for supplying electric power to the load (5) when the main power source (4) fails, and has a smaller capacity than the first auxiliary power source (22). The diagnosis unit (211) diagnoses the presence or absence of a failure of the second switch circuit (27). At the connection point (T2) between the second switch circuit (27) and the second auxiliary power supply (3), a voltage exceeding the determination threshold value for determining the presence or absence of an open failure of the second switch circuit (27) is the second auxiliary. The diagnostic unit (211) diagnoses the presence or absence of an open failure of the second switch circuit (27) while the voltage is applied from the power supply (3).

According to this aspect, if the voltage applied from the second auxiliary power supply (3) to the connection point (T2) is equal to or less than the determination threshold value, even if an open failure does not occur in the second switch circuit (27), There is a possibility of misdiagnosis as an open failure. Since the diagnostic unit (211) diagnoses the presence or absence of an open failure of the second switch circuit (27) while a voltage exceeding the determination threshold is applied from the second auxiliary power supply (3) to the connection point (T2). It is possible to reduce the possibility of erroneously diagnosing the presence or absence of a failure of the second switch circuit (27) that conducts and cuts off the second power supply path (L2) connecting the second auxiliary power supply (3) and the load (5).

In the backup power supply system (1) of the second aspect, in the first aspect, the second auxiliary power supply (3) applies a voltage to the connection point (T2) in a predetermined period after the main power supply (4) is turned on. Apply. The diagnosis unit (211) diagnoses the presence or absence of an open failure of the second switch circuit (27) in a predetermined period.

According to this aspect, it is possible to diagnose the presence or absence of an open failure of the second switch circuit (27) in a predetermined period after the main power supply (4) is turned on.

In the backup power supply system (1) of the third aspect, in the second aspect, the diagnostic unit (211) determines the voltage applied from the second auxiliary power supply (3) to the connection point (T2) in a predetermined period. If it is equal to or less than the threshold value, the presence or absence of an open failure of the second switch circuit (27) is not diagnosed.

According to this aspect, the possibility of erroneously diagnosing the presence or absence of an open failure of the second switch circuit (27) can be reduced.

In the backup power supply system (1) of the fourth aspect, in the third aspect, the load (5) is mounted on the vehicle (9) capable of automatic driving. If the presence or absence of an open failure has not been diagnosed in a predetermined period, at the timing when the vehicle (9) performs a predetermined automatic driving operation, before the second switch circuit (27) conducts the second power supply path (L2). The diagnosis unit (211) diagnoses the presence or absence of an open failure of the second switch circuit (27).

According to this aspect, it is possible to diagnose the presence or absence of an open failure of the second switch circuit (27) before starting the automatic operation operation.

In the backup power supply system (1) of the fifth aspect, in the first aspect, the load (5) is mounted on the vehicle (9) capable of automatic driving. At the timing when the vehicle (9) performs a predetermined automatic driving operation, the diagnostic unit (211) performs the second switch circuit (27) before the second switch circuit (27) conducts the second power supply path (L2). Diagnose the presence or absence of open failure.

According to this aspect, it is possible to diagnose the presence or absence of an open failure of the second switch circuit (27) before starting the automatic operation operation.

In the backup power supply system (1) of the sixth aspect, in any one of the first to fifth aspects, the second switch circuit (27) is connected in series between the load (5) and the second auxiliary power supply (3). It has a series circuit of a first switching element (SW3) and a second switching element (SW4) connected to. The first switching element (SW3) and the second switching element (SW4) each have a body diode. In the first state, the diagnostic unit (211) of the first switching element (SW3) is based on the height of the voltage at the midpoint of the first switching element (SW3) and the second switching element (SW4) and the determination threshold value. Diagnose the presence or absence of open failure. In the first state, a control signal for conducting the first switching element (SW3) is input to the first switching element (SW3), and a cutoff signal for blocking the second switching element (SW4) is sent to the second switching element (SW4). It is in the entered state.

According to this aspect, the presence or absence of an open failure of the first switching element (SW3) is diagnosed based on the height of the voltage at the midpoint of the first switching element (SW3) and the second switching element (SW4) and the determination threshold value. can do.

In the backup power supply system (1) of the seventh aspect, in any one of the first to sixth aspects, the diagnostic unit (211) is the second switch in the second state based on the voltage of the connection point (T2). Diagnose the presence or absence of a short circuit failure in the circuit (27). The second state is a state in which the main power supply (4) has not failed and the second auxiliary power supply (3) has not applied a voltage to the connection point (T2).

According to this aspect, by diagnosing the presence or absence of a short circuit failure, it is possible to suppress the flow of a through current between the first auxiliary power supply (22) and the second auxiliary power supply (3).

In the backup power supply system (1) of the eighth aspect, in any one of the first to seventh aspects, the first auxiliary power supply (22) and the second auxiliary power supply (3) are supplied from the main power supply (4). It is charged by electric power. If the charging of the first auxiliary power supply (22) is not completed when the main power supply (4) fails, power is supplied from the second auxiliary power supply (3) to the load (5) via the second power supply path (L2). ..

According to this aspect, since the second auxiliary power supply (3) having a smaller capacity can be charged in a shorter time than the first auxiliary power supply (22), the first auxiliary power supply (4) fails when the main power supply (4) fails. Even when the charging of 22) is not completed, the power can be supplied from the second auxiliary power source (3) to the load (5).

In the backup power supply system (1) of the ninth aspect, the second auxiliary power supply (3) is further provided in any one of the first to eighth aspects.

According to this aspect, a backup power supply system (1) including a second auxiliary power supply (3) can be provided.

The failure diagnosis method of the backup power supply system (1) according to the tenth aspect is a backup power supply system including a first auxiliary power supply (22) capable of supplying power to the load (5) when the main power supply (4) fails. The failure diagnosis method includes a first switching step, a second switching step, and a diagnosis step. In the first switching step, the first power supply path (L1) connecting the first auxiliary power supply (22) and the load (5) is conducted and cut off by the first switch circuit (26). In the second switching step, the second power supply path (L2) connecting the second auxiliary power supply (3) and the load (5) is conducted and cut off by the second switch circuit (27). The second auxiliary power source (3) is a power source for supplying electric power to the load (5) when the main power source (4) fails, and has a smaller capacity than the first auxiliary power source (22). In the diagnosis step, the presence or absence of failure of the second switch circuit (27) is diagnosed. In the diagnostic step, a voltage exceeding the determination threshold value for determining the presence or absence of an open failure of the second switch circuit (27) at the connection point (T2) between the second switch circuit (27) and the second auxiliary power supply (3). Is applied from the second auxiliary power supply (3), and the presence or absence of an open failure of the second switch circuit (27) is diagnosed.

According to this aspect, if the voltage applied from the second auxiliary power supply (3) to the connection point (T2) is equal to or less than the determination threshold value, even if an open failure does not occur in the second switch circuit (27), There is a possibility of misdiagnosis as an open failure. Since the diagnostic unit (211) diagnoses the presence or absence of an open failure of the second switch circuit (27) while a voltage exceeding the determination threshold is applied from the second auxiliary power supply (3) to the connection point (T2). It is possible to reduce the possibility of erroneously diagnosing the presence or absence of a failure of the second switch circuit (27) that conducts and cuts off the second power supply path (L2) connecting the second auxiliary power supply (3) and the load (5).

The program of the eleventh aspect is a program for causing one or more computer systems to execute the failure diagnosis method of the backup power supply system (1) of the tenth aspect.

According to this aspect, the possibility of erroneous diagnosis of the presence or absence of failure of the switching element can be reduced.

Not limited to the above aspects, the various configurations (including modifications) of the backup power supply system (1) according to the embodiment are the failure diagnosis method of the backup power supply system (1), the (computer) program, or the non-recorded program. It can be embodied in a temporary recording medium or the like.

The configurations according to the second to tenth aspects are not essential configurations for the backup power supply system (1) and can be omitted as appropriate.

1 Backup power supply system 3 2nd auxiliary power supply 4 Main power supply 5 Brake system (load)
9 Vehicle 22 1st auxiliary power supply 26 1st switch circuit 27 2nd switch circuit 211 Diagnostic unit L1 1st power supply path L2 2nd power supply path SW3 switch (1st switching element)
SW4 switch (second switching element)
T2 input terminal (connection point)

Claims (11)

The first auxiliary power supply to supply power to the load when the main power supply fails,
A first switch circuit that conducts and cuts off the first power supply path that connects the first auxiliary power supply and the load.
A second power supply path that connects a second auxiliary power supply having a capacity smaller than that of the first auxiliary power supply and the load for supplying power to the load when the main power supply fails is conducted and cut off. Switch circuit and
A diagnostic unit for diagnosing the presence or absence of a failure of the second switch circuit is provided.
In a state where a voltage exceeding the determination threshold value for determining the presence or absence of an open failure of the second switch circuit is applied from the second auxiliary power supply to the connection point between the second switch circuit and the second auxiliary power supply. , The diagnostic unit diagnoses the presence or absence of an open failure of the second switch circuit.
Backup power system. The second auxiliary power supply applies a voltage to the connection point during a predetermined period after the main power supply is turned on.
The diagnostic unit diagnoses the presence or absence of an open failure of the second switch circuit during the predetermined period.
The backup power supply system according to claim 1. If the voltage applied from the second auxiliary power supply to the connection point is equal to or less than the determination threshold value during the predetermined period, the diagnostic unit does not diagnose the presence or absence of an open failure of the second switch circuit.
The backup power supply system according to claim 2. The load is mounted on a vehicle that can be driven automatically.
If the presence or absence of an open failure has not been diagnosed during the predetermined period, the diagnostic unit may perform a predetermined automatic driving operation at the timing before the second switch circuit conducts the second power supply path. Diagnosing the presence or absence of an open failure of the second switch circuit,
The backup power supply system according to claim 3. The load is mounted on a vehicle that can be driven automatically.
At the timing when the vehicle performs a predetermined automatic driving operation, the diagnostic unit diagnoses the presence or absence of an open failure of the second switch circuit before the second switch circuit conducts the second power supply path.
The backup power supply system according to claim 1. The second switch circuit includes a series circuit of a first switching element and a second switching element connected in series between the load and the second auxiliary power supply.
The first switching element and the second switching element each have a body diode.
The diagnostic unit is in a state where the control signal for conducting the first switching element is input to the first switching element and the cutoff signal for blocking the second switching element is input to the second switching element. Based on the high and low of the voltage at the midpoint of the 1 switching element and the 2nd switching element and the determination threshold value, the presence or absence of an open failure of the 1st switching element is diagnosed.
The backup power supply system according to any one of claims 1 to 5. The diagnostic unit of the second switch circuit is based on the voltage of the connection point in a state where the main power supply has not failed and the second auxiliary power supply has not applied a voltage to the connection point. Diagnose the presence or absence of short circuit failure,
The backup power supply system according to any one of claims 1 to 6. The first auxiliary power supply and the second auxiliary power supply are charged by the electric power supplied from the main power supply, and are charged.
If the charging of the first auxiliary power supply is not completed at the time of the failure of the main power supply, the load is supplied from the second auxiliary power supply via the second power supply path.
The backup power supply system according to any one of claims 1 to 7. The second auxiliary power supply is further provided.
The backup power supply system according to any one of claims 1 to 8. It is a failure diagnosis method for a backup power supply system equipped with a first auxiliary power supply that can supply power to the load when the main power supply fails.
A first switching step of conducting and disconnecting a first power supply path connecting the first auxiliary power supply and the load by a first switch circuit.
A second power supply path connecting the load and the second auxiliary power supply having a capacity smaller than that of the first auxiliary power supply for supplying power to the load when the main power supply fails by the second switch circuit is provided. The second switching process of conducting and shutting off,
Includes a diagnostic step of diagnosing the presence or absence of failure of the second switch circuit.
In the diagnostic step,
In a state where a voltage exceeding the determination threshold value for determining the presence or absence of an open failure of the second switch circuit is applied from the second auxiliary power supply to the connection point between the second switch circuit and the second auxiliary power supply. , Diagnosing the presence or absence of an open failure of the second switch circuit,
Backup power system failure diagnosis method. For one or more computer systems
A program for executing the failure diagnosis method of the backup power supply system according to claim 10.

Images