JP2022144850A - Control device and control method - Google Patents

Abstract

To provide a control device and a control method that are able to suppress a decrease in opportunities of automatic operation while securing safety.SOLUTION: A control device according to an embodiment includes a first system, a second system, an inter-system switch, a specifying unit, a control unit, and a fail-safe unit. The first system supplies power of a first power source to a first load for automatic operation. The second system supplies power of the second power source to a second load for automatic operation. The inter-system switch is provided in a connection path connecting the first and second systems and can connect and disconnect the connection path. The specifying unit detects an occurrence of disconnection or ground fault in the first and second systems and specifies a point of the occurrence. The control unit permits or inhibits continuation of the automatic operation according to the point of the occurrence specified by the specifying unit. When an occurrence of a disconnection or a ground fault is detected during automatic operation and continuation of the automatic operation is inhibited, the fail-safe unit shifts to a retreat travel.SELECTED DRAWING: Figure 1

Description

The disclosed embodiments relate to control devices and control methods.

Conventionally, a first power supply and a second power supply have been provided, and one power supply system has been provided so that even if a power failure occurs during automatic driving of a vehicle, the vehicle can be evacuated to a safe place and stopped. There is a power supply system that, when a ground fault occurs in the other power supply system, supplies power to an on-vehicle device (load) for automatic operation to make the vehicle evacuate (see, for example, Patent Document 1).

JP 2018-182864 A

However, in the conventional power supply system, when a power failure occurs, even if the power for evacuation driving can be supplied to the load for evacuation driving, automatic driving is uniformly stopped and the vehicle is driven for evacuation driving. As a result, the opportunities for autonomous driving will decrease.

One aspect of the embodiments has been made in view of the above, and an object thereof is to provide a control device and a control method that can suppress a decrease in the chances of automatic driving while ensuring safety. .

A control device according to an aspect of an embodiment includes a first system, a second system, an inter-system switch, a specifying unit, a control unit, and a fail-safe unit. The first system supplies power from the first power supply to the first load for automatic operation. The second system supplies the power of the second power supply to the second load for automatic operation. An inter-system switch is provided in a connection path that connects the first system and the second system, and is capable of connecting and disconnecting the connection path. The specifying unit detects occurrence of wire breakage or ground fault in the first system and the second system, and specifies a location where the wire breakage or the ground fault has occurred. The control unit permits or prohibits continuation of the automatic operation according to the occurrence location specified by the specifying unit. The fail-safe section shifts to evacuation running when the occurrence of the disconnection or the ground fault is detected by the specifying section during automatic operation and continuation of automatic operation is prohibited by the control section.

The control device and the control method according to one aspect of the embodiment have the effect of being able to prevent a decrease in the chances of automatic driving while ensuring safety.

FIG. 1 is an explanatory diagram illustrating a configuration example of a control device according to an embodiment. FIG. 2 is an explanatory diagram showing an operation example of the control device according to the embodiment. FIG. 3 is an explanatory diagram showing an operation example of the control device according to the embodiment. FIG. 4 is an explanatory diagram showing an operation example of the control device according to the embodiment. FIG. 5 is an explanatory diagram showing an operation example of the control device according to the embodiment. FIG. 6 is an explanatory diagram showing an operation example of the control device according to the embodiment. FIG. 7 is an explanatory diagram showing an operation example of the control device according to the embodiment. FIG. 8 is a flowchart illustrating an example of processing executed by the control device according to the embodiment;

Hereinafter, embodiments of a control device and a determination method will be described in detail with reference to the accompanying drawings. In addition, this invention is not limited by embodiment shown below. In the following, a control device mounted in a vehicle equipped with an automatic driving function and supplying electric power to a load will be described as an example. good too.

In the following description, the vehicle in which the control device is installed is an electric vehicle or a hybrid vehicle, but the vehicle in which the control device is installed may be an engine vehicle that runs on an internal combustion engine.

[1. Configuration of control device]
FIG. 1 is an explanatory diagram illustrating a configuration example of a control device according to an embodiment. As shown in FIG. 1, the control device 1 according to the embodiment is connected to a first power supply 10, a first load 101, a general load 102, a second load 103, and an automatic operation control device 100. The control device 1 includes a first system 110 that supplies power from a first power supply 10 to a first load 101 and a general load 102, and a second system 120 that supplies power from a second power supply 20, which will be described later, to a second load 103. Prepare.

The first load 101 includes a load for automatic operation. For example, the first load 101 includes a steering motor, an electric brake device, an in-vehicle camera, a radar, etc. that operate during automatic driving. General loads 102 include, for example, displays, air conditioners, audio, video, and various lights.

The second load 103 has functions similar to those of the first load 101 . The second load 103 includes, for example, devices that operate during automatic driving, such as a steering motor, an electric brake device, an in-vehicle camera, and a radar. First load 101 , general load 102 , and second load 103 operate with power supplied from control device 1 . The automatic driving control device 100 is a device that operates the first load 101 or the second load 103 to control the automatic driving of the vehicle.

The first power supply 10 includes a DC/DC converter (hereinafter referred to as "DC/DC11") and a lead battery (hereinafter referred to as "PbB12"). The battery of the first power supply 10 may be any secondary battery other than PbB12.

DC/DC 11 is connected to a generator and a high-voltage battery having a higher voltage than PbB 12 , steps down the voltage of the generator and high-voltage battery, and outputs the voltage to first system 110 . A generator is, for example, an alternator that converts the kinetic energy of a running vehicle into electricity to generate electricity. A high-voltage battery is, for example, a battery for driving a vehicle mounted on an electric vehicle or a hybrid vehicle.

When the first power supply 10 is installed in an engine vehicle, an alternator (generator) is provided instead of the DC/DC 11 . The DC/DC 11 charges the PbB 12, supplies power to the first load 101 and the general load 102, supplies power to the second load 103, and charges the second power supply 20, which will be described later.

The control device 1 includes a second power source 20, an inter-system switch 41, a first switch 42, a second switch 43, a third switch 44, a specifying unit 31, a control unit 32, and a fail-safe unit 33. Prepare. Further, the control device 1 includes current sensors 51 , 52 , 53 , 54 , 55 and 56 and a voltage sensor 57 .

The second power supply 20 is a backup power supply when the first power supply 10 cannot supply power. The second power source 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). The battery of the second power supply 20 may be any secondary battery other than LiB21.

Inter-system switch 41 is a switch that is provided on connection path 130 that connects first system 110 and second system 120 and that can connect and disconnect connection path 130 . The first switch 42 connects the second load power supply path 140 connecting the connection path 130 and the connection point P of the second system 120 and the second load 103 to the connection point P on the second load power supply path 140 . It is a switch that can be connected and disconnected at the end on the side of the .

The second switch 43 is a switch that can connect and disconnect the second load power supply path 140 at the end of the second load power supply path 140 on the second load 103 side. The third switch 44 is a switch that can connect and disconnect the bypass path 150 that bypasses the second load power supply path 140 and supplies power from the connection path 130 to the second load 103 .

The current sensor 51 detects the current value supplied to the first load 101 and outputs the detection result to the specifying unit 31 . The current sensor 52 detects the current value supplied to the general load 102 and outputs the detection result to the identification unit 31 . Current sensor 53 detects the value of the current flowing through second load power supply path 140 and outputs the detection result to identifying unit 31 .

The current sensor 54 detects the current value supplied to the second load 103 and outputs the detection result to the specifying unit 31 . Current sensor 55 detects the value of current flowing through the power supply path between intersystem switch 41 and connection point P, and outputs the detection result to identifying unit 31 .

Current sensor 56 detects the current value of the current flowing between connection point P<b>1 between connection path 130 and first system 110 and first power supply 10 , and outputs the detection result to identification unit 31 . Voltage sensor 57 detects the voltage value of the power supply path between inter-system switch 41 and connection point P, and outputs the detection result to identifying unit 31 .

The specifying unit 31, the control unit 32, and the fail-safe unit 33 include a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and various circuits. The specifying unit 31, the control unit 32, and the fail-safe unit 33 may be configured by hardware such as ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

The identification unit 31 detects the occurrence of disconnection or ground fault in the first system 110 and the second system 120 by executing the program stored in the ROM by the CPU using the RAM as a work area. Identify the location of the ground fault. The identification unit 31 identifies the location of the disconnection or ground fault based on the detection results input from the current sensors 51 , 52 , 53 , 54 , 55 and the voltage sensor 57 . A method of specifying the disconnection or ground fault occurrence location by the specifying unit 31 will be described later with reference to FIG. 2 .

The control unit 32 turns on/off the inter-system switch 41, the first switch 42, the second switch 43, and the third switch 44 by executing the program stored in the ROM by the CPU using the RAM as a work area. control. The on/off control of each switch by the control unit 32 will be described later with reference to FIGS. 2 to 8. FIG.

Furthermore, the control unit 32 permits or prohibits continuation of the automatic operation according to the location of the disconnection or ground fault identified by the identification unit 31 . For example, even if a disconnection or a ground fault occurs in the first system 110 or the second system 120, the control unit 32 can automatically Allow driving to continue.

As a result, the control device 1 can suppress a decrease in the chances of automatic driving while ensuring safety. Further, the control unit 32 prohibits the continuation of the automatic operation if the disconnection or ground fault occurs at a location where the first power source 10 cannot be backed up by the second power source 20 . Thereby, the control device 1 can ensure safety.

The fail-safe unit 33 detects the occurrence of a disconnection or a ground fault by the specifying unit 31 during automatic operation, and when the control unit 32 prohibits the continuation of automatic operation, the automatic operation control device issues a command to shift to evacuation traveling. Output to 100.

Next, the operation of the control device 1 will be described with reference to FIGS. 2 to 8. FIG. In FIGS. 2 to 8, in order to facilitate understanding of the operation of the control device 1, the identification unit 31, the control unit 32, the fail-safe unit 33, and the control signal lines indicated by dashed arrows or dotted arrows in FIG. are omitted.

[2. Normal operation of control device]
Control unit 32 operates inter-system switch 41, first switch 42, and second switch 43 as shown in FIG. It conducts and cuts off the third switch 44 . Thereby, the control device 1 can supply power from the first power source 10 to the first load 101 , the general load 102 , and the second load 103 .

Identification unit 31 normally monitors whether or not disconnection or ground fault has occurred in first system 110 or second system 120 . Specifically, the identification unit 31 detects that a disconnection or ground fault has occurred upstream of the first load 101 in the power supply path of the first system 110, that is, in the section A-1 from the first power supply 10 to the first load 101. monitor whether or not

Further, the identifying unit 31 monitors whether or not disconnection or ground fault has occurred in the section A-2 downstream of the first load 101 in the power supply path of the first system 110 . Further, the identifying unit 31 monitors whether or not a disconnection or ground fault has occurred in the section B between the inter-system switch 41 and the second system 120 . In addition, the identifying unit 31 monitors whether or not disconnection or ground fault has occurred in the section C between the first switch 42 and the second switch 43 serving as the second load power supply path 140 .

An example of the operation of the control device 1 when disconnection or ground fault occurs in the sections A-1, A-2, B, and C will be described below.

[3. When a ground fault or disconnection occurs in section A-1, when a ground fault occurs in section A-2]
When a ground fault occurs in the first system 110 or the second system 120 during the normal time shown in FIG. 2 , an overcurrent flows to the ground fault point. , 53, 54, 56 decreases. Specifically, when a ground fault occurs in the first system 110, an overcurrent flows through the current sensor 55 from the second system 120 toward the first system 110, and when a ground fault occurs in the second system 120, An overcurrent flows through the current sensor 55 from the first system 110 toward the second system 120 . On the other hand, the current flowing through the current sensors 51, 52, 53, 54 and 56 becomes zero.

Therefore, specifying unit 31 determines that a ground fault has occurred in first system 110 or second system 120 when the detection result of current sensor 55 is greater than or equal to the first ground fault threshold value for current value. The identifying unit 31 determines that the detection result of the current sensor 55 is greater than or equal to the first ground fault threshold for current value, and the detection result of at least one of the current sensors 51, 52, 53, 54, and 56 is the second ground fault threshold for current value. It may be determined that a ground fault has occurred in first system 110 or second system 120 when the ground fault threshold value is reached or less.

The first ground fault threshold is a threshold for detecting overcurrent, and is larger than the current that flows when the first load 101 and the second load 103 are normally driven (hereinafter referred to as "normal current"). value. The second ground fault threshold is a threshold for detecting no current flow, and is a value smaller than the normal current. When the specifying unit 31 determines that a ground fault has occurred, the control unit 32 shuts off the inter-system switch 41 as shown in FIG.

Note that the identifying unit 31 determines that a ground fault has occurred in the first system 110 or the second system 120 when the voltage detected by the voltage sensor 57 instead of the current sensor 55 has dropped below the threshold. good too.

At this time, if the ground fault 201 occurs in the section A-1 or section A-2, the current from the first power supply 10 does not flow through the current sensors 51, 52, 56. is still below the second ground fault threshold for the current value. On the other hand, since power is supplied from the second power supply 20 to the second system 120, the detection results of the current sensors 53 and 54 are higher than the second ground fault threshold for current value.

Therefore, the identification unit 31 determines that the detection results of the current sensors 51, 52, and 56 are equal to or less than the second ground fault threshold value for the current value after the inter-system switch 41 is shut off, and the detection results of the current sensors 53 and 54 becomes higher than the second ground fault threshold for the current value, the location where the ground fault 201 occurs is identified as section A-1 or section A-2.

Further, when disconnection 202 occurs between first power supply 10 and connection point P1 in section A-1 during normal operation shown in FIG. , 52 are greater than or equal to the second ground fault threshold and less than or equal to the first ground fault threshold.

Further, when disconnection 202 occurs between connection point P1 and first load 101 in section A-1 during normal operation shown in FIG. The current sensors 51 and 52 become equal to or less than the second ground fault threshold.

Therefore, the identification unit 31 determines that the detection result of the current sensor 56 is equal to or less than the second ground fault threshold, and the detection results of the current sensors 51 and 52 are equal to or greater than the second ground fault threshold and equal to or less than the first ground fault threshold. or when the detection result of the current sensor 56 becomes greater than or equal to the second ground fault threshold and less than or equal to the first ground fault threshold, and the current sensors 51 and 52 become less than or equal to the second ground fault threshold, disconnection occurs. It is determined that the disconnection 202 has occurred, and the location where the disconnection 202 has occurred is identified as section A-1. The identification unit 31 shuts off the inter-system switch 41 when detecting the disconnection.

The control unit 32 determines whether the location of the disconnection 202 identified by the identification unit 31 is the section A-1, or the location of the ground fault 201 identified by the identification unit 31 is the section A-1 or A-2. , the continuation of the automatic operation is prohibited with the inter-system switch 41 turned off, and the power of the second power supply 20 is supplied to the second load 103 .

Note that when the identifying unit 31 detects the disconnection 202, the power of the second power supply 20 may be supplied to the first load 101 and the second load 103 without shutting off the inter-system switch 41. The power of the second power supply 20 runs out quickly. Therefore, when the identifying unit 31 detects the disconnection 202, it is desirable to turn off the inter-system switch 41. FIG.

Then, the fail-safe unit 33 issues a command to shift to evacuation running when the specifying unit 31 detects the occurrence of the disconnection 202 or the ground fault 201 during automatic operation and the control unit 32 prohibits the continuation of the automatic operation. Output to the automatic operation control device 100 . As a result, when a power failure occurs in the first system 110, the automatic driving control device 100 can evacuate the vehicle to a safe place and stop the vehicle.

[4. When disconnection occurs in section A-2]
As shown in FIG. 4, when disconnection 202 occurs in section A-2 during normal operation, first load 101 is supplied with power from first power supply 10, but general load 102 is not supplied with power. Therefore, the specifying unit 31 determines that the detection result of the current sensor 51 is the normal value (more than or equal to the second ground fault threshold and less than or equal to the first ground fault threshold), and that the detection result of the current sensor 52 is the second ground fault threshold. If it is equal to or less than the fault threshold, a wire breakage 202 occurs, and the location where the wire breakage 202 occurs is identified as section A-2.

At this time, a current is supplied to the first load 101 and the second load 103 required for automatic operation. Therefore, the control unit 32 permits continuation of the automatic operation when the wire breakage 202 occurs in the section A-2. As a result, the control device 1 can continue the automatic operation even if the disconnection 202 occurs in the section A-2, so it is possible to suppress the decrease in the chance of automatic operation while ensuring safety. .

[5. If disconnection or ground fault occurs in section B]
The specifying unit 31 determines that a ground fault has occurred somewhere inside the control device 1 when the detection result of the voltage sensor 57 is equal to or less than the ground fault threshold value for the voltage value. Note that the identifying unit 31 detects when the detection result of at least one of the current sensors 51, 52, 53, 54, and 56 is equal to or less than the second ground fault threshold value for the current value, or when the detection result of the current sensor 55 is the current It may be determined that a ground fault has occurred somewhere inside the control device 1 when the first ground fault threshold value for the value is exceeded. When it is determined that a ground fault has occurred, the control unit 32 shuts off the inter-system switch 41 as shown in FIG.

After that, when the detection results of the current sensors 51, 52, and 56 are higher than the second ground fault threshold value for the current value, the specifying unit 31 determines that the ground fault has not occurred in the first system 110 and the section It is determined that a ground fault has occurred in B or section C. Subsequently, the control unit 32 cuts off the first switch 42 and the second switch 43 and turns on the third switch 44 .

As a result, if the detection values of the current sensors 54 and 55 become higher than the second ground fault threshold value for the current value, the specifying unit 31 specifies the section C as the location where the ground fault 201 occurs, and the current sensors 54 and 55 is still equal to or less than the second ground fault threshold for the current value, section B is identified as the location where the ground fault 201 has occurred.

Further, the specifying unit 31 determines that the detection result of the current sensor 55 is equal to or less than the second ground fault threshold in normal times, and the detection results of the current sensors 53 and 54 are equivalent to the detection results in normal times (the second ground fault threshold or more and first ground fault threshold), the section B is identified as the location where the disconnection 202 has occurred.

Further, the specifying unit 31 determines that the disconnection 202 has occurred in the section B or the section C when the detection result of the current sensor 53 is equal to or less than the second ground fault threshold during normal operation. After that, the control unit 32 cuts off the first switch 42 and the second switch 43 and turns on the third switch 44 . As a result, when the detection results of the current sensors 54 and 55 are the same as the normal detection results, the identification unit 31 identifies the section C as the location where the disconnection 202 occurs.

When the disconnection 202 or the ground fault 201 occurs in the section B, the control unit 32 prohibits continuation of the automatic operation while the inter-system switch 41 is shut off. Then, the fail-safe section 33 outputs to the automatic operation control device 100 a command to shift from automatic operation to manual operation. As a result, the control device 1 can continue running by manual operation with the electric power of the first power source 10 .

[6. When a ground fault occurs in section C]
When the location where the ground fault 201 occurs is identified as section C by the method described above, as shown in FIG. conduct.

As a result, even if a power failure occurs in the first system 110 after that, the control device 1 shuts off the inter-system switch 41 and supplies power to the second load 103 from the second power supply 20 via the third switch 44 . A backup state in which power can be supplied can be secured. Therefore, the control unit 32 permits continuation of the automatic operation. As a result, the control device 1 can continue the automatic operation even if the ground fault 201 occurs in the section C, so that it is possible to suppress the reduction in the chances of the automatic operation while ensuring safety.

[7. When disconnection occurs in section C]
When the location where the wire breakage 202 occurs is identified as section C by the method described above, the control unit 32 turns on the third switch 44 as shown in FIG. 7 . As a result, the control device 1 can ensure the backup state by the second power supply 20 as in the case where the ground fault 201 occurs in the section C.

Therefore, the control unit 32 permits continuation of the automatic operation. As a result, the control device 1 can continue the automatic operation even if the disconnection 202 occurs in the section C, so that it is possible to suppress the decrease in the chance of the automatic operation while ensuring safety.

[8. Processing executed by the control device]
Next, processing executed by the control device according to the embodiment will be described with reference to FIG. FIG. 8 is a flowchart illustrating an example of processing executed by the control device according to the embodiment; The control device 1 repeatedly executes the processing shown in FIG. 8 during normal times when a power failure does not occur.

Specifically, as shown in FIG. 8, the identification unit 31 determines whether or not a disconnection 202 or a ground fault 201 has occurred (step S101). When determining that the disconnection 202 or the ground fault 201 has not occurred (step S101, No), the identifying unit 31 terminates the process and restarts the process from step S101.

When determining that the disconnection 202 or the ground fault 201 has occurred (step S101, Yes), the identifying unit 31 identifies the location where the disconnection 202 or the ground fault 201 has occurred (step S102). Thereafter, the control unit 32 determines whether or not the disconnection 202 or the ground fault 201 occurred in the section A-1 or the ground fault 201 occurred in the section A-2 (step S103).

If the control unit 32 determines that the disconnection 202 or the ground fault 201 has occurred in the section A-1 or the ground fault 201 has occurred in the section A-2 (step S103, Yes), the inter-system switch 41 is blocked (step S104), automatic operation is prohibited (step S105). After that, the fail-safe section 33 shifts to evacuation travel (step S106), and terminates the process.

Further, when the control unit 32 determines that the disconnection 202 or the ground fault 201 is not specified as the section A-1 or the ground fault 201 is not specified as the section A-2 (step S103, No), It is determined whether or not the section A-2 is specified as the location where the disconnection 202 occurs (step S107).

If the control unit 32 determines that the disconnection 202 occurs in the section A-2 (step S107, Yes), the control unit 32 permits continuation of the automatic operation (step S108), and ends the process. Further, when the control unit 32 determines that the disconnection 202 is not identified as the section A-2 (step S107, No), whether the disconnection 202 or the ground fault 201 is identified as the section B. (step S109).

When the control unit 32 determines that the disconnection 202 or the ground fault 201 occurs in the section B (step S109, Yes), the control unit 32 continues the automatic operation while the inter-system switch 41 is shut off (step S110). prohibited (step S111). After that, the fail-safe section 33 shifts to manual operation (step S112) and terminates the process.

Further, when the control unit 32 determines that the section B is not specified as the location where the disconnection 202 or the ground fault 201 occurs (step S109, No), whether or not the section C is specified as the location where the ground fault 201 occurs. is determined (step S113).

When the control unit 32 determines that the location where the ground fault 201 has occurred is identified as the section C (step S113, Yes), the control unit 32 shuts off the first switch 42 and the second switch 43 and turns on the third switch 44. (Step S114), the automatic operation is permitted (Step S115), and the process ends.

Further, when the control unit 32 determines that the location where the ground fault 201 occurs is not specified as the section C (step S113, No), it determines that the location where the disconnection 202 occurs is specified as the section C (step S116). , the third switch 44 is turned on (step S117), automatic operation is permitted (step S115), and the process ends.

Further effects and modifications can be easily derived by those skilled in the art. Therefore, the broader aspects of the invention are not limited to the specific details and representative embodiments so shown and described. Accordingly, various changes may be made without departing from the spirit or scope of the general inventive concept defined by the appended claims and equivalents thereof.

1 Control Device 10 First Power Supply 11 DC/DC
12PbB
20 second power supply 21 LiB
31 identification unit 32 control unit 33 fail-safe unit 41 inter-system switch 42 first switch 43 second switch 44 third switch 51, 52, 53, 54, 55, 56 current sensor 57 voltage sensor 100 automatic operation control device 101 first Load 102 General load 103 Second load 110 First system 120 Second system 130 Connection path 140 Power feeding path for second load 150 Bypass path

Claims (9)

a first system that supplies power from the first power supply to a first load for automatic operation;
a second system that supplies power from the second power supply to a second load for automatic operation;
an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path;
an identification unit that detects the occurrence of disconnection or ground fault in the first system and the second system and identifies a location where the disconnection or the ground fault occurs;
A control unit that permits or prohibits continuation of automatic operation according to the occurrence location specified by the specifying unit;
and a fail-safe unit that shifts to evacuation running when the occurrence of the disconnection or the ground fault is detected by the specifying unit during automatic operation and the continuation of automatic operation is prohibited by the control unit. control device. The control unit
continuation of automatic operation is prohibited in a state in which the inter-system switch is cut off when the disconnection or the ground fault occurs upstream of the first load in the power supply path of the first system. The control device according to claim 1, wherein The control unit
3. The control according to claim 1 or 2, wherein continuation of automatic operation is permitted when the disconnection occurs downstream of the first load in the power supply path of the first system. Device. The control unit
wherein, when the location of the ground fault is downstream of the first load in the power supply path of the first system, continuation of the automatic operation is prohibited while the inter-system switch is shut off. Item 4. The control device according to any one of items 1 to 3. The control unit
prohibiting continuation of automatic operation in a state where the inter-system switch is cut off when the disconnection or the ground fault occurs between the inter-system switch and the second system;
The fail-safe section is
5. The control device according to any one of claims 1 to 4, wherein automatic operation is shifted to manual operation. A second load feed path connecting between the connection path and a connection point of the second system and the second load is connectable and disconnectable at an end of the second load feed path on the side of the connection point. a first switch;
a second switch capable of connecting and disconnecting the second load power supply path at an end portion of the second load power supply path on the side of the second load;
a third switch capable of connecting and disconnecting a bypass path that bypasses the second load power supply path and supplies power from the connection path to the second load,
The control unit
In a normal state when the occurrence of the disconnection or the ground fault is not detected by the specifying unit, the inter-system switch, the first switch, and the second switch are turned on, and the third switch is turned off. Item 6. The control device according to any one of items 1 to 5. The control unit
When the ground fault occurs in the power supply path for the second load, the first switch and the second switch are cut off, and the continuation of the automatic operation is permitted while the third switch is turned on. 7. The control device according to claim 6, characterized by: The control unit
8. The continuation of the automatic operation is permitted in a state where the third switch is turned on when the disconnection occurs in the power supply path for the second load. Control device. a first system that supplies power from the first power supply to a first load for automatic operation;
a second system that supplies power from the second power supply to a second load for automatic operation;
A system-to-system switch that is provided in a connection path that connects the first system and the second system and that is capable of connecting and disconnecting the connection path. or detecting the occurrence of a ground fault and identifying the location where the disconnection or the ground fault has occurred;
The control unit of the control device permits or prohibits continuation of automatic operation according to the occurrence location specified by the specifying unit;
The fail-safe unit of the control device shifts to evacuation running when the occurrence of the disconnection or the ground fault is detected by the specifying unit during automatic operation and continuation of automatic operation is prohibited by the control unit. and .

Images