JP6131906B2 - Limp home system, its safety control device - Google Patents

Description

  The present invention relates to limp home mode control at the time of failure in an automobile including an electric motor as a power source.

  In recent years, it has been considered to switch to limp home mode in the event of a failure in an automobile equipped with an electric motor as a power source so that the vehicle can travel at a modest speed and can reach a home or a nearby maintenance factory.

  Here, in the invention of Patent Document 1, when a failure of the motor control unit is detected, a torque command zero or stop is detected, and the limp home control unit (preliminary control device) is switched to realize limp home control. .

Patent Document 2 describes a control device that controls an induction motor by switching it to speed sensorless.
Non-Patent Document 1 describes a watchdog device that switches to a redundant circuit due to a failure of a microcontroller.

  Also, Non-Patent Document 1 describes that “Limp Home” refers to the operation of a car that enters a fail-safe mode and can be driven at a modest speed to reach a home or a nearby maintenance shop or the like when any failure occurs. There is a disclosure that it is a mode. Alternatively, the limp home mode may be implemented so that a faulty vehicle can safely return the occupant while suppressing damage to the engine and other components, or that the engine will operate at a low output (reduction mode). There is disclosure.

FIG. 11 shows a configuration diagram of the system of Patent Document 2. As shown in FIG.
This configuration will be briefly described below.
The configuration shown in FIG. 11 includes coordinate conversion means 122, magnetization current command calculation means 115, speed adjuster 112, torque current command calculation means 113, magnetization current adjustment means 116, torque current adjustment means 114, and the like. The control device for the induction motor that controls the output voltage of the power converter 120 according to the above. Then, the speed detecting means 111 and the speed calculating means 153 of the induction motor M, and selecting means for selecting any one of the detected speed value and the estimated speed value according to the control method determination signal and outputting the selected speed information to the speed adjuster 112. 154. When the speed information selected by the selection unit 154 is changed according to the control method determination signal, the speed regulator 112 automatically changes control constants such as a proportional gain for speed control and an integration time constant.

JP-A-8-242505 JP 2011-87424 A

"High-voltage watchdog timer improves in-vehicle system safety"; Internet <URL; http://www.maximintegrated.com/app-notes/index.mvp/id/4210> [2013/02/16 14:46 : 02 Search]

  In the method described in Patent Document 1, when a failure occurs in the main control unit, it cannot be detected by the failure detection unit, so that it cannot be switched to limp home control, and limp home control cannot be performed. Further, when the torque command fails, there is a possibility that danger cannot occur such as stopping within the railroad crossing because it is not possible to switch to limp home control until the vehicle stops.

  Further, Patent Document 2 describes switching to sensorless control when a failure occurs in the speed detector. However, if a failure occurs in the motor control unit, the motor control cannot be performed, and the motor operation is not performed. Cannot be secured.

Non-Patent Document 1 describes switching to a redundant circuit due to a failure of a microcontroller, but does not mention the configuration of the redundant circuit.
In addition, when switching to limp home control, the power converter switch pair (upper and lower switch pair) may be turned on simultaneously, which may cause burnout of the power converter (inverter, etc.) due to overcurrent. there were.

  An object of the present invention is to prevent simultaneous turn-on of a power converter switch pair in a transition to limp home control for an automobile equipped with an electric motor as a power source, and thus damage the power converter due to overcurrent. It is to provide a limp home system or the like that enables limp home control even when a safety control device fails.

The limp home system of the present invention is a limp home system in an automobile equipped with an electric motor and has the following configurations.
Power conversion means for driving the electric motor based on a control signal that is enabled by the supplied control power supply;
First switching means for turning on / off the supply of the control power supply to the power conversion means;
Motor control means for generating a first control signal according to an arbitrary command;
A limp control means for generating a second control signal in accordance with a predetermined command set in advance;
Second switching means for inputting any one of the first control signal and the second control signal to the power conversion means as the control signal;
When an abnormality is detected, the first switching means is controlled to temporarily stop the supply of the control power supply to the power conversion means, and then the second switching means is controlled while the supply is stopped And safety control means for switching to a limp home control mode for inputting the second control signal as the control signal to the power conversion means.

  According to the limp home system and the like of the present invention, for an automobile equipped with an electric motor as a power source, the switch pair of the power converter is prevented from being simultaneously turned on at the time of transition to limp home control. Limp home control can be realized even if the converter is prevented from burning or the safety control device fails.

It is a schematic block diagram of the limp home system of this example. It is an example of detailed composition of a limp home system of this example. It is a process flowchart figure of a safety control apparatus. It is a figure which shows the switching operation | movement to the limp home mode of this example. It is a figure which shows the switching logic and circuit example of power supply SW. It is a figure which shows the switching logic and circuit example of control switching SW by the side of a motor control apparatus. It is a figure which shows the switch logic and circuit example of control switch SW by the side of a limp control apparatus. It is a time chart figure of a speed instruction | indication and monitoring process. It is a functional block diagram of a sensorless vector control processing part. It is a specific example of a one-shot pulse generation circuit. It is a block diagram of the conventional patent document 2.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a schematic configuration diagram of the limp home system of this example.
FIG. 2 is a detailed configuration example of the limp home system of this example.

  Note that the limp home system of this example is mounted on an automobile equipped with an electric motor as a power source, such as an electric vehicle, a hybrid vehicle, etc., and is a system for driving the electric motor to drive the automobile. In this system, the vehicle is driven by switching to the limp home control mode and controlling the driving of the electric motor at the time of failure. The limp home control mode is a mode in which, for example, control is performed so that the vehicle can travel at a moderate speed and can reach a safe place.

  As shown in FIG. 1, the limp home system of this example schematically includes a safety control unit 1, a WDT (watchdog timer) unit 2, a motor control unit 3, a limp control unit 4, a power conversion unit 5, and a motor. (Induction motor) 6, first switching unit 7, second switching unit 8, and the like.

  Among the above components, the motor control unit 3, the power conversion unit 5, and the motor 6 may be regarded as existing configurations. Therefore, although these will not be described in particular, the motor control unit 3 outputs a control signal to the power conversion unit 5 based on a speed command or the like from a host device (not shown). Drive control of the motor 6 is performed. The motor 6 is an electric motor or the like. The power conversion unit 5 is, for example, an inverter.

  The limp control unit 4 is configured to generate and output a control signal for the power conversion unit 5, and is configured to drive and control the power conversion unit 5 and the motor 6 by the control signal in the limp home control mode. The limp control unit 4 may be realized by an existing technique, and as an example, can be realized by the conventional technique described in Patent Document 2. In this example, the limp control unit 4 can perform the drive control without a speed sensor. However, the present invention is not limited to this example. For example, the limp control unit 4 may be realized by the conventional technique of Patent Document 1 or other conventional techniques. Furthermore, regarding the limp control unit 4, this example proposes a configuration for generating a control signal based on, for example, a preset value stored in advance. By performing control based on such setting values and the like, drive control is possible even if there is no speed command or the like from the host device (even in a state where there is no speed command input). In this example, the limp control unit 4 performs, for example, constant speed traveling control at a low speed.

The limp control device 20 described later is an example of the limp control unit 4 and will be described in detail later.
The control signal from the motor control unit 3 and the control signal from the limp control unit 4 described above control ON / OFF of the six switching elements when the power conversion unit 5 is, for example, a three-phase inverter. Signal. That is, in this example, there are six signal lines for the control signal (PWM signal).

  The first switching unit 7 receives the control signal from the motor control unit 3 and the control signal from the limp control unit 4 and selectively outputs one of these two control signals to output the power conversion unit 5. This is a switch to be input to. Normally, a control signal from the motor control unit 3 is input to the power conversion unit 5. When a failure occurs, the safety control unit 1 or the WDT unit 2 controls the first switching unit 7 so that the control signal from the limp control unit 4 is input to the power conversion unit 5. That is, the mode is shifted to the limp home control mode.

Here, the safety control unit 1 or the WDT unit 2 further controls the second switching unit 8 when shifting to the limp home control mode, which will be described later.
As described above, the motor 6 is driven and controlled by the motor control unit 3 and the like via the power conversion unit 5 during normal times. When an abnormality occurs, the limp home control mode is set, and the limp control unit 4 controls the drive of the motor 6 via the power conversion unit 5.

  The safety control unit 1 switches the first switching unit 7 and the second switching unit 8 when a speed command from a host device (not shown) is transmitted to the motor control unit 3, a function for detecting various abnormalities, and an abnormality is detected. It has a function to safely shift to the limp home control mode by controlling. An example of these various functions will be described in detail when the safety control device 11 is described with reference to FIG.

  When the safety control unit 1 fails, the WDT unit 2 detects this failure and switches the first switching unit 7 and the second switching unit 8 to control the limp home control mode safely. Transition.

  For example, the WDT unit 2 has a configuration that controls the switching of the first switching unit 7 and the second switching unit 8 in addition to a general watchdog timer function. Particularly regarding the switching control of the second switching unit 8, for example, a one-shot pulse having a predetermined pulse width is output to the second switching unit 8. As a result, the second switching unit 8 is temporarily turned OFF for a predetermined time, thereby temporarily stopping the control power supply to the power conversion unit 5.

  Here, the control signal input to the power conversion unit 5 is effective when the power from the control power source is being supplied to the power conversion unit 5. In other words, either the control signal from the motor control unit 3 or the control signal from the limp control unit 4 is substantially in a state where the power from the control power source is not supplied to the power conversion unit 5. Is in an invalid state. In the invalid state, for example, all the six switching elements are turned off. These switching elements are switching elements for driving the motor 6 and are, for example, insulated gate bipolar transistors (IGBT), but are not limited to this example.

  The second switching unit 8 is a switch or the like that is switched between an ON state in which the control power supply is supplied to the power conversion unit 5 and an OFF state in which the power supply is cut off. The second switching unit 8 is normally in the ON state, and is switched to the ON state again after being temporarily switched to the OFF state by the safety control unit 1 or the WDT unit 2 in the event of an abnormality.

  In other words, in this method, when shifting to the limp home control mode, the supply of the control power to the power conversion unit 5 is temporarily stopped, and the first switching unit 7 is controlled to be switched during the stop. Realize safe switching to limp home control mode. “Safe” means that the switch pair (upper and lower switch pairs) of the power converter 5 (inverter, etc.) can be prevented from being turned on at the same time. It can be prevented from occurring.

The control power supply is not a high-voltage power supply for driving the motor 6, but supplies power for a low voltage (for example, about 4.5 (V) to 5 (V)) for the control circuit.
As described above, the safety control unit 1 or the WDT unit 2 temporarily turns off the second switching unit 8 during an abnormality, and executes and completes switching of the first switching unit 7 during that time. Therefore, at the time of abnormality, for example, a one-shot pulse having a predetermined pulse width is output to the second switching unit 8. Details will be described with reference to an example shown in FIG.

  From the above, it can also be said that the power conversion unit 5 drives the motor 6 based on a control signal that is enabled by the supplied control power. Further, it can be said that the motor control unit 3 generates a first control signal according to an arbitrary command, for example. It can be said that the limp control unit 4 generates, for example, a second control signal corresponding to a predetermined command set in advance. It can be said that the second switching unit 8 is, for example, a first switching unit that turns on / off the supply of the control power to the power conversion unit 5. The first switching unit 7 can also be referred to as a second switching unit that inputs one of the first control signal and the second control signal to the power conversion unit 5 as the control signal, for example.

  In addition, for example, when the safety control unit 1 detects any abnormality among various abnormalities, the safety control unit 1 controls the first switching unit to temporarily supply the control power supply power to the power conversion unit 5. It can also be said that after the supply is stopped, the second switching unit is controlled during the supply stop to switch to the limp home control mode in which the second control signal is input to the power conversion unit 5 as the control signal. .

  For example, when the WDT unit 2 detects an abnormality of the safety control unit 1, the WDT unit 2 controls the first switching unit to temporarily stop the supply of the control power supply to the power conversion unit 5. It can be said that during the supply stop, the second switching unit is controlled to switch to the limp home control mode in which the second control signal is input to the power conversion unit 5 as the control signal.

  Further, the WDT unit 2 may include, for example, a watchdog timer 12 and a one-shot pulse generation circuit 13 shown in FIG. For example, when the watchdog timer 12 detects an abnormality in the safety control unit 1, the one-shot pulse generation circuit 13 outputs a pulse having a predetermined time width to the first switching unit, thereby converting the power of the control power supply. The structure which stops supply to the part 5 temporarily may be sufficient.

The predetermined time width may be a time width equal to or longer than the OFF operation time of the motor driving switching element in the power conversion unit 5, for example.
The configuration and operation of the limp home system of the present example have been schematically described above with reference to FIG.

Hereinafter, the configuration and operation of the limp home system of this example will be described in more detail with reference to FIG. Of course, the system configuration is not limited to the example shown in FIG.
The limp home system of the example shown in FIG. 2 includes a safety control device 11, a watchdog timer 12, a one-shot pulse generation circuit 13, a power supply SW (switch) 14, control switching SW (switches) 15a and 15b, a power converter 16, A motor 17, a motor control device 18, a speed detector 19, a limp control device 20, and the like are included.

  The safety control device 11 may be regarded as an example of the safety control unit 1. The watchdog timer 12 and the one-shot pulse generation circuit 13 may be regarded as an example of the WDT unit 2. The power converter 16 may be regarded as an example of the power conversion unit 5, the motor control device 18 may be regarded as an example of the motor control unit 3, and the limp control device 20 may be regarded as an example of the limp control unit 4. Further, the power supply SW (switch) 14 may be regarded as an example of the second switching unit 8, and the control switching SW (switches) 15 a and 15 b may be regarded as an example of the first switching unit 7. Of course, it is not limited to these examples.

  The power converter 16, the motor 17, and the motor control device 18 are existing configurations, and are not particularly described here. However, the power converter 16 is, for example, a three-phase inverter, which is well-known. A pair of switching elements is provided for each phase (a switching element group 16b of six switching elements is provided), and each phase is turned ON / OFF with a phase difference of 120 degrees. The switching element is, for example, an insulated gate bipolar transistor (IGBT), but is not limited to this example.

  The power converter 16 includes the switching element group 16b and, for example, a photocoupler group 16a. A control signal from the motor control device 18 or limp control device 20 is input to the photocoupler group 16a, and the control power supply is supplied to the photocoupler group 16a. Each switching element of the switching element group 16b is ON / OFF controlled by the control signal input to the photocoupler group 16a, and the motor 17 is driven and controlled. However, in a state where the control power supply is not supplied, the control signal is substantially invalid and all the switching elements of the switching element group 16b are turned off.

  Further, the motor control device 18 generates the control signal based on the speed command S passed from the safety control device 11, and outputs it to the power converter 16 via the control switching SW 15a. However, this control signal is not input to the power converter 16 when the control switch SW15a is in the OFF (cut-off) state.

  Further, the limp control device 20 generates the control signal based on the prestored command value table 21 and the like instead of the speed command S, and sends the control signal to the power converter 16 via the control switching SW 15b. Output. However, this control signal is not input to the power converter 16 when the control switch SW15b is OFF (cut off).

  The control switching SWs 15a and 15b are switched and controlled by the safety control device 11 or the watchdog timer 12 so that when either one is ON (energized), the other is OFF (shut off). In normal times, the control switch SW15a is ON and the control switch SW15b is OFF, so that the motor controller 18 drives and controls the power converter 16 and the motor 17. On the other hand, if there is any abnormality, the control switch SW15a is switched to the OFF state and the control switch SW15b is switched to the ON state. As a result, the limp controller 20 drives the power converter 16 and the motor 17.

  Then, the control power supply is supplied to the power converter 16 (the photocoupler group 16a) via the power supply SW14. However, the control power supply power is not supplied to the power converter 16 when the power supply SW14 is OFF. In the state where the control power supply is not supplied, the control signal does not substantially function (is invalid), and all the six switching elements (IGBT, etc.) are turned off.

  A driving power supply (not shown) (for example, 100 V or more) is supplied to each switching element, and the motor 17 is driven by turning each switching element ON / OFF according to a control signal or the like. Here, when both of the paired switching elements are turned on, the power converter 16 may be burned out due to overcurrent. Experience has shown that such a situation can occur when switching to a control signal from the limp control device 20.

For this reason, in this method, by temporarily stopping the supply of the control power supply, all the switching elements are once turned off, and then the control signal is switched. That is, the control signal is switched to the control signal from the limp control device 20. Then, those control signals are enabled by resuming the supply of the control power supply power after the switching, the switching element is ON / OFF in response to the control signal. In this way, the above problem can be avoided.

  The power converter 16 is not limited to the configuration having the photocoupler group 16a. Even if there is no photocoupler, any configuration may be used as long as the control signals do not function and all the six switching elements (IGBT, etc.) are turned off in a state where control power is not supplied.

The speed detector 19 detects a speed P (such as the rotational speed of the motor 17). The detected speed P is input to the motor control device 18 and the safety control device 11.
On the other hand, in the example illustrated, the speed P is not input to the limp control device 20. The limp control device 20 can realize speed sensorless control. That is, the limp control device 20 has a function of inputting the output current Io and the output voltage Vo to the motor 17 from the power converter 16 and obtaining a speed estimated value based on these. This function itself may be an existing function described in Patent Document 2, for example. However, not limited to this example, the rate P is may be configured to be input to the limp control device 20. Also in this configuration, there may be a function for obtaining the speed estimated value.

  The output current Io indicates an output current value to the motor 17 detected by a current detector (not shown). This current detector arrives at a two-phase output. The output voltage Vo represents an output voltage value to the motor 17 detected by a voltage detector (not shown). This voltage detector arrives at a three-phase output.

  The voltage detector is not always necessary. That is, the output voltage Vo can be replaced by an output voltage command by adding a signal line 41 from the coordinate conversion unit 39 to the speed calculation unit 40 as shown in FIG. Therefore, it is possible to delete the voltage detector.

  The safety control device 11 includes functional units such as a speed instruction / monitoring processing unit 11a. The safety control device 11 is, for example, a CPU or the like, and the CPU executes an application program or the like stored in advance in a built-in memory (not shown), whereby processing functions (described later) such as a speed instruction / monitoring processing unit 11a ( For example, the processing of FIG.

  Note that processing functions to be described later such as the motor control device 18 and the limp control device 20 may be realized by, for example, a dedicated IC (for example, a programmable logic device (PLD)) or the like, or the CPU may execute an application program. It may be a form realized by executing the above.

  The speed instruction / monitor processing unit 11a reads, for example, a speed command S sent from a host device (not shown) at a constant cycle, and transmits the speed command S to the motor control device 18. The speed command S is generated by, for example, a host CPU (not shown) based on detection results from an accelerator sensor and a shift position sensor (not shown), and is transmitted to the safety control device 11 by a communication function or the like.

  Further, the speed instruction / monitoring processing unit 11a monitors and checks the presence / absence of an abnormality based on various inputs and the like. For example, based on the input (speed P) from the speed detector 19, it is monitored whether or not the speed upper limit is exceeded. In addition, various abnormalities are monitored. For example, a failure of any of the motor control device 18, speed sensor (speed detector 19), or watchdog timer 12 is detected, or an operation sequence abnormality of the safety control device 11 is detected, or whether the speed command S is normal. Or detect power failure, battery power shortage, etc. These abnormality detection methods will be described later.

  Here, as described above, the control switches SW (switches) 15a and 15b are in a state in which the power converter 16 and the motor 17 are driven and controlled by the motor control device 18 at the normal time.

  When the speed instruction / monitoring processing unit 11a determines that there is some abnormality, the control switching SWs 15a and 15b are switched and the limp control device 20 drives and controls the power converter 16 and the motor 17. Put it in a state. However, by outputting a one-shot pulse having a predetermined pulse width to the power supply SW 14 before this switching control, the control power supply power is temporarily prevented from being supplied to the power converter 16 (its photocoupler). .

  That is, the switching of the control switching SWs 15a and 15b is executed and completed in a state where the control signal is substantially invalid, that is, all the switching elements of the power converter 16 are OFF. Thereafter, the supply of control power is resumed, so that the control signal returns to a functioning state. As a result, it is possible to prevent the switch pairs of the power converter 16 from being simultaneously turned on, thereby preventing the power converter from being burned down due to overcurrent.

  An example of the switching operation is shown in FIG. For example, the switching operation as shown in FIG. 4 is the same in the case of the switching control by the watchdog timer 12 or the like described below, so FIG. 4 will be described together with the following description of the operation of the watchdog timer 12 or the like. Shall.

  Here, when the safety control device 11 breaks down, the above-described abnormality detection and switching control cannot be performed. On the other hand, in this example, a watchdog timer 12 and a one-shot pulse generation circuit 13 are provided.

  That is, when the watchdog timer 12 detects a failure of the safety control device 11, the watchdog timer 12 causes the one-shot pulse generation circuit 13 to output a one-shot pulse to the power source SW 14. For example, a one-shot pulse having a predetermined pulse width T1 as shown in the upper side of FIG. 4 is output. Thereby, the power supply to the power converter 16 is temporarily stopped (during time T1) by the power source SW14.

  During the one-shot pulse generation, the watchdog timer 12 further controls the control switching SWs 15a and 15b so that the limp control device 20 can drive and control the power converter 16 and the motor 17. That is, as shown in FIG. 4, the control switch SW15a is switched from ON to OFF, and the control switch SW15b is switched from OFF to ON.

  When the one-shot pulse ends, the power supply to the power converter 16 is resumed and the control signal becomes valid, so that the drive control by the limp control device 20 is substantially started. The failure detection itself of the safety control device 11 can be realized by the existing “watchdog timer” function (timeout), and therefore will not be described here.

  As shown in the “PWM command” on the upper and lower sides of FIG. 4, the drive control of the power converter 16 and the like is such that the control signal from the motor control device 18 is valid before the switching, and after the switching, The control signal from the limp control device 20 is valid, but both are invalid during the one-shot pulse generation.

  As described above, even when the safety control device 11 detects any one of the above-mentioned various abnormalities, the safety control device 11 executes a switching operation as shown in FIG. 4, for example. That is, as shown in FIG. 4, the safety control device 11 outputs a one-shot pulse having a predetermined pulse width T1 to the power source SW14, and switches the control switch SW15a from ON to OFF during this time T1. At the same time, the control switch SW15b is switched from OFF to ON.

  The limp control device 20 performs constant speed traveling control according to a magnetic flux command value and a speed command value specified in advance based on a command value table 21 or the like stored in advance. This control is executed by the sensorless vector control processing unit 22 shown in the figure. The sensorless vector control processing unit 22 can be realized by an existing technology, and an example of the configuration is shown in FIG. 9 and will be described later. Even in the case of constant speed traveling control, the driver can decelerate and stop by a brake operation.

Hereinafter, the configuration of FIG. 2 described above will be further described.
First, the safety control device 11 has the speed instruction / monitoring processing unit 11a as described above, and a processing flowchart thereof will be described later with reference to FIG.

  In addition to the above-described inputs, the safety control device 11 is further supplied with power supply information J, an alarm Q, and the like. The power supply information J is data transmitted from a host device (not shown) or the like including, for example, battery (battery) impedance and temperature data, voltage data of a power supply supplied to the safety control device 11, and the like.

C O Tchido' grayed timer 12, for example equipped with a counter (not shown), the counter is reset by periodic reset signal from the safety controller 11 when the safety control device 11 is normal. On the other hand, when there is some abnormality in the safety control device 11 and no reset signal is sent, the count value of the counter exceeds the set value.

The counter of the U O Tchido' grayed timer 12, if the count value as described above exceeds the set value as the timeout, and outputs a HIGH (1) signal to the safety controller 11. As a result, the safety control device 11 is reset. This is an existing function, but in this example, the one-shot pulse generation circuit 13 generates a one-shot pulse having a predetermined pulse width by inputting the HIGH (1) signal to the one-shot pulse generation circuit 13 as well. And output to the power source SW14. An example of the configuration and operation of the one-shot pulse generation circuit 13 will be described later with reference to FIG.

Here, it is explained using the example of outputting the HIGH (1) signal c O Tchido' grayed timer 12 as described above as a time-out, but of course, not limited to this example, U O Tchido' grayed timer 12, for example, timeout When a LOW (0) signal is output, a configuration corresponding to the LOW (0) signal may be used (for example, a NOT circuit (not shown) or the like described later is not necessary).

Also, U O Tchido' grayed timer 12, in addition to the counter is the configuration of the general U O Tchido' grayed timer, further control switching SW15a, also have structure (not shown) for generating a control signal 15b It may be. This is, for example, a configuration that outputs the output of the counter (the output related to timeout) inverted with respect to the control switching SW 15a, 15b (not shown, etc.). However, the present invention is not limited to this example. For example, when the control switching SW 15a has the configuration shown in FIG. 7B described later and the control switching SW 15a has the configuration shown in FIG. 6B described later, such a NOT circuit is not necessary. Alternatively, as described above, even upon the manner of the output of the time-out of U O Tchido' grayed timer 12, the configuration is one change. Here, the case of the above example will be described.

As described above in the example, since the normal output of the counter is LOW (0), which by being inverted by the NOT circuit, U O Tchido' grayed control from the timer 12 switching SW15a, output to 15b are “1” (ON). 6A and 7A, if the output from the safety control device 11 is ON, the control switch SW15a is ON (energized) and the control switch SW15b is OFF. (Blocking).

On the other hand, the output of the street counter becomes HIGH (1) in case of trouble (the timeout), which by being inverted by the NOT circuit, c O Tchido' control change SW15a from grayed timer 12, to 15b The output is “0” (off). Thus, in the example shown in FIGS. 6A and 7A, the control switch SW15a is switched to OFF (shut off), and the control switch SW15b is switched to ON (energization).

In the case of the example shown in FIGS. 6A and 7A, the safety control device 11 normally outputs “1” (ON) to the control switching SWs 15a and 15b. Is detected, it is set to “0” (off). Thus, U O Tchido' grayed timer 12 from control change SW15a, when the output of the 15b is to be the state at the time of the normal, the normal control switch SW15a is ON (energized), the control switching SW15b is OFF (cutoff) However, when an abnormality is detected, the control switch SW15a is switched off (cut off) by the safety control device 11, and the control switch SW15b is switched on (energized).

Even if both of the safety control device 11 and the U O Tchido' grayed timer 12 has performed the operation at the time of the abnormality, the control switching SW15a is switched to OFF (blocking), the control switching SW15b be switched to ON (energized) become.

  As described above, in this example, the control switch SW15a is ON and the control switch SW15b is OFF in the normal state. From this, the control signal (output voltage command R (three-phase)) from the motor controller 18 is obtained. Is input to the power converter 16. On the other hand, when the above switching is performed according to some abnormality, the control switching SW 15a is turned off and the control switching SW 15b is turned on. As a result, the control signal (output voltage command R ′ (three-phase)) from the limp control device 20 is input to the power converter 16. That is, the limp control device 20 switches to a state in which the power converter 16 and the motor 17 are driven and controlled.

  In this example, two control switching SWs 15a and 15b are provided as control switching switches. However, the present invention is not limited to this example, and may be configured with only one switch as shown in FIG. In this description, the two may be collectively referred to as a control switch SW15.

Note that U O Tchido' grayed timer 12, said time-out feature, in addition to the reset output function, the time window c O Tchidoggu function, power up / down reset external voltage monitoring function, the enable input function, the enable output function, the pseudo-out reset It may have a function.

One-shot pulse generating circuit 13, c O when Tchido' input from grayed timer 12 is changed from OFF to ON, generates a one-shot pulse of such off → on → off as shown in the drawing the upper side of FIG. 4, for example This is output to the power source SW14. For example, the pulse width T1 is equal to or longer than the operation time of the switching elements of the switching element group 16b of the power converter 16. This operation time means, in particular, the time required until the switching element is actually turned off when switching to OFF. This is because the power supply of the control power supply is resumed in a state where all the switching elements of the power converter 16 are reliably switched to the OFF state as described above.

Although the one-shot pulse generation circuit 13 has an existing configuration, a specific example thereof is shown in FIG. 10 and will be described later.
The power supply SW14 is a control power supply cut-off switch, and turns on / off the power supply of the control power supply to the photocoupler group 16a or the like that is an output voltage command (three-phase) output control device. The switching control signal of the power supply SW 14 is an output from the safety control device 11 and an output from the one-shot pulse generation circuit 13, and operates according to the logic shown in FIG. That is, only when both of the above two inputs to the power supply SW14 are off, the power supply SW14 is in an on state, thereby supplying power to the power converter 16 (the photocoupler group 16a). ing. When either one or both of the two switching control signals to the power source SW14 are turned on, the power source SW14 is turned off, and thus the power converter 16 (the photocoupler group 16a) is turned on. The power supply of the control power supply is stopped.

  The power supply SW 14 has, for example, the configuration shown in FIG. 5B, and thereby realizes the logic shown in FIG. That is, the power supply SW14 includes the illustrated OR circuit and switching circuit.

  The output of the safety control device 11 and the output of the one-shot pulse generation circuit 13 are input to the OR circuit. The output of the safety control device 11 here is an output from an output terminal (not shown) that outputs a one-shot pulse. Accordingly, the output of the OR circuit becomes “0” (L) only when both the output of the safety control device 11 and the output of the one-shot pulse generation circuit 13 are “0” (L), and either or both of them are In the case of “1” (H), the output of the OR circuit is “1” (H). In other words, when a one-shot pulse is output from one or both of the safety control device 11 and the one-shot pulse generation circuit 13 (for example, during the predetermined time T1), the output of the OR circuit is “1”. (H).

  When the output of the OR circuit is “0” (L), the switching circuit turns on the transistor Tr1 (the power supply SW14 is turned on), so that the control power supply power (4.5 V) is transferred to the photo of the power converter 16. This is supplied to the coupler group 16a. On the other hand, when the output of the OR circuit is “1” (H), the transistor Tr1 is turned off (the power supply SW14 is in the off state), so that the control power supply power is not supplied to the photocoupler group 16a of the power converter 16. It becomes a state. That is, for example, when the output of the OR circuit becomes ‘1’ (H) for the predetermined time T <b> 1, the power supply of the control power supply to the power converter 16 can be temporarily stopped.

  The control changeover switches 15a and 15b are output voltage command changeover switches, and the inputs thereof are the above control signals. The inputs for the ON / OFF changeover control are the output from the safety control device 11 and the watchdog timer 12. And output from. In this case, these outputs are not the one-shot pulse, but in the case of the watchdog timer 12, they are inverted outputs by the above-described NOT circuit, and the output from the safety control device 11 is the same as this.

The control switch SW15a operates with the logic shown in FIG. 6A, and the control switch SW15b operates with the logic shown in FIG.
That is, as shown in FIG. 6A, the control switching SW 15a is turned on (energized) only when both the output from the safety control device 11 and the output from the watchdog timer 12 are on, and all other cases are performed. OFF (shut off). On the other hand, as shown in FIG. 7A, the control switching SW 15b is OFF (shut off) only when both the output from the safety control device 11 and the output from the watchdog timer 12 are ON, and all other cases are performed. Turns on (energized). In the ON (energized) state, the control signal input to the self is output to the photocoupler group 16a of the power converter 16.

Then, for example, the logic shown in FIG. 6A is realized by the configuration shown in FIG.
FIG. 6B is a configuration example of the control switching SW 15a.
As shown in FIG. 6B, the control switching SW 15a includes, for example, six buffer circuits provided on the six signal lines for the control signal and an AND circuit. The output of the AND circuit is output as an ON / OFF (energization / cutoff) control signal to all buffer circuits.

  That is, when the output of the AND circuit is “1” (H), all the buffer circuits are turned on (energized), that is, the control switch SW15a is turned on, so that the output voltage command R (three) is supplied from the motor control device 18. Phase) is input to the power converter 16. On the other hand, when the output of the AND circuit is '0' (L), all the buffer circuits are turned off (cut off), that is, the control switch SW15a is turned off, and the output voltage command R (control signal R) is cut off.

  The inputs of the AND circuit are an output from the safety control device 11 and an output from the watchdog timer 12. Normally, these two inputs are both “1” (H), and the output of the AND circuit is “1” (H). Therefore, as described above, the control switch SW15a is in the ON state. It has become. That is, the power control unit 18 and the motor 17 are driven and controlled by the motor control device 18. When the output of one or both of the safety control device 11 and the watchdog timer 12 becomes “0” (L), the output of the AND circuit becomes “0” (L), and the control switch SW15a is turned off as described above. It becomes a state.

Similarly, for example, the logic shown in FIG. 7A is realized by the configuration shown in FIG.
FIG. 7B is a configuration example of the control switching SW 15b.
As shown in FIG. 7B, the control switching SW 15b includes, for example, six buffer circuits provided on the six signal lines for the control signal and a NAND circuit. The output of the NAND circuit is output as an ON / OFF (energization / cutoff) control signal to all buffer circuits.

  That is, when the output of the NAND circuit is “1” (H), all the buffer circuits are turned on (energized), that is, the control switching SW 15 b is turned on, and thus the output voltage command R ′ ( 3 phase) is input to the power converter 16. On the other hand, when the output of the NAND circuit is '0' (L), all the buffer circuits are turned off (cut off), that is, the control switch SW15b is turned off, and the output voltage command R '(control signal R') is cut off. The

  The inputs of the NAND circuit are an output from the safety control device 11 and an output from the watchdog timer 12. These may be the same as the input to the AND circuit of the control switch SW15a. Accordingly, in normal times, these two inputs are both “1” (H), and the output of the NAND circuit is “0” (L). It is in the OFF state. When the output of one or both of the safety control device 11 and the watchdog timer 12 becomes “0” (L), the output of the NAND circuit becomes “1” (H), and the control switch SW15b is turned on as described above. Switch to state. That is, the limp control device 20 switches to a state where the power converter 16 and the motor 17 are driven and controlled.

The power converter 16, the motor 17, the motor control device 18, and the speed detector 19 have the existing configurations as described above, and will be briefly described below.
The power converter 16 receives an output voltage command PWM signal (either one of the control signals R and R ′) and outputs a three-phase AC voltage to the motor 17 in accordance with the output voltage command.

The motor 17 is, for example, a three-phase induction motor, but is not limited to this example.
The motor control device 18 receives the speed command value S from the safety control device 11 and generates and outputs a PWM signal (control signal R) of an output voltage command to the power converter 16 based on the speed command value S. As feedback, output current Io, output voltage Vo, and speed data P detected by the speed detector 19 are input. The speed detector 19 is, for example, a motor shaft speed detection sensor.

  The limp control device 20 includes a command value table 21, a sensorless vector control processing unit 22, and the like, and generates and outputs a PWM signal (control signal R ′) as an output voltage command to the power converter 16. Further, data such as the output current Io and the output voltage Vo are input as feedback.

The limp control device 20 performs speed control of the motor 17 based on information in the command value table 21 set in advance.
In the command value table 21, for example, as shown in FIG. 9, for example, magnetic flux command values and speed command values are registered. The configuration of the sensorless vector control processing unit 22 will be described later with an example shown in FIG. The configuration of the sensorless vector control processing unit 22 shown in FIG. 9 may be regarded as substantially the same as that described in Patent Document 2, for example. However, since the command value table 21 is provided as described above in this example, the power converter 16 and the motor 17 can be driven and controlled without any problem even if there is no command based on the accelerator opening or the like.

FIG. 3 is a processing flowchart of the safety control device 11 (its speed instruction / monitoring processing unit 11a).
The speed instruction / monitoring processing unit 11a generally reads a speed command S from a host device (not shown) at a regular cycle, transmits the speed command S to the motor control device 18, various input data, and the like. Based on the above, processing for monitoring the occurrence of abnormality is performed. An example of this monitoring process is a process of monitoring whether or not the speed upper limit is exceeded based on the input (speed P) from the speed detector 19.

For example, the speed instruction / monitoring processing unit 11a periodically executes the process illustrated in FIG.
First, it is confirmed whether or not the transition to the limp home mode has already been made (step S11). If it is already in the limp home mode (step S11, YES), the process proceeds to step S20 described later.

Limp if not the home mode (step S11, NO), it is subsequently determined whether or not for example U O Tchido' grayed timer 12 is normal (step S12). This determination method, for example, be confirmed by such pseudo timeout reset c O Tchido' grayed timer 12. This is an existing technology and will be briefly described below.

Pseudo-out reset safety control device 11, U O timeout reset signal from Tchido' grayed timer 12 is masked when those which generate intentionally timeout by not reset the c O Tchido' grayed timer 12 is there. If U O Tchido' grayed timer 12 is normal, but will be time-out reset signals being outputted, since while as mask described above, will not be safety controller 11 has been reset. On the other hand, if there is abnormality or c O Tchido' grayed timer 12 what like, by time-out reset signal is not output, it can be determined that abnormality.

If U O Tchido' grayed timer 12 is abnormal (step S12, NO), control proceeds to step S22. The processing in step S22 (transition processing to limp home mode) performs the operation already described with reference to FIG. 4 and the like, and will be briefly described below.

  First, by outputting a one-shot pulse having the predetermined pulse width to the power supply SW14, the power supply SW14 is changed from the on state to the off state, and after a predetermined time, the power supply SW14 is returned to the on state. That is, the power supply SW14 is turned off for a certain period of time, and the control power supply is temporarily stopped.

  While the power supply SW 14 is turned off, the control switch SW15a is switched from on to off, and the control switch SW15b is controlled from off to on. As described above, when the output to the control switching SWs 15a and 15b is ‘1’ (H), the control switching SW 15a is turned on and the control switching SW 15b is turned off. Conversely, when the output to the control switches SW15a and 15b is '0' (L), the control switch SW15a is off and the control switch SW15b is on. Here, it is assumed that the same output signal is input to both the control switching SWs 15a and 15b. However, the present invention is not limited to this example.

When execution of the above process is completed, the process proceeds to step S20 described later.
On the other hand, when the U O Tchido' grayed timer 12 is determined to be normal proceeds to (step S12, YES), the next process (step S13).

  Although not described one by one, regarding steps S13, S14, S17, S18, and S19, which will be described later, if the determination result is YES, the "next process" in the figure (for example, the process of step S18 if step S17) ).

  Step S13 is a process for confirming whether or not the speed command S from a host device (CPU or the like) (not shown) is normal. This confirmation method is, for example, for confirming coincidence in multiplexing of speed command signals. For example, as a configuration in which two speed commands S are transmitted by performing duplication, it is confirmed whether or not the two speed commands S match. Of course, if they match, it is determined to be normal.

  Alternatively, the speed command signal may be pulsed, and when the pulse width is a predetermined width, it may be determined as normal. Note that the pulse formation uses a pulse signal having a relatively narrow pulse width when the data value is ‘0’ and a relatively wide pulse width when the data value is ‘1’.

  The present invention is not limited to these examples. For example, it may be confirmed whether it is normal by CRC added to the communication message, sequence number check, response time monitoring, or the like. Since these are existing technologies, they will not be described in particular.

If it is determined that the speed command S is not normal (step S13, NO), the process proceeds to step S22.
Further, for example, it is confirmed whether or not the power supply is normal (step S14). In this confirmation method, for example, an overvoltage or an undervoltage is determined by comparing a voltage value of a power supply (control power supply or the like) to the safety control device 11 with a preset threshold value. Or when the voltage fluctuation of the said power supply exceeds a preset threshold value, it determines with it being abnormal.

  Although not shown in FIG. 2, for example, the control power is also supplied to the safety control device 11, and the safety control device 11 can measure the voltage value and the like. Of course, the present invention is not limited to this example. For example, a voltmeter (not shown) for measuring the voltage value of the control power supply or the like may be provided, and the measurement data may be input to the safety control device 11. .

  Further, the safety control device 11 may input battery impedance and battery temperature data, and may determine whether the battery power is insufficient based on these data. This is determined, for example, by comparison with a threshold value for determining battery power shortage. These confirmation methods may also be regarded as existing technologies.

Note that the power supply information J shown in FIG. 2 may be regarded as corresponding to the input data for the determination in step S14, but is not limited to this example.
If it is determined that the power supply is not normal (step S14, NO), the process proceeds to step S22.

Note that the order of the processing in steps S12, S13, and S14 is not limited to the above example, and may be anything.
When all the determination results in steps S12 to S14 are YES, a speed command S is output to the motor control device 18 (step S15). Then, after a certain time (after the monitoring start time t1 in FIG. 8 elapses), a value obtained by adding a predetermined margin to the speed command value S is set as the upper limit speed (Nmax in FIG. 8), and the motor speed is monitored ( Step S16). That is, it is monitored whether the input speed P exceeds the upper limit speed. still. This confirmation method may also be regarded as an existing technology. When the speed P exceeds the upper limit speed (step S18, NO), it is regarded as an abnormality of the apparatus after the motor control apparatus 18, and the process proceeds to step S22.

  However, before that, it may be confirmed whether or not the speed detector 19 is normal (step S17). This confirmation method is performed by, for example, validity confirmation between the phases of the two-phase output. That is, when the deviation of the phase of the output phase of the encoder, which is an example of the speed detector 19 (speed sensor), is within a predetermined range set in advance, it is determined as normal. As described above, generally, the phase shift between the phases is usually about 120 °. Note that this confirmation method may be regarded as an existing technology.

If it is determined that the speed detector 19 is not normal (step S17, NO), the process proceeds to step S22.
Further, for example, it is confirmed whether or not there is an abnormality in the motor control device 18 (step S19). For example, the presence or absence of an alarm from the motor control device 18 is confirmed. That is, when the motor control device 18 detects its own abnormality or the like, the motor control device 18 outputs the alarm Q shown in FIG. If there is an alarm Q (NO in step S19), the process proceeds to step S22. Note that the self-abnormality detection function of the motor control device 18 is an existing technology and will not be described here.

  Further, it checks whether or not the operation sequence of itself (speed instruction / monitoring processing unit 11a) is normal (step S20). In this confirmation method, for example, a sequence number or the like is given in advance to the processing of each step in FIG. 3, and the sequence number is sequentially stored every time an arbitrary step processing is executed. At this time, it is performed by reversing the sequence number or confirming the jump based on the stored contents.

If own operating sequence is not normal and the process ends without performing (step S20, NO), the step of resetting c O Tchido' grayed timer 12. Thus, U O Tchido' grayed timer 12 is to detect an abnormality of the safety control device 11, thereby performing an operation abnormality described above. On the other hand, if its own operation is normal (step S20, YES), performs the reset process c O Tchido' grayed timer 12 (step S21) and the process ends.
FIG. 9 is a configuration example of the limp control device 20 and is a diagram illustrating a function of the sensorless vector control processing unit 22.

  As described above, the limp control device 20 includes the command value table 21 and the sensorless vector control processing unit 22. 9 may be regarded as the configuration of the limp control device 20, and the configuration other than the command value table 21 illustrated therein is the configuration of the sensorless vector control processing unit 22.

The command value table 21 stores a magnetic flux command value and a speed command value that are specified in advance so as to enable control at a constant speed at a low speed.
The sensorless vector control processing unit 22 includes, for example, the illustrated coordinate conversion unit 31, speed adjuster 32, torque current command calculation unit 33, torque current adjustment unit 34, magnetization current command calculation unit 35, magnetization current adjustment unit 36, and slip frequency calculation. A unit 37, an adder 38, a coordinate converter 39, a speed calculator 40, and the like.

  The magnetic flux command value in the command value table 21 is read by the magnetizing current command calculation unit 35, and the speed command value is read by the speed regulator 32. The speed regulator 32 inputs a difference between the speed command and the speed information, performs proportional and integral feedback control, and outputs a torque command.

  Here, the coordinate conversion unit 31, the speed adjuster 32, the torque current command calculation unit 33, the torque current adjustment unit 34, the magnetization current command calculation unit 35, the magnetization current adjustment unit 36, the slip frequency calculation unit 37, the addition unit 38, The coordinate conversion unit 39 and the speed calculation unit 40 are the coordinate conversion unit 122, the speed regulator 112, the torque current command calculation unit 113, the torque current adjustment unit 114, and the magnetization current command calculation unit 115 of Patent Document 2 shown in FIG. The magnetizing current adjusting means 116, the slip frequency calculating means 117, the adding means 118, the coordinate converting means 119, and the speed calculating means 153 may be substantially the same, and the description thereof is omitted here.

  The output voltage detector and circuit can be replaced by an output voltage command and can be deleted. To realize this, a signal line 41 from the output of the coordinate conversion unit 39 to the speed calculation unit 40 may be added as shown in FIG. In this case, the detector (not shown) of the output voltage Vo shown in the figure and the input signal line to the speed calculation unit 40 of the output voltage Vo may be deleted.

  The configuration of the limp control device 20 is not limited to the example of FIG. 9 and may be an existing general configuration. However, in the case of the configuration of FIG. 9, abnormal acceleration or the like can be prevented by performing sensorless vector control. In addition, even when the speed sensor breaks down, it is possible to travel in a limp home mode at a constant speed at a low speed such as on a slope where torque control is required, and safety is improved.

  Alternatively, in the configuration of FIG. 9, speed sensorless operation is possible, so that even if the speed detector 19 breaks down, it can operate without any problem. Further, in the case of the configuration shown in FIGS. 2 and 9, the limp control device 20 performs control based on the command value table 21 set in advance, so that it is possible to operate even in the state of “no speed command input”. It is done. “Speed command” is, for example, a signal generated by a host CPU (not shown) based on detection results from an accelerator sensor and a shift position sensor (not shown) and transmitted to the safety control device 11 and the like by a communication function or the like. Etc. Even in a situation where the “speed command” cannot be input due to an abnormality such as a sensor failure, disconnection, noise, short circuit, or the like, since the control is performed based on the command value table 21 as described above, it can operate without any problem. For example, the vehicle can be driven at a constant speed (low speed). For example, the vehicle can be driven in a limp home mode at a constant speed (low speed) in a situation where torque control such as a slope is necessary, and safety is improved.

FIG. 10 is a configuration example of the one-shot pulse generation circuit 13.
The one-shot pulse generation circuit 13 in the illustrated example has two counters, a counter CNT1 and a counter CNT2.

The one-shot pulse generation circuit has various existing configurations, and the configuration shown in FIG. 10 is one of them and is a known configuration, so that it will be briefly described below.
The counter CNT1 generates, for example, one pulse per 1 ms from a clock signal CLK of 1 (MHz) (N_FLAG in the figure), in other words, generates a signal corresponding to a clock signal of 1 (kHz). It is. Based on the pulse every 1 (ms), the counter CNT2 outputs a signal (one-shot pulse) having a pulse width of 10 ms from the time when the input INPUT becomes HIGH (1) as the OUTPUT shown in the figure.

  The counter CNT2 monitors its own count value and sets its output OUTPUT to HIGH (1) while it is '10' or less. The count value is preset to '11' by the illustrated RESET signal when the power is turned on, and the output value OUTPUT is LOW (0) because the counter value is not 10 or less. After that, when INPUT becomes HIGH (1) at any time, the counter value is “11”, so the counter value is preset to “0” and the count operation based on N_FLAG is started. The counter value is counted up from 0 → 1 → 2 →..., And the output OUTPUT becomes HIGH (1) while it is “10” or less as described above. When the counter value reaches ‘10’, the count value is preset to 12 and the count operation stops. In this way, a one-shot pulse with a pulse width of 10 (ms) is generated and output.

The counter CNT1 is not always necessary. For example, if there is a clock signal of 1 (kHz), the counter CNT1 is not necessary.
After the one-shot pulse generation circuit 13 counts up, even if the output from the watchdog timer 12 to the one-shot pulse generation circuit 13 is HIGH (1), the output from the one-shot pulse generation circuit 13 is LOW (0). become.

  Here, the ON / OFF switching operation of the switching element takes some time (for example, about 10 ms). Therefore, it takes some time until all the six switching elements are turned off after the power supply SW 14 is turned off. Thus, in order to more reliably prevent the occurrence of the burnout, it is desirable to enable the control signal (restart the supply of control power) after all the six switching elements are turned off. . The pulse width of the one-shot pulse may be determined based on, for example, such a concept. For example, “pulse width = 10 ms + α” may be used. However, the present invention is not limited to such an example.

  According to the limp home system of this example described above, it is possible to prevent the power converter switch pair from being simultaneously turned on by temporarily shutting off the power supply (control power supply) of the control signal when the output voltage command (control signal) is switched. Thus, it is possible to prevent burning of the power converter due to overcurrent.

  Further, in sensorless vector control, PI feedback control is performed by the speed regulator 32 of FIG. 9, and abnormal acceleration is detected as a difference between the speed command and the speed information, and the abnormal acceleration is subtracted to follow the speed information. Abnormal acceleration can be prevented because of torque control output. Thus, in addition to the effect of preventing the power converter from being burned out, it is possible to realize the transition to the limp home mode even when the automobile is not stopped and in the running state. In addition, it is possible to avoid danger such as stopping at a level crossing. These effects can be obtained with this method, even if the vehicle shifts to limp home mode while driving, there is a danger that the vehicle will behave abnormally (abnormal acceleration, sudden shutdown due to power converter burnout, etc.) This is because the sex is very low.

  In addition, when the limp control device is configured to perform torque control without a speed sensor, even if the speed sensor fails, the limp control device can travel in a limp home mode at a constant speed at a low speed in a scene where torque control is necessary, such as a slope. Safety is improved.

  Moreover, according to the limp home system of this example mentioned above, it can respond also when the safety control apparatus 11 fails. That is, when the safety control device 11 fails, the watchdog timer 12 detects the failure and switches the control signal. At that time, similarly to the above, it is possible to prevent the switch pairs of the power converters from being simultaneously turned on, thereby preventing the power converters from being burned out due to overcurrent.

  Further, in Patent Document 1, only the failure of the motor control unit is targeted, and any of the motor control device, speed sensor, safety control device, speed command, and WDT fails, or a power supply abnormality or a battery power shortage is detected. However, limp home mode can be realized and safety is improved.

  In addition, a safety function can be realized without using a duplex (redundant) configuration, and cost reduction can be achieved. According to the configuration of the present technique, for example, the configuration of FIG. 2, for example, even if a redundant configuration (redundant motor control device 18 or safety control device 11) is not used, the vehicle continues to run safely in the event of any abnormality. Can be made. The automobile in this description is an automobile driven by an electric motor, such as an electric automobile or a hybrid car.

DESCRIPTION OF SYMBOLS 1 Safety control part 2 WDT (watchdog timer) part 3 Motor control part 4 Limp control part 5 Power conversion part 6 Motor (induction motor)
7 First switching unit 8 Second switching unit 11 Safety control device 12 Watchdog timer 13 One-shot pulse generation circuit 14 Power supply SW (switch)
15a, 15b Control switch SW (switch)
16 Power converter 17 Motor 18 Motor controller 19 Speed detector 20 Limp controller 21 Command value table 22 Sensorless vector control processor 31 Coordinate converter 32 Speed regulator 33 Torque current command calculator 34 Torque current adjuster 35 Magnetizing current Command calculation unit 36 Magnetizing current adjustment unit 37 Slip frequency calculation unit 38 Addition unit 39 Coordinate conversion unit 40 Speed calculation unit

Claims (6)

A limp home system in an automobile equipped with an electric motor,
Power conversion means for driving the electric motor based on a control signal that is enabled by the supplied control power, and
First switching means for turning on / off the supply of the control power to the power conversion means;
Motor control means for generating a first control signal according to an arbitrary command;
Limp control means for generating a second control signal according to a predetermined command set in advance;
Second switching means for inputting any one of the first control signal and the second control signal to the power conversion means as the control signal;
When an abnormality is detected, the first switching means is controlled to temporarily stop the supply of the control power supply to the power conversion means, and then the second switching means is controlled while the supply is stopped. Safety control means for switching to a limp home control mode for inputting the second control signal to the power conversion means as the control signal;
A limp home system characterized by comprising: A watchdog means having a watchdog timer for detecting an abnormality of the safety control means;
The watchdog means, when detecting an abnormality of the safety control means, controls the first switching means to temporarily stop the supply of the control power supply to the power conversion means, 2. The limp home system according to claim 1, wherein the limp home system is switched to the limp home control mode in which the second switching means is controlled to input the second control signal as the control signal to the power conversion means during the stop. 3. . The watchdog means has a one-shot pulse generation circuit,
When the watchdog timer detects an abnormality of the safety control means, the one-shot pulse generation circuit outputs a pulse having a predetermined time width to the first switching means, whereby the control power supply power is supplied to the power conversion means. The limp home system according to claim 2, wherein the supply is temporarily stopped.   The limp home system according to claim 3, wherein the predetermined time width is a time width equal to or longer than an OFF operation time of the switching element for driving the electric motor in the power conversion means.   The safety control means can detect a plurality of types of abnormalities, and performs switching to the limp home control mode when any of the abnormalities is detected. Limp home system as described.   The safety control means may be any of an abnormality of the safety control means itself, an abnormality of the motor control means, an abnormality of the watch dog means, an abnormality of a speed sensor for detecting the speed of the motor, a power supply abnormality, and a battery power shortage. 6. The limp home system according to claim 5, wherein two or more abnormalities can be detected.