JPH07143604A - Electric motor vehicle controller - Google Patents

Abstract

PURPOSE:To provide an electric motor vehicle controller having high reliability by conducting double check of comparing executing cycle periods with calculated results of microprocessors, deciding the fault of the microprocessor if the period is normal but the calculated result is abnormal and outputting the normal calculated result of the microprocessor. CONSTITUTION:Faults of a first microprocessor 1 having a split calculator of a vehicle controller 11 and a sub-motor controller 12 and a second microprocessor 2 having a split calculator of a sub-vehicle controller 15 and a motor controller 18 are decided by a microprocessor fault deciding circuit 3 from the combination of a watch dot signal 24 and a microprocessor fault detection signal 25. Faults of various sensors are decided by a sensor fault detector 4, and a fault mode diagnosing circuit 5 switches a switching circuit 6, a switch 16 and a control pulse switching unit 23 to a normal control, a complementary control, a stop control, etc.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control device for an electric vehicle, and more particularly to a control device suitable for an electric vehicle.

[0002]

2. Description of the Related Art As a conventional electric vehicle control device, there is one disclosed in JP-A-1-164201. According to this, the configuration is such that the controller can be switched from the primary to the secondary, and when the positive controller malfunctions during the traveling control of the electric vehicle, the reliability of the traveling control of the electric vehicle is improved by switching to the secondary controller. Is.

Further, as an automobile control device, Japanese Patent Laid-Open No. 61-
Some are disclosed in Japanese Patent No. 49154. This is provided with two microcomputers, that is, a first microcomputer and a second microcomputer, which are configured in the same way as each other, and divides a plurality of control items into two and simplifies the main task of performing a regular control process for each divided control item. Prepare a sub-task that performs simplified control processing,
A subtask that causes the first microcomputer to share a main task that normally executes one division control item and a subtask that simplifies and executes the other division control item, and simplifies and executes one division control item. And the main task of executing the other division control item normally is shared by the second microcomputer, and when one of the microcomputers has an abnormal operation, the control output signal from the abnormal microcomputer is prohibited. In addition, by sending the main control output signal and the sub control output signal obtained by executing the main task and the sub task to the controlled system by the microcomputer in which no abnormality has occurred, a relatively small scale and low Equipped with a backup function in case of abnormal operation of the microcomputer due to its costly configuration One, together with the processing capability can improve the use efficiency of hardware resources, it is possible in particular to improve the processing speed.

[0004]

DISCLOSURE OF THE INVENTION Problems to be Solved by the Invention
1-164201 gazette), it is possible to switch from primary to secondary by using two controllers to improve reliability, but the secondary controller is in standby state unless the primary controller fails. . Therefore, when it is normal, the control performance of the electric vehicle is determined only by the performance of the positive controller, which may delay the discovery of the failure.
Then, there is a waste that the processing capacity of the sub controller is not utilized, and if it is in a standby state for too long, it may not be possible to understand even if it breaks down, and there is also a concern when it is necessary.

Further, in the above-mentioned prior art (Japanese Patent Laid-Open No. 61-49154), a plurality of types of control items are divided into two, primary and secondary processing is provided for each control item, and the two controllers independently operate. It performs processing and outputs a control signal to the controlled system. This method only monitors the cycle of the loop execution cycle of the program for detecting the failure between the two controllers, and does not judge the abnormality of the result of the control processing. Since the primary and secondary processes are provided for each control item, and are shared by the two controllers,
If the cycle of the loop execution cycle of the program of one controller becomes abnormal, engine control is possible by the sub-control processing of the remaining controller, but even if the cycle of the loop execution cycle of the program is normal,
If the result of the positive control process is abnormal, there is a problem that an abnormal control signal is output to the controlled system.

SUMMARY OF THE INVENTION An object of the present invention is to provide an electric vehicle control device which has a reliable two-way controller in which two primary and secondary controllers are always operated and which has a highly reliable traveling control independent of the positive controller.

Furthermore, the traveling control of an electric vehicle uses, for example, a speed sensor or a current sensor, which is a detection means for detecting the traveling state of the electric vehicle, to detect, for example, the rotation speed or current of the electric motor and feed back the detected result. It is controlled by the controller. Therefore, besides the controller failure,
Failure of these speed sensors or current sensors is also possible. The securing of reliability in this case is also not described in the above-mentioned prior art.

A second object of the present invention is to provide an electric vehicle control device which is supplemented with a complementary control for a failure of a speed sensor or a current sensor and further improved in reliability.

[0009]

The first object is to provide an electric motor for driving an electric vehicle, an electric power converting means for supplying electric power to the electric motor, a detecting means for detecting a running state of the electric vehicle, A control unit that calculates a control command for controlling the power conversion unit based on detection information from the detection unit, wherein the control unit includes a first calculation unit that executes a calculation of the control command and a first calculation unit. A first arithmetic unit and a second arithmetic unit, and a sub arithmetic unit that executes a normal control arithmetic operation and a simplified arithmetic operation. And prepared,
A first control means including the first positive operation part and the second sub operation part; and a second control means including the first sub operation part and the second positive operation part, the first control means Is the period of the watchdog signal issued by the second control means for each operation execution cycle, the operation result of the first positive operation section executed by the first control means, and the first sub-operation executed by the second control means. From the difference in the calculation result of the calculation unit and the difference between the calculation result of the second sub-calculation unit executed by the first control unit and the calculation result of the second positive calculation unit executed by the second control unit, (2) a second control means failure detection means for detecting a failure of the second control means and outputting a second control means failure detection signal, wherein the second control means is a watchdog which the first control means emits in each operation execution cycle. The signal cycle, the calculation result of the first positive calculation unit, and the first A failure of the first control means is detected from the difference between the operation results of the operation section and the difference between the operation result of the second sub operation section and the operation result of the second correct operation section, and a first control means failure detection signal is detected. A first control means failure detection means for outputting, the cycle of the watchdog signal of the first control means, the cycle of the watchdog signal of the second control means, the first control means failure detection signal, From a combination with the second control means failure detection signal, a failure of the first control means or the second control means is determined, and a control means failure determination means for outputting a switching signal, and the first switching means in accordance with the switching signal. First switching means for switching the calculation result of the one-correction arithmetic unit and the calculation result of the first sub-calculation unit, and the calculation result of the second positive calculation unit and the calculation result of the second sub-calculation unit according to the switching signal. And the second switching means It is achieved by providing.

A second object is to detect a rotation speed of an electric motor for driving an electric vehicle or a current flowing through the electric motor, and to normalize a traveling control command based on a detection signal of the detection sensor. In an electric vehicle control device including control calculation means for calculating, the traveling control command is calculated based on a simplified control method such as an open loop voltage / frequency control method or a voltage / frequency control method with slip control instead of the detection signal. Complementary calculation means for complementing the control calculation means, failure detection means for detecting a failure of the detection sensor and outputting a failure signal, and calculation switching for switching between the control calculation means and the complementary calculation means according to the failure signal. Means and means.

[0011]

[Operation] Normal of two controllers, which are divided into control items for traveling control, and are provided with a primary and secondary operation unit for each control item,
Regardless of the abnormal condition, the information used for the calculation is simultaneously input to the primary and secondary calculation units, and the necessary control processing is always performed. Therefore, the secondary controller is always working.

On the other hand, between the two controllers, the period of the loop execution cycle of the program is confirmed, and at the same time, the comparison difference between the calculation results of the primary and secondary operation units is confirmed. Then, even if the cycle of the loop execution cycle of the program of the positive controller is normal, if the comparison difference of the calculation results is not within the range of the predetermined value, it is determined that the positive controller has a failure. Therefore, it is not only dependent on the positive controller.

When it is determined that one controller has failed and the other controller is normal based on the combination of the confirmation of the execution cycle period and the comparison difference of the calculation results, the normal controller complements. If both controllers fail, control can be stopped. As a result, an electric vehicle control device having highly reliable traveling control can be obtained.

Further, when a failure of the sensor for detecting the rotation speed or current of the electric motor is detected, it is provided in advance,
Even if there is no information from the sensor, the necessary minimum control processing is switched to the complementary calculation unit that performs alternative calculation. As a result, complementary control can be performed when the sensor malfunctions, and an electric vehicle control device with improved reliability can be obtained.

[0015]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows an embodiment of an electric vehicle control device constructed by using two microprocessors. A first microprocessor 1, a second microprocessor 2,
The microprocessor failure determination circuit 3, the sensor failure detection circuit 4, the failure mode diagnostic circuit 5, the first switching unit 16, the second switching circuit 6, the power conversion device 7, the motor 8, the speed sensor 9, the current sensor 10, and the like.

The first microprocessor 1 comprises a vehicle control section 11 which is a first corrective operation section, an auxiliary motor control section 12 which is a second auxiliary operation section, and a microprocessor failure detection section 60. The vehicle control unit 11 is a regular control unit that calculates the speed command 13 based on the input signal 40 such as the accelerator amount and the brake amount. It should be noted that it is also possible to perform vehicle control calculation such as auxiliary equipment control.

The sub-motor control unit 12 constantly operates the motor control unit 18 of the second microprocessor 2 based on the speed command 13.
This is a complementary control unit that performs the same calculation as above and outputs the control pulse 14 to the second switching circuit 6 as necessary.

The second microprocessor 2 includes a sub vehicle control unit 15 which is a first sub operation unit, a motor control unit 18 which is a second correct operation unit, a microprocessor failure detection unit 61, and a first switching unit 16. Consists of.

The sub-vehicle control unit 15 always performs the same calculation as the vehicle control unit 11 of the first microprocessor 1 based on the input signal 40 such as the accelerator amount and the brake amount, and the speed command 19 if necessary. Is a complementary control unit that outputs

The first switching unit 16 selectively switches the speed command 13 obtained from the first microprocessor 1 via a dual port ram and the speed command 19 from the sub vehicle control unit 15. Normally, the vehicle control unit 11 and the motor control unit 18 are connected. The first switching unit 16 may not be included in the second microprocessor 2.

The motor controller 18 includes a vector control calculator 17
And speed / voltage sensorless vector control method (Okuyama, Fujimoto, Matsui, Kubota: “Speed / voltage sensorless vector control method for induction motors”, IEEJ Transactions D, 107, 191 (SHO 62-
2)), and a slip frequency control calculator 21 that employs a speed sensorless vector control calculator 20 and a voltage / frequency control method with slip control (Denki Shoin, BKBOSE, “Power Electronics & AC Drive”, Chapter 7.4).
And the V / f open control calculation unit 22 that adopts the open loop voltage / frequency control method (see the same), and the control pulse switching unit
23 is a control unit.

The vector control calculator 17 is a second positive calculator. By using a speed sensor or a current sensor that is a detection means for detecting the running state of the electric vehicle, the rotation speed of the motor and the current flowing through the motor are fed back, and the speed control is always performed based on the speed command 13, and the speed control This is a regular calculation unit that performs current control based on the current command obtained from the above, and finally calculates the voltage command. Normally, the control pulse 33 corresponding to this voltage command is output to the power converter 7.

The speed sensorless vector control calculation unit 20, the slip frequency control calculation unit 21, or the voltage / frequency open control calculation unit 22 executes the simplified control calculation and complements the second positive calculation unit. It corresponds to a calculation means.

The speed sensorless vector control calculation unit 20 is
Speed control and current control are performed without a speed sensor signal, and a control pulse 34 is calculated and output. The slip frequency control calculation unit 21
Only the speed control is performed without the current sensor signal, the voltage command is calculated, and the control pulse 35 is output. The voltage / frequency open control calculation unit 22 (hereinafter, referred to as V / f open control calculation unit 22) calculates the voltage command without any speed sensor signal or current sensor signal, and outputs the control pulse 36.

In addition, the slip frequency control calculation unit 21 and V / f
The control calculation based on the simplified control method such as the open control calculation unit 22 is adopted in the sub motor control unit 12 of the first microprocessor 1.

Of the motor control unit 18, a speed sensorless vector control calculation unit 20, a slip frequency control calculation unit 21, V / f
The open control calculation unit 22 is a complementary control calculation unit in case the speed sensor 9 or the current sensor 10 fails, and is not used when these sensors are normal.

The control pulse switching unit 23 is one of the control pulses output from the vector control calculation unit 17, the speed sensorless vector control calculation unit 20, the slip frequency control calculation unit 21, and the V / f open control calculation unit 22. To output. Therefore, the motor control unit 18 outputs the control pulse 37 selected by the control pulse switching unit 23 to the second switching circuit 6.

The microprocessor failure determination circuit 3 causes a failure of the microprocessor based on a watchdog signal 24 and a microprocessor failure detection signal 25 which are inverted at regular intervals by the software processing of the first microprocessor 1 and the second microprocessor 2. Then, the microprocessor failure signal 26 is output to the failure mode diagnostic circuit 5.

The sensor failure detection circuit 4 detects a failure of the speed sensor 9 or the current sensor 10 based on the speed signal 27 from the speed sensor 9 and the current signal 28 from the current sensor 10, and informs the failure mode diagnosis circuit 5 of the failure. , Sensor failure signal 29 is output.

The failure mode diagnostic circuit 5 determines whether or not the complement is necessary, based on the microprocessor failure signal 26, and outputs a first switching signal 30 to the first switching section 16 when the microprocessor needs to be switched. . Further, the second switching signal 31 is output to the second switching circuit 6. Further, when the speed sensor 9 or the current sensor 10 fails, the vector control calculation unit 17, the speed sensorless vector control calculation unit 20, and the slip frequency control of the motor control unit 18 are based on the sensor failure signal 29 according to the failure state. A calculation switching signal 32 for selectively switching the calculation unit 21 and the V / f open control calculation unit 22 is output to the control pulse switching unit 23.

When all are normal, the first switching unit 16 transmits the speed command 13 calculated by the vehicle control unit 11 of the first microprocessor 1 to the motor control unit 18 of the second microprocessor 2 to control pulses. The switching unit 23 outputs the control pulse 33 output from the vector control calculation unit 17 of the second microprocessor 2 as the control pulse 37. The second switching circuit 6 transmits the control pulse 37 from the second microprocessor 2 to the power conversion device 7.

The microprocessor failure detection in the microprocessor failure detection units 60 and 61 detects the failure of the microprocessors by issuing a watchdog signal 24 each time software processing is performed in a constant cycle, and whether or not the signals are inverted. And the cycle is monitored. If the inversion cycle of the watchdog signal is different from the preset value, it is determined that the microprocessor is malfunctioning due to power failure or an interrupt signal constantly input from the outside.

Further, in detecting the failure of the microprocessor, the calculation result or the intermediate calculation result of the vehicle control unit 11 and the sub vehicle control unit 15 which each microprocessor constantly exchanges with each other via the dual port ram, and the sub operation. This is also performed by comparing the calculation results or intermediate calculation results of the motor control unit 12 and the motor control unit 18 and confirming each other.

This comparison confirmation confirms that the difference obtained by comparing the calculation results is within a predetermined value range. If the comparison difference is not within the range, it can be determined that the A / D converter has failed or the input signal has noise. At the time of this failure, each of the microprocessors outputs a microprocessor failure detection signal 25 from the microprocessor failure detection units 60 and 61 to the microprocessor failure determination circuit 3.

On the other hand, the microprocessor failure detection units 60, 6
1 indicates that the A / D conversion value such as the amount of accelerator / brake exceeds the certain range in each microprocessor itself, or when the rate of change is very large, It is also possible to judge that the / D converter is in failure and not detect the microprocessor failure by comparing the operation results.

FIG. 2 shows the configuration of the microprocessor failure determination circuit 3.

The microprocessor failure determination circuit 3 includes the watchdog abnormality detection circuits 100 and 101 and the failure state determination circuit 102.
It consists of Watchdog signal 24a from the first microprocessor 1 and microprocessor failure detection signal 25
a, Watchdog signal 2 from the second microprocessor 2
Based on 4b and microprocessor failure detection signal 25b,
The first microprocessor failure signal 26a and the second microprocessor failure signal 26b are output. The watchdog abnormality detection circuits 100 and 101 measure the period of the watchdog signal whose signal level is inverted at regular intervals and detect that the period is longer or shorter than a predetermined value to detect the watchdog abnormality. The signals 103 and 104 are output. The failure state determination circuit 102 determines the failure state of the microprocessor based on the watchdog abnormality signals 103 and 104 and the microprocessor failure detection signals 25a and 25b.

Table 1 shows an example of the determination method in the failure state determination circuit 102.

[0040]

[Table 1]

For example, when the watchdog signal is abnormal, the watchdog abnormal signal 103 or 104 is displayed as HIGH. Similarly, when it is judged that the microprocessor 1 or 2 has failed, the microprocessor failure detection signal 25a
Alternatively, 25b is displayed as HIGH. When both microprocessors are normal, No. in the figure. All are displayed as LOW, as shown at 216. Therefore, the first microprocessor failure signal 26a and the second microprocessor failure signal 26b are normal and are displayed as LOW. The judgment of the failure is basically made by the watchdog abnormality signal 103 or 104.

The features of the present invention are as follows. N in the figure
o. In 211, 212, 215, both of the watchdog failure signals 103, 104 are LOW. That is, both microprocessors are temporarily determined to be normal. However, at least one of the microprocessor failure detection signals 25a and 25b is HIGH,
This is the case where there is a difference between the two calculation results. In this case, it is determined to be a microprocessor failure indicated by the microprocessor failure detection signals 25a and 25b. When both the microprocessor failure detection signals 25a and 25b are HIGH, it is unknown which operation result is correct. Therefore, by not believing in doubt, signals 26a, 26b
Both display HIGH and judge that both microprocessors have failed. No. in the figure. The cases 201, 202, 205, and 206 are exactly cases where it can be said that they are failures of both microprocessors, and they are treated the same as in this case to improve reliability.

FIG. 3 shows the configuration of the sensor failure detection circuit 4. The sensor failure detection circuit 4 includes an A / D converter 30
1, current sensor failure determination unit 302, speed sensor failure determination unit 30
It consists of three. The current signal 28 and the speed signal 27 are input, and the current sensor failure signal 29a and the speed sensor failure signal 29b are output.

The A / D converter 301 A / D converts the current signal 28. The current sensor failure determination unit 302 detects a waveform change such as an offset temperature change, a three-phase current amplitude difference, and a waveform disturbance from the A / D converted data, and outputs a current sensor failure signal 29a. . This processing can be executed by either the first microprocessor 1 or the second microprocessor 2. Speed sensor failure determination unit 303
Detects an abnormality or disconnection of the signal line in the order of the A phase and the B phase of the rotation angular velocity signal 27, and outputs the speed sensor failure signal 29b.

Tables 2 and 3 show the diagnostic processing of the failure mode diagnostic circuit 5.

[0046]

[Table 2]

In Table 2, the first microprocessor failure signal 26a and the second microprocessor failure signal 26b are
The HIGH display indicates a failure. When both signals 26a and 26b are LOW (both microprocessors are normal), the first switching unit 16 selects the speed command 13 from the first microprocessor 1 by the first switching signal 30 of the failure mode diagnostic circuit 5. Then, the second switching circuit 6 selects the control pulse 37 from the second microprocessor 2 by the second switching signal 31. Further, the control pulse switching unit 23 uses the calculation switching signal 32 to drive the motor control unit 18
The control pulse 33 by the vector control calculation unit 17, which is a normal calculation of, is selected.

When the signal 26a is LOW and the signal 26b is HIGH (second microprocessor abnormality), the second switching circuit 6 uses the second switching signal 31 of the failure mode diagnostic circuit 5 to output the current command 14 for the first microprocessor 1. Select. In this case, the first microprocessor 1 complements the second microprocessor 2.

When the signal 26a is HIGH and the signal 26b is LOW (abnormality of the first microprocessor), the first switching section 16 causes the speed command 19 of the second microprocessor 2 by the first switching signal 30 of the failure mode diagnostic circuit 5. Select. In this case, the second microprocessor 2 complements the first microprocessor 1.

Next, the control pulse switching section 23 will be described. If the calculation processing performance of the second microprocessor 2 is not so high, all calculations of the sub vehicle control unit 15 and the motor control unit 18 (that is, the vector control calculation 17) can be performed even when both microprocessors are normal. It is possible that you cannot. At that time, the calculation of the motor control unit 18 is mainly performed, and the calculation of the sub vehicle control unit 15 is only necessary control calculation. For example, only the A / D conversion value such as the accelerator / brake amount is calculated, and the microprocessor failure detection unit 61
The failure of the first microprocessor 1 is detected by comparing the A / D converted values.

Further, when the first microprocessor fails, the second microprocessor 2 has to perform all the calculations of the sub vehicle control section 15 and the motor control section 18, so that the motor control section 18 is controlled by the control pulse. The switching unit 23
By the operation switching signal 32 of the failure mode diagnostic circuit 5, the vector control operation unit 17 which is a normal operation is switched to the V / f open control operation unit 22 which is a simplified operation. This switching balances the arithmetic processing, and the second microprocessor 2 alone can perform the necessary vehicle control and motor control arithmetic operations.

Further, when the second microprocessor 2 has a high arithmetic processing performance and both microprocessors are normal, it is possible to perform all the arithmetic operations of the sub vehicle controller 15 and the motor controller 18 (the vector control arithmetic 17 at this time). If possible, the second microprocessor 2 causes the motor control unit 18 to perform the operation of the vector control operation unit 17 even when the first microprocessor fails.

When both the signals 26a and 26b are HIGH (both microprocessor abnormalities), the second switching signal 31 of the failure mode diagnostic circuit 5 causes the second switching circuit 6 to output a command to stop the motor 8. Note that this stop command can be directly output from the failure mode diagnosis circuit 5 to the power conversion device 7, and various methods can be considered.

When the microprocessor fails, it is desirable to issue a warning or the like so that the failure can be immediately repaired.

[0055]

[Table 3]

Table 3 shows the switching selection of the control pulse switching unit 23 when both the microprocessors are normal and the speed sensor 9 or the current sensor 10 fails.

In Table 3, the current sensor failure signal 29a and the speed sensor failure signal 29b both indicate a failure when HIGH. When both signals 29a and 29b are LOW (each sensor is normal),
The control pulse switching unit 23 selects the control pulse 33 by the vector control calculation unit 17 according to the calculation switching signal 32 issued when the sensor fails. When the signal 29a is LOW and the signal 29b is HIGH (speed sensor abnormality), the control pulse switching unit 23 selects the control pulse 34 by the speed sensorless vector control calculation unit 20. When the signal 29a is HIGH and the signal 29b is LOW (current sensor abnormality), the control pulse switching unit 23 selects the control pulse 35 by the slip frequency control calculation unit 21. Signal 26a, 26b
When both are HIGH (both speed and current sensors are abnormal), the control pulse switching unit 23 selects the control pulse 36 by the V / f open control calculation unit 22.

In the above embodiments, the calculation of the control command for the electric vehicle is divided into the vehicle control unit 11 and the motor control unit 18,
When the first and second microprocessors are normal, the vector control calculation unit 17 performs speed control by feeding back the speed of the motor based on the speed command selected by the first switching unit 16, and further controlling the speed. Based on the current command obtained from the above, the current control is performed to calculate the voltage command, and the control pulse 33 corresponding to this voltage command is output to the power converter 7. However, the vehicle control unit 11 includes a process of feeding back the speed of the motor based on the speed command that has been performed by the vector control calculation unit 17 so far to perform speed control and calculate a current command. In this case, the vector control calculation unit 17 is the vehicle control unit.
Only current control will be performed based on the current command calculated by 11. As a result, the load on the second microprocessor can be reduced.

At this time, the speed command calculated by the vehicle control unit 11
It is assumed that 13 includes both a speed command and a current command, and that each computing unit of the motor control unit 18 and the sub motor control unit 12 perform computation according to a necessary command. The microprocessor failure detection method and sensor failure processing are the same as in the previous embodiments. When the first microprocessor fails, the control pulse switching unit 23 selects the control pulse 36 of the V / f open control calculation unit 22.

Another embodiment of the present invention will be described with reference to the drawings. FIG. 4 shows a control device for an electric vehicle constructed by using three microprocessors. Mainly microprocessor 501, microprocessor 502, microprocessor 503, microprocessor failure determination circuit 504, third switching circuit 505, inverter 506, motor 540, speed sensor
541 and current sensor 542.

The microprocessor 501 includes an arithmetic processing unit 507,
The calculation processing 508, the calculation processing 509, and the microprocessor failure detection processing 510 are included. The arithmetic processing 507 is the main processing performed by the microprocessor 501. The vehicle motion control for calculating the speed command of the automobile is calculated with respect to the input signal 511 such as the accelerator amount and the brake amount. The calculation result 512 is output to the microprocessor 502 and the calculation processing 508.

The arithmetic processing 508 and the arithmetic processing 509 are complementary processing in which the main processing performed by the microprocessor 502 and the microprocessor 503 is simplified. Arithmetic processing 508
Outputs the operation result 513 to the microprocessor 503, and the operation processing 509 outputs the control pulse of the operation result 514 to the third switching circuit 505 as an external output.

The microprocessor failure detection process 510 is
A microprocessor failure is detected by a method described later, and a microprocessor failure detection signal 515 is output to the microprocessor failure determination circuit 504.

The microprocessor 502 has an arithmetic processing unit 516,
The calculation processing 517, the calculation processing 518, the first switching unit 519, and the microprocessor failure detection processing 520 are included. The arithmetic processing 516
This is the main processing performed by the microprocessor 502. The speed of the motor obtained from the speed sensor 541 is fed back for speed control.

The arithmetic processing 517 and the arithmetic processing 518 are complementary processing in which the main processing performed by the microprocessor 501 and the microprocessor 503 is simplified. Arithmetic processing 517
Performs an operation using the input signal 511 as an input, and outputs an operation result 521 to the first switching unit 519. The first switching unit 519 performs arithmetic processing
Three operations: an operation result 521 from the 517, an operation result 523 from the operation process 522 that complements the main processing of the microprocessor 501 in the microprocessor 503, and an operation result 512 from the operation process 507 in the microprocessor 501. Select one operation result from the results.

This selection is made by the microprocessor failure determination circuit 504, which is a switching signal 524 at the time of microprocessor failure.
Based on. The arithmetic processing 516 performs arithmetic operation with the arithmetic result 525 selected by the first switching unit 519 as an input, and outputs the arithmetic result 526 to the arithmetic processing 518 and the microprocessor 503. The arithmetic processing 518 performs an arithmetic operation with the arithmetic result 526 as an input, and outputs the control pulse of the arithmetic result 527 to the third switching circuit 505 as an external output.

The microprocessor failure detection processing 520 is
A microprocessor failure is detected by a method described later, and a microprocessor failure detection signal 528 is output to the microprocessor failure determination circuit 504.

The microprocessor 503 has an arithmetic processing unit 522,
The calculation processing 529, the calculation processing 530, the second switching unit 531 and the microprocessor failure detection processing 532. The arithmetic processing 530 is
This is the main processing performed by the microprocessor 503. Current control is performed based on the current command obtained from the speed control and the current value obtained from the current sensor 542, a voltage command is given, and a control pulse is output to the inverter so that this voltage command is achieved.

The arithmetic process 522 and the arithmetic process 529 are complementary processes which simplify the main process performed by the microprocessor 501 and the microprocessor 502, respectively. Arithmetic processing 522
Performs an operation using the input signal 511 as an input, and outputs an operation result 523 to the operation processing 529 and the microprocessor 502. The arithmetic processing 529 performs the arithmetic operation by using the arithmetic result 523 as an input, and outputs the arithmetic result 533 to the second switching unit 531. The second switching unit 531 is
One calculation result is selected from the three calculation results of the calculation result 533 from the calculation process 529, the calculation result 526 of the calculation process 516, and the calculation result 526 of the calculation process 516.

This selection is made by the switching signal 5 at the time of microprocessor failure from the microprocessor failure determination circuit 504.
Based on 34. The arithmetic processing 530 performs an arithmetic operation by using the arithmetic result 535 selected by the second switching unit 531 as an input, and outputs the control pulse of the arithmetic result 536 as an external output to the third switching circuit 505.
Output to.

The microprocessor failure detection processing 532 detects a microprocessor failure by a method described later and outputs a microprocessor failure detection signal 537 to the microprocessor failure determination circuit 504.

The microprocessor failure determination circuit 504 inputs the watchdog signal and the microprocessor failure detection signals 515, 528 and 537 from each microprocessor and determines the failure of each microprocessor and outputs the microprocessor failure switching signals 524, 534,539.

The third switching circuit 505 selects one from the three operation results (control pulses) 514, 527 and 528 output to the outside and outputs it to the inverter 506 as an external output 538.
This selection is made based on the microprocessor failure switching signal 539 from the microprocessor failure determination circuit 504.

The inverter 506 is a motor 540 of an electric vehicle.
Drive.

Each of the three microprocessors detects the failure of the microprocessor as follows.

First, in order to indicate to other microprocessors that they are operating normally, a watchdog signal that inverts the signal level is output at regular intervals. These signals are constantly monitored by the microprocessor failure detection processing 510, 520, 532 in each microprocessor to confirm whether they are inverted at a predetermined time. When the watchdog signal is not inverted within a predetermined time, each microprocessor outputs the microprocessor failure detection signals 515, 528, 537, and outputs what is considered as a failure.

Next, the calculation result of the complementary processing for complementing each other microprocessor is output to the microprocessor which is performing the main processing. The results of these calculations are compared in the microprocessor failure detection processes 510, 520, and 532 in each microprocessor to see whether they are always the same as the results of the main process. When the calculation results are different, the microprocessor failure detection signals 515, 528 and 537 are output by the respective microprocessors as in the case of the watchdog signal, and the fact that the failure is considered is output.

Here, the microprocessor failure determination circuit
The processing in 504 will be described. In the microprocessor failure determination circuit 504, the watchdog signal from each microprocessor and the microprocessor failure signals 515, 528, 53
Determine the failure of each microprocessor by inputting 7. Then, the switching signal is output to the first switching unit 519, the second switching unit 531 and the third switching circuit 505.

The failure diagnosis of the microprocessor is judged by the failure signal output by the microprocessor which normally outputs the watchdog signal. For example, in the failure determination when the microprocessor 502 fails, first, if the watchdog signal from the microprocessor 502 is abnormal, then the microprocessor 502 is determined to be failed.

Next, even if the watchdog signal from the microprocessor 502 is normal, the microprocessor failure detection processes 510 and 532 detect the failure of the microprocessor 502 by the communication of the calculation result between the microprocessors, and the microprocessor 502 detects the failure. If the processor failure signals 515 and 537 are output, the microprocessor failure determination circuit 504 confirms that the watchdog signals from the microprocessors 501 and 503 are normal, and further the failure signals 515 and 537.
Is detected, it is determined that the microprocessor 502 has failed.

Table 4 shows a method of outputting the switching signals 524, 534,539 at the time of microprocessor failure.

[0082]

[Table 4]

First, when it is determined that all the microprocessors are operating normally, the switching signal 524 for the first switching unit 519 causes the calculation result 512 to be selected, and the switching signal 534 for the second switching unit 531 is selected. , The calculation result 526 is selected, and the switching signal 539 to the third switching circuit 505 is
Select calculation result 536. As a result, the calculation result of the main processing of each microprocessor is selected and
Output to 506.

When the failure of the microprocessor is judged, each switching signal is output so as to select the operation result shown in Table 4 according to the failed microprocessor. As a result, the calculation result of the complementary processing corresponding to the failed microprocessor is selected, so that the running performance of the electric vehicle is guaranteed.

When it is determined that all the microprocessors have failed, the third switching circuit 505 outputs a stop signal to the inverter to stop the electric vehicle.

As described above, according to the present embodiment, since the three microprocessors mutually monitor the operating states, it is possible to easily detect the presence / absence of a failure, so that a normal microprocessor can safely perform complementary processing. it can. Therefore, even if the two microprocessors run out of control, the vehicle can travel safely.

[0087]

According to the present invention, it is possible to provide an electric vehicle control device having a highly reliable traveling control in which two primary and secondary controllers are always operated and which is not dependent only on the positive controller.

Further, it is possible to provide an electric vehicle control device in which complementary control for a failure of the speed sensor or the current sensor is added to further improve the reliability.

[Brief description of drawings]

FIG. 1 is a diagram showing an electric vehicle control device according to an embodiment of the present invention.

FIG. 2 is a diagram showing a configuration of a microprocessor failure determination circuit.

FIG. 3 is a diagram showing a configuration of a sensor failure detection circuit.

FIG. 4 is a diagram showing an electric vehicle control device of another embodiment according to the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... 1st microprocessor, 2 ... 2nd microprocessor, 3 ... Microprocessor failure determination circuit, 4 ... Sensor failure detection circuit, 5 ... Failure mode diagnostic circuit, 6 ... Second switching circuit, 7 ... Power conversion device, 8 ... Motor, 9 ... Speed sensor, 10 ... Current sensor, 11 ... Vehicle control unit, 12 ... Sub motor control unit, 13, 19 ... Speed command, 14 ... Control pulse, 15 ... Sub vehicle control unit, 16 ... First switching Part, 17 ... Vector control calculation part, 18
... Motor control unit, 20 ... Speed sensorless vector control operation unit, 21 ... Slip frequency control operation unit, 22 ... v / f open control operation unit, 23 ... Control pulse switching unit, 24 ... Watchdog signal, 25 ... Microprocessor failure detection Signal, 26 ... Microprocessor failure signal, 29 ... Sensor failure signal, 30 ... First switching signal, 31 ... Second switching signal, 32 ... Operation switching signal, 33,
34, 35, 36, 37 ... Control pulse 60, 61 ... Microprocessor failure detector

Claims (13)

[Claims] 1. An electric motor for driving an electric vehicle, a power converting means for supplying electric power to the electric motor, a detecting means for detecting a traveling state of the electric vehicle, and the electric power based on detection information from the detecting means. And a control unit that calculates a control command that controls the conversion unit, wherein the control unit divides the calculation unit that executes the calculation of the control command into two, a first calculation unit and a second calculation unit. A first operation unit and a second operation unit for executing a normal control operation for each second operation unit, and a sub-operation unit for executing a simplified control operation. A first control unit including a one-correction arithmetic unit and the second sub-calculation unit, and a second control unit including the first sub-calculation unit and the second positive calculation unit, the first control unit, Watchdog signal issued by the second control means in each operation execution cycle A cycle, a difference between the calculation result of the first positive calculation unit executed by the first control unit and the calculation result of the first sub-calculation unit executed by the second control unit, and the difference executed by the first control unit From the difference between the calculation result of the second sub-calculation section and the calculation result of the second positive calculation section executed by the second control means, a failure of the second control means is detected, and a second control means failure detection signal is sent. It has a second control means failure detection means for outputting, the second control means, the period of the watchdog signal issued by the first control means for each operation execution cycle, the operation result of the first positive operation unit and the first A failure of the first control means is detected from the difference between the calculation results of the one sub-calculation section and the difference between the calculation result of the second sub-calculation section and the calculation result of the second positive calculation section, and the first control means malfunctions. A first control means for outputting a detection signal, failure detection means, From the combination of the cycle of the watchdog signal of the control means, the cycle of the watchdog signal of the second control means, the first control means failure detection signal, and the second control means failure detection signal, the first control Means or the second control means for determining the failure, the control means failure determination means for outputting a switching signal, the operation result of the first correct operation unit and the operation result of the first sub-operation unit according to the switching signal An electric vehicle, comprising: a first switching unit for switching between a calculation result of the second positive calculation unit and a calculation result of the second sub calculation unit according to the switching signal. Control device. 2. The method according to claim 1, wherein there is a difference between the calculation result of the first positive calculation unit and the calculation result of the first sub calculation unit, or the calculation result of the second sub calculation unit and the second positive calculation unit. In the case of at least one of the cases where there is a difference between the calculation result of the calculation unit, the first control means failure detection means outputs the first control means failure detection signal, and the second control means failure detection means Second control means An electric vehicle control device which outputs a failure detection signal. 3. The control means failure determination means according to claim 1, when both the first control means and the second control means are determined to be normal, the first correct operation unit and the second When outputting the switching signal for calculating the control command with the second positive operation unit, and determining that the first control unit is normal and the second control unit is in failure, the first positive operation unit and The first sub-calculation is performed when the switching signal for calculating the control command is output by the second sub-calculation section and the first control means is in failure and the second control means is normal. An electric vehicle control device, wherein the switching signal for calculating the control command is output by the control unit and the second positive calculation unit. 4. The control means failure determination means according to claim 1, wherein the first control means where the period of the watchdog signal is abnormal is determined to be faulty, and the cycle of the watchdog signal is abnormal. 2. An electric vehicle control device, wherein the second control means is determined to be a failure. 5. The control means failure determination means according to claim 1, wherein both of the watchdog signal of the first control means and the watchdog signal of the second control means are normal. An electric vehicle control, wherein a failure of the first control means is determined by the presence or absence of a means failure detection signal, and a failure of the second control means is determined by the presence or absence of the first control means failure detection signal. apparatus. 6. The stop signal to the power conversion means according to claim 1, when the control means failure determination means determines that both the first control means and the second control means are in failure. An electric vehicle control device comprising means for outputting. 7. The first positive calculation unit and the first sub calculation unit calculate a speed command for setting a traveling speed of the electric vehicle, and the second sub calculation unit and the second sub calculation unit according to claim 1. An electric vehicle control device, wherein the second-order arithmetic unit calculates a voltage command corresponding to the speed command. 8. The detection means failure determination means for determining a failure of the detection means for detecting a traveling state of the electric vehicle and outputting a failure signal according to claim 1, and an open loop instead of the detection information from the detection means. Sensorless calculation means for executing a simplified control calculation by employing an alternative control method such as a voltage / frequency control method or a voltage / frequency control method with slip control, and the detection means failure determination And a calculation switching means for switching the calculation result of the second positive calculation part and the calculation result of the sensorless calculation means according to the failure signal of the means, and when the detection means is judged to be defective by the detection means failure judgment means. An electric vehicle control device, wherein the control command is calculated by the first positive calculation unit and the sensorless calculation unit. 9. The second sub-calculation unit according to claim 1,
An electric vehicle control device, characterized in that an alternative control method such as an open loop voltage / frequency control method or a voltage / frequency control method with slip control is adopted to execute a simplified control calculation. 10. The method according to claim 8, wherein when the control means failure determination means determines that the first control means is in failure and the second control means is normal, the first sub-calculation unit and the An electric vehicle control device, wherein the control command is calculated by a sensorless calculation means. 11. An electric motor for driving an electric vehicle, a power converting means for supplying electric power to the electric motor, a detecting means for detecting a traveling state of the electric vehicle, and the electric power based on detection information from the detecting means. The control means calculates a control command for controlling the conversion means, and the control means includes a calculation part that executes a calculation of the control command, the first calculation part, the second calculation part, and the third calculation part. It is divided into three parts, a main operation part that executes a normal control operation for each of the first operation part, the second operation part, and the third operation part, and a sub operation that executes a simplified control operation. A first control unit including the first positive operation unit, the second sub operation unit, and the third sub operation unit, the first sub operation unit, and the second positive operation unit. And second control means including the third sub-calculation section, and the first sub-calculation section It has a second sub-operation unit and a third control unit including the third positive operation unit, the first control unit, the second control unit and the third control unit, each of which is issued in each operation execution cycle From the cycle of the watchdog signal and the difference between the primary and secondary operation results of each of the first arithmetic unit, the second arithmetic unit, and the third arithmetic unit, failure detection of each control unit is performed,
A control means failure detection means for outputting a control means failure detection signal, respectively, the period of the watchdog signal of the first control means, the second control means, and the third control means, and from each control means A control means failure determination means for determining a failure of the first control means, the second control means, or the third control means from a combination with the control means failure detection signal is provided, and a failure determination of the control means failure determination means The means for switching the calculation result of the first positive calculation unit to the calculation result of the first sub-calculation unit of the second or third control means, and the calculation result of the second positive calculation unit for the first or first And a means for switching to a calculation result of the second sub-calculation section of the three control means and a calculation result of the third positive calculation section for the calculation result of the third sub-calculation section of the first or second control means. Electric vehicle control apparatus is characterized by providing a step. 12. A microprocessor control unit executes a normal control process from a positive microprocessor which performs a normal control process by checking a program run cycle signal issued in each program loop execution cycle of the microprocessor to execute a complementary control process of the normal microprocessor. In a control method of an electric vehicle that switches to at least one sub-microprocessor to perform traveling control, confirmation of the program run period signal, comparison difference confirmation of the control processing result of the positive microprocessor and the control processing result of the sub-microprocessor A method for controlling an electric vehicle, characterized in that the abnormality of the primary microprocessor or the secondary microprocessor is determined by a combination with the above. 13. A detection sensor for detecting a rotational speed of an electric motor for driving an electric vehicle or a current flowing through the electric motor, and a control calculation means for normally calculating a travel control command based on a detection signal of the detection sensor. In the electric vehicle control device including the above, the traveling control command is calculated based on a simplified control method such as an open loop voltage / frequency control method or a voltage / frequency control method with slip control instead of the detection signal, and the control calculation means is complemented. And a failure detection means for detecting a failure of the detection sensor and outputting a failure signal, and a calculation switching means for switching between the control calculation means and the complementary calculation means according to the failure signal. An electric vehicle control device characterized by: