WO2018012419A1 - Motor control device, motor drive system, and motor control method - Google Patents

Abstract

After microcomputers (401, 402) are started, a ready signal transmission unit (622) of a second microcomputer (402) that is a "synchronization signal reception side microcomputer" transmits a ready signal indicating the completion of synchronization preparation of the microcomputer to a first microcomputer (401) that is a "synchronization signal transmission side microcomputer". A ready signal reception unit (621) of the first microcomputer (401) receives the ready signal. Handshake determination units (611, 612) of the microcomputers (401, 402), upon normal implementation of a handshake including at least a transmission and reception of the ready signal, determine that the handshake has been successful. If it is determined that the handshake is successful, the microcomputers (401, 402) drive a motor (80) in synchronism from the initial time after starting.

Description

Motor control device, motor drive system, and motor control method Cross-reference of related applications

This application is a patent application number 2016-136611 filed on July 11, 2016, a patent application number 2017-51260 filed on March 16, 2017, and filed on June 29, 2017. Which is based on Japanese Patent Application No. 2017-126972, which is incorporated herein by reference.

The present disclosure relates to a motor control device that controls driving of a motor by a plurality of microcomputers, a motor drive system including the motor control device, and a motor control method.

2. Description of the Related Art Conventionally, in a motor control apparatus that controls driving of a motor by a plurality of redundantly provided microcomputers, an apparatus in which each microcomputer operates with a clock generated by an independent clock generation circuit is known. When all microcomputers are operated with a single clock generation circuit, the motor drive stops when the clock generation circuit fails. By providing an independent clock generation circuit for each microcomputer, reliability is improved. improves.

However, in reality, there is a problem that the operation control timing of each microcomputer is shifted due to manufacturing variation of the clock generation circuit.
Therefore, for example, the motor control device disclosed in Patent Document 1 transmits and receives a synchronization signal between a plurality of microcomputers, and the microcomputer that receives the synchronization signal corrects the calculation control timing based on the synchronization signal. In this way, the torque pulsation of the motor is suppressed by synchronizing the operation control timings of the plurality of microcomputers with each other.

Japanese Patent No. 5412095

However, the prior art does not assume the initial synchronization when starting up a plurality of microcomputers. For example, there is a case where the start timing of each microcomputer due to power ON is shifted due to a difference in power supply voltage supplied to each microcomputer, wiring resistance, voltage detection characteristics, or the like. Then, only the microcomputer that has been activated first operates asynchronously during the period from when the microcomputer that has been activated first starts the timer to when the microcomputer that is activated later starts the timer. Therefore, there is a problem that a plurality of microcomputers cannot be synchronized from the first time.
In this specification, “asynchronous control” is included, including control in which a motor is driven by only a part of a plurality of microcomputers.

Further, the technique of Patent Document 1 does not assume a case where an abnormality occurs in a synchronization signal transmitted / received between a plurality of microcomputers. However, if an abnormality occurs in the transmitted synchronization signal, the microcomputer on the synchronization signal receiving side corrects the timing based on the abnormal synchronization signal. Therefore, depending on the degree of abnormality of the synchronization signal, the control by the synchronization signal receiving side microcomputer may fail. As a result, there is a possibility that a more inconvenient situation may occur than a torque pulsation caused by a clock shift. For example, in an electric power steering device for a vehicle, if the assist function is stopped by stopping the motor drive, the driver is anxious. Therefore, it is required to determine an abnormality of the synchronization signal and to take an appropriate measure in the case of the abnormality.

An object of the present disclosure is to provide a motor control device that can be synchronized from the first time after activation of a plurality of microcomputers.
Preferably, in a motor control device that transmits and receives a synchronization signal for correcting a clock shift between a plurality of microcomputers that operate with independent clocks, a motor control device capable of determining an abnormality of the synchronization signal is provided. There is.
Furthermore, it is providing the motor drive system provided with the motor control apparatus, and the motor control method by the motor control apparatus.

The motor control device according to the present disclosure includes a plurality of motor drive circuits, a plurality of microcomputers, and a plurality of clock generation circuits.
The plurality of motor drive circuits drive, for example, one or more motors having a plurality of winding sets.
The plurality of microcomputers include a drive signal generation unit and a drive timing generation unit. The drive signal generation unit generates a motor drive signal that commands each of the plurality of motor drive circuits. The drive timing generation unit generates a drive timing that is a pulse timing of the motor drive signal.
The plurality of clock generation circuits independently generate clocks used as a reference for operation by the plurality of microcomputers.
The clock generation circuit, the microcomputer, and the motor drive circuit are provided corresponding to each other, and the unit of the group of components is defined as “system”. The motor control device drives the motor by controlling the energization to the corresponding winding set by the constituent elements of each system.

Among the plurality of microcomputers, “at least one microcomputer that transmits a synchronization signal that synchronizes with the driving timing of the microcomputer and synchronizes the driving timings of the plurality of microcomputers” is referred to as a synchronization signal transmitting side microcomputer. The at least one microcomputer that receives the synchronization signal transmitted from the microcomputer is referred to as a synchronization signal receiving side microcomputer. For each microcomputer, the microcomputer itself is referred to as “own microcomputer”.

In addition to the basic configuration described above, the motor control device according to the first aspect further includes the following configuration.
The synchronization signal transmission side microcomputer has a synchronization signal generation part which generates a synchronization signal and transmits it to the synchronization signal reception side microcomputer.
The synchronization signal receiving side microcomputer has a timing correction unit capable of performing timing correction for correcting the driving timing of the microcomputer so as to be synchronized with the received synchronization signal.

Furthermore, the synchronization signal receiving side microcomputer has a ready signal transmission part. The ready signal transmission unit transmits a ready signal indicating that the synchronization preparation of the microcomputer is completed to the synchronization signal transmission side microcomputer. In addition, the synchronization signal transmission side microcomputer includes a ready signal receiving unit that receives a ready signal.
In addition, the synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer have a handshake determination unit that determines that the handshake is successful when a handshake including at least transmission / reception of a ready signal is normally performed.
When it is determined that the handshake is successful, the synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer drive the motor synchronously from the first time after activation.
Thereby, the motor control device according to the present disclosure can be synchronized from the first time after activation of a plurality of microcomputers.

Preferably, the timing correction unit of the synchronization signal receiving side microcomputer includes a reception signal determination unit that performs reception signal determination that is normal or abnormal determination of the received synchronization signal.
The synchronization signal receiving microcomputer permits timing correction when the synchronization signal is determined to be normal in the reception signal determination, and prohibits timing correction when the synchronization signal is determined to be abnormal in the reception signal determination. The motor is driven asynchronously with the signal transmission side microcomputer.

In this configuration, the synchronization signal abnormality can be determined by the reception signal determination unit of the synchronization signal receiving side microcomputer. When the synchronization signal is determined to be abnormal in the reception signal determination, the synchronization signal reception side microcomputer prohibits timing correction and drives the motor asynchronously with the synchronization signal transmission side microcomputer. Accordingly, it is possible to prevent the control of the synchronization signal receiving microcomputer from failing due to the abnormality of the synchronization signal.
In this case, even if torque pulsation occurs, at least driving of the motor can be continued. Therefore, the present invention is particularly effective in a motor drive system in which there is a great need for continuing an assist function by driving a motor, such as an electric power steering device.

The motor control device of the second aspect further has the following three drive modes on the premise of the above basic configuration.
(1) Synchronous drive mode in which the synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer that has received the synchronization signal drive the motor synchronously (2) Without using the synchronization signal, the synchronization signal transmission side microcomputer and the synchronization signal reception side Asynchronous drive mode in which the microcomputer drives the motor asynchronously (3) Partial system drive mode in which the motor is driven by only one of the synchronization signal transmission side microcomputer or the synchronization signal reception side microcomputer This motor control device includes a synchronization signal transmission side microcomputer and When the synchronization signal receiving side microcomputer is activated, the system may be shifted in the order of partial system drive mode, asynchronous drive mode, and synchronous drive mode.

Further, a motor control method by the motor control device having the above basic configuration is provided.
In the ready signal transmission step of this motor control method, the synchronization signal receiving side microcomputer transmits a ready signal indicating that the synchronization preparation of its own microcomputer is completed to the synchronization signal transmitting side microcomputer.
In the ready signal receiving step, the synchronization signal transmitting side microcomputer receives the ready signal.
In the handshake success determination step, when at least a handshake including transmission / reception of a ready signal is normally performed, the handshake determination unit of the synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer determines that the handshake is successful. .
In the synchronous drive step, when it is determined that the handshake is successful, the synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer drive the motor synchronously from the first time after activation.

The above and other objects, features, and advantages of the present disclosure will become more apparent from the following detailed description with reference to the accompanying drawings. The drawing
FIG. 1 is a configuration diagram of an electric power steering apparatus in which the ECU of each embodiment is applied as an electromechanical integrated motor drive system. FIG. 2 is a configuration diagram of an electric power steering device in which the ECU of each embodiment is applied as an electro-mechanical separate type motor drive system, FIG. 3 is a sectional view in the axial direction of a two-system electromechanical integrated motor, 4 is a cross-sectional view taken along line IV-IV in FIG. FIG. 5 is a schematic diagram showing the configuration of a multi-homologous axis motor, FIG. 6 is an overall configuration diagram of an ECU (motor control device) according to each embodiment. FIG. 7 is a detailed configuration diagram of an ECU (motor control device) according to a basic form of the first embodiment. FIG. 8 is a diagram showing the relationship between the motor drive signal and the analog signal sampling timing. FIG. 9 is a time chart showing the clock deviation of the two systems of microcomputers. FIG. 10 is a time chart for explaining timing correction (prior art) using a synchronization signal. FIG. 11 is a time chart for explaining the problems of the prior art when the synchronization signal is abnormal, FIG. 12 is a flowchart of timing determination processing according to the basic form of the first embodiment. FIG. 13 is a diagram illustrating a setting example of a synchronization permission section according to the basic form of the first embodiment. FIG. 14 is a time chart when the synchronization signal is abnormal according to the basic form of the first embodiment. FIG. 15 is a flowchart of the motor drive start process at the time of starting the microcomputer. FIG. 16 is a flowchart of the timing determination standby process when the microcomputer is activated. FIG. 17 is a flowchart of timing correction return processing after the synchronization signal abnormality determination, FIG. 18 is a flowchart of the synchronization signal abnormality confirmation process, FIG. 19 is a configuration diagram of an ECU (motor control device) according to the first embodiment. FIG. 20 is a time chart of the handshake operation example 1. FIG. 21 is a time chart of a modified example of the handshake operation example 1. FIG. 22 is a time chart of handshake operation example 2. FIG. 23 is a time chart of Modification A of Handshake Operation Example 2; FIG. 24 is a time chart of Modification B of Handshake Operation Example 2; FIG. 25 is a time chart of the handshake operation example 3. FIG. 26 is a flowchart of the first microcomputer startup process in the first to third operation examples. FIG. 27 is a flowchart of the second microcomputer startup process in the first to third operation examples. FIG. 28 is a flowchart of the second microcomputer activation post-processing of the modification B of the operation example 2, FIG. 29 is a flowchart of the handshake success / failure storage process. FIG. 30 is a flowchart of the second microcomputer synchronization processing during asynchronous control. FIG. 31 is a time chart of the handshake operation example 4. FIG. 32 is a flowchart of the second microcomputer start-up process in the operation example 4, FIG. 33 is a time chart of a handshake operation example 5A at the time of restart, FIG. 34 is a time chart of the handshake operation example 5B at the time of restart, FIG. 35 is a time chart of the handshake operation example 6 at the time of restart, FIG. 36 is a configuration diagram of an ECU (motor control device) according to the second embodiment. FIG. 37 is a time chart of an example of handshake operation with three microcomputers. FIG. 38 is a configuration diagram of a basic form corresponding part of an ECU (motor control device) according to a third embodiment. FIG. 39 is a diagram illustrating bidirectional synchronization signal transmission / reception timing according to the third embodiment. FIG. 40 is a time chart of the handshake operation example 7. FIG. 41 is a flowchart of the first microcomputer start-up process in Operation Example 7, FIG. 42 is a flowchart of processing after starting the second microcomputer of the operation example 7, FIG. 43 is a time chart of the fourth embodiment using a synchronization signal of a specific pulse pattern, FIG. 44 is a time chart of the fifth embodiment using a synchronization signal of a specific pulse pattern.

Hereinafter, a plurality of embodiments of a motor control device will be described based on the drawings. In each embodiment, an ECU as a “motor control device” is applied to an electric power steering device of a vehicle and controls energization of a motor that outputs a steering assist torque. The ECU and the motor constitute a “motor drive system”.
In the plurality of embodiments, substantially the same components are denoted by the same reference numerals and description thereof is omitted. The following first to fifth embodiments are collectively referred to as “this embodiment”.

First, as a matter common to each embodiment, the configuration of an applied electric power steering device, the configuration of a motor drive system, and the like will be described with reference to FIGS.
1 and 2 show an overall configuration of a steering system 99 including an electric power steering device 90. FIG. FIG. 1 shows an “mechanical and integrated” configuration in which the ECU 10 is integrally formed on one side of the motor 80 in the axial direction, and FIG. The structure of “mechanical separate type” is illustrated. The electric power steering device 90 in FIGS. 1 and 2 is a column assist type, but can be similarly applied to a rack assist type electric power steering device.

The steering system 99 includes a handle 91, a steering shaft 92, a pinion gear 96, a rack shaft 97, wheels 98, an electric power steering device 90, and the like.
A steering shaft 92 is connected to the handle 91. A pinion gear 96 provided at the tip of the steering shaft 92 is engaged with the rack shaft 97. A pair of wheels 98 are provided at both ends of the rack shaft 97 via tie rods or the like. When the driver rotates the handle 91, the steering shaft 92 connected to the handle 91 rotates. The rotational motion of the steering shaft 92 is converted into a linear motion of the rack shaft 97 by the pinion gear 96, and the pair of wheels 98 are steered at an angle corresponding to the amount of displacement of the rack shaft 97.

The electric power steering device 90 includes a steering torque sensor 93, an ECU 10, a motor 80, a reduction gear 94, and the like.
The steering torque sensor 93 is provided in the middle of the steering shaft 92 and detects the steering torque of the driver. In the form shown in FIGS. 1 and 2, the duplicated steering torque sensor 93 includes a first torque sensor 931 and a second torque sensor 932, and detects the first steering torque trq1 and the second steering torque trq2 doubly. .
When the steering torque sensor is not redundantly provided, the detected value of one steering torque trq may be used in common for the two systems. Hereinafter, where there is no particular meaning in using redundantly detected steering torques trq1 and trq2, they are described as one steering torque trq.

The ECU 10 controls the driving of the motor 80 based on the steering torques trq1 and trq2 so that the motor 80 generates a desired assist torque. The assist torque output from the motor 80 is transmitted to the steering shaft 92 via the reduction gear 94.
The ECU 10 acquires the electrical angles θ1 and θ2 of the motor 80 detected by the rotation angle sensor and the steering torques trq1 and trq2 detected by the steering torque sensor 93. The ECU 10 controls the driving of the motor 80 based on such information and information such as the motor current detected inside the ECU 10.

A configuration of an electromechanical integrated motor 800 in which the ECU 10 is integrally formed on one side in the axial direction of the motor 80 will be described with reference to FIGS. 3 and 4. In the form shown in FIG. 3, the ECU 10 is disposed coaxially with the axis Ax of the shaft 87 on the side opposite to the output side of the motor 80. In other embodiments, the ECU 10 may be configured integrally with the motor 80 on the output side of the motor 80.
The motor 80 is a three-phase brushless motor, and includes a stator 840, a rotor 860, and a housing 830 that accommodates them.

The stator 840 has a stator core 845 fixed to the housing 830 and two sets of three- phase winding sets 801 and 802 assembled to the stator core 845.
Lead wires 851, 853, and 855 extend from the respective phase windings constituting the first winding set 801. Lead wires 852, 854, 856 extend from the respective phase windings constituting the second winding set 802.
The rotor 860 has a shaft 87 supported by a rear bearing 835 and a front bearing 836, and a rotor core 865 in which the shaft 87 is fitted. The rotor 860 is provided inside the stator 840 and is rotatable relative to the stator 840. A permanent magnet 88 is provided at one end of the shaft 87.

The housing 830 has a bottomed cylindrical case 834 including a rear frame end 837 and a front frame end 838 provided at one end of the case 834. The case 834 and the front frame end 838 are fastened to each other by bolts or the like. Lead wires 851, 852 and the like of each winding set 801, 802 extend through the lead wire insertion hole 839 of the rear frame end 837 to the ECU 10 side and are connected to the substrate 230.

The ECU 10 includes a cover 21, a heat sink 22 fixed to the cover 21, a substrate 230 fixed to the heat sink 22, and various electronic components mounted on the substrate 230. The cover 21 protects electronic components from external impacts and prevents intrusion of dust or water into the ECU 10.
The cover 21 includes an external connection connector 214 and a cover 213 for an external power supply cable and signal cable. The power supply terminals 215 and 216 of the external connection connector portion 214 are connected to the substrate 230 via a path (not shown).

The board 230 is, for example, a printed board, is provided at a position facing the rear frame end 837, and is fixed to the heat sink 22. The board 230 is provided with electronic components for two systems independently for each system, and has a completely redundant configuration. In the present embodiment, the number of the substrates 230 is one, but in other embodiments, two or more substrates may be provided.
Of the two main surfaces of the substrate 230, the surface facing the rear frame end 837 is referred to as a motor surface 237, and the opposite surface, that is, the surface facing the heat sink 22 is referred to as a cover surface 238.

A plurality of switching elements 241 and 242, rotation angle sensors 251 and 252, custom ICs 261 and 262 are mounted on the motor surface 237.
In this embodiment, the plurality of switching elements 241 and 242 are six for each system, and constitute the three-phase upper and lower arms of the motor drive circuit. The rotation angle sensors 251 and 252 are arranged so as to face the permanent magnet 88 provided at the tip of the shaft 87. The custom ICs 261 and 262 and the microcomputers 401 and 402 have a control circuit for the ECU 10. The custom ICs 261 and 262 are provided with, for example, clock monitoring units 661 and 662 shown in FIG.

On the cover surface 238, microcomputers 401 and 402, capacitors 281 and 282, inductors 271 and 272, and the like are mounted. In particular, the first microcomputer 401 and the second microcomputer 402 are arranged on the cover surface 238 that is the same side surface of the same substrate 230 at a predetermined interval.
Capacitors 281 and 282 smooth the electric power input from the power source and prevent noise from flowing out due to the switching operation of switching elements 241 and 242. The inductors 271 and 272 constitute a filter circuit together with the capacitors 281 and 282.

As shown in FIGS. 5 and 6, the motor 80 to be controlled by the ECU 10 is a three-phase brushless motor in which two sets of three- phase winding sets 801 and 802 are provided coaxially.
The winding sets 801 and 802 have the same electrical characteristics. For example, as shown in FIG. 3 of Japanese Patent No. 5672278, the winding sets 801 and 802 are arranged on a common stator with an electrical angle shifted by 30 degrees. In response to this, the winding sets 801 and 802 are controlled so that, for example, a phase current having the same amplitude and a phase shift of 30 deg.

In FIG. 6, a combination of the first winding set 801 and the first microcomputer 401 and the motor drive circuit 701 related to the energization control of the first winding set 801 is defined as a first system GR1. A combination of the second winding set 802 and the second microcomputer 402, the second motor drive circuit 702, and the like related to energization control of the second winding set 802 is defined as a second system GR2. The first system GR1 and the second system GR2 are all composed of two independent element groups, and have a so-called “complete two-system” redundant configuration.

In the specification, “first” is added to the beginning of components or signals of the first system GR1, and “second” is added to the beginning of components or signals of the second system GR2, as necessary. To distinguish. Items that are common to each system are collectively described without adding “first and second”. Also, “1” is added to the end of the code of the first system component or signal, and “2” is added to the end of the code of the second system component or signal.
Hereinafter, for a certain component, a system including the component is referred to as “own system”, and the other system is referred to as “other system”. Similarly, regarding the two systems of microcomputers 401 and 402, the microcomputer of the own system is referred to as “own microcomputer”, and the microcomputer of the other system is referred to as “other microcomputer”.

The first connector portion 351 of the ECU 10 includes a first power connector 131, a first vehicle communication connector 311, and a first torque connector 331. The second connector portion 352 includes a second power connector 132, a second vehicle communication connector 312, and a second torque connector 332. Each of the connector portions 351 and 352 may be formed as a single connector, or may be divided into a plurality of connectors.

The first power connector 131 is connected to the first power source 111. The power of the first power supply 111 is supplied to the first winding set 801 via the power connector 131, the power relay 141, the first motor drive circuit 701, and the motor relay 731. The power of the first power supply 111 is also supplied to the first microcomputer 401 and the sensors of the first system GR1.
The second power connector 132 is connected to the second power source 112. The power of the second power source 112 is supplied to the second winding set 802 via the power connector 132, the power relay 142, the second motor drive circuit 702, and the motor relay 732. The power of the second power source 112 is also supplied to the second microcomputer 402 and the sensors of the second system GR2.
When the power supply is not redundantly provided, the two power supply connectors 131 and 132 may be connected to a common power supply.

When the CAN is redundantly provided as the vehicle communication network, the first vehicle communication connector 311 is connected between the first CAN 301 and the first vehicle communication circuit 321, and the second vehicle communication connector 312 is connected to the second CAN 302 and the second CAN communication network 312. Connected to the vehicle communication circuit 322.
When the CAN is not provided redundantly, the two vehicle communication connectors 311 and 312 may be connected to the common CAN 30. Further, as a vehicle communication network other than CAN, a network of any standard such as CAN-FD (CAN with Flexible Data rate) or FlexRay may be used.
The vehicle communication circuits 321 and 322 communicate information bidirectionally with the microcomputers 401 and 402 of the own system and other systems.

The first torque connector 331 is connected between the first torque sensor 931 and the first torque sensor input circuit 341. The first torque sensor input circuit 341 notifies the first microcomputer 401 of the steering torque trq1 detected by the first torque connector 331.
The second torque connector 332 is connected between the second torque sensor 932 and the second torque sensor input circuit 342. The second torque sensor input circuit 342 notifies the second microcomputer 402 of the steering torque trq2 detected by the second torque connector 332.

Each processing in the microcomputers 401 and 402 may be software processing by a CPU executing a program stored in advance in a substantial memory device such as a ROM, or hardware processing by a dedicated electronic circuit. Also good.
The microcomputers 401 and 402 operate with the reference clock generated by the clock generation circuits 651 and 652. The clock monitoring units 661 and 662 monitor the reference clocks generated by the clock generation circuits 651 and 652, respectively. The generation and monitoring of the reference clock will be described later in detail.

The first microcomputer 401 generates a motor drive signal Dr1 for operating the operation of the switching element 241 of the first motor drive circuit 701 and instructs the first motor drive circuit 701. In addition, the first microcomputer 401 generates a first power relay drive signal Vpr1 and a first motor relay drive signal Vmr1.
The second microcomputer 402 generates a motor drive signal Dr2 for operating the operation of the switching element 242 of the second motor drive circuit 702, and instructs the second motor drive circuit 702. The second microcomputer 402 generates a second power relay drive signal Vpr2 and a second motor relay drive signal Vmr2.
The power supply relay drive signals Vpr1 and Vpr2 generated by the microcomputers 401 and 402 are instructed to the power supply relays 141 and 142 of the own system, and are also notified to other microcomputers.

The microcomputers 401 and 402 can transmit / receive information to / from each other through communication between microcomputers. The microcomputers 401 and 402 can transmit and receive a current detection value, a current command value, and the like to each other through communication between the microcomputers, and drive the motor 80 in cooperation with the first system GR1 and the second system GR2. . A communication frame for communication between microcomputers includes a current detection value and the like. In addition, a current command value, a current limit value, an update counter, a status signal, a CRC signal that is an error detection value signal, or a checksum signal may be included. Note that this embodiment can be applied regardless of the communication contents of the communication between microcomputers, and may transmit / receive other information as necessary, or a part or all of the data may not be included. .

If each microcomputer receives power relay drive signals Vpr1 and Vpr2 from other microcomputers, but does not receive signals from other microcomputers through communication between microcomputers, the other microcomputers are normal and communication between microcomputers is normal. Is determined to be abnormal.
On the other hand, when each microcomputer does not receive the power supply relay drive signals Vpr1 and Vpr2 from the other microcomputers and does not receive the signal from the other microcomputers through the communication between the microcomputers, it is determined that the other microcomputers are abnormal.

The first motor drive circuit 701 is a three-phase inverter having a plurality of switching elements 241 and converts electric power supplied to the first winding set 801. On / off operation of the switching element 241 of the first motor drive circuit 701 is controlled based on the motor drive signal Dr1 output from the first microcomputer 401.
The second motor drive circuit 702 is a three-phase inverter having a plurality of switching elements 242, and converts electric power supplied to the second winding set 802. The on / off operation of the switching element 242 of the second motor drive circuit 702 is controlled based on the motor drive signal Dr2 output from the second microcomputer 402.

The first power supply relay 141 is provided between the first power supply connector 131 and the first motor drive circuit 701, and is controlled by a first power supply relay drive signal Vpr1 from the first microcomputer 401. When the first power supply relay 141 is on, energization between the first power supply 111 and the first motor drive circuit 701 is allowed. When the first power supply relay 141 is off, the first power supply 111 and the first motor drive circuit are allowed. The power supply to and from 701 is cut off.
The second power supply relay 142 is provided between the second power supply connector 132 and the second motor drive circuit 702, and is controlled by a second power supply relay drive signal Vpr2 from the second microcomputer 402. When the second power supply relay 142 is on, energization between the second power supply 112 and the second motor drive circuit 702 is allowed. When the second power supply relay 142 is off, the second power supply 112 and the second motor drive circuit are allowed. The power supply to and from 702 is cut off.

The power supply relays 141 and 142 of this embodiment are semiconductor relays such as MOSFETs. When the power supply relays 141 and 142 have parasitic diodes such as MOSFETs, it is desirable to provide a reverse connection protection relay (not shown) that is connected in series so that the direction of the parasitic diodes is opposite to the power supply relays 141 and 142. Further, the power relays 141 and 142 may be mechanical relays.

The first motor relay 731 is provided in each phase power path between the first motor drive circuit 701 and the first winding set 801, and is controlled by a first motor relay drive signal Vmr 1 from the first microcomputer 401. When the first motor relay 731 is on, energization between the first motor drive circuit 701 and the first winding set 801 is allowed, and when the first motor relay 731 is off, the first motor drive circuit 701 and the first winding set 801 are turned on. Energization with the one winding set 801 is interrupted.
The second motor relay 732 is provided in each phase power path between the second motor drive circuit 702 and the second winding set 802, and is controlled by the second motor relay drive signal Vmr2 from the second microcomputer 402. When the second motor relay 732 is on, energization between the second motor drive circuit 702 and the second winding set 802 is allowed, and when the second motor relay 732 is off, the second motor drive circuit 702 and the second winding set 802 are The energization between the two-winding set 802 is interrupted.

The first current sensor 741 detects the current Im1 energized in each phase of the first winding set 801 and outputs it to the first microcomputer 401. The second current sensor 742 detects the current Im <b> 2 energized in each phase of the second winding set 802 and outputs it to the second microcomputer 402.
When the rotation angle sensors 251 and 252 are redundantly provided, the first rotation angle sensor 251 detects the electrical angle θ <b> 1 of the motor 80 and outputs it to the first microcomputer 401. The second rotation angle sensor 252 detects the electrical angle θ <b> 2 of the motor 80 and outputs it to the second microcomputer 402.
When the rotation angle sensor is not provided redundantly, for example, based on the electric angle θ1 of the first system detected by the first rotation angle sensor 251, the electric angle θ2 of the second system is calculated by the equation “θ2 = θ1 + 30 deg”. May be.

[Configuration of ECU]
Hereinafter, the configuration and operational effects of the ECU of each embodiment will be described for each embodiment. Description of each configuration related to the two-system redundancy shown in FIG. 6 is omitted as appropriate. As for the sign of the ECU of each embodiment, the number of the embodiment is attached to the third digit following “10”.
(Basic form of the first embodiment)
Prior to the description of the first embodiment, first, the configuration and operational effects of the basic form constituting the basic part of the first embodiment will be described with reference to FIGS.
FIG. 7 shows a configuration related to synchronization during operation among the configurations of the ECU 101 of the first embodiment shown in FIG. In the basic form ECU shown in FIG.
As shown in FIG. 7, the ECU 100 includes a first system control unit 601 that controls energization of the first winding set 801 and a second system control unit 602 that controls energization of the second winding set 802. The control units 601 and 602 of each system include clock generation circuits 651 and 652, clock monitoring units 661 and 662, microcomputers 401 and 402, and motor drive circuits 701 and 702. In other words, a unit of a group of components including a clock generation circuit, a microcomputer, and a motor drive circuit corresponding to each other is referred to as a “system”.

The first clock generation circuit 651 and the second clock generation circuit 652 independently generate reference clocks that the first microcomputer 401 and the second microcomputer 402 operate as references.
The first clock monitoring unit 661 monitors the reference clock generated by the first clock generation circuit 651 and output to the first microcomputer 401. The second clock monitoring unit 662 monitors the reference clock generated by the second clock generation circuit 652 and output to the second microcomputer 402. Further, when the clock monitoring units 661 and 662 detect the abnormality of the reference clock, the clock monitoring units 661 and 662 output a reset (“RESET” in the drawing) signal to the microcomputers 401 and 402.

The microcomputers 401 and 402 receive vehicle information input via the CANs 301 and 302, and information such as steering torque trq1 and trq2, phase currents Im1 and Im2, and electrical angles θ1 and θ2 input from each sensor. . The microcomputers 401 and 402 generate motor drive signals Dr1 and Dr2 by control calculation based on these various pieces of input information, and output them to the motor drive circuits 701 and 702. Here, the timing of the control operation is determined based on the clock generated by the clock generation circuits 651 and 652.

The motor drive circuits 701 and 702 energize the winding sets 801 and 802 based on the motor drive signals Dr1 and Dr2 commanded from the microcomputers 401 and 402, respectively. Typically, the motor drive circuits 701 and 702 are power conversion circuits in which a plurality of switching elements such as MOSFETs are bridge-connected. The motor drive signals Dr1 and Dr2 are switching signals that turn on / off each switching element. For example, in this embodiment for driving a three-phase brushless motor, the motor drive circuits 701 and 702 are three-phase inverters.

Each microcomputer 401, 402 is independently provided with a ROM that stores fixed values such as control programs and parameters, and a RAM that temporarily stores and holds the results of arithmetic processing. The ROM and RAM of the partner microcomputer can be referred to. Can not.
On the premise of this, the two microcomputers 401 and 402 are connected by a synchronization signal line 471. In the example illustrated in FIG. 7, the number of the synchronization signal lines 471 is one, but a plurality of synchronization signal lines may be provided in the third embodiment to be described later and other embodiments including three or more microcomputers. . That is, the ECU based on the basic form of the first embodiment generally includes at least one synchronization signal line.

This synchronization signal line is not limited to a dedicated line for transmitting a synchronization signal, which will be described later. May be shared with other signal lines.
Further, as disclosed in paragraph [0044] of Japanese Patent Application Laid-Open No. 2011-148498, for example, the port signal level is changed from the first microcomputer 401 to the second microcomputer 402 in place of communication using the synchronization signal line. By doing so, a synchronization signal can be notified.

The first microcomputer 401 and the second microcomputer 402 have drive timing generation units 441 and 442, drive signal generation units 451 and 452, and analog signal sampling units 461 and 462 as a common configuration.
The drive timing generation units 441 and 442 generate a drive timing that is a pulse timing of the motor drive signals Dr1 and Dr2 using, for example, a PWM carrier common to each phase, and instruct the drive signal generation units 451 and 452. The drive signal generators 451 and 452 generate, for example, motor drive signals Dr1 and Dr2 that are PWM signals by comparing the DUTY of the voltage command signal and the PWM carrier, and command the motor drive circuits 701 and 702.

The analog signal sampling units 461 and 462 sample analog signals.
As analog signals, the detection values of the motor currents Im1 and Im2 of each system are mainly assumed. In the three-phase motor, motor currents Im1 and Im2 are U-phase, V-phase, and W-phase currents of the winding sets 801 and 802, respectively. FIG. 7 shows arrows assuming that motor currents Im1 and Im2 detected by shunt resistors and the like provided in the motor drive circuits 701 and 702 are acquired. In addition, assuming that the motor currents Im1 and Im2 are acquired from a current sensor provided on the motor 80 side, an arrow from outside the ECU 100 to the analog signal sampling units 461 and 462 may be described. As indicated by broken lines, the analog signal sampling units 461 and 462 may acquire analog signals of the electrical angles θ1 and θ2 and the steering torques trq1 and trq2.

The analog signal sampling units 461 and 462 sample the analog signals at timings different from the switching timings of the motor drive signals Dr1 and Dr2, in synchronization with the drive timing generation units 441 and 442.
FIG. 8 shows a configuration for generating a motor drive signal Dr using a PWM carrier having a period Tp in common for each phase. Here, the assumed DUTY is, for example, a value in the range of 10% to 90%, 0% and 100%. In this specification, DUTY 0% is represented as the peak side of the PWM carrier, and DUTY 100% is represented as the valley side of the PWM carrier. The period Tp of the PWM carrier corresponds to the pulse period of the motor drive signal Dr.

When DUTY is 90%, the pulse of the motor drive signal Dr rises at time u9, falls at time d9, and the ON time is expressed as 0.9 Tp.
When DUTY is 10%, the pulse of the motor drive signal Dr rises at time u1, falls at time d1, and the ON time is expressed as 0.1 Tp.

In the DUTY range of 10% to 90%, the pulse of the motor drive signal Dr rises during the period SWu from the time u9 to the time u1, and falls during the period SWd from the time d1 to the time d9. Further, no rise or fall of the pulse occurs during the DUTY 0% and 100% periods. Therefore, in the “non-switching period NSW” hatched by the broken line, the switching of the motor drive signal Dr does not occur for the switching elements of all phases. Note that the non-switching period NSW in the PWM control corresponds to a minute period straddling the timing of the valleys and peaks of carriers.

In addition, when switching from DUTY other than DUTY 0% to 0%, or when switching from DUTY other than DUTY 100% to 100%, a rise or fall of a pulse occurs. However, by setting the DUTY switching timing to the carrier valley timing, it is possible to avoid switching at the peak timing in the non-switching period NSW. Conversely, if the DUTY switching timing is fixed at the peak timing, switching at the valley timing in the non-switching period NSW can be avoided. Further, if the setting is such that the duty cycle of the PWM carrier is switched once, for example, every N times, switching does not occur at the (N-1) times when the duty cycle is not switched.

Therefore, the analog signal sampling units 461 and 462 sample in synchronization with the drive timing generation units 441 and 442 at a timing at which switching to 0% or 100% DUTY does not occur in the non-switching period NSW. This makes the sampling signal less susceptible to switching noise and improves sampling accuracy.
More specifically, sampling is preferably performed after a lapse of time during which the surge voltage generated by switching decays.

Furthermore, in the basic form of the first embodiment, the first microcomputer 401 has a synchronization signal generation unit 411 and the second microcomputer 402 has a timing correction unit 422. The first microcomputer 401 functions as a “synchronization signal transmission side microcomputer” that transmits a synchronization signal, and the second microcomputer 402 functions as a “synchronization signal reception side microcomputer” that receives the synchronization signal. For each of the microcomputers 401 and 402, the microcomputer itself is referred to as “own microcomputer”.

The synchronization signal generation unit 411 of the first microcomputer 401 generates a synchronization signal that is synchronized with the drive timing generated by the drive timing generation unit 441 of its own microcomputer and that synchronizes the drive timings of the two microcomputers 401 and 402. Then, the synchronization signal generation unit 411 transmits a synchronization signal to the second microcomputer 402 via the synchronization signal line 471.
The timing correction unit 422 of the second microcomputer 402 receives the synchronization signal transmitted from the first microcomputer 401 and can correct the drive timing generated by the drive timing generation unit 442 of the own microcomputer so as to be synchronized with the received synchronization signal. It is. This correction is called “timing correction”. As indicated by a broken line in the second microcomputer 402 in FIG. 7, in timing correction, a timing correction instruction is output from the timing correction unit 422 to the drive timing generation unit 442, and the drive timing generation unit 442 changes the drive timing accordingly. to correct.

Incidentally, a configuration in which “the second microcomputer 402 corrects the drive timing based on the synchronization signal transmitted from the first microcomputer 401” is disclosed in Patent Document 1 (Japanese Patent No. 5412095). In contrast to this conventional technique, in the basic form of the first embodiment, a timing determination unit 432 as a “reception signal determination unit” is further included in the timing correction unit 422.
Next, before moving on to the description of the timing determination unit 432, the problems solved by the conventional technique of Patent Document 1 and the problems that have not been solved by this conventional technique will be described with reference to FIGS.

FIG. 9 shows how the timings of the motor drive signals Dr1 and Dr2 of the two microcomputers 401 and 402 are gradually shifted due to manufacturing variations of the clock generation circuits 651 and 652.
In the time charts of FIG. 9 and subsequent figures, the pulse period of the first motor drive signal Dr1 is indicated as TpA, and the pulse period of the second motor drive signal Dr2 is indicated as TpB. Also, the PWM carrier valley and peak timings of the first microcomputer 401 are set to ta1, ta2,... In order from the reference time ta0. Similarly, the valley and peak timing of the PWM carrier of the second microcomputer 402 are tb1, tb2,... In order from the reference time tb0. Here, the reference times ta0 and tb0 match.

After the reference times ta0 and tb0, since the pulse period is in a relationship of TpA <TpB, the second motor drive signal Dr2 is gradually delayed with respect to the first motor drive signal Dr1. Although the timing shift Δt1 that occurs in the first cycle is relatively small, if this accumulates, the timing shift expands to the size of Δt7 in the fourth cycle. When the timing deviation becomes large, torque pulsation occurs as described in Patent Document 1, for example.

In FIG. 9, the falling timing of the first motor drive signal Dr1 after ta11 overlaps with the analog signal sampling timing of the second microcomputer 402. The rising timing of the second motor drive signal Dr2 after tb11 overlaps with the analog signal sampling timing of the first microcomputer 401. Thus, at the sampling timing overlapping the pulse edges of the motor drive signals Dr1 and Dr2, the sampling accuracy is lowered due to the influence of switching noise.

Next, in the prior art of Patent Document 1, two microcomputers 401 and 402 are connected by a synchronization signal line 471, and a shift in calculation timing is corrected using the synchronization signal. This method is shown in FIG.
As shown in FIG. 10, the synchronization signal is generated as a pulse signal having a cycle Ts corresponding to four cycles of the pulse cycle TpA of the first motor drive signal Dr1. This pulse repeats rising and falling every four times of PWM carrier valley and peak timing. That is, it rises at ta0 and ta8, and falls at ta4 and ta12. In the example of FIG. 10, the timing of the second microcomputer 402 is corrected so as to synchronize with the timing of ta0 and ta8 when the pulse rises.

That is, the timing is corrected so that the timing tb8 of the second microcomputer 402 coincides with the timing ta8 at which the synchronization signal pulse rises after the timing deviation Δt7 is accumulated as in FIG.
Since the timing shift is reset to 0 at tb8, the timing shift Δt9 that occurs in the subsequent one cycle is suppressed to the same extent as the initial timing shift Δt1. That is, good motor driving can be continued by correcting and synchronizing the drive timing before the timing deviation reaches a level that affects torque pulsation and sampling accuracy. A specific synchronization method is not limited to the example in FIG. 10 and may be set as appropriate.

In this way, by performing timing correction using a synchronization signal among a plurality of microcomputers, each microcomputer can operate a motor while synchronizing control timing in an ECU that operates with a clock generated by an independent clock generation circuit. It can be carried out. Thereby, torque pulsation can be suppressed. Further, it is possible to avoid the analog signal sampling timing from overlapping with the switching timing of the motor drive signals Dr1 and Dr2.

However, a normal synchronization signal is not always transmitted. That is, an abnormality occurs in the transmitted synchronization signal itself due to a failure of the first clock generation circuit 651 for operating the first microcomputer 401 or the synchronization signal generation unit 411 of the first microcomputer 401 or the synchronization signal line 471. There is a possibility. Then, next, a problem when an abnormal synchronization signal is received by the second microcomputer 402 will be described.

FIG. 11 shows a malfunction that is assumed when an abnormality occurs in the first clock generation circuit 651 that operates the first microcomputer 401.
As shown in FIG. 11, the clock generation circuit 651 is normal from the reference time ta0 to ta8, but after ta8, the clock frequency increases and an abnormality occurs in which the pulse period TpA of the first motor drive signal Dr1 is shortened. . Along with this, the frequency of the synchronization signal generated using the clock generated by the clock generation circuit 651 increases, and the cycle Ts becomes shorter.
In this case, if the control calculation becomes unable to follow the increased clock frequency, the control of the first microcomputer 401 fails, and the motor drive must be stopped.

On the other hand, the second microcomputer 402 is normal, and the pulse period TpB of the second motor drive signal Dr2 is kept constant. Here, it is assumed that the drive timing of the second microcomputer 402 is corrected to the rising timings ta0, ta8, ta16, and ta24 of the synchronization signal pulse. Then, at ta16 and ta24 surrounded by a broken line, timing correction is performed in the middle of the ON period of the second motor drive signal Dr2, and it is forcibly turned off.
As a result, an unintended pulse is generated, and the switching control of the second motor drive circuit 702 may become unstable. In addition, the sampling interval of the analog signal becomes uneven, which may affect the sampling accuracy.

In this way, the influence of the failure generated in the first system control unit 601 affects the operation of the microcomputer 402 of the other system is referred to as “failure propagation”. In the example of FIG. 11, the second microcomputer 402 performs timing correction based on the abnormal synchronization signal transmitted from the first microcomputer 401, so that the motor drive that should have been able to be executed normally if only the second system is used. There is a serious situation where the situation becomes impossible.

In the first place, the reason why the motor control device has a redundant configuration of two systems is that even if an abnormality occurs in one of the systems, the motor drive can be continued by the operation of the other normal system. Nevertheless, when fault propagation occurs, its purpose is not fulfilled at all.
In particular, in the electric power steering apparatus 90, it is more important to continue driving the motor and avoid stopping the assist function even if torque pulsation occurs and analog signal sampling accuracy is reduced. Therefore, there is a fatal problem in the prior art of Patent Document 1 in which there is a possibility of failure propagation.

Therefore, in order to solve this problem, the ECU 100 according to the basic form of the first embodiment performs “reception signal determination” which is a determination of normality or abnormality of the received synchronization signal on the timing correction unit 422 of the second microcomputer 402. A timing determination unit 432 is included as the “reception signal determination unit”.
The second microcomputer 402 permits timing correction when the timing determination unit 432 determines that the received synchronization signal is normal. On the other hand, when it is determined that the received synchronization signal is abnormal, the second microcomputer 402 prohibits timing correction and drives the motor asynchronously with the first microcomputer 401.

In short, the synchronization signal reception side microcomputer first determines whether or not the synchronization signal from the synchronization signal transmission side microcomputer that causes failure propagation is normal. When the synchronization signal is determined to be normal, good motor drive is realized by correcting the drive timing of the synchronization signal reception side microcomputer so as to be synchronized with the drive timing of the synchronization signal transmission side microcomputer.
However, when it is determined that the synchronization signal is abnormal, priority is given to prevention of failure propagation and timing correction is not performed. That is, it is most important to maintain the minimum assist function by cutting the edge with the synchronization signal transmission side microcomputer and continuing the motor drive asynchronously.

Next, a configuration in which the timing determination unit 432 performs “timing determination” as “reception signal determination” will be described with reference to FIGS.
In the determination method of the basic form of the first embodiment, it is determined whether or not the pulse edge of the received synchronization signal, that is, the rising or falling timing is included in the “synchronization permission section”. The “synchronization permission section” may be rephrased as “correction permission section”. Hereinafter, the “timing of pulse edge reception of the synchronization signal” is simply referred to as “synchronization signal reception timing”.

This timing determination process in the motor control method is shown in the flowchart of FIG. In the following flowchart, the symbol “S” means a step. Except for S01 of FIG. 12, the execution subject of the flowcharts of FIG. 12 and FIGS.
The synchronization signal generation unit 411 of the first microcomputer 401 transmits a synchronization signal to the second microcomputer 402 in the synchronization signal transmission step S01 of FIG.
In the synchronization signal reception step S02, the timing correction unit 422 receives the synchronization signal.
In the reception signal determination step S03, the timing determination unit 432 determines whether the synchronization signal is normal or abnormal by determining whether the reception timing of the synchronization signal is within the synchronization permission section.

If YES in S03, the second microcomputer 402 permits the timing correction of the second microcomputer 402 in the timing correction permission step S04. Then, the first microcomputer 401 and the second microcomputer 402 drive the motor 80 in synchronization. This is called “synchronous drive mode”.
If NO in S03, it is determined that the received synchronization signal is abnormal. The second microcomputer 402 prohibits the timing correction of the second microcomputer 402 in the timing correction prohibiting step S05, and drives the motor 80 asynchronously with the first microcomputer 401.

Next, a setting example of the synchronization permission section will be described. For example, as shown in FIG. 10, a case is assumed where a pulse of the synchronization signal is generated in accordance with the valley or peak timing of the PWM carrier. In this case, as shown in FIG. 8, the timing of the synchronization signal does not overlap with the switch timing of the motor drive signal Dr.
When the timing difference between the motor drive signals Dr1 and Dr2 is ideally 0, the timing at which the timing correction unit 422 receives the synchronization signal coincides with the valley or peak timing of the PWM carrier of the second microcomputer 402. With respect to this ideal state, the maximum range of clock deviation when the clock generation circuits 651 and 652 are normal is estimated.

For example, it is assumed that the clocks generated by the clock generation circuits 651 and 652 vary by a maximum of ± x%, and the period for performing timing correction by the synchronization signal is Ts [s].
At this time, the counted time in the microcomputers 401 and 402 is at least “(100−x) / 100” times to “(100 + x) / max” with respect to the original clock generated by the clock generation circuits 651 and 652. It varies in the range of 100 times.
From this, the maximum deviation width ΔTmax [s] generated between the microcomputers 401 and 402 during one synchronization period is expressed by Expression (1).
ΔTmax = Ts × {(100 + x) − (100−x)} / 100
= Ts × 2x / 100 (1)

In order not to prohibit the correction by mistake during normal driving, it is necessary to define the synchronization permission section with a width of ΔTmax or more. In addition, an appropriate timing determination process can be performed by setting the synchronization permission section within the time allowed by the system.
For example, the synchronization period Ts is set to 1 ms, and the variation width of the clock generated by the clock generation circuits 651 and 652 is set to ± 1% at the maximum. At this time, the maximum deviation width ΔTmax [s] generated from one synchronization to the next synchronization is 0.02 [ms] according to the equation (1).
ΔTmax = 1 [ms] × (2 × 1/100) = 0.02 [ms]

As shown in FIG. 13, it is assumed that the PWM carrier period Tp is, for example, 0.5 [ms] and the DUTY range is 10% to 90%. Here, when driven at DUTY 90%, the non-switching period from the falling time d9 of the motor drive signal Dr to the next rising time u9 is 0.1 Tp, that is, 0.05 [ms].
On the other hand, when a period of 0.02 [ms], which is the maximum deviation width ΔTmax, is set as a synchronization permission section around 0.01 [ms] before and after the valley timing of the PWM carrier, the synchronization permission section is reliably set to 0.05 [ms]. ] Within the non-switching period.

For this reason, if the variation in the clock generated by the clock generation circuits 651 and 652 is within ± 1% at the maximum, the synchronization permission interval is set to 2% or more of the synchronization signal period Ts. Therefore, it is possible to prevent the correction from being prohibited. Therefore, it is possible to continue the synchronous driving while synchronizing the driving timing between the microcomputers 401 and 402.
If the clock variation exceeds ± 1% due to the failure of the second clock generation circuit 652, it can be detected by the second clock monitoring unit 662. Therefore, it is assumed that the position of the synchronization permission section of the second microcomputer 402 is set correctly.

Also, if the synchronization permission section is set within the non-switching period of the motor drive signal Dr at the maximum DUTY, it is possible to avoid the forced OFF during the pulse ON period due to the timing correction. Therefore, even if an abnormal synchronization signal enters the synchronization permission section at a timing different from the original synchronization timing, the motor drive signal Dr can always ensure the pulse width at the maximum DUTY, and there is no problem. Operation can be secured.

Note that, for example, in overmodulation control including 0% and 100% output in addition to the range of 10% to 90% as the DUTY, the reception timing of the synchronization signal may overlap the switching timing of the DUTY. However, in this case, the DUTY switching timing is only synchronized. For example, when DUTY is kept at 100%, there is no timing to turn off in the first place. Absent.

Also, at the switching timing of DUTY, for example, when switching from DUTY other than 100% to 100%, after the normal pulse width is fully obtained for DUTY before switching, the start timing of 100% DUTY output is only changed. . On the other hand, in the case of switching from 100% DUTY to a DUTY other than 100%, the end timing of 100% DUTY output is only changed, and the next DUTY output period is not affected. In any case, an abnormal DUTY output is not performed, and the influence on the motor drive is slight. The 0% DUTY output is the same as the 100% DUTY output except that the ON and OFF are switched.

FIG. 14 shows a timing chart of timing determination when the synchronization signal is abnormal, using the synchronization permission section in the above example. FIG. 14 shows the result of timing determination at the rising timings ta8, ta16, and ta24 of the synchronization signal when an abnormality occurs in the first clock generation circuit 651, as in FIG. The case where the timing of the synchronization signal is within the synchronization permission section is described as “OK”, and the case where it is outside the synchronization permission section is described as “NG”.

In ta8 and ta16, the timing correction unit 422 does not perform timing correction because the reception timing of the synchronization signal is outside the synchronization permission section. At this time, the second microcomputer 402 drives the motor 80 asynchronously with the first microcomputer 401.
Thereby, the second microcomputer 402 can prevent failure propagation from the first microcomputer 401. In particular, at ta16, a situation in which the motor drive signal Dr2 is forcibly turned off during the ON period by timing correction based on an abnormal synchronization signal is avoided.

On the other hand, at ta24, since the reception timing of the synchronization signal is within the synchronization permission section, the timing correction unit 422 performs timing correction. In this case, even if the period Ts of the synchronization signal is abnormal, the rising timing itself at ta24 is close to the normal timing. Therefore, even if the timing correction unit 422 performs timing correction based on the received synchronization signal, there is substantially no influence on the motor drive signal Dr2.

As described above, according to the basic technical idea of the basic form of the first embodiment, the timing determination unit 422 of the second microcomputer 402 determines whether the synchronization signal transmitted from the first microcomputer 401 is normal or abnormal. .
When it is determined that the received synchronization signal is normal, the second microcomputer 402 permits timing correction and drives the motor 80 in synchronization with the first microcomputer 401. Thereby, torque pulsation of the motor 80 can be suppressed. Further, it is possible to avoid the sampling timing of the analog signal sampling units 461 and 462 from overlapping with the switching timing of the motor drive signals Dr1 and Dr2. When a rectangular wave of DUTY 50% is used as the synchronization signal, the rise timing and fall timing enter the non-switching period NSW, so that the influence on the analog signal due to secondary switching of the synchronization signal is reduced. It is possible.

On the other hand, when it is determined that the received synchronization signal is abnormal, the second microcomputer 402 prohibits timing correction and drives the motor asynchronously with the first microcomputer 401. Thereby, it is possible to prevent the control of the second microcomputer 402 from failing due to the failure propagation from the first microcomputer 401.
In particular, the electric power steering apparatus 90 can maintain at least the normal motor drive by the second microcomputer 402 and maintain the assist function.

Note that the switching of the motor drive signals Dr1 and Dr2 may affect not only the sampling of the analog signal but also the synchronization signal. Assume that the switching of the motor drive signals Dr1 and Dr2 affects the synchronization signal and an erroneous pulse edge occurs in the synchronization signal. In this case, with a normal configuration in which no synchronization permission section is provided, there is a problem that the synchronization signal receiving side microcomputer recognizes the rising edge of the pulse at a timing different from the original, and erroneous timing correction is performed.

However, according to the configuration of the basic form of the first embodiment in which the synchronization permission section is set within the non-switching period NSW, it can be expected that a significant effect is obtained even for this problem. That is, according to the configuration of the basic form of the first embodiment, the switching of the motor drive signals Dr1 and Dr2 is always performed outside the synchronization permission section. Therefore, even if the synchronization signal is affected and an erroneous pulse edge occurs, the timing can be expected to be outside the synchronization permission interval. As a result, even if the synchronization signal receiving side microcomputer recognizes the pulse edge of the synchronization signal caused by the influence of the switching of the motor drive signals Dr1 and Dr2, it is outside the synchronization permission section, so it is determined that the synchronization timing is abnormal. can do. Therefore, it is possible to avoid timing correction at the wrong timing by the synchronization signal receiving side microcomputer.

Next, various application processes of the basic form of the first embodiment will be described with reference to FIGS.
(Processing at startup)
When each microcomputer starts up and starts motor drive, if there is a deviation in the drive timing, the synchronization signal reception timing does not enter the synchronization permission section even if it is operating normally. Timing correction may not be permitted. Therefore, it is conceivable that the startup processing shown in FIGS. 15 and 16 is performed when the synchronization signal receiving side microcomputer is started up.

FIG. 15 shows a flowchart of the motor drive start process when the microcomputer is activated.
In S10, the second microcomputer 402 on the receiving side is activated. The initial value of the number of receptions at startup is zero. The timing correction unit 422 receives the synchronization signal in S11, and increments the number of receptions in S12.
In S13, it is determined whether or not the number of receptions has reached a predetermined initial number Ni (≧ 2).
If YES in S13, the second microcomputer 402 starts driving the motor in S14. If NO in S13, the process returns to before S11.

In short, the synchronization signal receiving side microcomputer waits for the start of motor driving until the synchronization signal is received Ni times from the synchronization signal transmission side microcomputer. When the synchronization signal is received Ni times, the motor driving is synchronized with the synchronization signal transmission side microcomputer. To start. Thereby, after waiting for the preparation of the synchronization between the plurality of microcomputers to be completed, the synchronous drive can be appropriately started.

FIG. 16 shows a flowchart of the timing determination standby process when the microcomputer is activated.
S20 to S22 are the same as S10 to S12 of FIG.
In S23, it is determined whether or not the number of receptions exceeds a predetermined standby number Nw (≧ 1).
In the case where S23 is YES, the timing determination unit 432 starts timing determination in S24. If NO in S23, the process returns to before S21.

In short, after the activation of the synchronization signal receiving side microcomputer, the synchronization signal receiving side microcomputer permits the timing correction unconditionally until the number of times of receiving the synchronization signal is Nw times. Then, timing determination is started from the synchronization signal received after the (Nw + 1) th time. As a result, it is possible to appropriately avoid a situation where timing correction is excessively prohibited immediately after startup.

(Return processing)
Once an abnormality occurs in the sync signal and the system shifts to asynchronous drive, even if the sync signal transmission side microcomputer is reset or reinitialized, the synchronous drive cannot be resumed. . Therefore, it is conceivable to perform the return process shown in FIG.

FIG. 17 shows a flowchart of the timing correction return processing after the synchronization signal abnormality determination.
In S31, the timing correction unit 422 determines that the synchronization signal is abnormal because the reception timing of the synchronization signal is outside the synchronization permission section.
In S32, it is determined whether the synchronization signal reception count after the abnormality determination has reached a predetermined return count Nre (≧ 2) or whether the synchronization signal non-reception period has reached a predetermined return time Tre.
If YES in S32, the timing correction unit 422 cancels the prohibition of timing correction in S33. Then, after receiving the next synchronization signal, if the reception timing is within the synchronization permission section and the synchronization signal is determined to be normal, timing correction is permitted.

(Abnormality confirmation processing)
For example, the synchronization signal is abnormal because the synchronization signal reception timing does not enter the synchronization permission section even though there is no substantial abnormality in the synchronization signal transmission microcomputer due to temporary disturbance of the synchronization signal pulse, etc. There is a possibility that it is erroneously determined that. In such a case, the timing correction may be excessively prohibited. Therefore, it is conceivable to perform the abnormality confirmation process shown in FIG.

FIG. 18 shows a flowchart of the synchronization signal abnormality confirmation process.
In S <b> 40, the timing determination unit 432 sets the initial value of the continuous abnormality count, which is “the number of times that the synchronization signal abnormality is continuously determined”, to 0.
In S41, the timing correction unit 422 receives the synchronization signal.
In S42, the timing determination unit 432 determines whether the reception timing of the synchronization signal is outside the synchronization permission section. If the synchronization signal is normal and the result in S42 is NO, the process ends. In this case, timing correction is performed in S04 of FIG.
If YES in S42, the number of consecutive abnormalities is incremented in S43.
In S44, it is determined whether or not the number of consecutive abnormalities has reached a predetermined fixed number Nfix. If YES in S44, the process proceeds to S45. If NO in S44, the process returns to before S41.

When the timing determination unit 432 determines the abnormality of the synchronization signal in S45, the timing correction unit 422 prohibits the timing correction in S46. In other words, the timing correction may be permitted until the abnormality is confirmed, and the second microcomputer 402 may continue the synchronous driving with the first microcomputer 401. Thereby, erroneous determination in timing determination can be prevented.

(First embodiment)
Based on the configuration of the basic form as described above, the first embodiment will be described with reference to FIGS.
FIG. 19 shows the configuration of the ECU 101 of the first embodiment. Like FIG. 7 of the basic form, in FIG. 19, “1” is added to the end of the component of the first system and “2” is added to the end of the component of the second system. . In the following description, when distinguishing the components of each system, “first” or “second” is added to the beginning of the component or signal, and common matters are collectively described.

In this specification, regarding the control of the microcomputer, the control in which the plurality of microcomputers 401 and 402 operate in synchronization is referred to as “synchronous control”. Asynchronous control. Further, the drive modes of the motor 80 by the operations of the microcomputers 401 and 402 include the following three drive modes.
(1) “Synchronous drive mode” in which the first microcomputer 401 and the second microcomputer 402 drive the motor in synchronization.
(2) “Asynchronous drive mode” in which the first microcomputer 401 and the second microcomputer 402 drive the motor asynchronously without using a synchronization signal.
(3) “One-system drive mode” in which the motor is driven by only one of the microcomputers 401 and 402

The synchronous drive mode is applied when the microcomputers 401 and 402 perform synchronous control. In addition, when the microcomputers 401 and 402 perform asynchronous control, an asynchronous drive mode or a single-system drive mode is applied. At the start of asynchronous control, each of the microcomputers 401 and 402 starts a timer independently, except when continuing the previous operation.
In the asynchronous drive mode, the microcomputers 401 and 402 generate motor drive signals Dr1 and Dr2 at respective timings. In the single-system drive mode, for example, the second microcomputer 402 that is the own microcomputer does not cause the first microcomputer 401 that is the other microcomputer to generate the motor drive signal Dr1, and drives the motor 80 only by the motor drive signal Dr2 that the own microcomputer generates. To do.

In the basic mode, the synchronization control state can be continued during the operation of the microcomputers 401 and 402. However, the first synchronization after the activation of the microcomputers 401 and 402 is not considered.
For example, there is a case where the start timing of each microcomputer due to power ON is shifted due to a difference in power supply voltage supplied to each microcomputer, wiring resistance, voltage detection characteristics, or the like. Then, only the microcomputer that has been activated first operates asynchronously during the period from when the microcomputer that has been activated first starts the timer to when the microcomputer that is activated later starts the timer. Therefore, the two microcomputers 401 and 402 cannot be synchronized from the first time.

Also, there are cases where each microcomputer performs control in units of multiple cycles of the synchronization signal. Then, when one microcomputer synchronizes with a synchronization signal after several cycles different from the control unit after one microcomputer starts the timer, there is an offset in the control timing between the microcomputers. There is a problem that cannot be made.

Therefore, the ECU 101 according to the first embodiment enables synchronous control from the first time after the microcomputers 401 and 402 are activated. For this purpose, the microcomputers 401 and 402 perform “initial handshake” by transmitting and receiving signals to each other after activation. In addition, an “initial handshake determination unit” that determines whether the initial handshake is successful is provided. Since the handshake referred to in the present embodiment is not the one that is performed for the first time after activation, “first time” will be omitted and referred to as “handshake” and “handshake determination unit”.

Differences in configuration between the first microcomputer 401 and the second microcomputer 402 included in the ECU 101 of the first embodiment will be mainly described with respect to the ECU 100 of the basic form shown in FIG. As in the basic form, the first microcomputer 401 is a “synchronization signal transmission side microcomputer”, and the second microcomputer 402 is a “synchronization signal reception side microcomputer”.
The first microcomputer 401 further includes a handshake determination unit 611 and a ready signal reception unit 621 in addition to the basic configuration. The second microcomputer 402 further includes a handshake determination unit 612 and a ready signal transmission unit 622 in addition to the basic configuration.
A thick solid line arrow in FIG. 19 indicates a synchronization signal, and a thick one-dot chain line arrow indicates a ready signal.

The ready signal transmitter 622 transmits a ready signal indicating that the synchronization preparation of the second microcomputer 402 is completed to the ready signal receiver 621 of the first microcomputer 401 via the ready signal line 475. Here, the ready signal line 475 may be shared with the synchronization signal line 471 or may be provided separately from the synchronization signal line 471. Similarly to the synchronization signal, the ready signal may be notified by changing the level of the port signal instead of the communication using the ready signal line.
The ready signal receiving unit 621 receives a ready signal. Specifically, the ready signal receiving unit 621 detects that a ready signal has been received. Hereinafter, “receiving” means “detecting reception”, including the reception of the synchronization signal by the timing correction unit 422.

The handshake determination unit 611 of the first microcomputer 401 determines whether the handshake has succeeded or failed based on the synchronization signal transmitted by the synchronization signal generation unit 411 and the ready signal received by the ready signal reception unit 621. .
The handshake determination unit 612 of the second microcomputer 402 determines whether the handshake has succeeded or failed based on the synchronization signal received by the timing correction unit 422 and the ready signal transmitted by the ready signal transmission unit 622.
Details of signal transmission / reception and success / failure determination in the handshake will be described later.

The microcomputers 401 and 402 have current calculation units 631 and 632 that output commands to the drive signal generation units 451 and 452. Note that the current calculation units 631 and 632 are actually included in the basic form. However, since the relation with the specific operation of the basic form is weak, the illustration is omitted in FIG.

In the example shown in FIG. 19, it is assumed that the ready signal is generated as one of the communication clock signals, and the communication clock signal includes a data signal for communication between microcomputers other than the ready signal. In this case, the ready signal transmission unit 622 transmits a communication clock signal including the data signal input from the current calculation unit 632. The ready signal receiver 621 outputs a data signal included in the received communication clock signal to the current calculator 632.
Therefore, from the viewpoint including transmission and reception of data signals, the ready signal transmission unit 622 and the ready signal reception unit 621 may be simply referred to as “communication unit”, and the ready signal line 475 may be simply referred to as “signal line”. However, in the present embodiment, a name focusing on a ready signal transmission / reception function in handshake is used.

FIG. 19 shows the timing determination unit 432 in the timing correction unit 422 of the second microcomputer 402 and the analog signal sampling units 461 and 462 of the microcomputers 401 and 402 shown in FIG. Omitted. These may be omitted in the handshake operation of the first embodiment.
That is, as for the synchronization between the microcomputers after the first time, it is only necessary that the timing correction unit 422 can perform the timing correction based on at least the synchronization signal transmitted from the first microcomputer 401 to the second microcomputer 402. In addition, in the configuration in which the timing determination unit 432 is provided, as described in the basic form, timing correction is prohibited when the synchronization signal is abnormal, and control of the second microcomputer 402 is prevented from failing. it can.

Next, each operation example of the handshake according to the first embodiment will be described with reference to the time charts and flowcharts of FIGS.
First, note the terms listed on the left side of each time chart.
The “PWM timer” of each of the microcomputers 401 and 402 is a PWM carrier reference timer generated by the clock generation circuits 651 and 652, and the drive signals Dr1 and Dr2 are generated based on the timers. , 82 is controlled. The start of PWM timer generation is hereinafter referred to as “timer start”.
Further, the start timing when the power of each microcomputer 401, 402 is turned on is shown on the PWM timer chart for convenience.

“Synchronization signal 1 → 2” means a synchronization signal transmitted from the synchronization signal generation unit 411 of the first microcomputer 401 to the timing correction unit 422 of the second microcomputer 402. In this example, the synchronization signal is at a low level at startup.
In the operation example 1 in FIG. 20 and the like, the synchronization signal once rises from the low level to the high level before the timer of the first microcomputer 401 starts, and then returns to the low level again. In this case, the rising edge of the first synchronization signal is not recognized as the synchronization timing with the second microcomputer 402, but has the meaning of notifying the synchronization when the timer is started. Therefore, the operation of setting the synchronization signal to the high level before the timer starts is referred to as “outputting or transmitting the synchronization notice signal”. The operation of returning the high level synchronization signal to the low level before the timer starts is referred to as “end the synchronization notice signal”.

In the present embodiment, the first microcomputer 401 switches between the low level and the high level of the synchronization signal, and transmits to the second microcomputer 402 via the synchronization signal line 471 so that it also functions as a synchronization notice signal. As a result, there is no need to provide a signal generation unit or signal line dedicated for synchronization notice in handshaking.

After the timer of the first microcomputer 401 is started, the synchronization signal is toggled so as to periodically repeat the high level and the low level with the four periods of the PWM timer as the synchronization period Ts. In the present embodiment, the rising timing and falling timing of the synchronization signal coincide with the valley timing of the PWM timer.
Similar to the basic mode, the rising timing of the synchronization signal is the synchronization timing with the second microcomputer 402. In the configuration in which the timing determination is performed by the second microcomputer 402, whether the synchronization signal is normal or abnormal is determined based on the rising timing of the synchronization signal.

“Ready signal 2 → 1” means a ready signal transmitted from the ready signal transmission unit 622 of the second microcomputer 402 to the ready signal reception unit 621 of the first microcomputer 401. In this example, the ready signal is set to a high level as a default at start-up. Thereafter, a pulse signal that continuously repeats the high level and the low level four times is output as a ready signal for notifying that the synchronization preparation of the second microcomputer 402 has been completed. Note that the width and number of pulses may be set as appropriate. In the present embodiment, the communication clock signal used as the ready signal is continuously output periodically after the timer of the second microcomputer 402 is started.
Thus, in the present embodiment, the synchronization notice signal and the ready signal correspond to “signals to be transmitted / received” in the handshake.

“Period” indicates a location cited in the following description. The symbols <0> to <6> are attached independently for each figure, and are not related to the period of the same symbol in other figures. In the description of the specification, <> is not attached, and for example, a period corresponding to <1> in the figure is described as “period 1”.
The explanation of the operation at the temporary point in each period is an explanation of the operation executed at the start of the period, in principle, ignoring the control time lag.

[Operation Example 1]
As a specific operation example, an operation example 1 in which handshaking is successful after the microcomputers 401 and 402 are simultaneously started will be described with reference to FIG.
In period 1, the microcomputers 401 and 402 are in a state after being activated. The second microcomputer 402 counts the elapsed time from the start of period 1 as the second handshake time Ths2.
In period 2, the first microcomputer 401 transmits a synchronization notice signal to the second microcomputer 402. The second microcomputer 402 receives this synchronization notice signal before the second handshake time Ths2.

In addition, the first microcomputer 401 measures the elapsed time from the start of period 2.
The second microcomputer 402 transmits a ready signal to the first microcomputer 401 in period 3 as a response to the synchronization notice signal received in period 2. The first microcomputer 401 receives this ready signal before the first handshake time Ths1 has elapsed.
The first microcomputer 401 ends the synchronization notice signal in period 4 when the first handshake time Ths1 has elapsed after receiving the ready signal in period 3.

Since the transmission of the synchronization notice signal and the reception of the ready signal are normally performed through the operations in the periods 2, 3, and 4, the handshake determination unit 611 of the first microcomputer 401 determines that the handshake is successful, Instructs the drive timing generation unit 441 to perform initial synchronization.
Similarly, since the reception of the synchronization notice signal and the transmission of the ready signal are normally performed, the handshake determination unit 612 of the second microcomputer 402 determines that the handshake is successful, and the drive timing generation unit 442 Command the first synchronization.
In period 5, the first microcomputer 401 starts a timer simultaneously with outputting a synchronization signal. The second microcomputer 402 starts a timer at the rising timing of the synchronization signal received from the first microcomputer 401. Thereby, the microcomputers 401 and 402 drive the motor 80 synchronously from the first time after activation, that is, in the synchronous drive mode.

[Modification of Operation Example 1]
In the operation example 1, it is assumed that the first microcomputer 401 and the second microcomputer 402 are activated simultaneously and instantaneously. However, in reality, when the power supplies 111 and 112 corresponding to the microcomputers 401 and 402 are turned on from the OFF state, the supply voltage to the microcomputers 401 and 402 gradually increases from 0, and then the supply voltage reaches a certain value. At this time, the microcomputers 401 and 402 are activated. Even if the power supplies 111 and 112 are turned on at the same time if this rising gradient varies due to the wiring resistance of the power supply path or the like. The activation timings of the microcomputers 401 and 402 vary.
Referring to FIG. 21, as a modification of the first operation example, when the start timing deviation of the microcomputers 401 and 402 due to the time difference between the rise time UT1 of the first power supply 111 and the rise time UT2 of the second power supply 112 is relatively small An operation example will be described.

At the start of period 1, the first power supply 111 and the second power supply 112 are turned ON simultaneously from the OFF state, and the supply voltage to the microcomputers 401 and 402 increases. The second power supply 112 completes rising after time UT2, and the second microcomputer 402 is activated. Subsequently, the first power source 111 completes rising after the time UT1 shortly after the start of the second handshake time Ths2, and the first microcomputer 401 is activated.
Thereafter, the first microcomputer 401 transmits a synchronization notice signal to the second microcomputer 402 at the start of the period 2. Thereafter, as in the operation example 1 of FIG. 20, it is determined that the handshake is successful through the periods 2, 3, and 4.

In period 5, the first microcomputer 401 starts the timer simultaneously with outputting the synchronization signal, and the second microcomputer 402 starts the timer at the rising timing of the synchronization signal received from the first microcomputer 401. Thereby, the microcomputers 401 and 402 drive the motor 80 synchronously from the first time after activation, that is, in the synchronous drive mode.
As described above, even if the start timing of the first microcomputer 401 is slightly delayed, if the first microcomputer 401 transmits the synchronization notice signal within the second handshake time Ths2, the handshake is successful as in the first operation example. To do. On the other hand, even if the activation timing of the second microcomputer 402 is slightly delayed, the second microcomputer 402 transmits a ready signal within the first handshake time Ths1, which is the same as the operation example 1.

[Operation example 2]
Next, an operation example in which the handshake fails due to a “timeout” in which the other microcomputer does not start within a predetermined time after one of the microcomputers is started will be described. It should be noted that the case where the signal to be transmitted is not transmitted within a predetermined time after the other microcomputer is activated is considered to be similar to the case where it is not activated.
First, referring to FIG. 22, an operation example 2 in which handshake fails due to a timeout after the second microcomputer 402 is activated will be described. In the operation example 2, the first microcomputer 401 does not start even if a predetermined time has elapsed after the second microcomputer 402 is started, or the ready signal is not transmitted even if the first microcomputer 401 is started.

In period 1 of FIG. 22, only the second microcomputer 402 is in a state after startup. The second microcomputer 402 counts the elapsed time from the start of period 1. Thereafter, time elapses without the second microcomputer 402 receiving the synchronization notice signal to be transmitted from the first microcomputer 401.
When the elapsed time from the start of period 1 reaches the second handshake time Ths2, the handshake determination unit 612 of the second microcomputer 402 determines that the handshake has failed due to a timeout. Then, the handshake determination unit 612 notifies the drive timing generation unit 442 that the second microcomputer 402 generates the drive signal Dr2 alone.
In period 2, the second microcomputer 402, which is the synchronization signal receiving microcomputer, starts a timer independently. Accordingly, the ECU 101 drives the motor 80 in the second system single-system drive mode without causing the first microcomputer 401 to generate the motor drive signal Dr1.

[Modification A of Operation Example 2]
Next, with reference to FIG. 23, the modification A of the operation example 2 considering the rise time of the power supply will be described. In this example, the time difference between the rise time UT1 of the first power supply 111 and the rise time UT2 of the second power supply 112 is large compared to the modification of the operation example 1 shown in FIG. .
At the start of period 1, the first power supply 111 and the second power supply 112 are turned ON simultaneously from the OFF state, and the supply voltage to the microcomputers 401 and 402 increases. The second power supply 112 completes rising after time UT2, and the second microcomputer 402 is activated. Here, the rise time UT1 of the first power supply 111 is longer than the sum of the rise time UT2 of the second power supply 112 and the second handshake time Ths2. Therefore, the second handshake time Ths2 elapses before the first microcomputer 401 is activated, and in the period 2, the second microcomputer 402 starts a timer alone. Therefore, the motor 80 is driven in the single-system drive mode of the second system.

Thereafter, the rising of the first power supply 111 is completed in the middle of the period 2, and the first microcomputer 401 is activated. Subsequently, in period 3, the second microcomputer 402 after the timer starts transmits an invalid ready signal to the first microcomputer 401 during the elapse of the first handshake time Ths 1.
Here, “invalid” means that the microcomputer on the receiving side (here, the first microcomputer 401) does not recognize the signal as a ready signal. For example, the microcomputer that receives the ready signal determines whether the ready signal is valid or invalid based on the ID. An invalid ready signal transmitted during execution of the one-system drive mode of the second microcomputer 402 is not recognized as a signal indicating that the synchronization preparation has been completed with respect to the synchronization notice signal of the first microcomputer 401. Therefore, even if an invalid ready signal is transmitted, it is not determined that the handshake is successful.
After the end of period 3, through period 4 and at the start of period 5, first microcomputer 401 starts a timer without synchronizing with second microcomputer 402. As a result, in period 5, the motor 80 is driven in the asynchronous drive mode by the two systems of microcomputers 401 and 402.

After the synchronization period Ts from the start of the period 5, the first microcomputer 401 transmits a synchronization signal to the second microcomputer 402 at the start of the period 6, and the second microcomputer 402 receives it. At this time, when it is determined that the timing determination is normal or when the timing determination is not performed, the timing correction of the second microcomputer 402 is performed at the rising timing of the synchronization signal, and thereafter the microcomputers 401 and 402 are driven synchronously. The motor 80 is driven in the mode.
As described above, when the deviation of the activation timing of the microcomputers 401 and 402 is large, the drive mode of the motor 80 by the ECU 101 shifts in the order of the one-system drive mode, the asynchronous drive mode, and the synchronous drive mode. In other words, when the microcomputers 401 and 402 are activated, the motor control device that may shift in the order of the one-system drive mode, the asynchronous drive mode, and the synchronous drive mode can be regarded as corresponding to the ECU of the present embodiment.

[Modification B of Operation Example 2]
In the modification example B of the operation example 2 shown in FIG. 24, the operation up to the period 1 and the period 2 is the same as the modification example A of FIG. However, in the modified example B, when the first microcomputer 401 is activated while the second microcomputer 402 is operating in the one-system drive mode, the first microcomputer 401 performs processing such as transmission of a synchronization notice signal, timer start processing, and synchronization processing. Not performed. That is, the first microcomputer 401 does not generate the motor drive signal Dr1 while the microcomputer itself is activated, so that the motor drive by the first system is not performed. As a result, as in FIG. 22, the first microcomputer 401 continues the one-system drive mode while maintaining the period 2. Thus, the transition to the synchronous drive mode is not essential, and the one-system drive mode may be continuously used.

[Operation Example 3]
Next, with reference to FIG. 25, an operation example 3 in which the handshake fails due to a timeout after the activation of the first microcomputer 401 will be described, contrary to the operation example 2. In the third operation example, after the first microcomputer 401 is activated, the second microcomputer 402 is not activated even if a predetermined time has elapsed, or the ready signal is not transmitted even when the second microcomputer 402 is activated.
In period 1, only the first microcomputer 401 is in a state after activation.
In period 2, the first microcomputer 401 transmits a synchronization notice signal and measures the elapsed time from the start of period 2. Thereafter, time elapses without the first microcomputer 401 receiving a ready signal to be transmitted from the second microcomputer 402.

When the elapsed time from the start of period 2 reaches the first handshake time Ths1, the handshake determination unit 611 of the twelfth microcomputer 401 determines that the handshake has failed due to a timeout. Then, the handshake determination unit 611 notifies the drive timing generation unit 441 that the first microcomputer 401 generates the drive signal Dr1 alone.
The first microcomputer 401 ends the synchronization notice signal in period 3 when the first handshake time Ths1 has elapsed.
In the period 4 of the operation example 3, the first microcomputer 401, which is the synchronization signal transmission side microcomputer, outputs the synchronization signal and simultaneously starts the timer. As a result, the ECU 101 drives the motor 80 in the first system single-system drive mode without causing the second microcomputer 402 to generate the motor drive signal Dr2.

[Flowcharts of Operation Examples 1 to 3]
Post-startup processing of the first microcomputer 401 and the second microcomputer 402, handshake success / failure storage processing, and synchronization processing of the second microcomputer 402 related to the operation examples 1 to 3 and the modifications thereof assuming a handshake failure due to timeout Each flowchart is referred to.
In the first microcomputer start-up process shown in FIG. 26, the first microcomputer 401 starts up in S50, sets the synchronization signal to a high level in S51, transmits a synchronization notice signal, and starts measuring elapsed time.
In S52, it is determined whether the elapsed time is less than the first handshake time Ths1.
If YES is determined in S <b> 52, it is determined in a ready signal receiving step S <b> 53 whether a ready signal is received from the second microcomputer 402. If the first microcomputer 401 has not received a ready signal and it is determined NO in S53, the process returns to S52.

When the first microcomputer 401 receives the ready signal, YES is determined in S53, and the process proceeds to S54. Thereby, it is determined that the handshake is successful.
If the elapsed time reaches the first handshake time Ths1 and the handshake fails due to timeout, NO is determined in S52, and the process proceeds to S54.
In S54, the first microcomputer 401 returns the synchronization signal to the low level, and ends the synchronization notice signal.
In S <b> 56, the first microcomputer 401 transmits a synchronization signal to the second microcomputer 402.

If YES is determined in the previous S52, that is, if it is determined that the handshake is successful, YES is determined in the handshake determination step S57, and the process proceeds to the synchronous drive step S58. In S58, the first microcomputer 401 and the second microcomputer 402 start the timer at the same time, and drive the motor 80 synchronously from the first time.
On the other hand, if NO is determined in the previous S52, that is, if the handshake fails due to timeout, NO is determined in S57, and the process proceeds to S59. In S59, the first microcomputer 401 starts the timer alone and drives the motor 80 asynchronously.

In the post-activation process of the second microcomputer shown in FIGS. 27 and 28, the second microcomputer 402 is activated in S60 and starts measuring elapsed time in S61.
In S62, it is determined whether the elapsed time is less than the second handshake time Ths2.
If YES is determined in S62, it is determined in S63 whether a synchronization notice signal has been received from the first microcomputer 401. If the second microcomputer 402 has not received the synchronization notice signal and it is determined NO in S63, the process returns to S62.

When the second microcomputer 402 receives the synchronization advance notice signal, YES is determined in S63, and the process proceeds to the ready signal transmission step S64. In S64, the second microcomputer 402 transmits a ready signal. The step of responding to S64 on the first microcomputer 401 side is the ready signal receiving step S53 of FIG. Thereby, it is determined that the handshake is successful.
Thereafter, in S66, the second microcomputer 402 receives the synchronization signal from the first microcomputer 401, and starts a timer simultaneously with the first microcomputer 401 by an interrupt. Thereby, the first microcomputer 401 and the second microcomputer 402 drive the motor 80 in synchronization from the first time.

On the other hand, if the elapsed time reaches the second handshake time Ths2 and the handshake fails due to timeout, NO is determined in S62, and the process proceeds to S67. In S67, the second microcomputer 402 starts the timer alone and drives the motor 80 in the one-system drive mode.
In subsequent S50, it is determined whether or not the first microcomputer 401 has been started after the timer of the second microcomputer 402 is started. In the operation example 2 shown in FIG. 22, the first microcomputer 401 is not activated, and it is determined NO in S50. In the modification of the second operation example shown in FIGS. 23 and 24, the first microcomputer 401 is activated after the timer of the second microcomputer 402 is started, and YES is determined in S50.

In the modified example A of the operation example 2, as shown in FIG. 27, if YES is determined in S50, the second microcomputer 402 transmits an invalid ready signal in response to the synchronization notice signal from the first microcomputer 401 in S68. To do. In S69, the first microcomputer 401 alone and asynchronously starts the timer with the second microcomputer 402 due to a timeout associated with the passage of the first handshake time Ths1. This shifts from the one-system drive mode to the two-system asynchronous drive mode.
Thereafter, in S80, the “second microcomputer synchronization process” shown in FIG. 30 is executed, and when the synchronization condition is satisfied, the process shifts to the synchronous drive mode.
In the modified example B of the operation example 2, as shown in FIG. 28, if YES is determined in S50, the process is ended as it is. Therefore, the “one-system drive mode by the second microcomputer” in S67 is continued.

Next, in the handshake success / failure storage process shown in FIG. 29, handshaking is performed in S71.
When the handshake is successful and YES is determined in S72, the handshake determination units 611 and 612 turn on the success flag in S73. At this time, synchronous control is performed.
When the handshake fails and NO is determined in S72, the handshake determination units 611 and 612 turn off the success flag in S74. At this time, asynchronous control is performed.
The handshake determination units 611 and 612 store ON / OFF information of a success flag.

The second microcomputer synchronization process in FIG. 30 corresponds to S80 in FIGS. In FIG. 30, if the success flag is OFF and asynchronous control is being performed, YES is determined in S81, and the process proceeds to S82 to attempt synchronization. If the success flag is ON and synchronous control is being performed, NO is determined in S81 and the process ends.
Thereafter, the second microcomputer 402 waits for the synchronization signal to be transmitted from the first microcomputer 401 every synchronization cycle Ts, and receives the synchronization signal in S82. If the first microcomputer 401 is not activated and only the second microcomputer 402 is operating in the one-system drive mode, the synchronization signal is not transmitted. Therefore, when the waiting time reaches the upper limit value, the process ends. You may do it.

In the configuration in which the timing correction unit 422 of the second microcomputer 402 includes the timing determination unit 432 as in the basic mode, it is determined in S83 whether the reception timing of the synchronization signal is within the synchronization permission section. If YES is determined in S83, timing correction is performed in S84. If NO is determined in S83, the process returns to S82, and the second microcomputer 402 waits for the next synchronization signal to be transmitted.
In the configuration in which the timing correction unit 422 does not include the timing determination unit 432, the timing correction may always be performed when S83 is skipped and the second microcomputer 402 receives the synchronization signal.

[Operation Example 4]
Next, with reference to FIG. 31, the operation example 4 in which the handshake fails due to the transmission / reception of the abnormal signal will be described. Here, the description regarding the timeout as in the operation examples 2 and 3 is omitted.
Similarly to the operation example 1, the microcomputers 401 and 402 are activated at the same time, and in the period 1, the microcomputers 401 and 402 are in a state after activation.
In the period 2, an abnormal signal of high frequency noise is transmitted from the first microcomputer 401 to the second microcomputer 402 instead of the synchronization notice signal that should be transmitted originally.

The handshake determination unit 612 of the second microcomputer 402 determines that the handshake has failed as soon as it detects that an abnormal signal has been received in period 2. Then, the handshake determination unit 612 notifies the drive timing generation unit 442 that the second microcomputer 402 generates the drive signal Dr2 alone.
In period 3, the second microcomputer 402 starts a timer alone. Therefore, the motor 80 is driven in the single-system drive mode of the second system.

After the second microcomputer 402 starts the timer in the period 3, the second microcomputer 402 transmits an invalid ready signal to the first microcomputer 401.
The handshake determination unit 611 of the first microcomputer 401 determines that the handshake has failed and notifies the drive timing generation unit 441 that the first microcomputer 401 generates the drive signal Dr1 alone. In period 4, the first microcomputer 401 ends the synchronization notice signal.
In period 5, the first microcomputer 401 starts a timer simultaneously with outputting a synchronization signal. As a result, in period 5, the motor 80 is driven in the asynchronous drive mode by the two systems of microcomputers 401 and 402.

After the synchronization period Ts from the start of the period 5, the first microcomputer 401 transmits a synchronization signal to the second microcomputer 402 at the start of the period 6, and the second microcomputer 402 receives it. At this time, when it is determined that the timing determination is normal or when the timing determination is not performed, the timing correction of the second microcomputer 402 is performed at the rising timing of the synchronization signal, and thereafter the microcomputers 401 and 402 are driven synchronously. The motor 80 is driven in the mode.
As described above, even when the second microcomputer 402 receives an abnormal signal instead of the synchronous notice signal, the driving mode of the motor 80 by the ECU 101 shifts in the order of the one-system driving mode, the asynchronous driving mode, and the synchronous driving mode.

[Flowchart of Operation Example 4]
With reference to the flowchart of FIG. 32, the second microcomputer activation process in the operation example 4 assuming the handshake failure due to the transmission / reception of the abnormal signal will be described. In FIG. 32, steps that are the same as those in FIG. 27 are given the same step numbers, and descriptions thereof will be omitted as appropriate. In addition, in steps unique to the operation example 4, the letter “X” is written at the end of the step number.
In FIG. 32, a timeout of a signal transmitted from the first microcomputer 401 after the activation of the second microcomputer 402 is not assumed. That is, it is assumed that the second microcomputer 402 receives some signal during the second handshake time Ths2.

After the second microcomputer 402 is activated in S60, the second microcomputer 402 receives any signal from the first microcomputer 401, and when YES is determined in S62X, the signal received by the second microcomputer 402 is an abnormal signal in S63X. It is determined whether or not there is.
When the signal received by the second microcomputer 402 is a normal synchronization notice signal and it is determined NO in S63X, S64 and S66 are executed as in FIG.
If the signal received by the second microcomputer 402 is an abnormal signal and it is determined YES in S63X, the second microcomputer 402 starts the timer alone in S67 and drives the motor 80 in the one-system drive mode. Thereafter, S68, S69, and S80 are performed as in FIG.

(effect)
As described above, after the microcomputers 401 and 402 are activated, the ECU 101 according to the present embodiment performs a handshake that sends and receives the synchronization notice signal and the ready signal to each other, and according to the determination result of whether or not the handshake is successful. Take corrective action. When it is determined that the handshake is successful, the motor 80 can be driven in synchronization from the first time. On the other hand, when it is determined that the handshake has failed, the motor 80 is started to be driven asynchronously, and then the timing is corrected at the next and subsequent synchronization signal transmission timings, and the control shifts to synchronous control.

As described above, the ECU 101 of this embodiment can synchronize from the first time when the handshake is successful after the microcomputers 401 and 402 are activated. In addition, when the handshake is successful, the two microcomputers 401 and 402 start the timer at the same time, so that the control can be synchronized even when each microcomputer performs control in units of a plurality of periods of the synchronization signal.

[Operation examples 5 and 6]
The above operation examples 1 to 4 relate to the first handshake when the first microcomputer 401 and the second microcomputer 402 are both turned on and activated from the stopped state. However, the idea of the first handshake according to the present embodiment can also be applied when the operating microcomputer is restarted by resetting or the like.
Next, referring to FIGS. 33 to 35, handshake operation examples 5 and 6 when the other microcomputer is temporarily stopped due to reset or the like and then restarted while the operation of the one microcomputer in the one-system drive mode is continued. Will be described. Regarding the operation example 5, two patterns of 5A and 5B will be described.

In the operation example 5A shown in FIG. 33, the first microcomputer 401 is restarted by a reset or the like while the operation of the second microcomputer 402 is continued. The ready signal transmission start timing of the second microcomputer 402 is offset by a predetermined time τR with respect to the valley timing of the PWM timer.
In period 0, the first microcomputer 401 is in a state before restarting, and the second microcomputer 402 is operating alone. In period 1, the first microcomputer 401 is restarted.

In period 2, the first microcomputer 401 receives a ready signal from the second microcomputer 402, and grasps the timing of the valley of the PWM timer of the second microcomputer 402 based on the reception start timing. Then, the first microcomputer 401 calculates the timing at which the synchronization signal should be transmitted in accordance with the valley timing of the second microcomputer 402, and waits until that timing.
In period 3, the first microcomputer 401 transmits a synchronization signal at the calculated timing. The second microcomputer 402 restarts the timer at the rising timing of the synchronization signal received from the first microcomputer 401 and shifts to the synchronous drive mode. Thereby, synchronous control can be performed after the first microcomputer 401 is restarted while ensuring the continuity of operation of the second microcomputer 402.

In the operation example 5B shown in FIG. 34, as in the operation example 5A, the first microcomputer 401 is restarted by a reset or the like while the operation of the second microcomputer 402 is continued. The ready signal transmission start timing of the second microcomputer 402 coincides with the valley timing of the PWM timer. In other words, the operation example 5B corresponds to the case of “τR = 0” in the operation example 5A.
Period 0 and period 1 are the same as in operation example 5A.
In period 2, the first microcomputer 401 receives a ready signal from the second microcomputer 402 and transmits a synchronization signal at the same time. The second microcomputer 402 restarts the timer at the rising timing of the synchronization signal received from the first microcomputer 401 and shifts to the synchronous drive mode. Thereby, synchronous control can be performed after the first microcomputer 401 is restarted while ensuring the continuity of operation of the second microcomputer 402.

In the operation example 6 shown in FIG. 35, the second microcomputer 402 is restarted by a reset or the like while the operation of the first microcomputer 401 is continued.
In the period 0, the second microcomputer 402 is in a state before restarting, and the first microcomputer 401 is operating alone. In period 1, the second microcomputer 402 is restarted.
In period 2, the second microcomputer 402 restarts the timer at the rising timing of the synchronization signal received from the first microcomputer 401 and shifts to the synchronous drive mode. Thereby, synchronous control can be performed after the second microcomputer 402 is restarted.

As described above, even if the other microcomputer restarts while one microcomputer continues to operate, the restarted microcomputer ensures operation continuity according to the synchronization signal or ready signal of the microcomputer that is continuing to operate. However, synchronous control can be performed from the start of the timer.
Furthermore, when each microcomputer performs control in units of multiple cycles of the synchronization signal, it is possible to synchronize control in units of multiple cycles by recognizing the reference timing of the control cycle and restarting the microcomputer to start the timer. it can.

(Second Embodiment)
A second embodiment will be described with reference to FIGS.
As shown in FIG. 36, the ECU 102 according to the second embodiment includes one first microcomputer 401 that is a synchronization signal transmission side microcomputer, and two second and third microcomputers 402 and 403 that are synchronization signal reception side microcomputers. I have. For each microcomputer, only the configuration related to transmission / reception of a synchronization signal and a ready signal is shown. The timing correction unit 423, the ready signal transmission unit 623, and the handshake determination unit 613 of the third microcomputer 403 are all the same as the timing correction unit 422, the ready signal transmission unit 622, and the handshake determination unit 612 of the second microcomputer 402. It is the same composition.

FIG. 37 shows an operation example in which handshaking after startup is successful among three microcomputers according to the operation example 1 of the first embodiment shown in FIG. The notes related to the illustration are the same as in FIG. Further, the description regarding the handshake time is omitted.
In period 1, the microcomputers 401, 402, and 403 are in a state after startup.
In period 2, the first microcomputer 401 transmits a synchronization notice signal to the second microcomputer 402 and the third microcomputer 403.

The second microcomputer 402 and the third microcomputer 403 receive the synchronization notice signal in period 2.
In the period 3, the second microcomputer 402 and the third microcomputer 403 transmit a ready signal to the first microcomputer 401 as a response.
When the first microcomputer 401 receives the ready signal in period 3, the first microcomputer 401 ends the synchronization notice signal in period 4.

Through the operations in the periods 2, 3, and 4, the handshake determination units 611, 612, and 613 of the microcomputers 401, 402, and 403 determine that the handshake is successful, and instruct each drive timing generation unit to perform initial synchronization. .
In period 5, the first microcomputer 401 starts a timer simultaneously with outputting a synchronization signal. In addition, the second microcomputer 402 and the third microcomputer 403 start a timer at the rising timing of the synchronization signal received from the first microcomputer 401. Thereby, the microcomputers 401, 402, and 403 drive the motor 80 synchronously from the first time after activation, that is, in the synchronous drive mode.

In the second embodiment, a handshake is performed with a master / slave type ECU configuration in which one synchronization signal transmission side microcomputer is regarded as a master and a plurality of synchronization signal reception side microcomputers are regarded as slaves.
Further, as another configuration of the ECU including three microcomputers, for example, a configuration may be adopted in which a synchronization signal is transmitted from the first microcomputer to the second microcomputer, and a synchronization signal is transmitted from the second microcomputer to the third microcomputer. In this configuration, the second microcomputer functions as a synchronization signal reception side microcomputer in relation to the first microcomputer, and functions as a synchronization signal transmission side microcomputer in relation to the third microcomputer. That is, handshaking is performed by a chain ECU configuration.

Furthermore, even in an ECU including four or more microcomputers, handshaking between a plurality of microcomputers can be performed by a master / slave type, a chain type, or a combination thereof. When it is determined that handshaking has failed in three or more systems, the drive mode in which the motor is driven only by the own microcomputer without causing the other microcomputer to generate a motor drive signal is “ In other words, “partial system drive mode” is referred to as “one system drive mode”.

(Third embodiment)
A third embodiment will be described with reference to FIGS. 38 to 42. FIG. The third embodiment differs from the first embodiment in the configuration related to the communication of the synchronization signal and the ready signal.
As shown in FIG. 38, in the ECU 103 of the third embodiment, the first microcomputer 401 and the second microcomputer 402 have synchronization signal generation units 411 and 412 and timing correction units 421 and 422, respectively. The first microcomputer 401 and the second microcomputer 402 function as a “synchronization signal transmission side microcomputer” and a “synchronization signal reception side microcomputer”, and transmit and receive synchronization signals to and from each other.
The configuration of the synchronization signal line in this embodiment includes a first synchronization signal line 471 for transmission from the first microcomputer 401 to the second microcomputer 402 and a transmission from the second microcomputer 402 to the first microcomputer 401 as shown by the solid line. A reliable second synchronization signal line 472 may be provided separately. Alternatively, as indicated by a broken line, a synchronization signal line 48 capable of bidirectional communication may be used. Note that at least one of the bidirectional synchronization signal line 48 or the one-way synchronization signal lines 471 and 472 may be shared with other communication signal lines used for communication between microcomputers.

When the common synchronization signal line 48 is used as a bidirectional signal line, as shown in FIG. 39, the transmission timing of the synchronization signal from the first microcomputer 401 to the second microcomputer 402 and the transmission timing of the synchronization signal in the opposite direction. Are set at different timings. In particular, in the example of FIG. 39, the microcomputers 401 and 402 alternately transmit a synchronization signal.
As described in the first embodiment, instead of bidirectional communication using the synchronization signal line, the synchronization signal transmission side microcomputer changes the level of the port signal to the synchronization signal reception side microcomputer. May be notified in both directions.

In addition, for example, when the activation timings of the microcomputers 401 and 402 are different, the synchronization signal may be transmitted from the microcomputer activated first to the microcomputer activated later.
Alternatively, a synchronization signal may be transmitted mainly from the first microcomputer 401 to the second microcomputer 402, and transmission in the reverse direction may be performed only in some cases. For example, the first microcomputer 401 may be activated in synchronization with the synchronization signal from the second microcomputer 402 at the time of activation, and thereafter the second microcomputer 402 may be operated in synchronization with the synchronization signal from the first microcomputer 401. . For example, when an abnormality occurs in the first microcomputer 401 and the microcomputer is reset, the operation start timing of the own microcomputer may be determined based on the synchronization signal from the microcomputer from the second microcomputer 402 and the operation may be started. In this case, it is possible to resume motor driving in a state of being synchronized from the beginning when the microcomputer recovers from the abnormality.

Further, regarding ready signal transmission / reception, each of the first microcomputer 401 and the second microcomputer 402 includes ready signal transmission / reception units 621 and 622, and can transmit / receive ready signals to / from each other. Here, the ready signal transmission line 475 may be composed of two unidirectional communication lines as in the case of the synchronization signal line, or may be composed of bidirectional communication lines.
In the third embodiment, the first microcomputer 401 and the second microcomputer 402 have exactly the same function and have complete redundancy. Therefore, since it can respond to all the failure patterns for one system, the reliability can be further improved.
In addition, by using different transmission timings of the synchronization signals in each direction and using the common bidirectional synchronization signal line 48, the number of parts of the ECU can be reduced and the configuration can be simplified.

[Operation Example 7]
FIG. 40 shows an operation example 7 in which the microcomputers 401 and 402 handshake each other by transmitting and receiving ready signals according to the third embodiment. Regarding the transmission / reception of the synchronization signal in the operation example 7, for convenience, the first microcomputer 401 is a synchronization signal transmission side microcomputer, and the second microcomputer 402 is a synchronization signal reception side microcomputer. However, the microcomputers 401 and 402 may alternate between the transmission side and the reception side of the synchronization signal. Alternatively, the operation example 7 may be executed in an ECU having a configuration in which only the ready signal can be transmitted and received in both directions and the synchronization signal is transmitted and received in one direction, without being limited to the configuration in FIG.

An arrow “R1-n (n = 1, 2, 3)” in FIG. 40 represents a ready signal transmitted from the first microcomputer 401 to the second microcomputer 402 for the nth time after the first microcomputer 401 is activated. An arrow “R2-n (n = 1, 2)” represents a ready signal transmitted from the second microcomputer 402 to the first microcomputer 401 for the nth time after the second microcomputer 401 is activated. These ready signals include two types of signals: a ready signal for notifying completion of activation of the microcomputer and a ready signal for indicating successful handshake (“HS-OK” in the figure).
In FIG. 40, detailed divisions of detailed periods are omitted, and the distinction is made only with a large framework. At time r <b> 10 in period 1, the first microcomputer 401 is activated before the second microcomputer 402. The first microcomputer 401 transmits ready signals R1-1 and R1-2 of “startup completion” at times r11 and r12 at a predetermined cycle after startup, but is not received because the second microcomputer 402 is not started. “NG” in the figure means that a ready signal is not received.

Next, after the second microcomputer 402 is activated at time r20 in period 2, the second microcomputer 402 transmits a ready signal R2-1 of “activation complete” at time r21, and the first microcomputer 401 receives it. At time r13 after receiving the ready signal R2-1, the first microcomputer 401 transmits the ready signal R1-3 of “handshake successful”, and the second microcomputer 402 receives it. Subsequently, at time r22 after receiving the ready signal R1-3, the second microcomputer 402 transmits a ready signal R2-2 of “handshake successful”. The first microcomputer 401 receives the ready signal R2-2, but since the success of the handshake has already been determined, the ready signal R2-2 is ignored.

Thus, when it is determined that both the microcomputers 401 and 402 have succeeded in the handshake, in the next period 3, the first microcomputer 401 starts a timer simultaneously with outputting a synchronization signal. The second microcomputer 402 starts a timer at the rising timing of the synchronization signal received from the first microcomputer 401. Thereby, the microcomputers 401 and 402 drive the motor 80 synchronously from the first time after activation.

The processes after the activation of the first microcomputer 401 and the second microcomputer 402 in the operation example 7 are shown in the flowcharts of FIGS. 41 and 42, respectively. In FIG. 41 and FIG. 42, the same step number is attached | subjected to the step which is common in FIG. 26 and FIG. 27, and description is abbreviate | omitted suitably. Further, in steps unique to the operation example 7, the letter “R” is written at the end of the step number.
In the first microcomputer activation post-process shown in FIG. 41, the first microcomputer 401 transmits a ready signal of “activation complete” to the second microcomputer 402 and starts counting elapsed time in S51R.
When the elapsed time is less than the first handshake time Ths1 and YES is determined in S52, it is determined in S53R whether the first microcomputer 401 has received a “start-up complete” ready signal from the second microcomputer 402. If the first microcomputer 401 has received the ready signal for “start-up completion” and it is determined YES in S53R, the first microcomputer 401 sends a ready signal for “handshake successful” to the second microcomputer 402 in S54R. Send to S56.

If the first microcomputer 401 has not received the “start-up complete” ready signal and it is determined NO in S53R, the first microcomputer 401 sends a “handshake successful” ready signal from the second microcomputer 402 in S55R. It is determined whether it has been received. If YES is determined in S55R, the process proceeds to S56. If the “handshake successful” ready signal has not been received and the determination in S55R is NO, the process returns to the previous step.
If the elapsed time reaches the first handshake time Ths1 and NO is determined in S52 (that is, time-out), the process also proceeds to S56.
The first microcomputer 401 transmits a synchronization signal to the second microcomputer 402 in S56. S57 to S59 below are the same as those in FIG. That is, when a ready signal for “handshake success” is transmitted and received, synchronous control is performed in S58, and in the case of timeout, asynchronous control is performed in S59.

In the second microcomputer start-up process shown in FIG. 42, the second microcomputer 402 transmits a ready signal for “start-up completion” to the first microcomputer 402 and starts counting elapsed time in S61R.
When the elapsed time is less than the second handshake time Ths2 and it is determined YES in S62, it is determined in S63R whether the second microcomputer 402 has received a “start-up complete” ready signal from the first microcomputer 401. If the second microcomputer 402 has received the ready signal for “start-up completion” and it is determined YES in S63R, the second microcomputer 402 sends a ready signal for “handshake successful” to the first microcomputer 401 in S64R. Transmit, and the process proceeds to S66.

If the second microcomputer 402 has not received the “start-up complete” ready signal and it is determined NO in S63R, the second microcomputer 402 sends a “handshake successful” ready signal from the first microcomputer 401 in S65R. It is determined whether it has been received. If YES is determined in S65R, the process proceeds to S66. If the ready signal of “handshake successful” has not been received and the determination in S65R is NO, the process returns to before S62.
If the elapsed time reaches the second handshake time Ths2 and it is determined NO (that is, time-out) in S62, the second microcomputer 402 starts the timer independently and performs asynchronous control in S67. In addition, after S67, similarly to FIG. 27, the synchronization processing steps S50, S68, S69, and S80 after starting the first microcomputer may be performed.
As described above, in the operation example 7, when the microcomputers 401 and 402 mutually transmit and receive ready signals, a handshake can be suitably executed.

(Fourth and fifth embodiments)
The fourth and fifth embodiments will be described with reference to FIGS. 43 and 44.
The ECU 10 of the fourth and fifth embodiments basically uses the configuration of the basic form of the first embodiment shown in FIG. However, in the fourth and fifth embodiments, the reception signal determination does not determine the timing at which the synchronization signal is received, but determines whether the synchronization signal is normal or abnormal using a synchronization signal having a specific pulse pattern. Therefore, “timing determination unit 432” in the timing correction unit 422 in the second microcomputer 402 is replaced with “reception signal determination unit 432”.
The processing when the synchronization signal is determined to be normal by the received signal determination unit 432 of the fourth and fifth embodiments or when it is determined to be abnormal is the same as the basic form of the first embodiment.

The specific pulse pattern refers to a pattern in which the number of pulses per period, time width, or interval is defined in advance. 43 and 44, the cause of the synchronization signal abnormality is not clearly shown as in FIGS. 11 and 14, and only the difference between the normal pulse pattern and the abnormal pulse pattern is shown.

In the fourth embodiment shown in FIG. 43, as shown in the R section, it is determined that the synchronization signal is normal when the clock input having a predetermined time width is input k times that is the specified number of times. The synchronization signal receiving side microcomputer corrects the timing at the kth clock input timing, that is, synchronizes the drive timing between the microcomputers.
On the other hand, as shown in part X, when the time width of the pulse of the synchronization signal is different or the number of consecutive times is different, the timing is not corrected and the motor is driven asynchronously.

In the fifth embodiment, in the configuration in which the synchronization signal is shared with other signals, for example, when the serial communication clock line is used for the synchronization signal, the reception of the serial communication is used as a trigger to receive by the CRC method or the like. Calculate the reliability of the data. As a result of the check, if correct communication is performed, synchronization between microcomputers is permitted.

FIG. 44 shows pulses of the communication clock and the reception signal line in the fifth embodiment. When it is determined that the CRC is normal, the R unit performs timing correction based on the reception completion timing. At this time, for example, a specific method of timing correction may be set as appropriate, for example, correction is performed for the time required for CRC calculation and synchronization is performed.
On the other hand, part X determines that the timing is not normal because the CRCs do not match, and timing correction is not performed.

As described above, the reception signal determination unit 432 determines whether the synchronization signal is normal or abnormal even if a specific pulse pattern is used, as well as the method based on the reception timing of the synchronization signal as in the basic form of the first embodiment. be able to.
Note that the processes of FIGS. 15 to 18 can be similarly applied to the configurations of the fourth and fifth embodiments in which the received signal determination is performed based on the specific pulse pattern. Further, the fourth and fifth embodiments may be applied to the configuration of the third embodiment that transmits and receives a synchronization signal and a ready signal in both directions.

(Other embodiments)
(A) The motor 80 to be controlled in the above embodiment is a multi-winding motor in which two winding sets 801 and 802 are arranged on a common stator with an electrical angle of 30 deg. The motor to be controlled in other embodiments may be one in which two or more winding sets are arranged in the same phase. In addition, the configuration is not limited to a configuration in which two or more winding sets are arranged on a common stator of one motor. It may be applied to the motor of
Further, the number of phases of the multiphase brushless motor is not limited to three phases and may be four or more. Furthermore, the motor to be driven is not limited to an AC brushless motor, and may be a brushed DC motor. In that case, an H-bridge circuit may be used as the “motor drive circuit”.

(B) In the example of the handshake operation shown in FIGS. 20 and 25, after the first microcomputer 401 is activated, a high level synchronization signal is transmitted to the second microcomputer 402 as a synchronization notice signal. Not limited to such a configuration using the synchronization notice signal, the second microcomputer 402 may be notified by some means that the first microcomputer 401 is activated, and the second microcomputer 402 may transmit a ready signal based on the notice. .

Further, for example, in a system in which the first microcomputer 401 is always started before the second microcomputer 402 is started, the second microcomputer 402 transmits a ready signal at a unique timing without using the synchronization notice signal from the first microcomputer 401. May be. In this case, the initial handshake units 611 and 612 can determine that the handshake is successful only by the successful transmission / reception of the ready signal from the second microcomputer 402 to the first microcomputer 401.

(C) The motor control device may not include an analog signal sampling unit synchronized with the motor drive timing generation unit. In that case, the motor control device may perform a control calculation based on digital data acquired from the outside. Or you may implement feedforward control, without using feedback information.
Further, in the configuration including the analog signal sampling unit, the sampling timing may overlap the switch timing of the motor drive signal.

(D) The motor drive signal generation method is not limited to the PWM control method shown in FIG. 8 or the like, and for example, a pulse pattern for selecting an optimum pattern from a plurality of pulse patterns stored in advance according to the modulation rate and the rotation speed A method or the like may be adopted. Further, the PWM control type carrier is not limited to a triangular wave, and a sawtooth wave may be used.

(E) The motor control device of the present disclosure is not limited to a motor for an electric power steering device, and may be applied to a motor for any other purpose.
As mentioned above, this indication is not limited to such embodiment, In the range which does not deviate from the meaning, it can implement with a various form.

This disclosure has been described in accordance with the embodiment. However, the present disclosure is not limited to the embodiments and structures. The present disclosure also includes various modifications and modifications within the equivalent scope. Also, various combinations and forms, as well as other combinations and forms including only one element, more or less, are within the scope and spirit of the present disclosure.

Claims (17)

1. A plurality of motor drive circuits (701, 702) for driving one or more motors (80);
   Drive signal generation units (451, 452) for generating motor drive signals (Dr1, Dr2) for instructing the plurality of motor drive circuits, respectively, and drive timing generation for generating drive timings that are pulse timings of the motor drive signals A plurality of microcomputers (401, 402) having units (441, 442),
   A plurality of clock generation circuits (651, 652) for independently generating clocks which are used as a reference for operation by the plurality of microcomputers;
   With
   Among the plurality of microcomputers, at least one microcomputer that synchronizes with the drive timing of the microcomputer and transmits the synchronization signal that synchronizes the drive timing of the plurality of microcomputers is a synchronization signal transmission side microcomputer (401), When at least one microcomputer that receives the synchronization signal transmitted from the synchronization signal transmission side microcomputer is a synchronization signal reception side microcomputer (402),
   The synchronization signal transmission side microcomputer is:
   A synchronization signal generator (411) for generating the synchronization signal and transmitting the synchronization signal to the receiving side microcomputer;
   The synchronization signal receiving side microcomputer is:
   A timing correction unit (422) capable of performing timing correction for correcting the drive timing of the microcomputer to synchronize with the received synchronization signal;
   Furthermore, the synchronization signal receiving side microcomputer has a ready signal transmission unit (622) that transmits a ready signal indicating that the synchronization preparation of the microcomputer is completed to the synchronization signal transmitting side microcomputer, and the synchronization signal transmission The side microcomputer has a ready signal receiving unit (621) for receiving the ready signal,
   The synchronization signal transmission-side microcomputer and the synchronization signal reception-side microcomputer each determine a handshake determination unit (611, 612) that determines that the handshake is successful when a handshake including at least transmission / reception of the ready signal is normally performed. )
   When it is determined that the handshake is successful, the synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer synchronize from the first time after activation to drive the motor.
2. The synchronization signal transmission side microcomputer transmits a synchronization notification signal for notifying generation of a synchronization signal to the synchronization signal reception side microcomputer after the microcomputer is started, and the synchronization signal reception side microcomputer receives the synchronization notification signal. Then, the ready signal is transmitted to the synchronization signal transmitting side microcomputer,
   The motor control device according to claim 1, wherein the handshake determination unit determines that the handshake is successful when the handshake including transmission and reception of the synchronization notice signal and the ready signal is normally performed.
3. The handshake determination unit is configured to output the hand when a timeout occurs for a predetermined time before receiving the ready signal or the synchronization notice signal to be transmitted from another microcomputer or when an abnormal signal is transmitted / received. The motor control device according to claim 1, wherein the motor control device determines that the shake has failed.
4. When it is determined that the handshake has failed due to the timeout,
   The handshake determination unit of the own microcomputer does not cause the other microcomputer to generate the motor drive signal, but generates the drive timing so that the motor drive signal is generated by a partial system drive mode in which the motor is driven only by the own microcomputer. The motor control device according to claim 3, which notifies the unit.
5. When it is determined that the handshake has failed due to transmission / reception of an abnormal signal,
   The motor control device according to claim 3, wherein the plurality of microcomputers drive the motor asynchronously.
6. The plurality of microcomputers store information on the failure of the handshake, and attempt synchronization by transmitting a synchronization signal from the synchronization signal transmission side microcomputer to the synchronization signal reception side microcomputer during asynchronous control. Motor control device.
7. When the synchronization signal transmission side microcomputer is restarted during the operation of the synchronization signal reception side microcomputer,
   The restarted synchronization signal transmission side microcomputer transmits the synchronization signal after receiving the ready signal from the synchronization signal reception side microcomputer, or transmits the synchronization signal simultaneously with reception of the ready signal. Synchronize,
   When the synchronization signal reception side microcomputer is restarted while the operation of the synchronization signal transmission side microcomputer is continued,
   The motor control device according to any one of claims 1 to 6, wherein the restarted synchronization signal receiving side microcomputer synchronizes at a timing of receiving the synchronization signal from the synchronization signal transmitting side microcomputer.
8. The synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer are connected, and at least one synchronization signal line (471, 472, 48) through which the synchronization signal is transmitted and received is further provided. The motor control device according to item.
9. The said ready signal transmission part transmits the said ready signal to the said synchronizing signal transmission side microcomputer via the said ready signal line (475) provided separately from the said synchronizing signal line or the said synchronizing signal line. The motor control apparatus described.
10. The timing correction unit of the synchronization signal receiving side microcomputer includes a reception signal determination unit (432) that performs reception signal determination that is normal or abnormal determination of the received synchronization signal,
    The synchronization signal receiving side microcomputer is:
    When the synchronization signal is determined to be normal in the reception signal determination, the timing correction is permitted,
    The timing correction is prohibited when the synchronization signal is determined to be abnormal in the reception signal determination, and the motor is driven asynchronously with the synchronization signal transmission side microcomputer. Motor control device.
11. The motor control device according to any one of claims 1 to 10, wherein the plurality of microcomputers are arranged on the same side surface (238) of the same substrate (230) at a predetermined interval.
12. A plurality of motor drive circuits (701, 702) for driving one or more motors (80);
    Drive signal generation units (451, 452) for generating motor drive signals (Dr1, Dr2) for instructing the plurality of motor drive circuits, respectively, and drive timing generation for generating drive timings that are pulse timings of the motor drive signals A plurality of microcomputers (401, 402) having units (441, 442),
    A plurality of clock generation circuits (651, 652) for independently generating clocks which are used as a reference for operation by the plurality of microcomputers;
    With
    Among the plurality of microcomputers, at least one microcomputer that synchronizes with the drive timing of the microcomputer and transmits the synchronization signal that synchronizes the drive timing of the plurality of microcomputers is a synchronization signal transmission side microcomputer (401), When at least one microcomputer that receives the synchronization signal transmitted from the synchronization signal transmission side microcomputer is a synchronization signal reception side microcomputer (402),
    A synchronous drive mode in which the synchronous signal transmitting side microcomputer and the synchronous signal receiving side microcomputer that has received the synchronous signal synchronously drive the motor;
    Asynchronous drive mode in which the synchronous signal transmitting microcomputer and the synchronous signal receiving microcomputer asynchronously drive the motor without using the synchronous signal, and
    Partial system drive mode in which the motor is driven by only one of the synchronization signal transmission side microcomputer or the synchronization signal reception side microcomputer,
    For the three drive modes,
    A motor control device that may shift in the order of the partial system drive mode, the asynchronous drive mode, and the synchronous drive mode when the synchronous signal transmitting microcomputer and the synchronous signal receiving microcomputer are activated.
13. A motor control device according to any one of claims 1 to 12,
    The motor configured as a brushless motor coaxially provided with a plurality of multiphase winding sets energized by the motor control device;
    A motor drive system comprising:
14. The motor drive system according to claim 13, wherein the motor control device is integrally configured on one side in the axial direction of the motor.
15. A motor control device according to any one of claims 1 to 12, which is applied to an electric power steering device for a vehicle,
    The motor driven by the motor control device and outputting an assist torque;
    A motor drive system comprising:
16. Two power supplies (111, 112);
    The motor provided with two sets of multi-phase windings each supplied with electric power from the two power sources;
    Two microcomputers for controlling energization to two sets of the multiphase winding sets, and the motor control device including two motor drive circuits to which the motor drive signals are respectively commanded from the two microcomputers; ,
    Two steering torque sensors (931, 932) for detecting steering torque and outputting to the two microcomputers;
    Two rotation angle sensors (251, 252) for detecting the electrical angle of the motor and outputting the two to the microcomputer;
    The motor drive system according to claim 15.
17. A plurality of motor drive circuits (701, 702) for driving one or more motors (80);
    Drive signal generation units (451, 452) for generating motor drive signals (Dr1, Dr2) for instructing the plurality of motor drive circuits, respectively, and drive timing generation for generating drive timings that are pulse timings of the motor drive signals A plurality of microcomputers (401, 402) having units (441, 442),
    A plurality of clock generation circuits (651, 652) for independently generating clocks which are used as a reference for operation by the plurality of microcomputers;
    A motor control method by a motor control device comprising:
    Among the plurality of microcomputers, at least one microcomputer that synchronizes with the drive timing of the microcomputer and transmits the synchronization signal that synchronizes the drive timing of the plurality of microcomputers is a synchronization signal transmission side microcomputer (401), When at least one microcomputer that receives the synchronization signal transmitted from the synchronization signal transmission side microcomputer is a synchronization signal reception side microcomputer (402),
    A ready signal transmission step (S64) in which the synchronization signal reception side microcomputer transmits a ready signal indicating that the synchronization preparation of the microcomputer is completed to the synchronization signal transmission side microcomputer;
    A ready signal receiving step (S53) in which the synchronization signal transmitting side microcomputer receives the ready signal;
    When the handshake including at least transmission / reception of the ready signal is normally performed, the handshake determination unit (611, 612) of the synchronization signal transmission side microcomputer and the synchronization signal reception side microcomputer is successful. A handshake success judging step (S57) for judging;
    When it is determined that the handshake is successful, the synchronous signal transmitting side microcomputer and the synchronous signal receiving side microcomputer synchronously drive from the first time after startup to drive the motor (S58);
    A motor control method including:

Images