WO2021200774A1

WO2021200774A1 - Backup power supply system, power supply backup method, and program

Info

Publication number: WO2021200774A1
Application number: PCT/JP2021/013174
Authority: WO
Inventors: 靖博飯嶋; 庸介三谷
Original assignee: パナソニックＩｐマネジメント株式会社
Priority date: 2020-03-30
Filing date: 2021-03-29
Publication date: 2021-10-07
Also published as: JPWO2021200774A1

Abstract

A backup power supply system 1 is equipped with a first auxiliary power supply 22, a second auxiliary power supply 3, a first switch circuit 26, and a second switch circuit 27. The first auxiliary power supply 22 and the second auxiliary power supply 3 are able to supply power to a load 5 when a main power supply 4 fails. The first switch circuit 26 conducts and interrupts current in a first power supply line L1 connecting the first auxiliary power supply 22 and the load 5. The second switch circuit 27 conducts and interrupts current in a second power supply line L2 connecting the second auxiliary power supply 3 and the load 5. The backup power supply system 1 is further provided with a forcing circuit 29 for forcibly interrupting current in one of the switching circuits, that is, the first switching circuit 26 or the second switching circuit 27.

Description

Backup power system, power backup method and program

This disclosure generally relates to backup power systems, power backup methods and programs. More specifically, the present disclosure relates to backup power systems, power backup methods and programs capable of supplying power to a load in the event of a mains failure.

Patent Document 1 discloses a redundant power supply system (backup power supply system). This redundant power supply system includes a main power supply, an auxiliary power supply (auxiliary power supply), first to fourth relays (switch circuit, switching element), a regulator, and a DCDC converter. The DCDC converter is provided between the main power supply and the first load. The first relay connects the DCDC converter and the auxiliary power supply so that they can be energized and cut off. The second relay connects the DCDC converter and the second load so that they can be energized and cut off. The third relay connects the main power supply and the DCDC converter so as to be energized and cut off. The fourth relay connects the main power supply and the second load so that they can be energized and cut off. The regulator connects the auxiliary power supply and the first load.

In this system, in the engine restart process, the first relay and the fourth relay are cut off, the second relay and the third relay are energized, and the second load is connected to the main power supply via the DCDC converter. 1 Connect the load to the auxiliary power supply via the regulator. If the main power supply fails during the engine restart process, the first relay is energized and the second to fourth relays are shut off, the second load is disconnected from the main power supply, and the first load is converted to a DCDC converter. Connect to the secondary power supply via.

Japanese Unexamined Patent Publication No. 2020-26215

In the above redundant power supply system, if both the first relay and the second relay are conducting, a through current may flow between the two power supplies (main power supply and sub power supply).

Further, in order to stably supply power from the auxiliary power supply, it is desirable to be able to diagnose a failure of a relay (for example, the first relay) that controls the power supply from the auxiliary power supply to the load.

It is an object of the present disclosure that the switch circuit can be controlled so as to prevent a through current from flowing between the two power supplies, or the failure of the switching element that controls the power supply from the auxiliary power supply to the load can be diagnosed. To provide a backup power supply system, power supply backup method and program.

The backup power supply system according to one aspect of the present disclosure includes a first auxiliary power supply, a second auxiliary power supply, a first switch circuit, and a second switch circuit. The first auxiliary power supply and the second auxiliary power supply can supply electric power to the load when the main power supply fails. The first switch circuit conducts and cuts off the first power supply path connecting the first auxiliary power supply and the load. The second switch circuit conducts and cuts off the second power supply path connecting the second auxiliary power supply and the load. The backup power supply system further includes a compulsory circuit that forcibly shuts off one of the first switch circuit and the second switch circuit.

The backup power supply system according to one aspect of the present disclosure includes a first auxiliary power supply, a second auxiliary power supply, a first switch circuit, a second switch circuit, and a control circuit. The first auxiliary power supply and the second auxiliary power supply can supply electric power to the load when the main power supply fails. The first switch circuit conducts and cuts off the first power supply path connecting the first auxiliary power supply and the load. The second switch circuit conducts and cuts off the second power supply path connecting the second auxiliary power supply and the load. The control circuit controls the second switch circuit. The second switch circuit has a first switching element and a second switching element. The first switching element and the second switching element conduct and cut off the second power supply path, respectively. The control circuit has a diagnostic mode in which the first switching element is cut off and the second switching element is made conductive during the power supply period during which the second auxiliary power supply supplies electric power.

The power supply backup method according to one aspect of the present disclosure is a power supply backup method used in a backup power supply system including a first auxiliary power supply and a second auxiliary power supply capable of supplying power to a load when the main power supply fails. The power supply backup method includes a first switching step, a second switching step, and a control step. In the first switching step, the first power supply path connecting the first auxiliary power supply and the load is conducted and cut off by the first switch circuit. In the second switching step, the second power supply path connecting the second auxiliary power supply and the load is conducted and cut off by the second switch circuit. The control step controls the second switch circuit. In the second switching step, each of the first switching element and the second switching element conducts and cuts off the second power supply path. The control step has a diagnostic mode in which the first switching element is cut off and the second switching element is made conductive during the power supply period during which the second auxiliary power supply is supplying electric power.

The program according to one aspect of the present disclosure is a program for causing one or more processors to execute the power supply backup method of the above aspect.

According to the present disclosure, it is possible to control a switch circuit so as to prevent a through current from flowing between two power supplies, or to diagnose a failure of a switching element that controls power supply from an auxiliary power supply to a load. There is an effect that there is.

FIG. 1 is a diagram showing a configuration of a drive system using the backup power supply system according to the embodiment. FIG. 2 is a side view in which a part of the vehicle equipped with the backup power supply system of the above is broken. FIG. 3 is a time chart showing an operation example 1 of the backup power supply system of the above. FIG. 4 is a time chart showing an operation example 2 of the backup power supply system of the above. FIG. 5 is a time chart showing an operation example 3 of the backup power supply system of the above.

(Embodiment)
The embodiments and modifications described below are merely examples of the present disclosure, and the present disclosure is not limited to the following embodiments and modifications. Other than the following embodiments and modifications, various changes can be made according to the design and the like as long as they do not deviate from the technical idea of the present disclosure.

(1) Outline First, an outline of the backup power supply system 1 according to the embodiment will be described with reference to FIGS. 1 and 2.

The backup power supply system 1 according to the present embodiment is mounted on the vehicle 9 (see FIG. 2), for example, and is used to supply electric power to the load when the main power supply 4 provided in the vehicle 9 fails. That is, the backup power supply system 1 is mounted on the vehicle 9 having the main power supply 4 and the load. The term "when the main power supply 4 fails" as used in the present disclosure means that the power supply from the main power supply 4 to the load or the like is stopped due to a failure, deterioration, disconnection, or the like of the main power supply 4.

The vehicle 9 includes a drive system 10 and a vehicle body (vehicle body) 91 (see FIG. 2) on which the drive system 10 is mounted. The drive system 10 includes a backup power supply system 1, a main power supply 4, a load (for example, a first load 5 and a second load 6), and an ECU (Electronic Control Unit) 7. The main power source 4 is, for example, a battery mounted on a vehicle 9 (a lead storage battery as an example), and is configured to supply electric power to a plurality of loads. The ECU 7 is configured to control a plurality of loads provided on the vehicle 9.

The first load 5 is, for example, a brake system (hereinafter, also referred to as “brake system 5”). The second load 6 is, for example, a shift-by-wire system (hereinafter, also referred to as “shift-by-wire system 6”). In FIG. 1, the "shift-by-wire system 6" is referred to as the "SBW system 6".

The brake system 5 is a system that electrically operates the brake mechanism provided on each wheel of the vehicle 9. The brake system 5 includes a drive control unit 51 and an actuator 52. The drive control unit 51 controls the drive of the actuator 52 by outputting a control signal to the actuator 52 based on the amount of operation of the brake pedal by the driver. The actuator 52 is configured to operate a braking mechanism provided on each wheel to apply a brake to each wheel in response to a control signal from the drive control unit 51.

The shift-by-wire system 6 is a system that electrically switches the shift range of the automatic transmission mounted on the vehicle 9. The shift-by-wire system 6 includes a drive control unit 61 and an actuator 62. The drive control unit 61 controls the drive of the actuator 62 by outputting a control signal to the actuator 62 based on the position of the shift lever operated by the driver. The actuator 62 is configured to switch the shift range of the automatic transmission in response to a control signal from the drive control unit 61.

The shift range of the automatic transmission includes a parking range (P range), a reverse range (R range), a neutral range (N range), and a drive range (D range). The drive range is used when the vehicle 9 is moving forward, the reverse range is used when the vehicle 9 is moving backward, and the parking range is used when the vehicle 9 is parked. In the parking range, the actuator 62 locks the rotating shaft in the automatic transmission to lock the movement of the vehicle 9.

The brake system 5 and the shift-by-wire system 6 are configured to operate by the electric power supplied from the main power supply 4 or the backup power supply system 1.

When the main power supply 4 is normal, power is supplied from the main power supply 4 to the first load 5 and the second load 6 (that is, the brake system 5 and the shift-by-wire system 6). On the other hand, when the main power supply 4 fails, power is supplied from the backup power supply system 1 to the first load 5 and the second load 6. Therefore, even when the main power supply 4 fails, the first load 5 and the second load 6 can operate according to the operation of the driver.

The backup power supply system 1 includes a first auxiliary power supply 22 and a second auxiliary power supply 3. Each of the first auxiliary power supply 22 and the second auxiliary power supply 3 is an auxiliary power supply capable of supplying electric power to the first load 5 when the main power supply 4 fails.

Further, the backup power supply system 1 includes a first switch circuit 26, a second switch circuit 27, and a compulsory circuit 29. The first switch circuit 26 conducts and cuts off the first power supply path L1 connecting the first auxiliary power supply 22 and the first load 5. The first switch circuit 26 is controlled by hardware by the comparison circuit 28 described later. The second switch circuit 27 conducts and cuts off the second power supply path L2 that connects the second auxiliary power supply 3 and the first load 5. The second switch circuit 27 is controlled by software by the control circuit 21 described later. The forced circuit 29 forcibly shuts off the first switch circuit 26.

Here, the above-mentioned "controlled by software" means that it is controlled by a circuit operated by a program. A circuit operated by a program is a circuit that executes a program stored in one or more memories and operates based on the executed program (for example, a circuit including one or more processors). In other words, a circuit that operates by a program is a circuit that performs signal processing on a digital signal and outputs the result of the signal processing. Therefore, if the program is rewritten, the operation of the circuit operated by the program changes, and the relationship between the input and the output changes. The above-mentioned "controlled by hardware" means that it is controlled by a circuit that is not operated by a program (that is, a circuit that is not operated by a program). A circuit that does not operate by a program is a circuit that is composed of electronic components (including active elements and / or passive elements) having unique functions and operates with the unique functions of each electronic component. In other words, a circuit that does not operate by a program is a circuit that performs signal processing on an analog signal and outputs the result of the signal processing. Therefore, even if the program is rewritten, the operation of the circuit that does not operate by the program does not change, and the relationship between the input and the output does not change. In the following description, "continuity" may be described as "on" and "cutoff" may be described as "off".

With this configuration, the first switch circuit 26 can be forcibly cut off by the forced circuit 29. As a result, it is possible to prevent a period in which the first switch circuit 26 and the second switch circuit 27 are electrically connected to each other. As a result, it is possible to prevent a through current from flowing between the first auxiliary power supply 22 and the second auxiliary power supply 3.

Further, the backup power supply system 1 includes a control circuit 21 that controls the second switch circuit 27. The second switch circuit 27 has two switching elements SW3 and SW4, respectively, which conduct and cut off the second power supply path L2. The control circuit 21 has a diagnostic mode in which the switch SW3 (first switching element) 3 is cut off and the switch SW4 (second switching element) is made conductive during the power supply period in which the second auxiliary power supply 3 is supplying power.

With this configuration, it is possible to diagnose the failure of the second switch circuit 27 by using the output of the second auxiliary power supply 3.

(2) Details Next, the details of the backup power supply system 1 according to the embodiment will be described with reference to FIG.

As shown in FIG. 1, the backup power supply system 1 according to the present embodiment includes a backup power supply device 2 and a second auxiliary power supply 3.

The backup power supply device 2 includes a control circuit 21, a first auxiliary power supply 22, a power supply circuit 23, a first drive circuit 24, a second drive circuit 25, and a latch circuit 31 (five in FIG. 1). Switches SW1 to SW5, a comparison circuit 28, a compulsory circuit 29, and a plurality of diodes D1 to D4 (four in FIG. 1) are provided. Further, the backup power supply device 2 further includes a plurality of input terminals T1 and T2 (two in FIG. 1) and one output terminal T3. That is, in the backup power supply system 1 according to the present embodiment, the first auxiliary power supply 22 and the second auxiliary power supply 3 are separately provided. The switches SW1 and SW2 form the first switch circuit 26, and the switches SW3 and SW4 form the second switch circuit 27.

(2.1) Terminal The input terminal T1 is connected to the main power supply 4 via the ignition switch 8. The input terminal T1 is a terminal for inputting the power supplied from the main power supply 4 to the backup power supply device 2 when the ignition switch 8 is on.

The input terminal T2 is connected to the second auxiliary power supply 3. The input terminal T2 is a terminal for inputting the power supplied from the second auxiliary power supply 3 to the backup power supply device 2.

The output terminal T3 is connected to the brake system 5. The output terminal T3 is a terminal for outputting the electric power supplied from the first auxiliary power source 22 or the second auxiliary power source 3 to the brake system 5.

Further, the main power supply 4 is connected to the brake system 5 via the ignition switch 8. Therefore, in the brake system 5, when the main power supply 4 is normal and the ignition switch 8 is on, power is also supplied from the main power supply 4.

(2.2) Auxiliary power supply The first auxiliary power supply 22 and the second auxiliary power supply 3 are backup (that is, auxiliary or spare) power supplies for the main power supply 4. In other words, the first auxiliary power supply 22 and the second auxiliary power supply 3 are auxiliary power supplies capable of supplying power to the first load 5 when the main power supply 4 fails.

The first auxiliary power supply 22 is connected between the branch point N2 of the power supply path 101 and the power supply circuit 23. The second auxiliary power supply 3 is connected between the downstream side of the ignition switch 8 and the input terminal T2. Further, the second auxiliary power supply 3 is connected to the second load 6 and can supply power to the second load 6. The outputs of the first auxiliary power supply 22 and the second auxiliary power supply 3 are controlled by, for example, the ECU 7.

Each of the first auxiliary power supply 22 and the second auxiliary power supply 3 is, for example, an electric double layer capacitor (EDLC: Electric Double Layer Capacitor). Each of the first auxiliary power source 22 and the second auxiliary power source 3 may be a secondary battery such as a lithium ion capacitor (LIC: Lithium Ion Capacitor) or a lithium ion battery (LIB: Lithium Ion Battery). In a lithium ion capacitor, a positive electrode is formed of a material similar to EDLC (for example, activated carbon), and a negative electrode is formed of a material similar to LIB (for example, a carbon material such as graphite).

Further, each of the first auxiliary power supply 22 and the second auxiliary power supply 3 is not limited to the electric double layer capacitor, and may be, for example, an electrochemical device having the configuration described below. The electrochemical device referred to here includes a positive electrode member, a negative electrode member, and a non-aqueous electrolyte solution. The positive electrode member includes a positive electrode current collector and a positive electrode material layer supported on the positive electrode current collector and containing a positive electrode active material. The positive electrode material layer contains a conductive polymer as a positive electrode active material that is doped and dedoped with an anion (dopant). The negative electrode member has a negative electrode material layer containing a negative electrode active material. The negative electrode active material is, for example, a substance in which a redox reaction accompanied by occlusion and release of lithium ions proceeds, and specifically, a carbon material, a metal compound, an alloy, a ceramic material, or the like. The non-aqueous electrolyte solution has lithium ion conductivity as an example. This type of non-aqueous electrolyte contains a lithium salt and a non-aqueous solution that dissolves the lithium salt. An electrochemical device having such a configuration has a higher energy density than an electric double layer capacitor or the like.

Further, each of the first auxiliary power supply 22 and the second auxiliary power supply 3 is composed of two or more power storage devices (for example, electric double layer capacitors) electrically connected in parallel, in series, or in parallel and in series. May be. That is, one first auxiliary power supply 22 and one second auxiliary power supply 3 may be realized by a parallel circuit or a series circuit of two or more power storage devices, or a combination thereof.

Here, in the backup power supply system 1 according to the present embodiment, the first auxiliary power supply 22 and the second auxiliary power supply 3 are charged by the power supplied from the main power supply 4. Specifically, when the ignition switch 8 is turned on and the switch SW5 is turned on, the first auxiliary power supply 22 is supplied with electric power from the main power supply 4 and is charged by this electric power. Further, when the ignition switch 8 is turned on, the second auxiliary power source 3 is supplied with electric power from the main power source 4 and is charged by this electric power. Further, the first auxiliary power supply 22 and the second auxiliary power supply 3 are configured to discharge when the ignition switch 8 is turned off. Therefore, when the ignition switch 8 is turned on again, the first auxiliary power supply 22 and the second auxiliary power supply 3 are in an uncharged state. The "uncharged state" as used in the present disclosure means a fully charged state, that is, a state in which the remaining amount of electric energy is less than a state in which electric energy is sufficiently stored.

(2.3) Power supply circuit The power supply circuit 23 is a circuit that generates an operating voltage of the control circuit 21. The power supply circuit 23 steps down the output voltage of the main power supply 4 input via the input terminals T1 and the diodes D1 and D3 to a predetermined voltage (for example, 5V) and outputs the output voltage to the control circuit 21. Further, the power supply circuit 23 steps down the output voltage of the first auxiliary power supply 22 input via the diode D2 to a predetermined voltage (for example, 5V) and outputs the output voltage to the control circuit 21. Further, the power supply circuit 23 steps down the output voltage of the second auxiliary power supply 3 input via the diode D4 to a predetermined voltage (for example, 5V) and outputs the output voltage to the control circuit 21. The control circuit 21 can be operated by the output power of the power supply circuit 23.

(2.4) Drive Circuit The first drive circuit 24 is configured to drive two switches SW1 and SW2 together. Specifically, the first drive circuit 24 creates a drive signal for turning on (conducting) / off (cutting off) the switches SW1 and SW2 according to the output signal of the comparison circuit 28, and uses the created second drive signal. Output to switches SW1 and SW2. The switches SW1 and SW2 are turned on / off according to the drive signal from the first drive circuit 24.

The second drive circuit 25 is configured to control the two switches SW3 to SW5 separately. Specifically, the second drive circuit 25 is a third to fifth drive signal for turning on (conducting) / turning off (cutting off) the switches SW3 to SW5 according to the third to fifth control signals from the control circuit 21. Is created, and the created third to fifth drive signals are output to the switches SW3 to SW5. The switches SW3 to SW5 are turned on / off according to the third to fifth drive signals from the second drive circuit 25.

(2.5) Latch Circuit The latch circuit 31 is a circuit for preventing chattering of switches SW1 and SW2 by the first drive circuit 24. The latch circuit 31 controls the signal input from the comparison circuit 28 to the first drive circuit 24 according to the control from the control circuit 21 (that is, in terms of software). The control circuit 21 monitors the output signal (that is, the H level signal or the L level signal) of the comparison circuit 28. More specifically, when the output signal of the comparison circuit 28 fluctuates, the control circuit 21 inputs the fluctuation from the comparison circuit 28 to the first drive circuit 24 by the latch circuit if the fluctuation is within a short time. The signal to be generated is maintained (latched) to the signal before the fluctuation. This prevents chattering of the switches SW1 and SW2. Further, when the output signal of the comparison circuit 28 fluctuates, the control circuit 21 does not maintain the signal input from the comparison circuit 28 to the first drive circuit 24 unless the fluctuation is within a short period of time. As a result, the first drive circuit 24 can drive the switches SW1 and SW2 according to the output signal of the comparison circuit 28.

(2.6) Switch Each of the plurality of switches SW1 to SW5 is, for example, an enhancement type P-channel MOSFET (Metal Oxide Semiconductor Field Effect Transistor). The plurality of switches SW1 to SW5 are turned on (conducting) / off (disconnecting) according to the drive signal output from the first drive circuit 24 or the second drive circuit 25.

The switches SW1 and SW2 are provided between the first auxiliary power supply 22 and the output terminal T3 in the power supply path 101 connecting the input terminal T1 and the output terminal T3. The power supply path 101 constitutes a part of the first power supply path L1 that connects the main power supply 4 and the first load 5. The switches SW1 and SW2 are connected in series with each other in the power supply path 101. The source of the switch SW1 is connected to the first auxiliary power supply 22, and the drain of the switch SW1 is connected to the drain of the switch SW2. Further, the source of the switch SW2 is connected to the output terminal T3. Then, by turning on the switches SW1 and SW2 together, the electric power stored in the first auxiliary power supply 22 can be supplied to the brake system 5 via the switches SW1 and SW2.

The switches SW3 and SW4 are provided in the power supply path 102 connecting the input terminal T2 and the output terminal T3. The power supply path 102 constitutes a part of the second power supply path L2 that connects the second auxiliary power supply 3 and the first load 5. The switches SW3 and SW4 are connected in series with each other in the power supply path 102. The source of the switch SW4 is connected to the input terminal T2, and the drain of the switch SW4 is connected to the drain of the switch SW3. Further, the source of the switch SW3 is connected to the output terminal T3. Then, by turning on the switches SW3 and SW4 together, the electric power stored in the second auxiliary power source 3 can be supplied to the brake system 5 via the switches SW3 and SW4.

Here, the backup power supply system 1 according to the present embodiment is configured to supply power to the brake system 5 from one of the auxiliary power supplies 22 of the first auxiliary power supply 22 and the second auxiliary power supply 3. Therefore, when the switches SW1 and SW2 are turned on to supply power to the brake system 5 from the first auxiliary power supply 22, the switches SW3 and SW4 are turned off to stop the power supply from the second auxiliary power supply 3. There is. When the switches SW3 and SW4 are turned on to supply power to the brake system 5 from the second auxiliary power supply 3, the switches SW1 and SW2 are turned off to stop the power supply from the first auxiliary power supply 22. There is.

In the backup power supply system 1 according to the present embodiment, the first switch circuit 26 is configured by the switches SW1 and SW2, and the second switch circuit 27 is configured by the switches SW3 and SW4. That is, the backup power supply system 1 according to the present embodiment further includes a first switch circuit 26 that conducts and cuts off the first power supply path L1 and a second switch circuit 27 that conducts and cuts off the second power supply path L2. The first switch circuit 26 is turned on (conducting) when both switches SW1 and SW2 are turned on (conducting), and is turned off (cutting off) when at least one of the switches SW1 and SW2 is turned off (cutting off). The second switch circuit 27 is turned on (conducting) when both the switches SW3 and SW4 are turned on (conducting), and is turned off (cutting off) when at least one of the switches SW3 and SW4 is turned off (cutting off).

The switch SW5 is provided between the input terminal T1 and the first auxiliary power supply 22 in the power supply path 101 connecting the input terminal T1 and the output terminal T3. The source of the switch SW5 is connected to the input terminal T1 via the diode D1, and the drain of the switch SW5 is connected to the first auxiliary power supply 22. In the backup power supply system 1 according to the present embodiment, the first auxiliary power supply 22 can be charged by turning on the ignition switch 8 and turning on the switch SW5. Therefore, even if the ignition switch 8 is on, if the switch SW5 is off, the first auxiliary power supply 22 is not charged.

(2.7) Comparison circuit The comparison circuit 28 compares the divided voltage of the power supply path 101 with the reference voltage Vref, and controls the first drive circuit 24 according to the comparison result to turn on (conduct) the switches SW1 and SW2. ) / Off (block) is controlled. As a result, when the main power supply 4 fails, power can be supplied from the first auxiliary power supply 22 to the first load 5 under the control of the comparison circuit 28 (that is, in terms of hardware). The comparison circuit 28 monitors the failure and restoration of the main power supply 4 by comparing the divided voltage of the power supply path 101 with the reference voltage Vref. Since the switches SW1 and SW2 constitute the first switch circuit 26, the first switch circuit 26 is controlled according to the control of the comparison circuit 28 (in other words, according to the failure and / or restoration of the main power supply 4). NS.

More specifically, when the partial pressure of the power supply path 101 is equal to or higher than the reference voltage Vref, the comparison circuit 28 determines that the main power supply 4 has not failed, and drives the H level signal first. By outputting to the circuit 24, both switches SW1 and SW2 are turned on. Further, when the partial pressure of the power supply path 101 is less than the reference voltage Vref, the comparison circuit 28 determines that the main power supply 4 has failed and outputs the L level signal to the first drive circuit 24. By doing so, both switches SW1 and SW2 are turned off.

The comparison circuit 28 has a first input unit (that is, an input unit on the + side), a second input unit (that is, an input unit on the − side), and an output unit. The reference voltage Vref is input to the first input unit. The second input unit is connected to the branch point N1 of the power supply path 101 via the voltage dividing circuit 30. The branch point N1 is located between the first auxiliary power supply 22 and the first switch circuit 26 in the power supply path 101. The voltage dividing circuit 30 has two electric resistance components R1 and R2. The two electrical resistance components R1 and R2 are connected side by side in series between the branch point N1 and the grounding point. The second input portion of the comparison circuit 28 is connected between the two electrical resistance components R1 and R2. The output unit of the comparison circuit 28 is connected to the first drive circuit 24 and outputs the above H level signal and L level signal.

(2.8) Forced circuit The forced circuit 29 forcibly turns on (conducts) / turns off (conducts) switches SW1 and SW2 via the first drive circuit 24 according to the control from the control circuit 21 (that is, in terms of software). Shut off). As a result, when the switches SW1 and SW2 and the switches SW3 and SW4 are both turned on, the switch SW1 and SW2 are forcibly turned off by the forced circuit 29, so that the switches SW1 and SW2 and the switches SW3 and SW4 become Can be avoided from being turned on together. As a result, it is possible to suppress the flow of a through current between the first auxiliary power supply 22 and the second auxiliary power supply 3 via the switches SW1 to SW4. The above-mentioned "forced" means that when the control of the first drive circuit 24 by the comparison circuit 28 and the control of the first drive circuit 24 by the forced circuit 29 overlap, the first drive circuit 24 by the forced circuit 29 It means that the control of is prioritized.

For example, when the control circuit 21 turns on the switches SW3 and SW4 to supply the electric power from the second auxiliary power source 3 to the first load 5 at the request from the vehicle side (for example, ECU 7), the main power source 4 is turned on. Suppose a failure occurs. In this case, if there is no compulsory circuit 29, the control circuit 21 turns on the SW3 and SW4 at the request of the vehicle side, and further, by the comparison circuit 28 that detects the failure of the main power supply 4 (that is, in terms of hardware). ) Switches SW1 and SW2 are turned on. That is, the switches SW1 to SW4 are both turned on. However, in the present embodiment, since the compulsory circuit 29 is provided, when the switches SW1 to SW4 are both turned on as in the above case, the compulsory circuit 29 forcibly turns off the switches SW1 and SW2. As a result, it is suppressed that the switches SW1 and SW2 and the switches SW3 and SW4 are both turned on.

(2.9) Control circuit The control circuit 21 is composed of, for example, a microcomputer having a processor and a memory. That is, the control circuit 21 is realized in a computer system having a processor and a memory. Then, when the processor executes an appropriate program, the computer system functions as the control circuit 21. The program may be pre-recorded in a memory, may be recorded through a telecommunication line such as the Internet, or may be recorded and provided on a non-temporary recording medium such as a memory card.

The control circuit 21 controls the first drive circuit 24, the second drive circuit 25, the latch circuit 31, and the compulsory circuit 29. By this control, the control circuit 21 controls the switches SW1 to SW5.

More specifically, the control circuit 21 controls the on / off of the switches SW3 and SW4 via the second drive circuit 25 according to a signal from the vehicle side (for example, the ECU 7). The ECU 7 is an example of an “external device”. At that time, when the control circuit 21 controls the switches SW3 and SW4 to be turned on via the second drive circuit 25, the control circuit 21 first controls the first drive circuit 24 via the forced circuit 29 to control the switches S1 and SW2. Forcibly turn off. After that, the control circuit 21 turns on the switches SW3 and SW4 via the second drive circuit 25. As a result, it is possible to suppress the occurrence of a period in which the switches SW1 to SW4 are turned on at the same time. As a result, it is possible to suppress the generation of a through current between the first auxiliary power supply 22 and the second auxiliary power supply 3.

Further, in the control circuit 21, when the switches SW3 and SW4 should be controlled to be turned off via the second drive circuit 25, the main power supply 4 has failed and the first auxiliary power supply 22 is sufficiently charged. If not, the switch SW1 and SW2 are forcibly turned off by the control of the first drive circuit 24 by the forced circuit 29, and the switches SW3 and SW4 are turned on via the second drive circuit 25. To continue. As a result, it is possible to prevent the power from being supplied to the first load 5 from being supplied.

Then, when the failure of the main power supply 4 is recovered or the first auxiliary power supply 22 is sufficiently charged, the control circuit 21 controls the switches SW3 and SW4 to be turned off via the second drive circuit 25, and then controls the switches SW3 and SW4 to be off. , The forced control of the first drive circuit 24 by the forced circuit 29 is released.

Further, the control circuit 21 turns off the switches SW3 and SW4 via the second drive circuit 25 when the main power supply 4 has not failed or the first auxiliary power supply 22 is sufficiently charged. .. After that, the control circuit 21 releases the forced control of the first drive circuit 24 by the forced circuit 29.

The control circuit 21 monitors the output voltage of the main power supply 4 and the output voltage of the first auxiliary power supply 22. As a result, the control circuit 21 monitors whether or not the main power supply 4 has failed and whether or not the first auxiliary power supply 22 is sufficiently charged. The fact that the first auxiliary power supply 22 is sufficiently charged means that the charging voltage (output voltage) of the first auxiliary power supply 22 is equal to or higher than a predetermined charging voltage.

Further, the control circuit 21 has a function of diagnosing a failure of the second switch circuit 27. The control circuit 21 uses the output voltage of the second auxiliary power supply 3 to diagnose a failure of the second switch circuit 27. Therefore, the control circuit 21 diagnoses the failure of the second switch circuit 27 during the power supply period in which the power is supplied from the second auxiliary power supply 3. In other words, the control circuit 21 has a diagnostic mode for diagnosing a failure of the second switch circuit 27 during the power supply period in which power is supplied from the second auxiliary power source 3.

It is desirable that the above power supply period is a fixed period. When the above power supply period is a fixed period, the power supply period for supplying power from the second auxiliary power source 3 can be limited for the diagnostic mode. As a result, waste of the second auxiliary power supply 3 can be suppressed.

In the present embodiment, the control circuit 21 diagnoses a failure of the switch SW4 (for example, an open failure and a short failure) in the failure diagnosis of the second switch circuit 27. More specifically, the diagnosis of open failure is performed as follows. That is, the control circuit 21 controls the switch SW4 to be turned on with the switch SW3 turned off via the second drive circuit 25 during the power supply period of the second auxiliary power supply 3, and the switch SW4 is turned on in this control state. Detects the voltage across. As a result of this detection, the control circuit 21 determines that the switch SW4 is not an open failure when the voltages across the switch SW4 are the same, and when there is a voltage difference between the voltages across the switch SW4, the switch SW4 Is determined to be an open failure.

In addition, the diagnosis of short failure is performed as follows. That is, the control circuit 21 controls the switch SW4 to be turned off while the switch SW3 is turned off via the second drive circuit 25 during the power supply period of the second auxiliary power supply 3, and the switch SW4 is turned off in this control state. Detects the voltage across. As a result of this detection, the control circuit 21 determines that the switch SW4 is not a short-circuit failure when there is a voltage difference between the voltages across the switch SW4, and when the voltages across the switch SW4 are the same, the switch SW4 Is determined to be a short-circuit failure.

In the present embodiment, the second auxiliary power supply 3 is controlled by a device (for example, ECU 7) other than the control circuit 21. The second auxiliary power supply 3 outputs a voltage (that is, electric power) for a certain period of time from the start of the control circuit 21 under the control of the ECU 7 for the failure diagnosis of the second switch circuit 27. The control circuit 21 performs a failure diagnosis of the second switch circuit 27 in accordance with this fixed time. As a result, the failure diagnosis of the second switch circuit 27 can be easily adjusted to the power supply period of the second auxiliary power supply 3.

Further, the control circuit 21 performs a failure diagnosis of the second switch circuit 27 (that is, executes a diagnosis mode) based on a signal from an external device (for example, the ECU 7). That is, the control circuit 21 acquires information regarding the timing at which the second auxiliary power supply 3 supplies electric power by a signal from the external device, and performs a failure diagnosis of the second switch circuit 27 according to the timing. The above-mentioned "signal from an external device" is, for example, a signal for remotely parking the vehicle 9 (for example, a request signal for requesting the implementation of remote parking described later). When the vehicle 9 is remotely parked, electric power is output from the second auxiliary power source 3 in order to operate the first load 5 by the electric power from the second auxiliary power source 3. The control circuit 21 performs a failure diagnosis of the second switch circuit 27 based on a signal from an external device (for example, the ECU 7) in order to utilize the period in which this electric power is output.

That is, in the present embodiment, the failure diagnosis of the second switch circuit 27 is possible in any period of a certain period from the start of the control circuit 21 and a period based on the signal from the external device thereafter. .. The control circuit 21 monitors the presence or absence of the voltage output (power supply) of the second auxiliary power supply 3, and after confirming that the voltage is output from the second auxiliary power supply 3, the second switch circuit 27 fails. Make a diagnosis.

(2.10) Diode The diode D1 is provided between the input terminal T1 and the switch SW5 in the power supply path 101 connecting the input terminal T1 and the output terminal T3. The anode of the diode D1 is connected to the input terminal T1, and the cathode of the diode D1 is connected to the source of the switch SW5.

The diode D2 is provided between the first auxiliary power supply 22 and the power supply circuit 23. The anode of the diode D2 is connected to the first auxiliary power supply 22, and the cathode of the diode D2 is connected to the power supply circuit 23.

The diode D3 is provided between the connection point of the diode D1 and the switch SW5 and the power supply circuit 23. The anode of the diode D3 is connected to the connection point of the diode D1 and the switch SW5, and the cathode of the diode D3 is connected to the power supply circuit 23.

The diode D4 is provided between the input terminal T2 and the power supply circuit 23. The anode of the diode D4 is connected to the input terminal T2, and the cathode of the diode D4 is connected to the power supply circuit 23.

Here, when the output voltage of the main power supply 4 is higher than the output voltages of the first auxiliary power supply 22 and the second auxiliary power supply 3, the diodes D1 and D3 are conductive and the diodes D2 and D4 are non-conducting, so that the main power supply 4 The output voltage of is input to the power supply circuit 23 via the diodes D1 and D3. Then, the power supply circuit 23 steps down the input output voltage of the main power supply 4 to a predetermined voltage (for example, 5V) and outputs it to the control circuit 21.

When the output voltage of the first auxiliary power supply 22 is higher than the output voltages of the main power supply 4 and the second auxiliary power supply 3, the diodes D2 are conductive and the diodes D1, D3, and D4 are non-conducting, so that the first auxiliary power supply is non-conducting. The output voltage of 22 is input to the power supply circuit 23 via the diode D2. Then, the power supply circuit 23 steps down the input output voltage of the first auxiliary power supply 22 to a predetermined voltage (for example, 5V) and outputs it to the control circuit 21.

Further, when the output voltage of the second auxiliary power supply 3 is higher than the output voltages of the main power supply 4 and the first auxiliary power supply 22, the diodes D4 become conductive and the diodes D1, D2, D3 become non-conducting, so that the second auxiliary power supply becomes non-conducting. The output voltage of 3 is input to the power supply circuit 23 via the diode D4. Then, the power supply circuit 23 steps down the input output voltage of the second auxiliary power supply 3 to a predetermined voltage (for example, 5V) and outputs it to the control circuit 21.

(3) Operation The operation of the backup power supply system 1 will be described with reference to FIGS. 3 to 5.

(3.1) Operation example 1
An operation example 1 of the backup power supply system 1 will be described with reference to FIG.

In FIG. 3, "F1" is an output flag indicating the output state of the second auxiliary power supply 3. "F2" is a request flag that requests an output from the second auxiliary power supply 3. "F3" is a permission flag indicating whether or not remote parking is permitted. "F4" is a prohibition flag indicating whether or not remote parking is prohibited. “F5” is a charging permission flag indicating whether or not charging of the first auxiliary power source 22 is permitted. Hereinafter, the description will be made on the premise that the main power supply 4 has not failed.

In the following, the case where the vehicle 9 is automatically discharged from the parking lot by remote parking will be described as an example. In this case, power is supplied to the brake system 5 from, for example, the second auxiliary power source 3 in order to stop the vehicle 9 leaving the parking lot.

The user (driver or passenger) of the vehicle 9 gives an instruction for remote parking to the ECU 7 of the vehicle 9 using, for example, a dedicated remote controller. Here, when there is no instruction for remote parking to the ECU 7, the ignition switch 8 is off. Therefore, in this case, power is not supplied from the main power supply 4 to the first auxiliary power supply 22 and the second auxiliary power supply 3, and the first auxiliary power supply 22 and the second auxiliary power supply 3 are not charged. Further, when the ignition switch 8 is off, the electric power stored in the first auxiliary power supply 22 and the second auxiliary power supply 3 is discharged, so that the first auxiliary power supply 22 and the second auxiliary power supply 3 are in an uncharged state. be.

When the remote parking instruction is given to the ECU 7, the ECU 7 turns on the ignition switch 8 and starts charging the second auxiliary power source 3. When the ignition switch 8 is turned on, power is supplied from the main power supply 4 to the power supply circuit 23, and the control circuit 21 is activated by the output power of the power supply circuit 23. At this time, the permission flag B2 is turned off, and remote parking cannot be performed. At this time, all of the switches SW1 to SW5 are off. In this state, the first auxiliary power supply 22 is not charged, and only the second auxiliary power supply 3 is charged. That is, the second auxiliary power supply 3 is charged with priority over the first auxiliary power supply 22 by the electric power supplied from the main power supply 4. Further, the ECU 7 outputs a request signal Sigma 1 requesting the execution of remote parking to the control circuit 21. Upon receiving the request signal Sigma1 from the ECU 7, the control circuit 21 executes various processes shown below in order to perform remote parking. In this embodiment, the ECU 7 of the vehicle 9 is an external system.

The control circuit 21 detects a short circuit (short circuit failure) of the switches SW2 and SW3 before the time t1. At this time, the control circuit 21 detects a short circuit of the switch SW2 by measuring the voltage at the midpoint between the switches SW1 and SW2 while the switches SW1 to SW4 are off, and detects the short circuit of the switch SW2 and the midpoint P2 between the switches SW3 and SW4. A short circuit of the switch SW3 is detected by measuring the voltage. Further, the control circuit 21 turns on the switch SW3 at time t1 and measures the voltage between the switches SW3 and SW4 to detect the opening (open failure) of the switch SW3. The control circuit 21 turns off the switch SW3 at the time t2.

The control circuit 21 turns on the request flag F2 at time t2 if the switch SW3 is not short-circuited and is not open. The control circuit 21 measures the voltage at the midpoint P1, and if this voltage is equal to or higher than the first voltage, it determines that power is being output from the second auxiliary power supply 3. Then, the control circuit 21 turns on the output flag F1 (see FIG. 4). At this time, since the switches SW3 and SW4 are off, the output power of the second auxiliary power supply 3 is supplied to the shift-by-wire system 6, but not to the brake system 5.

The control circuit 21 performs a failure diagnosis of the switch SW4 in the period from the time t2 to the time t3 (that is, using the power supply period of the second auxiliary power supply 3). First, the control circuit 21 detects a short circuit (short circuit failure) of the switch SW4. More specifically, the control circuit 21 detects a short circuit of the switch SW4 by measuring the voltage across the switch SW4 with the switch SW4 turned off. More specifically, the control circuit 21 determines that the switch SW4 is not short-circuited if there is a voltage difference across the switch SW4, and if the voltage across the switch SW4 is the same voltage, the switch SW4 is short-circuited. It is determined that it is. Next, if the switch SW4 is not short-circuited, the control circuit 21 detects the opening (open failure) of the switch SW4 by turning on the switch SW4. More specifically, the control circuit 21 detects the opening of the switch SW4 by measuring the voltage across the switch SW4 with the switch SW4 turned off. More specifically, the control circuit 21 determines that the switch SW4 is not open if the voltage across the switch SW4 is the same, and opens the switch SW4 if the voltage across the switch SW4 has the same voltage difference. Judge that it is.

As described above, in the operation example 1, the failure diagnosis of the switch SW4 is performed in the period from time t3 to t4, and this period is an example of a fixed period from the time of startup. That is, in the operation example 1, the failure diagnosis of the switch SW4 is performed within a certain period from the time when the control circuit 21 is started. However, the failure diagnosis of the switch SW4 may be performed at the time of starting the control circuit 21 (that is, at the same time as starting the control circuit 21).

Further, the above-mentioned failure diagnosis for the switch SW4 may be performed on the switch SW3 or on both the switches SW3 and SW4. That is, the above-mentioned failure diagnosis for the switch SW4 may be performed on at least one of the switches SW3 and SW4.

The control circuit 21 turns on the switch SW3 at time t4 if the switch SW4 is not short-circuited and is not open. At this time, the control circuit 21 turns off the request flag F2. At this time, since the switches SW3 and SW4 are both turned on, the output power of the second auxiliary power source 3 is supplied to both the brake system 5 and the shift-by-wire system 6.

In the control circuit 21, the permission flag F3 is turned on because the second auxiliary power supply 3 is in a state where power can be supplied to the brake system (first load) 5 and remote parking is possible. At the same time, an authorization signal is output to the ECU 7. Upon receiving the permission signal from the control circuit 21, the ECU 7 transmits an operable signal indicating that remote parking is possible to the remote controller. Remote parking is started when the user performs a specific operation (operation for performing remote parking) on the remote controller that has received the operable signal.

At time t5, the control circuit 21 turns on the charge permission flag F5 and turns on the switch SW5 to start charging the first auxiliary power supply 22.

The control circuit 21 turns off the output flag F1 because the output voltage of the second auxiliary power supply 3 is equal to or lower than the first voltage at time t6. At time t7, the control circuit 21 turns off the permission flag F3 because the output voltage of the second auxiliary power supply 3 is equal to or lower than the first voltage and is not in a state where power can be supplied to the brake system 5. do. Further, the control circuit 21 turns on the prohibition flag F4 when the permission flag F3 is turned from on to off at the time t8. The control circuit 21 turns off the switches SW3 and SW4 at time t9, and stops the power supply from the second auxiliary power supply 3 to the brake system 5.

The control circuit 21 detects a short circuit of the switch SW1 in the period from time t9 to time t10. The control circuit 21 detects a short circuit of the switch SW1 by measuring the voltage at the third midpoint between the switches SW1 and SW2 while the switches SW1 and SW2 are off. The control circuit 21 detects that the switches SW1 and SW2 are open if the switches SW1 and SW2 are not short-circuited. The control circuit 21 turns on the switches SW1 and SW2 at time t10 and measures the voltage at the third midpoint between the switches SW1 and SW2 to detect the opening of the switches SW1 and SW2.

The control circuit 21 turns off the switches SW1 and SW2 and turns on the switches SW3 and SW4 at time t11. Then, at time t12, the control circuit 21 outputs because the output voltage of the second auxiliary power supply 3 is equal to or higher than the first voltage and is in a state where power can be supplied to the brake system 5. The flag F1 is turned on and the permission flag F3 is turned on.

Since the first auxiliary power supply 22 has been charged at the time t13, the control circuit 21 turns off the switches SW3 and SW4 in order to stop the power supply from the second auxiliary power supply 3 to the brake system 5. do. As a result, the power supply from the second auxiliary power supply 3 to the brake system 5 is stopped. Then, after time t13, since the first auxiliary power supply 22 is in a state where power can be supplied to the brake system 5, the control circuit 21 turns on the switches SW1 and SW2 to turn on the first auxiliary power supply 22. Power is supplied to the brake system 5.

Here, in the backup power supply system 1, the second auxiliary power supply 3 is used during the period when the switches SW3 and SW4 are on and the output flag F1 is on (the period from time t4 to t6 and the period from time t12 to t13). Remote parking can be done by electric power.

(3.2) Operation example 2
Next, with reference to FIG. 4, a more detailed operation when performing remote parking will be described. In the following description, it is assumed that the main power supply 4 fails when the first auxiliary power supply 22 is incompletely charged.

Note that, in FIG. 4, "Bin" is a flag indicating whether or not a failure has occurred in the main power supply 4. If the main power supply 4 has not failed, the flag Bin is turned off, and if the main power supply 4 has failed, the flag Bin is turned on. “B0” is a flag indicating whether the control circuit 21 has received the remote parking execution signal from the ECU 7 or the control circuit 21 has received the remote parking end signal from the ECU 7. When the control circuit 21 receives the remote parking execution signal from the ECU 7, the flag B0 is turned on, and when the control circuit 21 receives the remote parking end signal from the ECU 7, the flag B0 is turned off. The remote parking execution signal is a signal requesting the execution of remote parking, and the remote parking end signal is a signal requesting the end of remote parking. “B1” is a bluff indicating whether or not the second auxiliary power source 3 is in the fully charged state. If the second auxiliary power source 3 is in the fully charged state, the flag B1 is turned on, and if the second auxiliary power source 3 is in the incompletely charged state, the flag B1 is turned off. Become. "B2" is a permission flag indicating whether or not remote parking is permitted. “B3” is a flag indicating whether or not the backup power supply system 1 is in the first auxiliary power supply mode for outputting power from the first auxiliary power supply 22. “B4” is a flag indicating whether or not the output terminal T3 is outputting power from the first auxiliary power supply 22 or the second auxiliary power supply 3. “B5” is a flag indicating whether or not the comparison circuit 28 has detected the failure of the main power supply 4. “B6” is a flag indicating whether or not the switches SW1 and SW2 are forcibly turned off by the forced circuit 29. “B7” is a flag indicating whether or not the latch circuit 31 latches the switches SW1 and SW2. “SW1” to “SW4” indicate whether the switches SW1 to SW4 are turned on or off, respectively.

First, the operation shown in the solid line graph in FIG. 4 will be described. Before the time t21, the flags B1 to B7 are off, the switches SW1 to SW4 are off, the switch SW5 is on, and the main power supply 4 has not failed.

When the control circuit 21 receives the remote parking execution signal from the ECU 7 at the time t21 (flag B0 is turned on), the control circuit 21 forcibly turns off the switches SW1 and SW2 via the forced circuit 29 at the time t22 (the flag B0 is turned on). Flag B6 on). After that, at time t23, the control circuit 21 turns on the switches SW3 and SW4. As a result, at time t23, the electric power from the second auxiliary power source 3 is supplied from the output terminal T3 to the first load 5 via the switches SW3 and SW4 (flag B4 is turned on). With this power supply, remote parking can be performed at time t23 (flag B2 is turned on). In the present embodiment, since the switches SW1 and SW2 are turned off from the time t21, the forced off state of the switches SW1 and SW2 is maintained at the time t22.

Then, a failure occurs in the main power supply 4 at time t24 (flag Bin is turned on), and the comparison circuit 28 detects the failure of the main power supply 4 at time t25 (flag 7B5 is turned on). However, since the forced circuit 29 forcibly turns off the switches SW1 and SW2, the switches SW1 and SW2 are not turned on by the comparison circuit 28 and remain off.

Then, at time t26, the control circuit 21 receives the remote parking end signal from the ECU 7 (flag B0 is off). In this case, since the main power supply 4 has failed and the first auxiliary power supply 22 has not been charged, the control circuit 21 turns on the switches SW3 and SW4 even if the remote parking end signal is received from the ECU 7. To continue. As a result, the power from the second auxiliary power source continues to be supplied from the output terminal T3 to the first load 5 without interruption (that is, the flag B4 continues to be turned on).

Then, when the main power supply 4 is restored at time t30 (flag Bin is off), the comparison circuit 28 detects the restoration (flag B5 is off), and the power of the main power supply 4 is supplied to the first load 5. .. When the main power supply 4 is restored, the control circuit 21 turns off the switches SW3 and SW4 at time t31. As a result, at time t32, the power supply of the second auxiliary power supply 3 from the output terminal T3 to the first load 5 is stopped (flag B4 is turned off). As a result, remote parking becomes impossible at time t32 (flag B2 is off). When the main power supply 4 is restored, the first auxiliary power supply mode is turned off at time t32 (flag B3 is turned off). Further, when the switches SW3 and SW4 are turned off at time t31, the first auxiliary power supply mode of the backup power supply system 1 is released at time t32 (flag B3 is turned off). Further, when the switches SW3 and SW4 are turned off at the time t31, the forced off of the switches SW1 and SW2 by the forced circuit 29 is released at the subsequent time t32 (flag B6 is turned off).

In the above description, when the control circuit 21 receives the remote parking end signal from the ECU 7 (time t26), the switches SW3 and SW4 are continuously turned on. In the following, as a reference example, the operation (dotted line graph in FIG. 4) when the switches SW3 and SW4 are turned off instead of the switches SW3 and SW4 being continuously turned on will be described.

In this case, when the control circuit 21 receives the remote parking end signal from the ECU 7 at time t26 (flag B0 is turned off), the control circuit 21 turns off the switches SW3 and SW4 at time t27. As a result, at time t27, the power supply of the second auxiliary power supply 3 from the output terminal T3 is stopped (flag B4 is turned off). As a result, remote parking becomes impossible at time t27 (flag B2 is off). Further, when the switches SW3 and SW4 are turned off, the forced off of the switches SW1 and SW2 by the forced circuit 29 is released at the subsequent time t28 (flag B6 is turned off). At the time of this release, since the main power supply 4 has failed, the switches SW1 and SW3 are turned on by the comparison circuit 28 at time t28. As a result, at time t28, power from the first auxiliary power supply 22 that has not been charged is supplied from the output terminal T3 (flag B4 is turned on). When the switches SW1 and SW2 are turned on at the time t28, the latch circuit 31 latches the on of the switches SW1 and SW2 at the time t29 (flag B7 is turned on). Then, at time t30, when the main power supply 4 is restored (flag Bin is on), the comparison circuit 28 detects the restoration (flag B5 is off), but the latch circuit 31 is in the on state (flag B7 is on). ), Switches SW1 and SW2 continue to be on. When the latch circuit 31 is turned off at time t31 (flag B7 is turned off), the power supply of the first auxiliary power supply 22 from the output terminal T3 is stopped at time t31 (flag B4 is turned off).

As shown in the above reference example (dotted line graph in FIG. 4), the switches SW3 and SW4 are turned off when the control circuit 21 receives the remote parking end signal (time t26) during the failure of the main power supply 4. (Time t27), a period (time t27 to t28) in which the power supply from the output terminal T3 is stopped occurs. Therefore, in the present embodiment (graph of practice in FIG. 4), when the control circuit 21 receives the remote parking end signal (time t26) during the failure of the main power supply 4, the switches SW3 and SW4 are continuously turned on. By doing so, it is possible to prevent the power supply from the output terminal T3 from being interrupted during the period from time t27 to t28.

(3.3) Operation example 3
In the operation example 2, the operation when the main power supply 4 is restored after the remote parking is completed is illustrated. Next, with reference to FIG. 5, an operation when remote parking ends after the main power supply 4 is restored will be illustrated.

Before time t41, the flags B1 to B7 are off, the switches SW1 to SW4 are off, the switch SW5 is on, and the main power supply 4 has not failed.

When the control circuit 21 receives the remote parking execution signal from the ECU 7 at the time t41 (flag B0 is turned on), the control circuit 21 forcibly turns off the switches SW1 and SW2 via the forced circuit 29 at the time t42 (the flag B0 is turned on). Flag B6 on). After that, at time t43, the control circuit 21 turns on the switches SW3 and SW4. As a result, at time t43, the electric power from the second auxiliary power source 3 is supplied from the output terminal T43 to the first load 5 via the switches SW3 and SW4 (flag B4 is turned on). With this power supply, remote parking can be performed at time t43 (flag B2 is turned on). In the present embodiment, since the switches SW1 and SW2 are off from the time t41, the forced off state of the switches SW1 and SW2 is maintained at the time t42.

Then, a failure occurs in the main power supply 4 at time t44 (flag Bin is turned on), and the comparison circuit 28 detects the failure of the main power supply 4 at time t45 (flag 7B5 is turned on). However, since the forced circuit 29 forcibly turns off the switches SW1 and SW2, the switches SW1 and SW2 are not turned on by the comparison circuit 28 and remain off.

Then, when the main power supply 4 is restored at time t46 (flag Bin is off), the comparison circuit 28 detects the restoration (flag B5 is off), and the power of the main power supply 4 is supplied to the first load 5. .. Then, when the main power supply 4 is restored at time t46, the first auxiliary power supply mode is turned off at time t47 (flag B3 is turned off).

Then, when the control circuit 21 receives the remote parking end signal from the ECU 7 at time t48 (flag B0 is turned off), the control circuit 21 turns off the switches SW3 and SW4 at time t49. As a result, at time t49, the power supply of the second auxiliary power source from the output terminal T43 is stopped (flag B4 is turned off), and remote parking becomes impossible (flag B2 is turned off). Further, when the switches SW3 and SW4 are turned off, the forced off of the switches SW1 and SW2 by the forced circuit 29 is released at the subsequent time t50 (flag B6 is turned off).

As described above, in the operation examples 2 and 3 of the present embodiment, both the first condition and the second condition are satisfied, but at least one of the first condition and the second condition may be satisfied. The first condition is that the second switch circuit 27 (that is, switches SW3 and SW4) is controlled to be turned on (conducting) after the first switch circuit 26 (that is, switches SW1 and SW2) is forcibly turned off (disconnected). It is a condition. The second condition is that the forced cutoff (off) of the first switch circuit 26 is released after the second switch circuit 27 is turned off (cut off).

(4) Main Effects The backup power supply system 1 described above includes a first auxiliary power supply 22, a second auxiliary power supply 3, a first switch circuit 26, and a second switch circuit 27. The first auxiliary power supply 22 and the second auxiliary power supply 3 can supply electric power to the first load 5 (load) when the main power supply 4 fails. The first switch circuit 26 conducts and cuts off the first power supply path L1 connecting the first auxiliary power supply 22 and the first load 5. The second switch circuit 27 conducts and cuts off the second power supply path L2 that connects the second auxiliary power supply 3 and the first load 5. The first switch circuit 26 is controlled by hardware. The second switch circuit 27 is controlled by software. The backup power supply system 1 further includes a compulsory circuit 29 that forcibly shuts off the first switch circuit 26.

According to this configuration, the first switch circuit 26 can be forcibly cut off by the forced circuit 29. As a result, it is possible to prevent a period in which the first switch circuit 26 and the second switch circuit 27 are electrically connected to each other. As a result, it is possible to prevent a through current from flowing between the first auxiliary power supply 22 and the second auxiliary power supply 3.

Further, the backup power supply system 1 includes a first auxiliary power supply 22, a second auxiliary power supply 3, a first switch circuit 26, a second switch circuit 27, and a control circuit 21. The first auxiliary power supply 22 and the second auxiliary power supply 3 can supply electric power to the first load 5 when the main power supply 4 fails. The first switch circuit 26 conducts and cuts off the first power supply path L1 connecting the first auxiliary power supply 22 and the first load 5. The second switch circuit 27 conducts and cuts off the second power supply path L2 that connects the second auxiliary power supply 3 and the first load 5. The control circuit 21 controls the second switch circuit 27. The second switch circuit 27 has a switch SW3 (first switching element) and a switch SW4 (second switching element). The switch SW3 and the switch SW4 conduct and cut off the second power supply path L2, respectively. The control circuit 21 has a diagnostic mode in which the switch SW3 is shut off and the switch SW4 is made conductive during the power supply period in which the second auxiliary power supply 3 is supplying power.

According to this configuration, the output of the second auxiliary power supply 3 can be used to diagnose the failure of the second switch circuit 27.

(5) Modified Example The above-described embodiment is only one of the various embodiments of the present disclosure. The above-described embodiment can be changed in various ways depending on the design and the like as long as the object of the present disclosure can be achieved. Further, the same function as the backup power supply system 1 according to the above-described embodiment may be realized by a power supply backup method, a computer program, a non-temporary recording medium on which the computer program is recorded, or the like.

The power supply backup method according to one aspect is a power supply backup method used for a backup power supply system 1 including a first auxiliary power supply 22 and a second auxiliary power supply 3 capable of supplying power to the load 5 when the main power supply 4 fails. be. The power supply backup method includes a first switching step, a second switching step, and a control step. In the first switching step, the first power supply path L1 connecting the first auxiliary power supply 22 and the load 5 is conducted and cut off by the first switch circuit 26. In the second switching step, the second power supply path L2 connecting the second auxiliary power supply 3 and the load 5 is conducted and cut off by the second switch circuit 27. The control process controls the second switch circuit 27. In the second switching step, the switch SW3 (first switching element) and the switch SW4 (second switching element) each conduct and cut off the second power supply path L2. The control step has a diagnostic mode in which the switch SW3 is shut off and the switch SW4 is made conductive during the power supply period in which the second auxiliary power supply 3 is supplying power.

The program according to one aspect is a program for causing one or more processors to execute the above-mentioned power supply backup method.

(Modification example 1)
In the above embodiment, the forced circuit 29 forcibly turns off the first switch circuit 26. In this case, when the second switch circuit 27 is on, the first switch circuit 26 is forcibly cut off. However, the forced circuit 29 may forcibly turn off the second switch circuit 27 instead of the first switch circuit 26. In this case, the forced circuit 29 is configured to forcibly shut off the second switch circuit 27 when the first switch circuit 26 is on.

(Modification 2)
In the above embodiment, the first switch circuit 26 is controlled by hardware and the second switch circuit 27 is controlled by software, but the first switch circuit 26 is controlled by software and the second switch. The circuit 27 may be controlled by hardware.

(Modification example 3)
In the operation examples 2 and 3 of the above-described embodiment, for example, the ECU 7 controls the output of the second auxiliary power supply 3, and the second auxiliary power supply 3 constantly outputs the electric power after the control circuit 21 is activated. The second auxiliary power supply 3 may be controlled as described above. In this case, the failure diagnosis of the switch SW4 can be performed at any time after the control circuit 21 is activated in accordance with the output of the second auxiliary power supply 3.

However, the ECU 7 controls the second auxiliary power supply 3 so that the second auxiliary power supply 3 outputs power only for a certain period including the period in which the switches SW3 and SW4 are turned on to supply power from the output terminal T3. May be good. In this case, the failure diagnosis of the switch SW4 should be performed during the free time (a period other than the period in which the switches SW3 and SW4 are turned on for power supply) within the above-mentioned fixed period after the control circuit 21 is activated. Can be done.

In this case (when the switches SW3 and SW4 are turned on and the power of the second auxiliary power supply 3 is output from the output terminal T3), remote parking is performed. Therefore, the control circuit 21 can adjust the timing of performing the failure diagnosis of the switch SW4 to the above-mentioned free time based on the remote parking execution signal received from the ECU 7. That is, the control circuit 21 can execute the diagnosis (that is, the diagnosis mode) of the switch SW4 based on the remote parking execution signal (that is, the signal from the outside).

(6) Summary The backup power supply system (1) of the first aspect includes the first auxiliary power supply (22), the second auxiliary power supply (3), the first switch circuit (26), and the second switch circuit (27). And. The first auxiliary power supply (22) and the second auxiliary power supply (3) can supply electric power to the load (5) when the main power supply (4) fails. The first switch circuit (26) conducts and cuts off the first power supply path (L1) connecting the first auxiliary power supply (22) and the load (5). The second switch circuit (27) conducts and cuts off the second power supply path (L2) connecting the second auxiliary power supply (3) and the load (5). The backup power supply system (1) further includes a compulsory circuit (29) for forcibly shutting off one of the first switch circuit (26) and the second switch circuit (27).

According to this configuration, the forced circuit (29) can forcibly shut off one of the switch circuits (for example, the first switch circuit 26) of the first switch circuit (26) and the second switch circuit (27). can. As a result, it is possible to prevent a period in which both the first switch circuit (26) and the second switch circuit (27) are conducting with each other. As a result, it is possible to prevent a through current from flowing between the first auxiliary power supply (22) and the second auxiliary power supply (3).

In the backup power supply system (1) of the second aspect, in the first aspect, the first switch circuit (26) is controlled by hardware. The second switch circuit (27) is controlled by software. The compulsory circuit (29) forcibly forces one switch circuit (for example, the first switch circuit 26) when the other switch circuit of the first switch circuit (26) and the second switch circuit (27) is in a conductive state. Shut off.

According to this configuration, it is possible to prevent both the first switch circuit (26) and the second switch circuit (27) from conducting with each other. As a result, it is possible to prevent a through current from flowing between the first auxiliary power supply (22) and the second auxiliary power supply (3).

In the backup power supply system (1) of the third aspect, at least one of the first condition and the second condition is satisfied in the first or second aspect. The first condition is that one switch circuit (for example, the first switch circuit 26) is forcibly shut off and then the other switch circuit (for example, the second switch circuit 27) is controlled to be turned on. The second condition is that the forced cutoff of one switch circuit is released after the other switch circuit is cut off.

According to this configuration, by satisfying at least one of the first condition and the second condition, a period in which both the first switch circuit (26) and the second switch circuit (27) are electrically connected occurs more reliably. Can be prevented.

In the backup power supply system (1) of the fourth aspect, in the second or third aspect, one switch circuit (for example, the first switch circuit) is used during the period when the other switch circuit (for example, the second switch circuit 27) should be cut off. The forced interruption of the switch circuit 26) is maintained and the continuity of the other switch circuit is maintained.

According to this configuration, the first auxiliary power supply (22) cannot be sufficiently supplied with power from both the main power supply (4) and the first auxiliary power supply (22) during the period when the other switch circuit should be cut off. Power can be supplied from the second auxiliary power source (3) while preventing a through current from being generated between the second auxiliary power source (3) and the second auxiliary power source (3).

In the backup power supply system (1) of the fifth aspect, in any one of the first to fourth aspects, one switch circuit (for example, the first switch circuit 26) has a failure of the main power supply (4) or It is controlled according to the recovery.

According to this configuration, one of the above switch circuits can be controlled according to the failure or restoration of the main power supply (4).

The backup power supply system (1) of the sixth aspect includes a first auxiliary power supply (22), a second auxiliary power supply (3), a first switch circuit (26), a second switch circuit (27), and a control circuit. (21) and. The first auxiliary power supply (22) and the second auxiliary power supply (3) can supply electric power to the load (5) when the main power supply (4) fails. The first switch circuit (26) conducts and cuts off the first power supply path (L1) connecting the first auxiliary power supply (22) and the load (5). The second switch circuit (27) conducts and cuts off the second power supply path (L2) connecting the second auxiliary power supply (3) and the load (5). The control circuit (21) controls the second switch circuit (27). The second switch circuit (27) has a first switching element (SW3) and a second switching element (SW4). The first switching element (SW3) and the second switching element (SW4) conduct and cut off the second power supply path (L2), respectively. The control circuit (21) has a diagnostic mode in which the first switching element (SW3) is cut off and the second switching element (SW4) is made conductive during the power supply period in which the second auxiliary power supply (3) is supplying power. ..

According to this configuration, it is possible to diagnose a failure of the second switch circuit (27) (for example, the second switching element (SW4)) by using the output of the second auxiliary power supply (3).

The backup power supply system (1) of the seventh aspect, in the sixth aspect, the control circuit (21) is diagnosed at the time of starting the control circuit (21) or within a certain period from the time of starting the control circuit (21). Execute the mode.

According to this configuration, the diagnostic mode can be easily set to the second auxiliary power supply (3) by executing the diagnostic mode within a certain period from the start of the control circuit (21) or the start of the control circuit (21). It can be adjusted to the power supply period.

In the backup power supply system (1) of the eighth aspect, in the sixth aspect, the control circuit (21) executes the diagnostic mode based on a signal from the outside (for example, a remote parking execution signal).

According to this configuration, by executing the diagnostic mode based on the signal from the outside, the diagnostic mode can be easily adjusted to the power supply period of the second auxiliary power supply (3).

In the backup power supply system (1) of the ninth aspect, in any one of the sixth to eighth aspects, the power supply period is a fixed period.

According to this configuration, the power supply period for supplying power from the second auxiliary power supply (3) can be limited for the diagnostic mode. As a result, waste of the second auxiliary power supply (3) can be suppressed.

In the backup power supply system (1) of the tenth aspect, in any one of the sixth to ninth aspects, the control circuit (21) is the first switching element (SW3) and the second switching element in the diagnostic mode. Diagnose the failure of at least the second switching element (SW4) of (SW4).

According to this configuration, a failure of at least the second switching element (SW4) of the first switching element (SW3) and the second switching element (SW4) can be diagnosed.

The power supply backup method of the eleventh aspect is a backup power supply including a first auxiliary power supply (22) and a second auxiliary power supply (3) capable of supplying power to the load (5) when the main power supply (4) fails. This is a power supply backup method used in the system (1). The power supply backup method includes a first switching step, a second switching step, and a control step. In the first switching step, the first power supply path (L1) connecting the first auxiliary power supply (22) and the load (5) is conducted and cut off by the first switch circuit (26). In the second switching step, the second power supply path (L2) connecting the second auxiliary power supply (3) and the load (5) is conducted and cut off by the second switch circuit (27). The control step controls the second switch circuit (27). In the second switching step, each of the first switching element (SW3) and the second switching element (SW4) conducts and cuts off the second power supply path (L2). The control step has a diagnostic mode in which the first switching element (SW3) is cut off and the second switching element (SW4) is made conductive during the power supply period in which the second auxiliary power supply (3) is supplying electric power.

According to this configuration, the second switch circuit (27) can be diagnosed.

The program of the twelfth aspect is a program for causing one or more processors to execute the power supply backup method of the eleventh aspect.

According to this configuration, it is possible to provide a program for causing one or more processors to execute the power backup method.

1 Backup power supply system 3 2nd auxiliary power supply 5 1st load (load)
21 Control circuit 22 1st auxiliary power supply 26 1st switch circuit 27 2nd switch circuit 29 Forced circuit L1 1st power supply path L2 2nd power supply path SW3 switch (1st switch element)
SW4 switch (second switch element)

Claims

The first auxiliary power supply and the second auxiliary power supply that can supply power to the load when the main power supply fails,
A first switch circuit that conducts and cuts off the first power supply path that connects the first auxiliary power supply and the load.
A second switch circuit that conducts and cuts off the second power supply path that connects the second auxiliary power supply and the load.
A compulsory circuit for forcibly shutting off one of the first switch circuit and the second switch circuit is provided.
Backup power system.
The first switch circuit is controlled by hardware.
The second switch circuit is controlled by software.
The forced circuit forcibly shuts off the one switch circuit when the other switch circuit of the first switch circuit and the second switch circuit is in a conductive state.
The backup power supply system according to claim 1.
The first condition that the other switch circuit is controlled to be turned on after the one switch circuit is forcibly cut off, and the forcible cutoff of the one switch circuit after the other switch circuit is cut off. Satisfies at least one of the second conditions that is released,
The backup power supply system according to claim 1 or 2.
During the period when the other switch circuit should be cut off, the forced cutoff of the one switch circuit is maintained and the continuity state of the other switch circuit is continued.
The backup power supply system according to claim 2 or 3.
The one switch circuit is controlled in response to the failure or recovery of the main power supply.
The backup power supply system according to any one of claims 1 to 4.
The first auxiliary power supply and the second auxiliary power supply that can supply power to the load when the main power supply fails,
A first switch circuit that conducts and cuts off the first power supply path that connects the first auxiliary power supply and the load.
A second switch circuit that conducts and cuts off the second power supply path that connects the second auxiliary power supply and the load.
A control circuit for controlling the second switch circuit is provided.
The second switch circuit is
Each has a first switching element and a second switching element that conduct and cut off the second power supply path.
The control circuit
It has a diagnostic mode in which the first switching element is cut off and the second switching element is made conductive during the power supply period in which the second auxiliary power supply is supplying electric power.
Backup power system.
The control circuit executes the diagnostic mode at the time of starting the control circuit or within a certain period from the time when the control circuit is started.
The backup power supply system according to claim 6.
The control circuit executes the diagnostic mode based on an external signal.
The backup power supply system according to claim 6.
The power supply period is a fixed period.
The backup power supply system according to any one of claims 6 to 8.
The control circuit diagnoses a failure of at least the second switching element of the first switching element and the second switching element in the diagnostic mode.
The backup power supply system according to any one of claims 6 to 9.
A power supply backup method used in a backup power supply system equipped with a first auxiliary power supply and a second auxiliary power supply capable of supplying power to a load when the main power supply fails.
A first switching step of conducting and interrupting a first power supply path connecting the first auxiliary power supply and the load by a first switch circuit, and
A second switching step of conducting and interrupting the second power supply path connecting the second auxiliary power supply and the load by the second switch circuit, and
Including a control step for controlling the second switch circuit.
In the second switching step,
Each of the first switching element and the second switching element conducts and cuts off the second power supply path.
The control step is
It has a diagnostic mode in which the first switching element is cut off and the second switching element is made conductive during the power supply period in which the second auxiliary power supply is supplying power.
Power backup method.
A program for causing one or more processors to execute the power backup method according to claim 11.