JP2025096790A - Control device - Google Patents

Abstract

To provide a controller capable of continuing abnormality monitoring and operation of a control object even when abnormality occurs.SOLUTION: An ECU 15 includes micro computers 21 and 23, a power supply source, and a clock source. The micro computers 21 and 23 have operation cores 211, 212, 231 and 232 for performing control operation. The power supply source supplies power to the micro computers 21 and 23. The clock source supplies a clock to the operation cores 211, 212, 231 and 232. At least one of the operation cores 211, 212, 231 and 232, the power supply source and the clock source is made of three and more redundant configurations, specifies an abnormal part when abnormality occurs in a part which has three or more redundant configurations, and continues abnormality monitoring and operation by using two or more normal configurations.SELECTED DRAWING: Figure 2

Description

The present invention relates to a control device.

Conventionally, motor control devices that control a motor having two sets of motor windings are known. For example, in Patent Document 1, a two-system configuration is provided in which an inverter circuit and a control unit are provided corresponding to the motor windings.

JP 2018-129995 A

In Patent Document 1, if a further failure occurs while control is continuing after a first failure has occurred, there is a risk that the motor cannot continue to be driven.

The present invention was made in consideration of the above-mentioned problems, and its purpose is to provide a control device that can continue to monitor abnormalities and operate the controlled object even when an abnormality occurs.

The control device of the present invention includes a control unit (21-24), a power source (31-34), and a clock source (41-44, 415). The control unit has an arithmetic circuit (211, 212, 231, 232) that performs control arithmetic. The power source supplies power to the control unit. The clock source supplies a clock for the control arithmetic in the arithmetic circuit.

At least one of the arithmetic circuits, power sources, and clock sources has a three or more redundant configuration. If an abnormality occurs in a location that is made redundant with three or more, the abnormal location is identified, and abnormality monitoring and operation are continued using two or more normal sources. By making it redundant with three or more sources, even if an abnormality occurs in one location, abnormality monitoring and operation of the controlled object can be continued as long as two or more configurations are normal.

1 is a schematic configuration diagram showing an electric power steering device according to a first embodiment; FIG. 2 is a block diagram showing an ECU according to the first embodiment. FIG. 2 is a circuit diagram illustrating a driver circuit according to the first embodiment. FIG. 2 is a circuit diagram illustrating a driver component according to the first embodiment. FIG. 2 is a circuit diagram illustrating a driver component according to the first embodiment. FIG. 2 is a circuit diagram illustrating a driver component according to the first embodiment. FIG. 2 is a plan view showing the driver components according to the first embodiment. 8 is a cross-sectional view taken along line VIII-VIII in FIG. 7. FIG. 2 is a schematic diagram illustrating a substrate arrangement according to the first embodiment. FIG. 2 is a schematic diagram illustrating a substrate arrangement according to the first embodiment. FIG. 2 is a schematic diagram illustrating a substrate arrangement according to the first embodiment. FIG. 2 is an explanatory diagram for explaining connections between a microcomputer and components in two systems. FIG. 2 is an explanatory diagram for explaining connections between a microcomputer and components in three systems. FIG. 2 is an explanatory diagram showing an inter-system connection line according to the first embodiment. FIG. 1 is an explanatory diagram showing an isolator according to a first embodiment. FIG. 2 is an explanatory diagram illustrating a communication configuration between a microcomputer and a driver component according to the first embodiment. FIG. 2 is an explanatory diagram illustrating a communication configuration between a microcomputer and a driver component according to the first embodiment. 4 is a time chart illustrating data communication according to the first embodiment. FIG. 13 is a schematic diagram showing an arrangement of motor windings in a two-system configuration. FIG. 13 is a schematic diagram showing an arrangement of four motor windings. 5 is a time chart illustrating communication between an arithmetic core and a pre-driver IC according to the first embodiment. 6 is a time chart illustrating communication with the pre-driver IC when some of the arithmetic cores fail according to the first embodiment; FIG. 2 is an explanatory diagram illustrating an inter-system connection line according to the first embodiment. FIG. 2 is a block diagram illustrating driving of a power supply relay and a reverse connection protection relay according to the first embodiment. FIG. 2 is a block diagram illustrating a redundant configuration in a microcomputer according to the first embodiment. 10 is a flowchart illustrating a clock monitoring process according to the first embodiment. 5 is a flowchart illustrating a power supply monitoring process according to the first embodiment. FIG. 11 is a block diagram illustrating driving of a power supply relay and a reverse connection protection relay according to a second embodiment. FIG. 13 is a block diagram illustrating driving of a power supply relay and a reverse connection protection relay according to a third embodiment. FIG. 2 is a block diagram illustrating an ECU according to the first embodiment. FIG. 13 is a block diagram illustrating an ECU according to a fourth embodiment. FIG. 13 is a block diagram illustrating an ECU according to a fifth embodiment. FIG. 13 is a block diagram illustrating an ECU according to a sixth embodiment. FIG. 13 is a schematic diagram showing an arrangement of motor windings in three systems. FIG. 13 is a block diagram illustrating an ECU according to a seventh embodiment. FIG. 23 is a block diagram illustrating an ECU according to an eighth embodiment. FIG. 13 is a block diagram illustrating an ECU according to a ninth embodiment. FIG. 13 is a block diagram illustrating calculation timing according to the ninth embodiment. FIG. 23 is a block diagram illustrating an ECU according to a tenth embodiment. 23 is a time chart illustrating the operation of the motor relay according to the tenth embodiment. FIG. 23 is a schematic diagram illustrating a substrate arrangement according to an eleventh embodiment. FIG. 23 is a schematic diagram illustrating a substrate arrangement according to an eleventh embodiment. FIG. 23 is a schematic diagram illustrating a substrate arrangement according to a twelfth embodiment. FIG. 23 is a block diagram illustrating an ECU according to a twelfth embodiment. FIG. 23 is a block diagram illustrating an ECU according to a thirteenth embodiment. 23 is a time chart illustrating the operation of the motor relay according to the thirteenth embodiment. 23 is a time chart illustrating the operation of the motor relay according to the thirteenth embodiment. FIG. 23 is a schematic diagram illustrating a substrate arrangement according to the fourteenth embodiment. FIG. 23 is a schematic diagram illustrating a substrate arrangement according to the fifteenth embodiment. FIG. 23 is a plan view showing a driver component according to a sixteenth embodiment. This is a cross-sectional view of line LI-LI in Figure 50. This is a cross-sectional view of line LII-LII in Figure 50. FIG. 23 is a plan view showing a driver component according to the seventeenth embodiment. This is a cross-sectional view taken along line LIV-LIV in Figure 53. This is a cross-sectional view of line LV-LV in Figure 53. FIG. 23 is a plan view showing a driver component according to an eighteenth embodiment.

The control device according to the present invention will be described below with reference to the drawings. In the following, in multiple embodiments, substantially the same configurations are given the same reference numerals and the description will be omitted.

First Embodiment
The first embodiment is shown in Figures 1 to 28. As shown in Figure 1, a drive device 10 includes a motor 11 and an ECU 15 as a communication device, and is applied to, for example, an electric power steering device 5, which is a steering device for assisting the steering operation of a vehicle. Figure 1 shows the overall configuration of a steering system 90 including the electric power steering device 5. The steering system 90 includes a steering wheel 91, which is a steering member, a steering shaft 92, a pinion gear 96, a rack shaft 97, wheels 98, the electric power steering device 5, etc.

The steering wheel 91 is connected to a steering shaft 92. A torque sensor 93 that detects steering torque is provided on the steering shaft 92. A pinion gear 96 is provided at the tip of the steering shaft 92. The pinion gear 96 meshes with a rack shaft 97. A pair of wheels 98 are connected to both ends of the rack shaft 97 via tie rods or the like.

When the driver turns the steering wheel 91, the steering shaft 92 connected to the steering wheel 91 rotates. The rotational motion of the steering shaft 92 is converted into linear motion of a rack shaft 97 by a pinion gear 96. A pair of wheels 98 are steered to an angle that corresponds to the amount of displacement of the rack shaft 97.

The electric power steering device 5 includes a drive unit 10 and a reduction gear 6 as a power transmission unit that reduces the rotation of the motor 11 and transmits it to the rack shaft 97. The electric power steering device 5 of this embodiment is a so-called "rack assist type", but it may also be a so-called "column assist type" that transmits the rotation of the motor 11 to the steering shaft 92.

The drive unit 10 is a so-called "mechanically and electrically integrated" type in which the ECU 15 is integrally provided on one side of the motor 11 in the axial direction. The ECU 15 has a connector 16, and is connected to the vehicle power supply 7, the vehicle communication network 8, and the torque sensor 93 via the connector 16. The vehicle power supply 7 includes power supplies 501 and 502, which will be described later. The vehicle communication network 8 is, for example, a CAN (Controller Area Network), and is indicated as "CAN" in the figure.

The ECU 15 is disposed coaxially with the motor 11, on the opposite side to the output shaft of the motor 11. Here, "coaxial" means that errors and misalignments related to, for example, assembly and design are allowed. Hereinafter, the axial direction of the motor 11 is regarded as the axial direction of the drive unit 10, and will be referred to simply as the "axial direction." The same applies to "radial direction" and "circumferential direction."

As shown in FIG. 2, the motor 11 is, for example, a three-phase brushless motor, and has four motor windings 121 to 124. The motor 11 outputs all or part of the torque required for steering, and is driven by power supplied from power sources 501 and 502 to rotate the reduction gear 6 forward and reverse.

The ECU 15 includes microcomputers 21, 23, power supply ICs 31, 33, communication units 36, 38, oscillators 41, 43, driver circuits 51-54, pre-driver ICs 61-64, and position sensors 66-69. The subscripts "1", "2", "1A", "2A", "1B", "2B", etc. indicate that the components are provided correspondingly, and the reference numbers are omitted as appropriate for components that can be identified by the subscripts. The components that make up the ECU 15 are mounted on a board 75 that is provided approximately parallel to one end face of the motor 11 in the axial direction (see Figure 1). Although one board 75 is shown in Figure 1, multiple boards may be used.

The microcomputer 21 has arithmetic cores 211 and 212 with lockstep. The microcomputer 23 has arithmetic cores 231 and 232 with lockstep. The microcomputers 21 and 23 are arranged so that they can transmit and receive information to each other through inter-microcomputer communication. In this embodiment, the microcomputers 21 and 23 are configured in the same way, but the performance and detailed configuration may differ. Details of the microcomputers 21 and 23 will be described later.

The microcomputer 21 receives power from the power supply IC 31, and the microcomputer 23 receives power from the power supply IC 33. The power supply ICs 31 and 33 are power management ICs (PMICs). In this embodiment, the components above the dashed dotted line in FIG. 2 receive power from the power supply 501, and the components below the dashed dotted line receive power from the power supply 502. In other words, the drive device 10 of this embodiment is a "two-power supply system" in which power is supplied from the two power supplies 501 and 502.

The communication units 36 and 38 are used to send and receive various information. The communication units 36 and 38 are connected to the vehicle communication network 8 and acquire vehicle signals from the vehicle communication network 8. The oscillators 41 and 43 are clock sources such as quartz crystals or ceramic oscillators.

As shown in FIG. 3, driver circuit 51 has six switching elements 511-516 and is provided corresponding to winding 121. Driver circuit 52 has six switching elements 521-526 and is provided corresponding to winding 122. Driver circuit 53 has six switching elements and is provided corresponding to winding 123. Driver circuit 54 has six switching elements and is provided corresponding to winding 124. Motor relays 131-134 are provided between driver circuits 51-54 and windings 121-124 (see FIG. 39).

In the driver circuit 51, switching elements 511 to 513 are provided on the high potential side, and switching elements 514 to 516 are provided on the low potential side, and are bridge-connected. Switching elements 511 and 514 are connected to the U phase of the winding 121, switching elements 512 and 515 are connected to the V phase of the winding 121, and switching elements 513 and 516 are connected to the W phase of the winding 121.

In addition, in the driver circuit 52, switching elements 521 to 523 are provided on the high potential side, and switching elements 524 to 526 are provided on the low potential side, and are bridge-connected. Switching elements 521 and 524 are connected to the U phase of the winding 122, switching elements 522 and 525 are connected to the V phase of the winding 122, and switching elements 523 and 526 are connected to the W phase of the winding 122. Hereinafter, the switching element on the high potential side will be referred to as the upper arm element, and the switching element on the low potential side as the lower arm element, as appropriate. The switching elements in this embodiment are MOSFETs, but may also be IGBTs, bipolar transistors, etc.

The driver circuits 51 and 52 are connected to the power supply 501. Between the power supply 501 and the driver circuit 51, a power supply relay 551, a reverse connection protection relay 556, a choke coil 562, and a capacitor 566 are provided. The choke coil 561 and the capacitor 566 form a filter circuit. Between the power supply 501 and the driver circuit 52, a power supply relay 552, a reverse connection protection relay 557, a choke coil 562, and a capacitor 567 are provided. The choke coil 562 and the capacitor 567 form a filter circuit. The driver circuits 53 and 54 are connected to the power supply 502. The circuit configurations of the driver circuits 53 and 54, and the power supply relay, reverse connection protection relay, and filter circuit provided between the power supply 502 and the driver circuits 53 and 54 are similar to those of the driver circuits 51 and 52, the power supply relays 551 and 552, etc., so a description thereof will be omitted.

Returning to FIG. 2, pre-driver ICs 61-64 are provided corresponding to driver circuits 51-54. Pre-driver ICs 61 and 62 are provided to be capable of digital communication with microcomputer 21, and pre-driver ICs 63 and 64 are provided to be capable of digital communication with microcomputer 23. Microcomputers 21 and 23 transmit three-phase drive commands for motor 11 to each of pre-driver ICs 61-64 as a set of digital signals.

In detail, the pre-driver IC 61 is communicatively connected to the calculation core 211, the pre-driver IC 62 is communicatively connected to the calculation core 212, the pre-driver IC 63 is communicatively connected to the calculation core 231, and the pre-driver IC 64 is communicatively connected to the calculation core 232. In addition, the communication lines connecting the pre-driver ICs 61 to 64 and the calculation cores 211, 212, 231, and 232 are connected by the system connection line 25.

By digitizing the communication between the microcomputer and the pre-drivers and providing the system connection lines 25, even if an abnormality occurs in one of the calculation cores, commands can continue to be sent from the other normal calculation cores to all of the pre-driver ICs 61 to 64. The system connection lines 25 mean that the four connection lines connecting the cores and the pre-driver ICs are connected to the same potential. Therefore, even if a line is broken at the point indicated by the arrow mid in Figure 2, it is still possible to send and receive signals between the calculation cores 1A, 1B and the pre-drivers 2A, 2B.

An isolator 28 (not shown in FIG. 2 ), which will be described later, is provided on the inter-system connection line 25. The isolator 28 may be provided at any location on the inter-system connection line 25. The same effect can also be achieved by providing an isolator function to a necessary component.

The position sensors 66-69 detect the rotation of the motor 11. The position sensors 66-69 are connected to the calculation cores 211, 212, 231, 232, respectively. The communication lines connecting the position sensors 66-69 and the microcomputers 21, 23 are connected by the inter-system connection line 256. The communication lines connecting the power supply ICs 31, 33 and the microcomputers 21, 23 are connected by the inter-system connection line 257, and the communication lines connecting the communication units 36, 38 and the microcomputers 21, 23 are connected by the inter-system connection line 258. Note that the inter-system connection lines 256-258 may be omitted.

The pre-driver IC will be described with reference to FIG. 4. Here, the pre-driver IC 61 will be described as a representative example. As shown in FIG. 4, the pre-driver IC 61 includes a three-phase pre-driver circuit 611 that transmits gate signals to the switching elements that make up the driver circuit 51. The pre-driver IC 61 also includes a current detection circuit 612, a temperature detection circuit 613, an abnormality detection unit 614, and a relay driver circuit 621.

The pre-driver circuit 611 outputs a gate signal as a drive signal to the switching elements 511 to 516 based on a drive command from the microcontroller 21. The current detection circuit 612 detects the motor current based on the detection values of the current detection elements 517 to 519. In this embodiment, the current detection elements 517 to 519 are current sense MOSs, and are built into the low-side chip 713, which will be described later. The current sense MOSs may be built into the high-side chip 712, or may be a chip separate from the upper and lower arm elements.

As shown in FIG. 5, the current detection element 531 may be a shunt resistor provided in the arm of each phase. In the example of FIG. 5, the shunt resistor is provided on the low potential side of the lower arm element, but it may be provided on the high potential side of the upper arm element. Furthermore, as shown in FIG. 6, the current detection element 532 may be a Hall element provided between the connection point of the upper and lower arm elements and the motor winding. In FIG. 5 and FIG. 6, the current detection elements 531, 532 are described as being provided in the driver component 701 described later, but they may be provided outside the driver component 701. Note that the motor relay 131 is omitted in FIG. 6.

Returning to FIG. 4, the temperature detection circuit 613 detects the temperatures of the driver circuit 50 and the pre-driver IC 60 itself based on the detection value of a temperature detection element (not shown). The abnormality detection unit 614 monitors abnormalities in the driver circuit 50 based on the gate-source potential difference and drain-source potential difference of the elements that make up the driver circuit 50, and on drive commands from the microcontroller 21. For example, the abnormality detection unit 614 monitors abnormalities such as short circuits and open terminals based on the potential difference. The abnormality detection unit 614 also monitors overheating abnormalities based on temperature information and abnormalities in the pre-driver IC 61 itself.

Based on a drive command from the microcontroller 21, the relay driver circuit 621 outputs a gate signal as a drive signal to the power supply relay 551, the reverse connection protection relay 556, and the motor relay 131.

The pre-driver IC 61 transmits the current detection value, temperature information, and abnormality information to the microcontroller 21. Information transmission from the pre-driver IC 61 to the microcontroller 21 may be digital communication or analog communication.

In this embodiment, the corresponding driver circuits 51-54 and pre-driver ICs 61-64 are provided in the same package as a single driver component 701-704. Figures 7 and 8 show an example of a driver component 701 having a driver circuit 51 and a pre-driver IC 61. In Figure 7, the sealing portion 749 is omitted in order to explain the inside of the component, and in Figure 8, the hatching of the sealing portion 749 is omitted.

As shown in FIG. 7 and FIG. 8, the driver component 701 has a control chip 711, a high-side chip 712, a low-side chip 713, an intermediate clip 715, a ground clip 716, a lead frame 72, etc., and is sealed with a sealing portion 749. The sealing portion 749 is formed in a generally rectangular shape in a plan view, and terminals are formed along the outer edge. The terminal arrangement and shape are not important, and the terminals may be of a non-lead type, or may be formed to protrude outside the sealing portion 749. In addition, the driver component 701 is provided with a temperature detection element such as a temperature sensing diode. The temperature detection element may be built into the high-side chip 712 or the low-side chip 713, similar to the current detection elements 517 to 519.

The lead frame 72 includes a control land 721, a power land 722, an output land 723, and a ground land 724. The back side of the lead frame 72 is exposed from the sealing portion 749, and is electrically connected to the wiring pattern of the substrate 75 by soldering or the like. It is not necessary for all lands to be connected to the substrate 75 on the back side. Hereinafter, the region on the control land 721 side is referred to as the IC region Ric, and the region on the power land 722 side is referred to as the driving element region Rd. In addition, in the driver component 701, the end on the power land 722 side (upper side of the paper in FIG. 7) is referred to as the element side end, and the end on the control land 721 side (lower side of the paper in FIG. 7) is referred to as the IC side end.

The control chip 711 constitutes the pre-driver IC 61 and is disposed on the control land 721. In this embodiment, the control land 721 on which the control chip 711 is mounted is at ground potential, but if a control chip 711 with an insulated back side is used, the potential of the control land 721 may be a potential other than ground potential, such as a power supply potential.

The control terminals, which are terminals provided in the control region Rc, are connected to the microcontroller 21, the power supply IC 31, and the other pre-driver ICs 62 to 64. The control terminals include a clock signal terminal, a PWM frequency synchronization terminal, and a sample-and-hold terminal. In addition, if the communication between the microcontroller 21 and the pre-driver IC 61 is, for example, SPI communication, the control terminals include a chip select terminal, a MISO terminal, a MOSI terminal, etc.

The three high-side chips 712 each have an upper arm element for each phase built in, and the three low-side chips 713 each have a lower arm element for each phase built in. The low-side chip 713 also has current detection elements 517 to 519 built in.

The three high-side chips 712 are arranged on a power land 722, which is at the power supply potential. The high-side chips 712 are arranged side by side with their gate electrodes facing the control chip 711 along the long side of the control chip 711. The source electrodes of the high-side chips 712 face upward, and the drain electrodes provided on the back side are connected to the power land 722. On the upper side of the high-side chip 712, the intermediate clip 715, low-side chip 713, and ground clip 716 are layered in this order from the high-side chip 712 side, forming a stack structure.

The intermediate clip 715 is a conductive metal plate made of, for example, copper, and is provided for each of the three high-side chips 712. The lower surface of the intermediate clip 715 is connected to the source electrode of the high-side chip 712, and the upper surface is connected to the drain electrode of the low-side chip 713. The intermediate clip 715 is shifted to an extent that the signal line 718 can be connected to the control chip 711 side of the high-side chip 712. The end of the intermediate clip 715 opposite the control chip 711 is bent downward and connected to the output land 723. The output land 723 is connected to the motor terminal and is connected to each phase of the motor winding 121 via the board wiring or the like.

If the direction in which the high-side chips 712 are adjacent is defined as the width direction (the "first direction" in the figure), the intermediate clip 715 is spaced apart from adjacent frames in the width direction to an extent that insulation can be ensured, and is formed wider than the high-side chip 712. The area of the intermediate clip 715 is formed to be larger than the high-side chip 712. By forming the area of the intermediate clip 715 as large as possible, heat dissipation efficiency is improved.

The ground clip 716 is a conductive plate made of, for example, copper, and is provided across the three low-side chips 713. The ground clip 716 is offset to an extent that the signal line 718 can be connected on the control chip 711 side of the low-side chip 713. The ground clip 716 is bent downward on one side in the width direction and connected to the ground land 724. In this embodiment, the ground clip 716 is provided within the sealing portion 749, but the top surface side may be exposed from the sealing portion 749.

The high-side chip 712 and the low-side chip 713 are connected to the control chip 711 by signal lines 718. In this embodiment, the high-side chip 712 and the low-side chip 713 are stacked, but are offset and stacked in a staircase pattern to ensure a non-overlapping area that does not overlap with the components provided above, so that the signal lines 718 can be connected in the non-overlapping area. The connection ends of the signal lines 718 on the control chip 711 side are concentrated on one side of the control chip 711. The signal lines 718 include lines for gate drive, current detection, and temperature detection. This makes it possible to separate the inside of the driver component 701 into a drive element region Rd through which a large current flows and an IC region Ric.

The component layout on the board 75 is shown in Figures 9 to 11. Figures 9 and 11 show the side of the board 75 facing the motor 11, and Figure 10 shows the side of the board 75 opposite the motor 11. Note that Figure 11 shows a schematic layout of the driver components 701 to 704 and motor windings 121 to 124 on the board 75, with the corresponding pre-driver ICs 61 to 64 and driver circuits 51 to 54 numbered in parentheses for the control chip 711, high-side chip 712, and low-side chip 713. The same is true for Figure 42 etc.

As shown in Figures 9 and 11, the driver components 701 to 704 are mounted on a board 75. The four driver components 701 to 704 are provided on the surface of the board 75 facing the motor 11. The four driver components 701 to 704 are arranged on concentric circles at roughly equal intervals. Furthermore, the driver components 701 and 702 and the driver components 703 and 704 are arranged symmetrically with respect to the board partition line D1. The board partition line D1 is a partition line that separates areas with different power supplies.

The driver components 701-704 are arranged so that the ends on the element side face radially outward. The motor windings 121-124 are connected to the substrate 75 on the radially outer side of the driver components 701-704. That is, from the radially inner side, the control chip 711, the high-side chip 712, the low-side chip 713, and the motor line connection part are arranged in that order. The take-out wires of the motor windings 121-124 are arranged approximately parallel to the element side ends of the driver components 701-704 so as to correspond to the phase arrangement of the switching elements in the driver components 701-704. Note that the phase arrangement shown in FIG. 11 is an example, and may be different. In FIGS. 9-11, the winding connection points to which the take-out wires of the motor windings are connected are numbered as the motor windings 121-124. The same applies to the power terminals and signal terminals.

A rotation detector 65 is mounted on the surface of the substrate 75 facing the motor 11, at a position opposite a magnet provided at the end of the shaft (not shown) of the motor 11. In this embodiment, the rotation detector 65 is mounted in the center of the substrate 75. The rotation detector 65 includes position sensors 66 to 69.

The power terminals 761, 763 are connected to the outer edge of the board 75 in an area that straddles the board center line D2, which is perpendicular to the board partition line D1. The power terminals 761, 763 include a power terminal and a ground terminal. The power terminal 761 is supplied with power from the power source 501, and the power terminal 763 is supplied with power from the power source 502. The power supply ICs 31, 33 are mounted on the board 75 on the board center line D2 between the rotation detection unit 65 and the power terminals 761, 763. The power supply ICs 31, 33 may be located anywhere other than on the board center line D2 as long as they are easily connected to the power terminals 761, 763 and the microcomputers 21, 23. A signal terminal 77 is connected to the outer edge of the board 75 in an area that straddles the board partition line D1.

As shown in FIG. 10, on the surface opposite the motor 11, microcomputers 21 and 23 are mounted on both sides of the board center line D2 on the board partition line D1. A wiring pattern is formed so that power is supplied to the microcomputer 21 from a power terminal 761, and power is supplied to the microcomputer 23 from a power terminal 763. The microcomputers 21 and 23 are connected so that they can communicate with each other, and an isolator 28 is mounted at the connection point between the microcomputers 21 and 23. In this embodiment, the isolator 28 is provided at the center of the board. In addition, components such as capacitors and coils that constitute a filter circuit are mounted on the surface opposite the motor 11.

In this embodiment, the drive unit 10 is applied to an electric power steering device 5. When the drive unit 10 is applied to a main motor or a brake motor, not limited to the electric power steering device 5, various components may be made redundant to ensure safety even if some components fail.

Figures 12 to 15 conceptually show the communication configuration between the microcontrollers and components. As conceptually shown in Figure 12, if a combination of microcontrollers (or computing cores) M1, M2 and components P1, P2 communicatively connected by communication lines C1, C2 is considered to be a control system, if a failure occurs in the microcontroller M1 or component P1, which is the first control system, the microcontroller M2 and component P2, which are the second control system, can continue to operate with 50% of the functionality remaining. Here, if a failure occurs anywhere in the second control system, control cannot continue.

As shown in Figure 13, if further redundancy is achieved by, for example, increasing the number of control systems to three, in the event of a first failure, operation can continue with 66% of the functionality remaining. Even if a further failure occurs while operation is continuing with one failure and two control systems, operation can continue with 33% of the functionality remaining with the remaining one control system. However, increasing the number of control systems increases the number of parts.

As shown in Fig. 14(a) and Fig. 14(b), microcomputers M1 and M2 correspond to microcomputers 21 and 23, and components P1 and P2 correspond to driver components 701 and 703. Driver components 701 and 703 include pre-driver ICs 61 and 63 that control driver circuits 51 and 53, and output drive signals that drive driver circuits 51 and 53 in response to commands sent from microcomputers 21 and 23. In addition, driver components 701 and 703 send current detection values, driver outputs, abnormality information, temperature information, and the like to microcomputers 21 and 23.

As shown in FIG. 14(a), when the driver components 701 and 703 are capable of digital communication, the first communication line C1 and the second communication line C2 are connected by the inter-system connection line 25. For example, if a failure occurs in the microcomputer 21, the microcomputer 23 issues a command to the driver components 701 and 703. This allows control to continue. Also, if the second failure occurs in either the driver component 701 or 703, control can be continued with a normal microcomputer and driver component. This increases the possibility of continued operation in the event of a failure, even with two control systems. Also, as shown in FIG. 14(b), the driver components 701 and 703 may be connected by the inter-system connection line 25.

The communication between the microcontrollers 21, 23 and the components 701, 703 is, for example, SPI communication, but it may be a communication method other than SPI, such as PSI5, SENT, CAN, Ethernet, or Flexray, or it may be wireless communication. Also, in FIG. 14 etc., one communication line is shown, but the number of communication lines and the number of terminals can be set arbitrarily depending on the communication method etc.

As shown in Figure 14, when communication lines C1 and C2 are connected by inter-system connection line 25, if the communication lines are connected to a power supply or ground and the voltage is fixed, there is a failure mode in which all connected microcomputers and components cannot operate. Also, when microcomputers M1 and M2 are connected to different power supplies, a failure in one control system may cause a high voltage to be applied to the normal system or a large current to flow in, resulting in a failure.

As a result, as shown in FIG. 15, an isolator 28 is provided as a system separation component in a location where simultaneous failures are undesirable. Note that the illustration of the isolator 28 has been omitted from FIG. 2 and other figures. In the example of FIG. 15, the isolator 28 is provided in the inter-system connection line 25, but it may also be provided, for example, inside the microcontrollers M1 and M2 or the components P1 and P2. Any configuration that can transmit information while maintaining a potential difference is sufficient for separating the systems, and the system separation component may be provided with a passive blocking component such as a resistor or a buffer instead of an isolator. Also, simultaneous failures may be prevented by using wireless communication for communication.

Specific examples of communication configurations are shown in Figures 16 and 17. For simplicity, in Figures 16 and 17, the signal lines of the two cores of each microcontroller are shown together, and the inter-system connection lines are omitted. As shown in Figure 16, microcontrollers 21 and 23 can transmit a common clock signal SCLK and a MOSI signal to corresponding driver components 701 to 704, and can transmit a chip select signal CS_A to driver components 701 and 703, and a chip select signal CS_B to driver components 702 and 704. Each of driver components 701 to 704 can transmit a MISO signal to the corresponding microcontrollers 21 and 23.

The microcontrollers 21 and 23 are provided to enable inter-microcontroller communication, and perform PWM synchronization, duty update timing synchronization, and sample-and-hold timing synchronization for the four driver components 701-704. The microcontrollers 21 and 23 use the MISO signal to check the PWM update using the PWM reflected value and current detection value. In addition, PWM update check may be performed by configuring the driver components 701-704 to return the driver output to the microcontrollers 21 and 23. If the driver output is not returned to the microcontrollers 21 and 23, the terminals and wiring for returning the driver output can be omitted.

As shown in FIG. 17, the microcontroller 21, the driver component 701, and the driver component 702 may be connected in a so-called "daisy chain" configuration, in which the communication lines are connected in a circular fashion. Similarly, the microcontroller 23, the driver component 703, and the driver component 704 may be connected in a daisy chain.

Specifically, signals from the microcontrollers 21 and 23 are sent to driver components 701 and 703, and the signals are then sent from the driver components 701 and 703 to the driver components 702 and 704. The driver components 702 and 704 then send MISO signals to the microcontrollers 21 and 23, and so on. In this case, the chip select signal and sample and hold may be shared. This makes it possible to reduce the number of terminals and wiring.

In this embodiment, since the communication lines of each control system are connected by the system connection lines 25, in order to prevent data from being mixed on the communication lines, the microcontrollers 21 and 23 do not issue commands when communication from another microcontroller begins, or output commands a predetermined time after a response from the driver components 701 and 703. In addition, the destination of commands from the microcontrollers 21 and 23 may be specified by chip select, ID assignment, etc.

Figure 18 explains an example of data transmission and reception. In this embodiment, the microcontrollers 21 and 23 output an ID and a command to specify the part to be driven. For example, the part to be driven is specified by the ID, and a current command value and on-duty are transmitted to the part side by MOSI. In the ID method, the part to be driven is specified by the ID, but it is also possible to set an ID that commands multiple parts simultaneously. This makes it possible, for example, to align the timing of current detection for multiple parts. The part to be driven may be specified by the chip select method.

The driver components 701 and 703 transmit current values and status information to the microcontrollers 21 and 23. Data transmission from the driver components 701 and 703 is performed by MISO, so information can be transmitted even while commands are being transmitted from the microcontrollers 21 and 23. However, to prevent data transmission timing from different driver components from overlapping, the driver components are set to start transmission from the driver component 703 when transmission from the driver component 701 is completed, for example. Data arbitration can also be performed by setting transmission to be in ID order, for example.

Figures 19 and 20 show schematic layouts of motor windings, with three-phase wiring depicted as a single line. In a concentrated winding motor, the stator has multiple windings, which are connected to form a three-phase motor with three input terminals. Depending on how the windings are connected, it is possible to configure one set of three-phase windings, or multiple sets of three-phase windings. Figure 19 shows an example of configuring two sets of three-phase windings; when connecting windings that are 180° opposed to each other, the wiring for connecting the multiple windings and the configuration of the busbars that carry the wiring tend to become complicated.

In this embodiment, there are two power sources and four motor windings. As shown in FIG. 20, for example, when configuring four sets of three-phase windings in a concentrated winding motor using a 14-pole, 18-slot, 10-pole, 12-slot, or 8-pole, 12-slot stator, the wiring can be simplified because there is no need to connect the windings arranged opposite each other.

In this embodiment, the board 75 is provided on one side of the motor 11 in the axial direction, and the components corresponding to each power source are concentrated and arranged in an area defined by the board partition line D1 (see Figures 1, 9 to 11). In addition, the four motor windings 121-124 are assigned to the two power sources 501, 502 and the two microcomputers 21, 23. When the motor 11 is driven by the four motor windings 121-124, the winding sets that are 180° opposed to each other are often driven in the same phase. When the winding sets driven in the same phase are assigned to the same power source, there is a risk that the components that bundle the wiring will become complicated and thus the size will increase, the wiring on the board 75 will be crossed, which will deteriorate the layout, and a common cause failure will occur due to a wiring short.

Therefore, windings with different drive phases that are arranged next to each other on the stator are assigned to one power supply system. Specifically, power is supplied from power supply 501 to windings 121 and 122, and power is supplied from power supply 502 to windings 123 and 124. In this embodiment, since an inter-system connection line 25 is provided, one core can also output commands to windings assigned to other power supplies. Therefore, even if two windings with different drive phases that are arranged next to each other on the stator are assigned to the same power supply, drivers that drive in the same phase can be operated by commands from the same core.

In addition, because the windings assigned to the same power source have different energization phases, the timing at which the current draw reaches its maximum when the motor is driven shifts. This makes it possible to smooth out the power consumption in the driver circuit, and for example to reduce the size of the smoothing capacitor, compared to when driver circuits driven in the same phase are assigned to the same power source. It is also possible to consolidate components assigned to the same power source system on one side of the board, improve layout, and reduce the occurrence of common cause failures due to wiring shorts. In Figure 20, windings 121 and 123 that are energized in the same phase are shown in white, and windings 122 and 124 that are energized in the same phase but in a different phase from windings 121 and 123 are shown in matte finish.

The communication between the calculation cores 211, 212, 231, 232 and the pre-driver ICs 61 to 64 will be explained with reference to FIG. 21. For the sake of simplicity in explaining the communication, the calculation core 211 will be referred to as "core 1A", the calculation core 212 as "core 1B", the calculation core 231 as "core 2A", the calculation core 232 as "core 2B", the pre-driver IC 61 as "pre-driver 1A", the pre-driver IC 62 as "pre-driver 1B", the pre-driver IC 63 as "pre-driver 2A", and the pre-driver IC 64 as "pre-driver 2B".

In this embodiment, windings 121, 123 provided for pre-drivers 1A, 2A are wound around the stator in opposing directions and are energized in the same phase. Windings 122, 124 provided for pre-drivers 1B, 2B are wound around the stator in opposing directions and are energized in the same phase. The energization phase of windings 121, 123 is different from the energization phase of windings 122, 124. The amplitude of the currents energized in windings 121 to 124 is assumed to be equal.

As shown in FIG. 21, cores 1A and 2A transmit command signals such as duty command values and various drive permission signals to pre-drivers 1A and 2A, which are driven in the same phase. Pre-drivers 1A and 2A transmit current detection values and status information (e.g., driver output, abnormality information, temperature information, etc.) to cores 1A and 2A. Cores 1B and 2B transmit command signals such as duty command values and various drive permission signals to pre-drivers 1B and 2B, which are driven in the same phase. Pre-drivers 1B and 2B transmit current detection values and status information to cores 1B and 2B.

In this embodiment, cores 1A and 2A send drive commands to predrivers 1A and 2A, but do not send drive commands to predrivers 1B and 2B. Here, the predrivers 1B and 2B may be configured to send current detection values and status information to cores 1A and 2A that have not received a drive command. Similarly, the predrivers 1A and 2A may be configured to send current detection values and status information to cores 1B and 2B that have not received a drive command. This allows each core to grasp the control state of the entire drive device 10.

Cores 1A and 2A alternately send commands to pre-drivers 1A and 2A. Similarly, cores 1B and 2B alternately send commands to pre-drivers 1B and 2B. This makes it possible to reduce the computational load of each core.

As shown in FIG. 22, when one core fails, even if the processing is not changed from normal, the update period is extended, but control continues without any fatal impact. Specifically, for example, when core 2A fails, information in group A is not updated at the update timing commanded by core 2A, and the update period is extended. In this case, the previous command value is held at the update timing of core 2A. By using an estimated value from past data at the update timing of core 2A, the impact of the failure can be reduced.

When the command update timing of the failed core 2A occurs, the command may be sent from the normal core 1A instead of the core 2A. This makes it possible to prevent a decrease in performance, including the update cycle. Also, the pre-drivers 1B and 2B that do not use the command from the core 2A can continue to control without being affected by the failure of the core 2A.

As shown in FIG. 23, the system connection line 25 may be divided between group A and group B, which are driven in the same phase. In FIG. 23, the system connection line for group A is "25A", and the system connection line for group B is "25B". By dividing the communication lines by phase, the amount of information on the communication lines can be reduced. In addition, common failure modes in the communication lines can be avoided, so control can continue even if an abnormality occurs in one of the communication lines.

Next, the driving of the power supply relay and reverse connection protection relay will be described. As shown in FIG. 24, in this embodiment, the power supply relays 551-554 and reverse connection protection relays 556-559 are provided for each driver circuit 51-54, and are driven in normal operation by receiving individual commands from the relay driver circuits 621-624 of the corresponding driver circuits 51-54. In FIG. 24, the reverse connection protection relay and reverse connection protection relay are collectively described as "power supply/reverse connection relay", and the description of the calculation core in the microcomputer is omitted. Also, in FIG. 24, the system connection lines are described as being separate for group A and group B as in FIG. 23, but the system connection lines may be collectively described as in FIG. 2.

If an abnormality occurs in the pre-driver IC 61, the power supply relay 551, or the reverse connection protection relay 556, the pre-driver IC 61 is configured to be pulled down (off), and the other pre-driver ICs 62 to 64 are not driven. The same applies if an abnormality occurs in the other pre-driver ICs, the power supply relay, the reverse connection protection relay, or the motor relay (not shown in FIG. 24).

In addition, if an abnormality occurs in the microcomputer 21, the microcomputer 23 issues a command to the relay driver circuits 621, 622 in the pre-driver ICs 61, 62 to drive the power relays 551, 552 and the reverse connection protection relays 556, 557. Similarly, if an abnormality occurs in the microcomputer 23, the microcomputer 21 issues a command to the relay driver circuits 623, 624 in the pre-driver ICs 63, 64 to drive the power relays 553, 554 and the reverse connection protection relays 558, 559. As a result, even if an abnormality occurs in one microcomputer, the motor 11 can continue to be driven by driving the relays in response to a command from the other microcomputer.

Next, the redundant configuration within the microcomputer will be described with reference to FIG. 25. Here, the microcomputer 21 will be used as an example. The microcomputer 21 has arithmetic cores 211 and 212, a power supply control unit 213, and a clock control unit 217.

The power supply control unit 213 has a power supply monitoring unit 214. The power supply control unit 213 is connected to a plurality of power supply circuits PM1 to PM3. The power supply circuits PM1 and PM2 correspond to the power supply IC 31, and the power supply circuit PM3 corresponds to the power supply IC 33. The power supply IC 31 has, for example, a core power supply voltage output (for example, about 1.2 [V]) and a power supply output different from the core power supply voltage (for example, 5 [V]), and the core power supply corresponds to the power supply circuit PM1, and the 5V power supply corresponds to the power supply circuit PM2. The power supply circuits PM1 and PM2 correspond to the same power supply IC 31, but generate different voltages inside the power supply IC 31, and can be considered as "different power supply sources". In other words, the power supply control unit 213 of this embodiment can be said to have a redundant configuration in which power is supplied from three different power supply sources.

The power supply circuit PM1 is input to the power supply control unit 213 at its original voltage and used by the arithmetic cores 211 and 212. The power from the power supply circuit PM2 is stepped down by the built-in step-down circuit 215 and input to the power supply control unit 213 for use in the core arithmetic. The power from the power supply circuit PM3 is stepped down by a step-down circuit 216 outside the microcomputer and input to the power supply control unit 213. The power supply circuit PM2 may be supplied with power from a power source separate from the power supply IC 31, such as the power supply IC 33, or may be configured to step down the voltage using a step-down circuit outside the microcomputer. The power supply monitoring unit 214 monitors the voltage supplied from each power supply circuit.

The clock control unit 217 has a clock monitoring unit 218. The clock control unit 217 obtains a clock signal from the oscillator 41 via a phase-locked loop (PLL) 411. The clock control unit 217 also obtains clock signals from an internal clock circuit 415 and an external clock circuit. In this embodiment, the external clock circuit is the microcomputer 23 of another system, and obtains a clock signal from the microcomputer 23. Note that the external clock circuit is not limited to the microcomputer of another system, and may be a separately provided clock circuit.

In other words, the clock control unit 217 of this embodiment has a redundant configuration in which clocks are supplied from three different clock sources. Hereinafter, the clock signal obtained from the oscillator 41 via the phase-locked loop circuit 411 will be referred to as the "PLL clock", the clock signal obtained from the built-in clock circuit 219 as the "built-in clock", and the clock signal obtained from the external clock circuit as the "external clock".

The clock monitoring process of this embodiment will be described based on the flowchart in Figure 26. Here, the process will be described as being performed by the microcomputer 21, but similar processes are performed by the microcomputer 23. Note that each process in the microcomputers 21 and 23 may be software processing in which a program pre-stored in a physical memory device such as a ROM (i.e., a readable non-transitory tangible recording medium) is executed by the CPU, or may be hardware processing by a dedicated electronic circuit. Hereinafter, the "step" in step S101 and other steps will be omitted and simply referred to as the symbol "S".

In S101, the clock monitoring unit 218 judges whether the PLL clock and the built-in clock match. Note that a deviation of the order of error is tolerated and it is judged that they match. The same applies to other match judgments. If it is judged that the PLL clock and the built-in clock match (S101: YES), the process proceeds to S104. If it is judged that the PLL clock and the built-in clock do not match (S101: NO), the process proceeds to S102.

In S102, the clock monitoring unit 218 determines whether the built-in clock and the external clock match. If it is determined that the built-in clock and the external clock match (S102: YES), the process proceeds to S105. If it is determined that the built-in clock and the external clock do not match (S102: NO), the process proceeds to S103.

In S103, the clock monitoring unit 218 determines whether the PLL clock and the external clock match. If it is determined that the PLL clock and the external clock match (S103: YES), the process proceeds to S104. If it is determined that the PLL clock and the external clock do not match (S103: NO), the process proceeds to S106.

In S104, which is reached when the PLL clock matches the built-in clock or the external clock, the clock control unit 217 operates the arithmetic cores 211 and 212 using the PLL clock.

In S105, which is reached when the PLL clock and the built-in clock do not match, and the built-in clock and the external clock match, the clock control unit 217 operates the calculation cores 211 and 212 using the built-in clock. That is, the PLL clock is used normally, but when the PLL clock is abnormal, it switches to the built-in clock as a backup clock. At this time, the clock after switching is output to the microcomputer of the other control system, and the clock received by the microcomputer of the other system is synchronized to perform calculations. In addition, abnormality monitoring by comparing the built-in clock with the external clock continues.

In S106, which is reached when the PLL clock, the built-in clock, and the external clock do not match, the clock control unit 217 stops the calculations of the calculation cores 211 and 212 and notifies the external IC of the clock abnormality.

The power supply monitoring process will be described based on the flowchart in FIG. 27. In S201, the power supply monitoring unit 214 determines whether the core power supply voltage supplied from the power supply circuit PM1 is normal. If it is determined that the core power supply voltage from the power supply circuit PM1 is normal (S201: YES), the process proceeds to S202, and the arithmetic cores 211 and 212 are operated by the core power supply voltage from the power supply circuit PM1. If it is determined that the core power supply from the power supply circuit PM1 is not normal (S201: NO), the process proceeds to S203, and the power supply used for the core arithmetic is switched from the power supply circuit PM1 to the power supply circuit PM2 or the power supply circuit PM3. Here, the case where the backup power source is switched to the power supply circuit PM2 will be described as an example. In the case where the power supply circuit PM3 is switched to, the power supply circuit PM2 can be read as the power supply circuit PM3, so the description will be omitted.

In S204, the power supply monitor 214 determines whether the core power supply voltage supplied from the power supply circuit PM2 via the step-down circuit is normal. If it is determined that the core power supply voltage from the power supply circuit PM2 is normal (S204: YES), the process proceeds to S205, where the processor cores 211 and 212 are operated with the core power supply voltage from the power supply circuit PM2. If it is determined that the core power supply voltage from the power supply circuit PM2 is not abnormal (S204: NO), the process proceeds to S206, where the processor cores 211 and 212 stop operating and the external IC is notified of the core power supply voltage abnormality. As a result, even if a core power supply abnormality occurs in the power supply circuit PM1, the processor cores 211 and 212 can continue to operate by using the power supply circuits PM2 and PM3 as backup core power supplies.

As described above, the ECU 15 includes the microcomputers 21 and 23, a power source, and a clock source. The microcomputers 21 and 23 have calculation cores 211, 212, 231, and 232 that perform control calculations. The power source is mainly the power supply ICs 31 and 33, which supply power to the microcomputers 21 and 23. The clock source is mainly the oscillators 41 and 43 and the built-in clock circuit 415, which supply clocks to the calculation cores 211, 212, 231, and 232.

At least one of the computing cores 211, 212, 231, 232, power source, and clock source has a three or more redundant configuration, and if an abnormality occurs in a location that is made redundant to three or more, the abnormal location is identified and abnormality monitoring and operation are continued using two or more normal sources. By making it redundant to three or more, even if an abnormality occurs in a part, abnormality monitoring and operation can be continued as long as two or more configurations are normal.

The microcomputer 21 has a clock control unit 217 that can obtain clocks from three or more different clock sources and monitors clock abnormalities. If an abnormality occurs in the clock from the clock source used normally, the clock control unit 217 switches to a backup clock to continue operation and monitors for abnormalities.

In detail, in the microcomputer 21, the oscillator 41, the built-in clock circuit 415, and the other microcomputer, the microcomputer 23, are the "three different clock sources." Under normal circumstances, the PLL signal obtained from the oscillator 41 via the phase-locked loop circuit 411 is used, and if the PLL signal becomes abnormal, the built-in clock is used as a backup clock to continue operation, and abnormality monitoring continues by mutually comparing the built-in clock with the external clock. This makes it possible to continue operation and abnormality monitoring appropriately even if some of the clocks become abnormal.

There are multiple microcomputers 21 and 23, and a control unit that performs control using a backup clock due to a clock abnormality and a clock abnormality control unit, and a normal control unit that is normal. Here, the clock abnormality control unit is the microcomputer 21, and the normal control unit is the microcomputer 23. The microcomputers 21 and 23 transmit the clock used for calculation from one to the other, and perform calculations in the calculation core in synchronization with the backup clock. In this embodiment, the abnormal side microcomputer 21 outputs the backup clock to the normal side microcomputer 23, and the microcomputer 23 synchronizes the backup clock received from the microcomputer 21 and performs calculations in the calculation core. In addition, a normal clock may be sent from the normal side microcomputer 23 to the abnormal side microcomputer 21, and synchronization may be performed by the microcomputer 21. As a result, even if a clock abnormality occurs in some of the microcomputers, multiple microcomputers can be synchronized and control can be continued.

The microcomputer 21 has a power supply control unit 213 to which power is input from at least three power sources, and if the power source used normally becomes abnormal, the operation of the calculation core is continued using power from the backup power source. In this embodiment, the power supply circuits PM1 to PM3 are "three different power supply sources", and under normal circumstances, the power supply circuit PM1 is used as the power source, and if the power supply circuit PM1 becomes abnormal, the core calculation is continued using the power supply circuit PM2, which is a power supply circuit other than the power supply circuit PM1. This allows proper operation to continue even when a power source abnormality occurs.

The computing cores 211, 212, 231, and 232 have a lockstep function that monitors for abnormalities by performing the same calculations across multiple cores. This allows for appropriate detection of abnormalities in the computing cores 211, 212, 231, and 232.

(Second and third embodiments)
The second embodiment is shown in Fig. 28. Fig. 28 corresponds to Fig. 24 of the first embodiment, and the power supply relay and the reverse connection protection relay are different from those of the above embodiment. In this embodiment, the power supply relays 551, 553 and the reverse connection protection relays 556, 558 are provided for each power supply. The power supply relay 551 and the reverse connection protection relay 556 are shared by the driver circuits 51, 52, and the power supply relay 553 and the reverse connection protection relay 558 are shared by the driver circuits 53, 54.

The relay driver circuits 621 and 622 drive the power supply relay 551 and the reverse connection protection relay 556 via the arbitration circuit 571. The relay driver circuits 623 and 624 drive the power supply relay 553 and the reverse connection protection relay 558 via the arbitration circuit 573. By providing the arbitration circuits 571 and 573, the number of relays can be reduced.

When the arbitration circuit 571 is normal, it receives the same command from the relay driver circuits 621 and 622, and drives the power supply relay 551 and the reverse connection protection relay 556 by matching them. If one of the relay driver circuits 621 and 622 is abnormal, the arbitration circuit 571 receives different signals from the relay driver circuits 621 and 622, so it prioritizes the signal from the normally operating side to drive the power supply relay 551 and the reverse connection protection relay 556.

When the arbitration circuit 573 is normal, it receives the same command from the relay driver circuits 623 and 624, and drives the power relay 553 and reverse connection protection relay 558 by matching them. If one of the relay driver circuits 623 and 624 is abnormal, the arbitration circuit 573 receives different signals from the relay driver circuits 623 and 624, so it prioritizes the signal from the normally operating side and drives the power relay 553 and reverse connection protection relay 558.

The third embodiment is shown in Figure 29. In this embodiment, power supply relays 551-554 and reverse connection protection relays 556-559 are provided for each driver circuit 51-54, and arbitration circuits 571-574 are also provided.

The arbitration circuit 571 receives commands from the relay driver circuits 621 and 622 and drives the power relay 551 and the reverse connection protection relay 556. The arbitration circuit 572 receives commands from the relay driver circuits 621 and 622 and drives the power relay 552 and the reverse connection protection relay 557. The arbitration circuit 573 receives commands from the relay driver circuits 623 and 624 and drives the power relay 553 and the reverse connection protection relay 558. The arbitration circuit 574 receives commands from the relay driver circuits 623 and 624 and drives the power relay 554 and the reverse connection protection relay 559. The operation of the arbitration circuits 571 to 574 is generally similar to that of the second embodiment. This allows the motor 11 to continue operating even in a wider range of failure modes. It also provides the same effects as the above embodiment.

(Fourth to Eighth Embodiments)
The fourth to eighth embodiments are variations of the redundant configuration. In the description of the redundant system, the power supply, the vehicle signal input, and the torque signal input are collectively referred to as the "external input system", the power supply IC, the communication unit, and the oscillator are collectively referred to as the "microcomputer input system", and the pre-driver IC and the driver circuit are collectively referred to as the "driver system". The external input system corresponds to the input from the connector 16. The oscillator and the inter-system connection lines are omitted as appropriate. FIG. 30 shows a simplified configuration of the first embodiment. Note that, unless the number of cores in the microcomputer is mentioned, the microcomputer is assumed to have one arithmetic core with lockstep.

As shown in FIG. 31, in the fourth embodiment, four microcomputers each having one lockstep arithmetic core are provided. The other configurations are generally similar to those of the first embodiment. As shown in FIG. 32, in the fifth embodiment, four external input systems are provided, and the power supplies, microcomputers, drivers, and motor windings are all organized into four systems. By organizing the power supplies, microcomputers, and drivers into four systems, it is easy to combine them with a four-system motor. Also, when using a two-power supply configuration, it is easy to separate the power supplies into two systems.

By providing three or more of all components, control can continue even if two of the same components fail. Also, as explained in the first embodiment, by connecting the signal lines with inter-system connection lines, it is possible to provide the same output as in normal operation unless there is a failure on the drive side. When providing inter-system connection lines, it is preferable to insert an isolator as appropriate to avoid common cause failures.

The number of systems is not limited to an even number such as two or four systems, but may be an odd number, or a mixture of odd and even numbers of components. The sixth embodiment shown in FIG. 33 is an example of a three-system configuration in which three external input systems, three microcomputer input systems, three driver systems, and three motor windings are provided. As shown in FIG. 34, when there are three driver systems, the motor windings can also be provided in three systems, allowing for efficient wiring.

On the other hand, providing multiple components for redundancy raises concerns about an increase in the number of components, larger components, and increased computational load. In that case, components that are relatively prone to failure may be provided with three or four systems, and components that are relatively unlikely to fail may be provided with two systems. For example, if the driver circuit is most prone to failure, then the driver system may be provided with four systems and the rest with two systems, as in the seventh embodiment shown in Figure 35. This configuration will still produce the same effects as the above embodiments.

Also, as in the eighth embodiment shown in FIG. 36, the ECU 15 is provided with four power supply ICs 31-34 and four oscillators 41-44, and multiple power supply ICs and oscillators (two in FIG. 36) may be provided for one microcomputer. In this embodiment, four calculation cores are provided overall, and each calculation core uses a different power supply IC as a power source and a different oscillator as a clock source.

In the eighth embodiment, the ECU 15 is provided with three or more (four in this embodiment) arithmetic cores that operate on different clock sources. The ECU 15 is also provided with two or more (four in this embodiment) arithmetic cores that operate on different power sources. This allows the motor 11, which is the object of control, to continue operating even if an abnormality occurs in one of the clock sources or power sources. Also, the same effects as the above embodiments are achieved.

Ninth embodiment
The ninth embodiment is shown in Figures 37 and 38. In the above embodiments, the processor core is described as having lockstep. When the processor core has lockstep, redundant calculations are performed by the lockstep core, and abnormality detection is performed by comparing the calculation results. On the other hand, when the processor core does not have a lockstep core, calculation errors cannot be detected. The seventh embodiment is an example in which the processor core does not have a lockstep core, and the microcomputers 21 and 23 each have three processor cores, and abnormality monitoring is performed by majority vote of the calculation results.

As shown in FIG. 38, the three arithmetic cores 261 to 263 can perform calculations independently and simultaneously based on a common clock. In this case, for example, if momentary noise is introduced, the calculations in the three arithmetic cores 261 to 263 may be affected in the same way. Therefore, by shifting the calculation timing using the clock delayer 265, it is possible to prevent simultaneous occurrence of calculation errors. Note that the comparator 267, which compares the calculation results, needs to compare calculation results at the same timing, so the delay amount between multiple cores is made uniform. By dynamically comparing using the comparator 267, it is possible to make a judgment quickly. Also, instead of comparison by the comparator 267, data may be stored for a certain period of time and compared collectively by the arithmetic cores 261 to 263.

In this embodiment, the microcomputers 21, 23 have three or more calculation cores 261-263 that perform the same calculation, and control the motor 11 based on the results of mutual comparison of the calculation results. In detail, the motor 11 is controlled using calculation results that are determined to be normal according to the theory of majority voting. This makes it possible to continue controlling the motor 11 even if an abnormality occurs in the calculation results of some of the calculation cores.

Three or more calculation cores 261 to 264 perform the same calculation at different timings, and compare the calculation results by inputting values with timing adjusted so that the same calculation results can be compared to a comparator 267. This makes it possible to increase the detection coverage of anomaly detection for simultaneous occurrence of calculation errors. It also produces the same effects as the above embodiment.

Tenth embodiment
A tenth embodiment is shown in Fig. 39 to Fig. 41. In the tenth embodiment, a method of operation in a redundant configuration will be described. For example, in a configuration in which four microcomputers and four motor windings are provided (see Fig. 32), the four microcomputers may be driven equally, and the output of each set of motor windings may be set to 25%.

In addition, two microcomputers and two sets of motor windings are used as drive systems, and the remaining two each as backup systems. Under normal circumstances, the motor is driven by the drive systems, resulting in 50% output per set of motor windings. If an abnormality occurs in the drive system, the system switches to drive by the backup systems.

Figure 39 shows an example of four microcomputers 21-24 and driver circuits 51-54, and two sets of motor windings 121, 123. The microcomputers 21, 22 and driver circuits 51, 52 are connected to the motor winding 121, and the microcomputers 23, 24 and driver circuits 53, 54 are connected to the motor winding 123. A motor relay 131 is provided between the driver circuit 51 and the motor winding 121, a motor relay 132 is provided between the driver circuit 52 and the motor winding 122, a motor relay 133 is provided between the driver circuit 53 and the motor winding 123, and a motor relay 134 is provided between the driver circuit 54 and the motor winding 124. Each of the motor relays 131-134 includes three switching elements corresponding to each phase. In the figure, the motor relay is written as "SW".

As shown in FIG. 40, under normal circumstances, motor relays 131 and 133 are turned on to energize motor windings 121 and 123 using driver circuits 51 and 53, thereby driving motor 11. If an abnormality occurs in microcontroller 21, motor relay 131 is turned off and motor relay 132 is turned on, so that driver circuit 52 is used instead of driver circuit 51 to energize motor winding 121. If microcontroller 23 is normal, motor relay 133 remains on and motor relay 134 remains off.

Similarly, if an abnormality occurs in the microcomputer 23, the motor relay 133 is turned off and the motor relay 134 is turned on instead of off, so that the driver circuit 54 is used to supply current to the motor winding 123 instead of the driver circuit 53. If the microcomputer 21 is normal, the motor relay 131 remains on and the motor relay 132 remains off. This allows the motor 11 to continue to be driven in the same state as before the abnormality occurred, even if an abnormality occurs in the microcomputers 21, 23.

As shown in FIG. 41, the components related to the flow of current through the motor windings 121 are arranged together on one side of the board 75 (the left side of the paper in the example of FIG. 41), and the components related to the flow of current through the motor windings 123 are arranged together on the other side of the board 75 (the right side of the paper in the example of FIG. 41).

On the board 75, the power terminals are arranged symmetrically with respect to the board partition line D1. In addition, the take-off wires of the motor windings 121 and 123, the driver component 73, and the motor relays 131 to 134 between the motor wires and the driver component are arranged symmetrically with respect to the board partition line D1 in a configuration corresponding to the motor winding 121 and a configuration corresponding to the motor winding 123, and the phase arrangement is arranged in reverse order.

The driver components 73 are integrally sealed with one high-side chip 712, one low-side chip 713, and one control chip 711 with a corresponding pre-driver IC built in. The six driver components 73 are arranged side by side with their element side ends facing the motor windings 121, 123 and their IC side ends facing the board partition line D1.

In the driver component 73, the low-side chip 713, the high-side chip 712, and the control chip 711 are arranged in this order from the motor windings 121, 123 side. The low-side chip 713 is stacked on top of the high-side chip 712, but it may be laid flat without being stacked, or the control chip 711 may be a separate component. In addition, the driver components 701 to 704 of the above embodiment, in which a total of six switching elements are modularized, may be used. In this case, for the phase located in the middle (V phase in the example of Figure 41), the drive system elements and backup system elements are assigned to different modules.

In FIG. 41, the drive system components are shown with solid lines, and the backup system components are shown with two-dot chain lines, with the drive system driver components and backup system driver components corresponding to each phase arranged adjacent to each other and alternating. Therefore, the high-side chip 712 and the low-side chip 713 used for driving the same phase are arranged adjacent to each other. This makes it easier to wire the driver components 73 and the motor windings 121, 123, and makes it possible to reduce the mounting area of the power section on the board. This configuration also produces the same effects as the above embodiment.

(Eleventh to Thirteenth Embodiments)
The eleventh to thirteenth embodiments are variations of the power terminal arrangement and connection. When four external input systems are provided (see FIG. 32) as in the eleventh embodiment shown in FIG. 42, the power terminals 761 to 764 corresponding to the four connectors are evenly arranged at 90° intervals.

As in the twelfth embodiment shown in Figures 43 and 44, power terminals 761 and 762, and power terminals 763 and 763 may be arranged side by side at two locations on the outer edge of the board 75, on both sides of the board partition line D1. When four sets of power terminals 761-764 corresponding to four connectors are provided for two power supply ICs 31 and 33, the two sets of power terminals 76 are connected to the respective power supply ICs 31 and 33 via diodes 781-784. By electrically connecting multiple power supply inputs, it is possible to continue to supply power appropriately even if a connector abnormality occurs or the harness becomes detached.

Also, as in the thirteenth embodiment shown in Figures 45 to 47, switching elements 786 to 789 may be provided between the connector and the power supply IC instead of the diodes 781 to 784. The switching elements 786 and 787 are connected to the power supply IC 31, and the switching elements 788 and 789 are connected to the power supply IC 33.

As shown in FIG. 46, both switching elements 786 and 787 are turned on under normal conditions, and if an abnormality occurs in power supply 1A, switching element 786 on the side where the abnormality occurred is turned off. If an abnormality occurs in power supply 1B, switching element 787 is turned off. By keeping both switching elements 786 and 787 on under normal conditions, it is possible to quickly switch the power supply to be used in the event of an abnormality.

Also, as shown in FIG. 47, during normal operation, switching element 786 is turned on and switching element 787 is turned off so that power is supplied from one power source (for example, power source 1A). Furthermore, if an abnormality is detected in power source 1A, switching element 786 may be turned off and a wake-up signal may be sent from the normal microcomputer to switching element 787 to turn switching element 787 on. This makes it possible to reduce current consumption during normal operation. The same applies to the control of switching elements 788 and 789 connected to power supply IC 33. Even with this configuration, the same effects as the above embodiment can be achieved.

(14th and 15th embodiments)
The fourteenth and fifteenth embodiments are variations of the board arrangement. In the first embodiment, the motor windings 121 to 124 are provided radially outside the driver components 701 to 704 (see FIG. 11). In the fourteenth embodiment shown in FIG. 48, the motor windings 121 to 124 are provided radially inside the driver component 701.

In the fifteenth embodiment shown in FIG. 49, the driver components 701 and 702 are arranged symmetrically with respect to the board center line D2 so that the pre-driver ICs 61 and 62 face the power terminal 76. The driver components 703 and 704 are arranged symmetrically with respect to the board center line D2 so that the pre-driver ICs 63 and 64 face the power terminal 76. The motor windings 121 to 124 are provided on the driver circuit 51 to 54 side of the driver components 701 to 704. This configuration also produces the same effects as the above embodiments.

Sixteenth Embodiment
The sixteenth to eighteenth embodiments are modified driver components. The sixteenth embodiment is shown in Fig. 50 to Fig. 52. Fig. 50 corresponds to Fig. 7, and shows each component in a simplified form. In the driver component 705 of this embodiment, the stacked structure of the chips 712 and 713 is generally similar to that of the first embodiment.

The ground lands 724 of the lead frame 725 are provided on both sides of the power land 722. The ground clips 741 are bent downward on both sides in the width direction and connected to the ground lands 724.

As shown in FIG. 52, the control land 726 on which the control chip 711 is arranged is exposed from the sealing portion 749 to the back side at the middle in the width direction, and is not exposed from the sealing portion 749 at the outer side in the width direction. In other words, as shown by the dashed square, a part of the control land 726 is floating above the substrate 75. This ensures that the high-side chip 712 and the power supply line can be easily routed on the substrate. Also, since the power supply + line and the GND line are aligned in a straight line, it is easier to arrange anti-noise elements such as snubber elements (not shown). Also, noise loops can be reduced. Also, the same effects as the above embodiment are achieved.

Seventeenth Embodiment
The seventeenth embodiment is shown in Figures 53 to 55. In the driver component 706 of this embodiment, a control chip 711 is not built in, and the lead frame 727 does not have a control land 726. The stacked structure of the chips 712, 713 is generally similar to that of the first embodiment. Note that the control chip 711 may also be built in this embodiment. Also, in the first embodiment and other embodiments, the control chip 711 may not be built in the driver component, but may be provided separately.

In this embodiment, the ground lands 724 are divided for each phase and arranged on the opposite side of the power land 722 from the output land 723. A ground clip 742 is provided for each phase. Each ground clip 742 is provided above the low-side chip 713 and is bent downward to connect to the ground land 724. A notch 743 is formed in the ground clip 742 so that a portion of the high-side chip 712 and the low-side chip 713 is exposed on the top surface side. This ensures a non-overlapping area and allows the high-side chip 712 and the low-side chip 713 to be connected to the signal lines.

The motor current can be detected by dividing the ground clip 742 into phases and detecting the voltage across both ends of the low-side chip 713 and the ground land 724. In other words, in this embodiment, the ground clip 742 also functions as a current detection element. This makes it possible to detect the motor current with a relatively simple configuration.

Eighteenth embodiment
The eighteenth embodiment is shown in Fig. 56. In the driver component 707 of this embodiment, the high-side chip 712 and the low-side chip 713 are not stacked but are laid flat. In this embodiment, the control chip 711, the high-side chip 712, and the low-side chip 713 are arranged in this order from one side.

The lead frame 728 of this embodiment has a control land 721, a power land 722, an output land 729, and a ground land 724, and a low-side chip 713 is disposed on the output land 729. The intermediate clips 715 are provided on the upper side of the high-side chips 712, and one end is bent downward to connect to the output land 729.

In this embodiment, since the high-side chip 712 is disposed between the low-side chip 713 and the control chip 711, it is difficult to directly connect the gate electrode of the low-side chip 713 and the control chip 711. Therefore, in this embodiment, bonding pads are provided on the high-side chip 712, and the gate terminal of the low-side chip 713 and the control chip 711 are connected via the bonding pads of the high-side chip 712. By relaying the high-side chip 712 provided between them, the control chip 711 and the low-side chip 713 can be appropriately connected. In addition, the same effects as the above embodiment are achieved.

In this embodiment, the motor 11 corresponds to the "controlled object," the ECU 15 corresponds to the "control device," the microcomputers 21 to 24 correspond to the "control unit," and the calculation cores 211, 212, 231, and 232 correspond to the "calculation circuit."

Other Embodiments
In the above embodiment, the explanation was given mainly on examples of two to four power supply systems and two to four control systems. In other embodiments, the numbers of power supply ICs, microcomputers, arithmetic cores, pre-driver ICs, driver circuits, motor windings, etc. can be set arbitrarily according to the required redundancy, mounting space, etc. Also, the number of parts may be different, for example, four for fragile parts (for example, microcomputers and driver circuits) and three for others.

In the above embodiment, the electronic components are mainly driver components with built-in pre-driver ICs. In other embodiments, the electronic components may be any components capable of digitally communicating with the microcomputer, and may be, for example, pre-driver ICs or sensors that are provided separately from the driver circuit. In the above embodiment, the electronic components in each system are described as being the same. In other embodiments, the electronic components in each system may have different outputs, precision, etc.

In the above embodiment, the control target of the ECU is a motor. In other embodiments, the control target may be an actuator or other device other than a motor. In the above embodiment, the communication device is applied to an electric power steering device. In other embodiments, the communication device may be applied to an in-vehicle device other than an electric power steering device, or may be applied to a device other than an in-vehicle device.

In the present disclosure, the control device may be described as "the control device according to any one of items 1 to 6, wherein the arithmetic circuit has a lock-step function for monitoring abnormalities by performing the same calculation on multiple cores," and "the control unit has three or more of the arithmetic circuits that perform the same calculation, and controls a control target (11) based on mutual comparison of the calculation results."

The control unit and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit and the method described in the present disclosure may be realized by one or more dedicated computers configured by combining a processor and a memory programmed to execute one or more functions with a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transient tangible recording medium as instructions executed by a computer. As described above, the present invention is not limited to the above embodiment, and can be implemented in various forms within the scope of the invention.

10: Drive device 11: Motor (control target)
15...ECU (control unit)
21 to 24: Microcomputer (control unit)
211, 212, 231, 232...arithmetic core (arithmetic circuit)
213: Power supply control unit 217: Clock control unit 31 to 34: Power supply IC (power source)
41 to 44: Oscillator (clock source)
415: Built-in clock (clock source)

Claims (9)

a control unit (21 to 24) having an arithmetic circuit (211, 212, 231, 232, 261 to 263) for performing control arithmetic;
A power source (31 to 34) that supplies power to the control unit;
A clock source (41 to 44, 415) for supplying a clock for a control operation in the arithmetic circuit;
Equipped with
At least one of the arithmetic circuit, the power supply source, and the clock source has a redundant configuration of three or more;
A control device that, if an abnormality occurs in a location that is made redundant in three or more places, identifies the abnormal location and continues abnormality monitoring and operation using two or more normal locations. The control unit has a clock control unit (217) capable of acquiring clocks from three or more different clock sources and monitoring clock abnormalities;
2. The control device according to claim 1, wherein, when an abnormality occurs in the clock from the clock source used under normal circumstances, the clock control unit switches to a backup clock to continue operation and monitors for abnormalities. The control unit includes a plurality of control units, and the control unit that performs control using the backup clock due to a clock abnormality is a clock abnormality control unit, and the control unit that is normal is a normal control unit.
3. The control device according to claim 2, wherein the normal control section and the clock abnormality control section transmit a clock used for calculation from one to the other, and perform calculations in the calculation circuit in synchronization with the backup clock. The control unit according to any one of claims 1 to 3 has a power supply control unit (213) to which power is input from at least three different power supply sources, and when the power supply source used normally becomes abnormal, the control unit continues to operate the arithmetic circuit using power from a backup power supply source. The control device according to claim 1, which is provided with three or more arithmetic circuits each operating on a different clock source. The control device according to claim 1, which is provided with three or more arithmetic circuits each operating on a different power source. The control device according to claim 1, wherein the arithmetic circuit has a lock-step function that monitors for abnormalities by performing the same calculations on multiple cores. The control device according to claim 1, wherein the control unit has three or more of the arithmetic circuits (261-263) that perform the same calculation, and controls the control target (11) based on the mutual comparison result of the calculation results. The control device according to claim 8, wherein the three or more arithmetic circuits perform the same calculation at different timings, and compare the calculation results using values whose timing has been adjusted so that the same calculation results can be compared.

Images