JP2025096790A5

JP2025096790A5 -

Info

Publication number: JP2025096790A5
Application number: JP2023212705A
Authority: JP
Filing date: 2023-12-18
Publication date: 2026-04-01

Description

第１態様では、電源ソース、および、クロックソースの少なくとも一方は、３以上の冗長構成となっている。３以上に冗長化されている箇所にて異常が生じた場合、異常箇所を特定し、正常である２以上を用いて異常監視および動作を継続する。
第２態様および第３態様では、演算回路、電源ソース、および、クロックソースの少なくとも１つは、３以上の冗長構成となっており、３以上に冗長化されている箇所にて異常が生じた場合、異常箇所を特定し、正常である２以上を用いて異常監視および動作を継続する。
第２態様では、制御部は、３つ以上の異なるクロックソースからのクロックを取得可能であって、クロック異常を監視可能なクロックコントロール部（２１７）を有し、クロックコントロール部は、正常時に用いているクロックソースからのクロックが異常となった場合、バックアップクロックに切り替えて動作を継続し、異常監視を行う。
第３態様では、制御部は、少なくとも３つの異なる電源ソースから電力が入力される電源コントロール部（２１３）を有し、正常時に用いている電源ソースが異常になった場合、バックアップ電源ソースからの電力を用いて演算回路の動作を継続する。
３以上に冗長化することで、一部に異常が生じた場合であっても、２以上の構成が正常であれば、異常監視および制御対象の動作を継続することができる。 In the first embodiment, at least one of the power source and the clock source has a redundant configuration of three or more. If an abnormality occurs in one of the three or more redundant locations, the abnormal location is identified, and abnormality monitoring and operation continue using two or more normal locations.
In the second and third embodiments, at least one of the arithmetic circuit, power source, and clock source has a redundant configuration of three or more units. If an abnormality occurs in one of the three or more redundant units, the abnormal unit is identified, and abnormality monitoring and operation continue using two or more normal units.
In the second embodiment, the control unit has a clock control unit (217) that can acquire clocks from three or more different clock sources and can monitor clock abnormalities. The clock control unit switches to a backup clock and continues operation and monitors for abnormalities when the clock from the clock source used under normal conditions becomes abnormal.
In the third embodiment, the control unit has a power control unit (213) that receives power from at least three different power sources, and if the power source used under normal conditions becomes abnormal, it continues to operate the arithmetic circuit using power from a backup power source.
By implementing redundancy of three or more components, even if a malfunction occurs in one component, if two or more components remain functioning correctly, the operation of the component being monitored and controlled can continue.

そこで、図１５に示すように、同時故障を発生させたくない箇所に系統分離部品としてのアイソレータ２８を設ける。なお、図２等ではアイソレータ２８の記載を省略した。図１５の例では、系統間接続線２５にアイソレータ２８を設けているが、例えばマイコンＭ１、Ｍ２や部品Ｐ１、Ｐ２の内部に設けてもよい。系統間を分離するための構成として、電位差を保持しつつ情報伝達可能であればよく、系統分離部品は、アイソレータに替えて、例えば抵抗等の受動素子やバッファ等を設けてもよい。また、通信を無線通信とすることで、共連れ故障が生じないようにしてもよい。 Therefore, as shown in Figure 15, an isolator 28 is provided as a system isolation component at locations where simultaneous failures are undesirable. Note that the isolator 28 is omitted in Figure 2 and other figures. In the example in Figure 15, the isolator 28 is provided on the inter-system connection line 25, but it may also be provided inside, for example, the microcontrollers M1 and M2 or components P1 and P2. As a configuration for separating systems, it is sufficient to be able to transmit information while maintaining a potential difference, and the system isolation component may be replaced with passive elements such as resistors or buffers instead of isolators. Alternatively, communication may be made wireless to prevent tailgating failures.

次に、電源リレーおよび逆接保護リレーの駆動について説明する。図２４に示すように、本実施形態では、電源リレー５５１～５５４および逆接保護リレー５５６～５５９は、ドライバ回路５１～５４ごとに設けられており、正常時、対応するドライバ回路５１～５４のリレードライバ回路６２１～６２４から、個別の指令を受けて駆動される。図２４では、電源リレーおよび逆接保護リレーを纏めて「電源／逆接リレー」と記載し、マイコン内の演算コアの記載を省略した。また、図２４では、図２３のようにＡグループとＢグループとで系統間接続線を分けているものとして記載したが、図２のように系統間接続線を纏めてもよい。 Next, the operation of the power relays and reverse protection relays will be described. As shown in Figure 24, in this embodiment, power relays 551 to 554 and reverse protection relays 556 to 559 are provided for each driver circuit 51 to 54, and under normal conditions, they are driven by individual commands from the relay driver circuits 621 to 624 of the corresponding driver circuits 51 to 54. In Figure 24, the power relays and reverse protection relays are collectively referred to as "power/reverse relays," and the description of the processing core in the microcontroller has been omitted. Also, in Figure 24, the inter-system connection lines are shown as being separated into Group A and Group B as in Figure 23, but the inter-system connection lines may be combined as in Figure 2.

Claims

A control unit (21-24) having arithmetic circuits (211, 212, 231, 232, 261-263) that perform control calculations,
A power source (31-34) that supplies power to the control unit,
The clock sources (41-44, 415) that supply the clock for the control calculation in the aforementioned arithmetic circuit,
Equipped with,
At least one of the power source and the clock source has a redundant configuration of three or more components.
A control device that, if an abnormality occurs in a section with 3 or more redundant units, identifies the abnormal location and continues monitoring and operation using 2 or more of the normal units.

A control unit (21-24) having arithmetic circuits (211, 212, 231, 232, 261-263) that perform control calculations,
A power source (31-34) that supplies power to the control unit,
The clock sources (41-44, 415) that supply the clock for the control calculation in the aforementioned arithmetic circuit,
Equipped with,
At least one of the arithmetic circuit, the power supply source, and the clock source has a redundant configuration of three or more components.
If an anomaly occurs in a section with 3 or more redundant sections, the anomaly is identified, and the 2 or more functioning sections are used to continue monitoring the anomaly and the operation continues .
The control unit has a clock control unit (217) that can acquire clocks from three or more different clock sources and can monitor clock abnormalities.
The aforementioned clock control unit is a control device that, when the clock from the clock source used under normal conditions becomes abnormal, switches to a backup clock to continue operation and monitors for abnormalities .

If the control units are multiple in number, and the control unit that performs control using the backup clock due to a clock anomaly is designated as the clock anomaly control unit, and the control unit that is functioning normally is designated as the normal control unit,
The control device according to claim 2, wherein the normal control unit and the clock abnormality control unit transmit the clock used for calculations from one to the other, and perform calculations in the calculation circuit in synchronization with the backup clock.

A control unit (21-24) having arithmetic circuits (211, 212, 231, 232, 261-263) that perform control calculations,
A power source (31-34) that supplies power to the control unit,
The clock sources (41-44, 415) that supply the clock for the control calculation in the aforementioned arithmetic circuit,
Equipped with,
At least one of the arithmetic circuit, the power supply source, and the clock source has a redundant configuration of three or more components.
If an anomaly occurs in a section with 3 or more redundant sections, the anomaly is identified, and the 2 or more functioning sections are used to continue monitoring the anomaly and the operation continues .
The control unit has a power control unit (213) to which power is input from at least three different power sources, and is a control device that, if the power source used under normal conditions becomes abnormal, continues the operation of the calculation circuit using power from a backup power source .

The control device according to claim 1, wherein three or more arithmetic circuits are provided, each operating on a different clock source.

The control device according to claim 1, wherein three or more arithmetic circuits are provided, each operating on a different power source.

The control device according to claim 1 , 2, or 4 , wherein the arithmetic circuit has a lockstep function that monitors for abnormalities by performing the same calculation with multiple cores.

The control device according to claim 1 , 2, or 4 , wherein the control unit has three or more calculation circuits (261 to 263) that perform the same calculation, and controls the control target (11) based on the results of a comparison of the calculation results.

The control device according to claim 8, wherein three or more calculation circuits perform the same calculation at different timings and compare the calculation results using values whose timings have been adjusted so that the same calculation results can be compared.