Driving circuit, control device, and protection method for driving circuit

A driving circuit according to an embodiment includes a driving unit, a first temperature detecting unit, an overheat protecting unit, a second temperature detecting unit, and a failure diagnosing unit. The driving unit supplies a driving current to a load based on a control signal input from a controller. The overheat protecting unit blocks supply of the driving current to the load when the level of the signal output from the first temperature detecting unit exceeds a temperature threshold. The failure diagnosing unit blocks supply of the driving current to the load and outputs a signal of a level corresponding to a temperature out of a temperature range detectable by the second temperature detecting unit to the controller when it is determined that the first temperature detecting unit breaks down.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2016-179946, filed on Sep. 14, 2016, the entire contents of which are incorporated herein by reference.

FIELD

The embodiment discussed herein is directed to a driving circuit, a control device, and a protection method for the driving circuit.

BACKGROUND

There is known a conventional control device that includes: a controller that outputs a control signal for controlling the drive of a load; and a driving circuit that supplies a driving current from a power source to the load to drive the load on the basis of the control signal from the controller.

When an abnormal large current flows into its inside from any cause, the driving circuit may enter an overheated state to be destroyed. For this reason, there is a control device that includes: a temperature detecting unit that detects a temperature near the driving circuit; and a controller that monitors the temperature detected by the temperature detecting unit and blocks the supply of a driving current to the load when it is determined that the driving circuit enters an overheated state (for example, see Japanese Laid-open Patent Publication No. 2009-284576).

In addition to the configuration that the controller determines an overheated state, there is a control device that has a configuration that the driving circuit itself determines an overheated state and blocks the supply of a driving current to a load so as to beforehand prevent the burnout destruction of the driving circuit more surely.

The driving circuit of the control device includes a temperature detecting unit that outputs the detected temperature to an overheat determining unit in the driving circuit, separately from the temperature detecting unit that outputs the detected temperature to the controller. When the overheat determining unit determines that the temperature is not less than a temperature threshold, the driving circuit blocks the supply of a driving current to the load.

As a result, when the control device cannot prevent the burnout destruction of the driving circuit by requiring time in an overheated state determination process performed by the controller due to the instant rising of the temperature of the driving circuit, the driving circuit can immediately block the supply of a driving current to the load.

However, the temperature detecting unit in the driving circuit may break down. In this case, because the controller cannot determine the presence or absence of a failure of the temperature detecting unit in the driving circuit, the control device cannot prevent the burnout destruction of the driving circuit in that an overheated state determination process performed by the controller causes delay when the temperature of the driving circuit instantly rises as described above.

SUMMARY

A driving circuit according to an embodiment includes a driving unit, a first temperature detecting unit, an overheat protecting unit, a second temperature detecting unit, and a failure diagnosing unit. The driving unit supplies a driving current to a load based on a control signal input from a controller. The first temperature detecting unit outputs a signal according to a detected temperature. The overheat protecting unit blocks supply of the driving current to the load when the level of the signal output from the first temperature detecting unit exceeds a temperature threshold. The second temperature detecting unit outputs a signal according to a detected temperature to the controller. The failure diagnosing unit blocks supply of the driving current to the load and outputs a signal of a level corresponding to a temperature out of a temperature range detectable by the second temperature detecting unit to the controller when it is determined that the first temperature detecting unit breaks down.

DESCRIPTION OF EMBODIMENTS

Hereinafter, a driving circuit, a control device, and a protection method for the driving circuit according to an embodiment will be explained in detail with reference to the accompanying drawings. Moreover, this invention is not limited to the embodiment described below.FIG. 1is a diagram explaining the configuration of a control device1according to the embodiment.

As illustrated inFIG. 1, the control device1according to the embodiment is a device that is connected between a load L and a power source line BAT connected to a power source and performs supply control of a driving current to the load L from the power source line BAT. For example, the control device1is an electronic control unit (ECU) that is mounted on a vehicle.

Herein, the load L is, for example, a solenoid that drives CVT (continuously variable transmission) of the vehicle. However, the load L to which the control device1according to the embodiment supplies a driving current is not limited to the solenoid that drives CVT. Therefore, the load L may be an arbitrary electronics device, such as a headlight or a starter motor of a vehicle, which requires a large current for its actuation.

As described above, because the control device1supplies a large driving current to the load L, an abnormal large current flows into a driving circuit3in the control device1to cause an overheated state and thus the driving circuit3may be destroyed when a harness for connecting the load L and the driving circuit3causes a ground fault from any cause, for example. Moreover, because the control device1drives CVT etc. deeply related to safe traveling of the vehicle, it is required to beforehand prevent the generation of burnout destruction due to an abnormal large current.

For this reason, the control device1detects an internal temperature, and when the detected temperature is not less than a temperature threshold, improves running safety of a vehicle by including two fail-safe systems for blocking the supply of a driving current to the load L.

Furthermore, when one system of two fail-safe systems breaks down, the control device1has a function that specifies and stores the generated failure and outputs that effect to the outside so as to improve the running safety and maintenance of a vehicle.

Specifically, the control device1includes a controller2and the driving circuit3. The controller2includes a microcomputer and various types of circuits having a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), an input-output port, and the like, for example.

The controller2includes a plurality of processing units that functions by causing the CPU to execute a drive control program stored in the ROM by using the RAM as a working area. Specifically, the controller2includes a control signal generating unit21, a failure specifying unit22, and an output unit24. Furthermore, the controller2includes a storage23.

A part or the whole of the processing units included in the controller2may be configured by hardware such as an application specific integrated circuit (ASIC) and a field programmable gate array (FPGA).

The control signal generating unit21is a processing unit that generates a control signal for causing the driving circuit3to supply a driving current from the power source line BAT to the load L and outputs the control signal to the driving circuit3. When the driving current is supplied from the power source line BAT to the load L, the control signal generating unit21outputs a control signal, whose voltage level (hereinafter, simply referred to as “level”) is a HIGH (hereinafter, referred to as “Hi”) level, for example, to the driving circuit3.

When the supply of the driving current to the load L from the power source line BAT is blocked, the control signal generating unit21outputs a control signal whose level is a LOW (hereinafter, referred to as “Lo”) level to the driving circuit3.

The failure specifying unit22determines whether the driving circuit3reaches an overheated state on the basis of the level of the signal from the driving circuit3. Specifically, the failure specifying unit22receives, from the driving circuit3, a signal indicating that a level rises in accordance with the temperature rise of the driving circuit3when the driving circuit3does not break down.

Then, the failure specifying unit22samples the level of the signal received from the driving circuit3, and determines that the driving circuit3reaches the overheated state when the sampled result is not less than a temperature threshold. On the other hand, when the sampled result is less than the temperature threshold, the failure specifying unit22determines that the driving circuit3does not reach the overheated state.

At this time, the failure specifying unit22samples the level of the received signal multiple times and determines whether the driving circuit3reaches an overheated state so as to prevent the false determination of an overheated state caused by noise etc. Then, when it is determined that the driving circuit3reaches the overheated state, the failure specifying unit22outputs a signal indicating that effect to the control signal generating unit21.

When the signal indicating that the driving circuit3reaches the overheated state is input from the failure specifying unit22, the control signal generating unit21outputs a Lo-level control signal to the driving circuit3to block the supply of the driving current to the load L from the power source line BAT.

A system in which the failure specifying unit22determines the overheated state of the driving circuit3to block the supply of the driving current to the load L from the power source line BAT is a first fail-safe system. A second fail-safe system is a system in which the driving circuit3determines its overheated state to block the supply of the driving current to the load L from the power source line BAT. The second fail-safe system will be described below together with the explanation of the driving circuit3.

When the second fail-safe system breaks down, the failure specifying unit22receives from the driving circuit3a signal of a level corresponding to a temperature out of a detectable temperature range inside the driving circuit3. As a result, the failure specifying unit22can specify the failure of the second fail-safe system inside the driving circuit3.

When the failure of the second fail-safe system is specified, the failure specifying unit22outputs a signal indicating that effect to the control signal generating unit21. When the signal indicating that the failure of the second fail-safe system is specified is input from the failure specifying unit22, the control signal generating unit21blocks the supply of the driving current to the load L from the power source line BAT.

The failure specifying unit22outputs to the storage23information indicating that the second fail-safe system breaks down and causes the storage23to store the information. The storage23is a semiconductor memory device such as a random access memory (RAM) and a flash memory or a storage device such as a hard disk drive (HDD) and an optical disc, for example, and stores therein information input from the failure specifying unit22.

The output unit24is a processing unit that reads out the stored information from the storage23and outputs the information to the outside. When a predetermined testing device (not illustrated) is connected thereto, for example, the output unit24outputs to the testing device the information stored in the storage23indicating that the second fail-safe system breaks down. Moreover, when the information indicating that the second fail-safe system breaks down is stored in the storage23, the output unit24can output a signal indicating that effect to an install panel, for example, to cause a warning light to flash.

As described above, the controller2can monitor the overheated state of the driving circuit3on the basis of the signal input from the driving circuit3, and block the supply of the driving current to the load L from the power source line BAT when reaching the overheated state, so as to prevent the burnout destruction of the driving circuit3.

When it is specified that the second fail-safe system breaks down on the basis of the signal input from the driving circuit3, the controller2can immediately block the supply of the driving current to the load L from the power source line BAT. As a result, when the driving circuit3reaches an overheated state, the control device1can prevent the burnout destruction of the driving circuit3even if a determination for an overheated state requires a time in the first fail-safe system.

The driving circuit3includes a driving unit4, a first temperature detecting unit5, an overheat protecting unit6, a failure-for-overheat diagnosing unit7, and a second temperature detecting unit8. The driving unit4causes the power source line BAT to supply a driving current to the load L so as to drive the load L on the basis of the control signal input from the controller2. The driving unit4includes an AND circuit41and an N-channel MOS (Metal Oxide Semiconductor) field effect transistor (hereinafter, referred to as “nMOS”)42.

When the levels of the control signal input from the controller2and the signal input from the overheat protecting unit6are a Hi level together, the AND circuit41applies a Hi-level voltage to a gate of the nMOS42. On the other hand, when both or one of the level of the control signal input from the controller2and the level of the signal input from the overheat protecting unit6are/is a Lo level, the AND circuit41applies a Lo-level voltage to the nMOS42.

When a Hi-level voltage is applied to the gate from the AND circuit41, the nMOS42is turned ON to supply a driving current from the power source line BAT to the load L. Moreover, when a Lo-level voltage is applied to the gate from the AND circuit41, the nMOS42is turned OFF to block the supply of the driving current to the load L from the power source line BAT.

The first temperature detecting unit5is a temperature sensor that detects a temperature of the driving circuit3. The first temperature detecting unit5outputs a signal of a level according to the detected temperature to the overheat protecting unit6and the failure-for-overheat diagnosing unit7.

The first temperature detecting unit5has a detectable temperature range. The first temperature detecting unit5outputs, for example, a signal having a level of 2V when detecting a temperature of a lower limit (for example, 40 degrees Celsius) of the detectable temperature range, and outputs, for example, a signal having a level of 4V when detecting a temperature of an upper limit (for example, 150 degrees Celsius) of the detectable temperature range.

In other words, in a state where any does not break down, the first temperature detecting unit5outputs a signal of a level according to a detected temperature between levels of 2V to 4V to an overheat determining unit61and the failure-for-overheat diagnosing unit7. For example, when a short-circuit failure of the internal circuit and semiconductor device occurs or when an open failure of wiring between elements occurs, the first temperature detecting unit5outputs a signal of a level (0V) lower than a level corresponding to a lower limit of a detectable temperature to the overheat determining unit61and the failure-for-overheat diagnosing unit7.

When the level of the signal output from the first temperature detecting unit5is not less than the temperature threshold, the overheat protecting unit6determines that the driving circuit3reaches an overheated state and causes the driving unit4to block the supply of the driving current to the load L. The overheat protecting unit6includes the overheat determining unit61and an AND circuit62.

When the level of the signal input from the first temperature detecting unit5is less than the temperature threshold, the overheat determining unit61determines that the driving circuit3does not reach an overheated state but is in a normal temperature condition, and outputs a Hi-level signal to the AND circuit62.

When the level of the signal input from the first temperature detecting unit5is not less than the temperature threshold, the overheat determining unit61determines that the driving circuit3is in the overheated state, and outputs a Lo-level signal to the AND circuit62. Moreover, an example of a circuit configuration of the overheat determining unit61will be described below with reference toFIG. 2.

When the levels of the signal input from the overheat determining unit61and the signal input from the failure-for-overheat diagnosing unit7are the Hi level together, the AND circuit62of the overheat protecting unit6outputs the Hi-level signal to the AND circuit41of the driving unit4.

When both or one of the level of the signal input from the overheat determining unit61and the level of the signal input from the failure-for-overheat diagnosing unit7are/is the Lo level, the AND circuit62of the overheat protecting unit6outputs the Lo-level signal to the AND circuit41of the driving unit4.

When a signal of a level corresponding to a temperature within the temperature range detectable by the first temperature detecting unit5is output from the first temperature detecting unit5, the failure-for-overheat diagnosing unit7determines that the first temperature detecting unit5does not break down. Moreover, when a signal of a level lower than a level corresponding to the lower limit of the temperature detectable by the first temperature detecting unit5is output from the first temperature detecting unit5, the failure-for-overheat diagnosing unit7determines that the first temperature detecting unit5breaks down.

Then, when it is determined that the first temperature detecting unit5breaks down, the failure-for-overheat diagnosing unit7causes the driving unit4to black the supply of the driving current to the load L, and causes the second temperature detecting unit8to output a signal of a level corresponding to a temperature out of the temperature range detectable by the second temperature detecting unit8to the controller2.

When it is determined that the first temperature detecting unit5does not break down, the failure-for-overheat diagnosing unit7outputs the Hi-level signal to the AND circuit62of the overheat protecting unit6and a NOT circuit82(to be described later) of the second temperature detecting unit8.

When it is determined that the first temperature detecting unit5breaks down, the failure-for-overheat diagnosing unit7outputs the Lo-level signal to the AND circuit62of the overheat protecting unit6and the NOT circuit82(to be described later) of the second temperature detecting unit8.

Herein, an example of a circuit configuration of the overheat protecting unit6and the failure-for-overheat diagnosing unit7will be explained with reference toFIG. 2.FIG. 2is a diagram explaining an example of a circuit configuration of the overheat protecting unit6and the failure-for-overheat diagnosing unit7according to the embodiment.

Among the components of the control device1, the overheat protecting unit6and the failure-for-overheat diagnosing unit7and some components associated with operations of the overheat protecting unit6and the failure-for-overheat diagnosing unit7are illustrated inFIG. 2. Herein, in order to avoid duplication of explanation, the same reference numbers as those illustrated inFIG. 1are assigned to components other than the overheat protecting unit6and the failure-for-overheat diagnosing unit7, and their descriptions are omitted.

As illustrated inFIG. 2, the overheat protecting unit6includes the overheat determining unit61and the AND circuit62. The overheat determining unit61includes a comparator63and a threshold power source Vth. A signal of a level corresponding to the temperature threshold is input into a positive input of the comparator63from the threshold power source Vth, and a signal of a level corresponding to the temperature detected from the first temperature detecting unit5is input into its negative input.

Then, when the level of the signal input from the first temperature detecting unit5is lower than the level (for example, 3.5V) of the signal input from the threshold power source Vth, the comparator63outputs the Hi-level signal to the AND circuit62.

On the other hand, when the level of the signal input from the first temperature detecting unit5is not less than the level (for example, 3.5V) of the signal input from the threshold power source Vth, the comparator63outputs the Lo-level signal to the AND circuit62.

The AND circuit62receives signals from the overheat determining unit61and the failure-for-overheat diagnosing unit7. The failure-for-overheat diagnosing unit7outputs a Hi-level signal when the first temperature detecting unit5does not break down and outputs a Lo-level signal when it breaks down, to the AND circuit62of the overheat protecting unit6. Then, when Hi-level signals are input from both of the overheat determining unit61and the failure-for-overheat diagnosing unit7, the AND circuit62outputs the Hi-level signal to the AND circuit41of the driving unit4.

At this time, when a Hi-level control signal is input from the control signal generating unit21, the AND circuit41of the driving unit4applies a Hi-level voltage to the gate of the nMOS42to continue the supply of the driving current to the load L. In other words, when the first temperature detecting unit5does not break down and a temperature less than the temperature threshold is detected by the first temperature detecting unit5, the driving circuit3continues the supply of the driving current to the load L.

When the Lo-level signal is input from the overheat determining unit61or when the Lo-level signal is input from the failure-for-overheat diagnosing unit7, the AND circuit62of the overheat protecting unit6outputs the Lo-level signal to the AND circuit41of the driving unit4.

At this time, the AND circuit41of the driving unit4applies the Lo-level voltage to the gate of the nMOS42to block the supply of the driving current to the load L. Moreover, when the Lo-level signal is input from the control signal generating unit21, the AND circuit41applies the Lo-level voltage to the gate of the nMOS42to block the supply of the driving current to the load L.

In other words, when the first temperature detecting unit5breaks down, when a temperature not less than the temperature threshold is detected by the first temperature detecting unit5, or when there is an instruction for stopping the drive of the load L from the driving unit4, the driving circuit3blocks the supply of the driving current to the load L.

The failure-for-overheat diagnosing unit7includes a first P-channel MOS (Metal Oxide Semiconductor) field effect transistor (hereinafter, referred to as “pMOS”)71and a first nMOS72, which are serially connected between a predetermined reference voltage line Vcc and a ground. Moreover, the failure-for-overheat diagnosing unit7includes a second pMOS73and a first resistor74that are serially connected between the reference voltage line Vcc and the ground.

The failure-for-overheat diagnosing unit7includes a second resistor75and a second nMOS76that are serially connected between the reference voltage line Vcc and the ground, and includes a NOT circuit77whose input side is connected to a connection point of the second resistor75and the second nMOS76.

The source of the first pMOS71is connected to the reference voltage line Vcc and its gate is connected to the gate of the second pMOS73and the drain of the first pMOS71. The source of the first nMOS72is connected to the ground and its drain is connected to the drain of the first pMOS71.

The source of the second pMOS73is connected to the reference voltage line Vcc and its drain is connected to the gate of the second nMOS76and one end of the first resistor74. The other end of the first resistor74is connected to the ground.

One end of the second resistor75is connected to the reference voltage line Vcc and the other end is connected to the drain of the second nMOS76and the input of the NOT circuit77. The output of the NOT circuit77is connected to the second temperature detecting unit8and the input of the AND circuit62of the overheat protecting unit6. The source of the second nMOS76is connected to the ground.

In the failure-for-overheat diagnosing unit7, a voltage according to the temperature detected from the first temperature detecting unit5is applied to the gate of the first nMOS72to turn ON the first nMOS72when the first temperature detecting unit5does not break down. Along with this, the first pMOS71and the second pMOS73are turned ON, and the Hi-level voltage is applied to the gate of the second nMOS76from the reference voltage line Vcc to turn ON the second nMOS76.

As a result, because the Lo-level signal is input into the NOT circuit77, the Hi-level signal is output from the NOT circuit77. As described above, when the first temperature detecting unit5does not break down, the failure-for-overheat diagnosing unit7outputs the Hi-level signal to the AND circuit62of the overheat protecting unit6and the second temperature detecting unit8.

In the failure-for-overheat diagnosing unit7, a voltage corresponding to a temperature out of the temperature range detectable by the first temperature detecting unit5may be applied to the gate of the first nMOS72when the first temperature detecting unit5breaks down. For example, when a short-circuit failure of a circuit and a semiconductor device inside the first temperature detecting unit5occurs or when an open failure of wiring between elements occurs, the first temperature detecting unit5may output the voltage of 0V.

In this case, because the level of the signal input from the first temperature detecting unit5is less than the level (for example, 3.5V) of the signal input from the threshold power source Vth, the overheat protecting unit6continues to output a Hi-level signal indicative of a normal temperature condition even if the driving circuit3reaches an overheated state. As a result, the driving circuit3may be destroyed in some cases.

Therefore, when the first temperature detecting unit5breaks down, the failure-for-overheat diagnosing unit7detects the failure of the first temperature detecting unit5and outputs the Lo-level signal. Specifically, in the failure-for-overheat diagnosing unit7, because the voltage of 0V is applied to the gate of the first nMOS72from the first temperature detecting unit5when the first temperature detecting unit5has the above failure, the first nMOS72, the first pMOS71, and the second pMOS73are turned OFF.

Along with this, because the second nMOS76is turned OFF, the Hi-level signal is input into the NOT circuit77and the Lo-level signal is output from the NOT circuit77. As a result, when the first temperature detecting unit5breaks down, the failure-for-overheat diagnosing unit7can output the Lo-level signal to the AND circuit62of the overheat protecting unit6and the second temperature detecting unit8to block the supply of the driving current to the load L.

The configuration of the failure-for-overheat diagnosing unit7illustrated inFIG. 2is an example. If the failure-for-overheat diagnosing unit7has a configuration that can diagnose the failure of the first temperature detecting unit5, the failure-for-overheat diagnosing unit7can employ an arbitrary circuit. For example, the failure-for-overheat diagnosing unit7may be a comparator that compares a predetermined threshold voltage with the output of the first temperature detecting unit5.

In case of this configuration, the comparator sets, as a threshold voltage, a voltage corresponding to a lower limit of a temperature detectable by the first temperature detecting unit5, and outputs a Lo-level signal when the level of the signal input from the first temperature detecting unit5is less than the threshold voltage and outputs a Hi-level signal when the level of the signal is not less than the threshold voltage.

Again with reference toFIG. 1, the second temperature detecting unit8includes a temperature sensor81, the NOT circuit82, and an nMOS83. The temperature sensor81is a sensor that detects a temperature of the driving circuit3. The temperature sensor81outputs a signal of a level according to the detected temperature to the failure specifying unit22of the controller2.

The temperature sensor81has a detectable temperature range. The temperature sensor81outputs a signal having a level of 2V, for example, when detecting a temperature of a lower limit (for example, 40 degrees Celsius) of the detectable temperature range, and outputs a signal having a level of 4V, for example, when detecting a temperature of an upper limit (for example, 150 degrees Celsius) of the detectable temperature range. In other words, the temperature sensor81outputs a signal of a level according to a detected temperature between levels of 2V to 4V in a state where any does not break down.

The input of the NOT circuit82is connected to the output of the failure-for-overheat diagnosing unit7, and its output is connected to the gate of the nMOS83of the second temperature detecting unit8. The source of the nMOS83of the second temperature detecting unit8is connected to the ground, and its drain is connected to the output of the temperature sensor81.

In the second temperature detecting unit8, when the Hi-level signal is input into the NOT circuit82from the failure-for-overheat diagnosing unit7, namely when the first temperature detecting unit5does not break down, the NOT circuit82applies the Lo-level voltage to the gate of the nMOS83to turn OFF the nMOS83. As a result, the second temperature detecting unit8outputs a signal of a level according to the temperature detected by the temperature sensor81to the failure specifying unit22of the controller2.

At this time, because a signal of a level corresponding to a temperature within the temperature range detectable by the temperature sensor81is input from the second temperature detecting unit8, the failure specifying unit22can monitor a temperature condition of the driving circuit3on the basis of the input signal.

Then, when the driving circuit3reaches an overheated state, the failure specifying unit22can output a signal indicating that effect to the control signal generating unit21to block the supply of the driving current to the load L. Therefore, the control device1can prevent the burnout destruction caused by the overheated state of the driving circuit3.

In the second temperature detecting unit8, when the Lo-level signal is input into the NOT circuit82from the failure-for-overheat diagnosing unit7, namely when the first temperature detecting unit5breaks down, the NOT circuit82applies the Hi-level voltage to the gate of the nMOS83to turn ON the nMOS83.

As a result, because the output of the temperature sensor81is connected to the ground, the second temperature detecting unit8outputs the signal of the level (herein, 0V) lower than a level corresponding to the lower limit of the temperature range detectable by the temperature sensor81to the failure specifying unit22of the controller2.

At this time, because a signal of a level lower than the level corresponding to the lower limit of the temperature range detectable by the temperature sensor81is input from the second temperature detecting unit8, the failure specifying unit22can specify that the failure of the driving circuit3is the failure of the first temperature detecting unit5.

Then, when it is specified that the first temperature detecting unit5breaks down, the failure specifying unit22can output a signal indicating that effect to the control signal generating unit21to block the supply of the driving current to the load L. Therefore, the control device1can prevent the burnout destruction caused by the overheated state of the driving circuit3.

As described above, when the first temperature detecting unit5breaks down, the driving circuit3included in the control device1outputs a signal of a low level (for example, 0V) that does not exist in a normal term (term in which the first temperature detecting unit5does not break down) to the controller2as diagnosis output. As a result, the driving circuit3can inform the controller2that the first temperature detecting unit5breaks down.

Therefore, even if the second fail-safe system in which the driving circuit3itself performs overheat protection is in a state where the system does not function, the control device1can specify the generation of the state by using the controller2, immediately block the provision of a driving current to the load L, and thus prevent the burnout destruction of the driving circuit3.

The driving circuit3shares an output terminal, which outputs the detection result of a temperature performed by the temperature sensor81, as an output terminal of diagnosis output indicating that the first temperature detecting unit5breaks down. As a result, the control device1can suppress the increase of the number of output terminals of the driving circuit3and the number of input terminals of the controller2.

According to the present embodiment, the driving circuit3can inform the controller2that the first temperature detecting unit5breaks down, and the controller2can specify the failure of the first temperature detecting unit5, without largely changing a design of software and hardware.

Next, operations in each state of the control device1will be explained with reference toFIG. 1andFIG. 3.FIG. 3is a diagram explaining operating states in each state of the control device1according to the embodiment.

As illustrated inFIG. 3, when the first temperature detecting unit5does not have a failure and the driving circuit3is not in an overheated state but has a normal temperature, the level of the output of the first temperature detecting unit5becomes a level according to a detected temperature. In this case, because the level of the output of the overheat determining unit61becomes Hi and the level of the output of the failure-for-overheat diagnosing unit7becomes Hi, the level of the output of the overheat protecting unit6becomes Hi. As a result, the driving unit4can continue to supply the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8becomes a level according to a detected temperature. As a result, the controller2can monitor a temperature condition of the driving circuit3on the basis of the level of the output of the second temperature detecting unit8.

When the first temperature detecting unit5does not have a failure and the driving circuit3is in an overheated state, the level of the output of the first temperature detecting unit5becomes a level according to a detected temperature. In this case, because the level of the output of the overheat determining unit61becomes Lo and the level of the output of the failure-for-overheat diagnosing unit7becomes Hi, the level of the output of the overheat protecting unit6becomes Lo. As a result, the driving unit4can block the supply of the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8becomes a level according to a detected temperature. As a result, the controller2can monitor a temperature condition of the driving circuit3on the basis of the level of the output of the second temperature detecting unit8.

When the first temperature detecting unit5has a failure and the driving circuit3has a normal temperature, the level of the output of the first temperature detecting unit5becomes a level corresponding to a temperature lower than the lower limit of the detectable temperature. In this case, because the level of the output of the overheat determining unit61becomes Hi and the level of the output of the failure-for-overheat diagnosing-unit7becomes Lo, the level of the output of the overheat protecting unit6becomes Lo. As a result, the driving unit4can block the supply of the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8becomes a level corresponding to a temperature lower than the lower limit of the detectable temperature. As a result, the driving circuit3can inform the controller2that the first temperature detecting unit5breaks down.

When the first temperature detecting unit5has a failure and the driving circuit3is in an overheated state, the level of the output of the first temperature detecting unit5becomes a level corresponding to a temperature lower than the lower limit of the detectable temperature. In this case, because the level of the output of the overheat determining unit61becomes Hi and the level of the output of the failure-for-overheat diagnosing unit7becomes Lo, the level of the output of the overheat protecting unit6becomes Lo. As a result, the driving unit4can block the supply of the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8becomes a level corresponding to a temperature lower than the lower limit of the detectable temperature. As a result, the driving circuit3can inform the controller2that the first temperature detecting unit5breaks down.

Next, a process that is executed by the driving circuit3will be explained with reference toFIG. 4.FIG. 4is a flowchart illustrating a process that is executed by the driving circuit3according to the embodiment. The driving circuit3repeatedly performs the process illustrated inFIG. 4while a power source is supplied to the control device1.

Specifically, as illustrated inFIG. 4, the driving circuit3determines whether a control signal input from the controller2is a Hi level (Step S101). Then, when it is determined that the control signal is not a Hi level (Step S101: No), the driving circuit3blocks the supply of a driving current to the load L (Step S108) and terminates the process.

On the other hand, when it is determined that the control signal is a Hi level (Step S101: Yes), the driving circuit3performs temperature detection by the first temperature detecting unit5and the second temperature detecting unit8(Step S102). Next, the driving circuit3performs determination of whether a detected temperature of the first temperature detecting unit5is less than a temperature threshold (Step S103).

Then, when it is determined that the detected temperature of the first temperature detecting unit5is not less than the temperature threshold (Step S103: No), the driving circuit3blocks the supply of a driving current to the load L (Step S108) and terminates the process.

On the other hand, when it is determined that the detected temperature of the first temperature detecting unit5is less than the temperature threshold (Step S103: Yes), the driving circuit3determines whether the first temperature detecting unit5breaks down (Step S104).

Then, when it is determined that the first temperature detecting unit5does not break down (Step S104: No), the driving circuit3causes the second temperature detecting unit8to output a signal of a level according to the detected temperature to the controller2(Step S105). Furthermore, the driving circuit3performs the supply of a driving current to the load L (Step S106) and terminates the process.

On the other hand, when it is determined that the first temperature detecting unit5breaks down (Step S104: Yes), the driving circuit3causes the second temperature detecting unit8to output a signal of the minimum (MIN) level to be able to be output to the controller2as a failure signal (Step S107). Furthermore, the driving circuit3blocks the supply of a driving current to the load L (Step S108) and terminates the process.

Next, a control device1aaccording to an alternative example of the embodiment will be explained with reference toFIG. 5.FIG. 5is a diagram explaining the configuration of the control device1aaccording to an alternative example of the embodiment. The control device1aincludes a third fail-safe system in addition to the first fail-safe system and the second fail-safe system as described above.

The third fail-safe system is a system that determines an overcurrent state of a driving circuit3aof the control device1ato block the supply of a driving current to the load L from the power source line BAT. The driving circuit3aof the control device1ais different from the driving circuit3included in the control device1illustrated inFIG. 1in that a configuration for performing a protection on an abnormal large current flowing into the driving circuit3ais further employed.

The configuration for performing overheat protection included in the driving circuit3aillustrated inFIG. 5is the same configuration as the configuration for performing overheat protection included in the driving circuit3illustrated inFIG. 1. For this reason, the same reference numbers as those illustrated inFIG. 1are assigned to components related to overheat protection, and their descriptions are omitted.

As illustrated inFIG. 5, the control device1afurther includes a current detecting unit10, a failure-for-overcurrent diagnosing unit11, and an overcurrent protecting unit9in addition to the configuration included in the control device1illustrated inFIG. 1. Moreover, an AND circuit41aincluded in a driving unit4aof the driving circuit3areceives signals from the overcurrent protecting unit9as well as the control signal generating unit21and the overheat protecting unit6.

Only when all the levels of three signals to be input are Hi, the AND circuit41aoutputs a Hi-level signal to the nMOS42of the driving unit4a. On the other hand, even when one of the three signals to be input is Lo, the AND circuit41aoutputs a Lo-level signal to the nMOS42of the driving unit4a. Herein, it is assumed that Hi-level signals are input into the AND circuit41afrom the control signal generating unit21and the overheat protecting unit6.

A second temperature detecting unit8aincluded in the driving circuit3afurther includes a pMOS84in addition to the configuration of the second temperature detecting unit8illustrated inFIG. 1. The source of the pMOS84is connected to the reference voltage line Vcc, its drain is connected to the output of the temperature sensor81, and its-gate is connected to the output of the failure-for-overcurrent diagnosing unit11. Moreover, the level of the reference voltage line Vcc is a level higher than a level corresponding to the upper limit of the temperature range detectable by the temperature sensor81.

The current detecting unit10includes a detection resistor12and a current-detection nMOS13. The current-detection nMOS13has, for example, a gate area corresponding to around 1/1000 of the gate area of the nMOS42of the driving unit4a, and lets a current flow, whose size is around 1/1000 of a driving current that the driving circuit3asupplies to the load L, when being turned ON.

One end of the detection resistor12is connected to the power source line BAT and the overcurrent protecting unit9, and the other end is connected to the drain of the current-detection nMOS13, the failure-for-overcurrent diagnosing unit11, and the overcurrent protecting unit9. The source of the current-detection nMOS13is connected to the source of the nMOS42of the driving unit4a, and its gate is connected to the output of the AND circuit41aof the driving unit4a.

The current detecting unit10generates a current of about 1/1000 of the driving current that the driving circuit3asupplies to the load L, generates a signal of a level according to the detected current by the detection resistor12from the generated current, and outputs the signal to the failure-for-overcurrent diagnosing unit11and the overcurrent protecting unit9.

The current detecting unit10has a detectable current range. The current detecting unit10outputs a signal having a level of 2V, for example, when detecting a current of the lower limit of the detectable current range, and outputs a signal having a level of 4V, for example, when detecting a current of the upper limit of the detectable current range.

In other words, the current detecting unit10outputs, in a state where any does not break down, a signal of a level according to a detected current between levels of 2V to 4V to an overcurrent determining unit91and the failure-for-overcurrent diagnosing unit11. Moreover, when the detection resistor12has a short-circuit failure, for example, the current detecting unit10outputs a signal of a level (0V) lower than a level corresponding to the lower limit of the detectable current to the overcurrent determining unit91and the failure-for-overcurrent diagnosing unit11.

When the level of the signal output from the current detecting unit10becomes not less than a current threshold, the overcurrent protecting unit9determines that the driving circuit3ais in an overcurrent state and causes the driving unit4ato block the supply of the driving current to the load L. The overcurrent protecting unit9includes the overcurrent determining unit91and an AND circuit92.

When the level of the signal input from the current detecting unit10is less than the current threshold, the overcurrent determining unit91determines that the driving circuit3ais not in an overcurrent state but has a normal current, and outputs a Hi-level signal to the AND circuit92. On the other hand, when the level of the signal input from the current detecting unit10is not less than the current threshold, the overcurrent determining unit91determines that the driving circuit3ais in an overcurrent state and outputs a Lo-level signal to the AND circuit92.

When the levels of the signal input from the overcurrent determining unit91and the signal input from the failure-for-overcurrent diagnosing unit11are a Hi level together, the AND circuit92of the overcurrent protecting unit9outputs a Hi-level signal to the AND circuit41aof the driving unit4a.

When both or one of the level of the signal input from the overcurrent determining unit91and the level of the signal input from the failure-for-overcurrent diagnosing unit11are/is the Lo level, the AND circuit92of the overcurrent protecting unit9outputs the Lo-level signal to the AND circuit41aof the driving unit4a.

When the signal of the level corresponding to the current within the current range detectable by the current detecting unit10is output from the current detecting unit10, the failure-for-overcurrent diagnosing unit11determines that the current detecting unit10does not break down. Moreover, when a signal of a level lower than a level corresponding to a lower limit of a current detectable by the current detecting unit10is output from the current detecting unit10, the failure-for-overcurrent diagnosing unit11determines that the current detecting unit10breaks down.

Then, when it is determined that the current detecting unit10breaks down, the failure-for-overcurrent diagnosing unit11causes the driving unit4ato block the supply of the driving current to the load L, and causes the second temperature detecting unit8ato output a signal of a level corresponding to a temperature out of the temperature range detectable by the second temperature detecting unit8ato the controller2.

When it is determined that the current detecting unit10does not break down, the failure-for-overcurrent diagnosing unit11outputs the Hi-level signal to the AND circuit92of the overcurrent protecting unit9and the pMOS84of the second temperature detecting unit8a.

On the other hand, when it is determined that the current detecting unit10breaks down, the failure-for-overcurrent diagnosing unit11outputs the Lo-level signal to the AND circuit92of the overcurrent protecting unit9and the pMOS84of the second temperature detecting unit8a. The failure-for-overcurrent diagnosing unit11can be constituted by the same circuit and comparator as those of the failure-for-overheat diagnosing unit7illustrated inFIG. 2, for example.

When the Hi-level signal is input from the failure-for-overcurrent diagnosing unit11, namely the current detecting unit10does not break down, the second temperature detecting unit8aturns OFF the pMOS84. As a result, the second temperature detecting unit8aoutputs a signal of a level according to the temperature detected by the temperature sensor81to the failure specifying unit22of the controller2.

When the signal of the level corresponding to the temperature within the temperature range detectable by the temperature sensor81is input from the second temperature detecting unit8a, the failure specifying unit22can monitor a temperature condition of the driving circuit3aon the basis of the input signal.

Then, when the driving circuit3abecomes an overheated state, the failure specifying unit22can output a signal indicating that effect to the control signal generating unit21to block the supply of the driving current to the load L. Therefore, the control device1acan prevent the burnout destruction caused by the overheated state of the driving circuit3a.

When the Lo-level signal is input from the failure-for-overcurrent diagnosing unit11, namely the current detecting unit10breaks down, the second temperature detecting unit8aturns ON the pMOS84. As a result, because the output of the temperature sensor81is connected to the reference voltage line Vcc, the second temperature detecting unit8aoutputs a signal of a level higher than a level corresponding to the upper limit of the temperature range detectable by the temperature sensor81to the failure specifying unit22of the controller2.

When the signal of the level higher than the level corresponding to the upper limit of the temperature range detectable by the temperature sensor81is input from the second temperature detecting unit8a, the failure specifying unit22can specify that the failure of the driving circuit3ais the failure of the current detecting unit10.

Then, when it is specified that the current detecting unit10breaks down, the failure specifying unit22can output a signal indicating that effect to the control signal generating unit21to block the supply of the driving current to the load L. Therefore, the control device1acan prevent the burnout destruction caused by the overcurrent state of the driving circuit3a.

As described above, when the current detecting unit10breaks down, the driving circuit3aincluded in the control device1aoutputs a signal of a high level that does not exist in a normal term (term in which the current detecting unit10does not break down) to the controller2as diagnosis output. As a result, the driving circuit3acan inform the controller2that the current detecting unit10breaks down.

Therefore, even if the third fail-safe system for performing overcurrent protection is in a state where the system does not function, the control device1acan specify the generation of the state by the controller2, immediately block the provision of a driving current to the load L, and thus prevent the burnout destruction of the driving circuit3a.

The driving circuit3ashares an output terminals, which outputs the detection result of a temperature performed by the temperature sensor81, as an output terminals of diagnosis output indicating that the current detecting unit10breaks down. As a result, the control device1acan suppress the increase of the number of output terminals of the driving circuit3aand the number of input terminals of the controller2.

According to the present embodiment, the driving circuit3acan inform the controller2that the current detecting unit10breaks down, and the controller2can specify that the current detecting unit10breaks down, without largely changing a design of software and hardware.

Next, an operation in each state of the control device1awill be explained with reference toFIG. 5andFIG. 6. Because operating states related to overheat protection performed by the control device1aare the same as the operating states illustrated inFIG. 3, operating states related to overcurrent protection are explained herein, and explanations of operating states related to overheat protection are omitted. Herein, a case where the driving circuit3ais not in an overheated state and the first temperature detecting unit5does not break down will be explained.

FIG. 6is a diagram explaining an operating state in each state of the control device1aaccording to an alternative example of the embodiment. As illustrated inFIG. 6, when the current detecting unit10does not have a failure and the driving circuit3ais not in an overcurrent state and has a normal current, the level of the output of the current detecting unit10becomes a level according to a detected current.

In this case, because the level of the output of the overcurrent determining unit91becomes Hi and the level of the output of the failure-for-overcurrent diagnosing unit11becomes Hi, the level of the output of the overcurrent protecting unit9becomes Hi. As a result, the driving unit4acan continue to supply the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8abecomes a level according to a detected temperature. As a result, the controller2can monitor a temperature condition of the driving circuit3aon the basis of the level of the output of the second temperature detecting unit8a.

When the current detecting unit10does not have a failure and the driving circuit3ais in an overcurrent state, the level of the output of the current detecting unit10becomes a level according to a detected current. In this case, because the level of the output of the overcurrent determining unit91becomes Lo and the level of the output of the failure-for-overcurrent diagnosing unit11becomes Hi, the level of the output of the overcurrent protecting unit9becomes Lo. As a result, the driving unit4acan block the supply of the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8abecomes a level according to a detected temperature. As a result, the controller2can monitor a temperature condition of the driving circuit3aon the basis of the level of the output of the second temperature detecting unit8a.

When the current detecting unit10has a failure and the driving circuit3ahas a normal current, the level of the output of the current detecting unit10becomes a level corresponding to a current lower than the lower limit of the detectable current. In this case, because the level of the output of the overcurrent determining unit91becomes Hi and the level of the output of the failure-for-overcurrent diagnosing unit11becomes Lo, the level of the output of the overcurrent protecting unit9becomes Lo. As a result, the driving unit4acan block the supply of the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8abecomes a level corresponding to a temperature higher than the upper limit of the detectable temperature. As a result, the driving circuit3acan inform the controller2that the current detecting unit10breaks down.

When the current detecting unit10has a failure and the driving circuit3ais in an overcurrent state, the level of the output of the current detecting unit10becomes a level corresponding to a current lower than the lower limit of the detectable current. In this case, because the level of the output of the overcurrent determining unit91becomes Hi and the level of the output of the failure-for-overcurrent diagnosing unit11becomes Lo, the level of the output of the overcurrent protecting unit9becomes Lo. As a result, the driving unit4acan block the supply of the driving current to the load L.

At this time, the level of the output of the second temperature detecting unit8abecomes a level corresponding to a temperature higher than the lower limit of the detectable temperature. As a result, the driving circuit3acan inform the controller2that the current detecting unit10breaks down.

Next, a process that is executed by the driving circuit3awill be explained with reference toFIG. 7. Herein, a process that is performed when the driving circuit3aperforms overheat protection is similar to the process that is performed when the driving circuit3illustrated inFIG. 1performs overheat protection. For this reason, a process that is performed when the driving circuit3aperforms overcurrent protection will be explained, and explanations for the process that is performed when the driving circuit3aperforms overheat protection are omitted.

FIG. 7is a flowchart illustrating a process that is executed by the driving circuit3aaccording to the alternative example of the embodiment. The driving circuit3arepeatedly performs the process illustrated inFIG. 7while a power source is supplied to the control device1a.

Specifically, as illustrated inFIG. 7, the driving circuit3adetermines whether a control signal input from the controller2is a Hi level (Step S201). Then, when it is determined that the control signal is not a Hi level (Step S201: No), the driving circuit3ablocks the supply of a driving current to the load L (Step S208), and terminates the process.

When it is determined that the control signal is a Hi level (Step S201: Yes), the driving circuit3aperforms a current detection by the current detecting unit10(Step S202). Next, the driving circuit3adetermines which the detected current of the current detecting unit10is smaller than a current threshold (Step S203).

Then, when it is determined that the detected current of the current detecting unit10is not less than the current threshold (Step S203: No), the driving circuit3ablocks the supply of a driving current to the load L (Step S208), and terminates: the process. On the other hand, when it is determined that the detected current of the current detecting unit10is smaller than the current threshold (Step S203: Yes), the driving circuit3adetermines whether the current detecting unit10breaks down (Step S204).

Then, when it is determined that the current detecting unit10does not break down (Step S204: No), the driving circuit3aoutputs a signal of a level according to the detected temperature to the controller2from the second temperature detecting unit8a(Step S205). Furthermore, the driving circuit3aperforms the supply of a driving current to the load L (Step S206), and terminates the process.

On the other hand, when it is determined that the current detecting unit10breaks down (Step S204: Yes), the driving circuit3aoutputs a signal of the maximum (MAX) level as a failure signal to the controller2from the second temperature detecting unit8a(Step S207). Furthermore, the driving circuit3ablocks the supply of a driving current to the load L (Step S208), and terminates the process.

As described above, the control device according to the embodiment includes a driving circuit. The driving circuit includes a driving unit, a first temperature detecting unit, an overheat protecting unit, a second temperature detecting unit, and a failure-for-overheat diagnosing unit. The driving unit supplies a driving current from a power source to a load to drive the load on the basis of a control signal input from a controller.

The first temperature detecting unit detects a temperature, and outputs a signal of a level according to the detected temperature. When the level of the signal output from the first temperature detecting unit is not less than a temperature threshold, the overheat protecting unit causes the driving unit to block the supply of the driving current to the load. The second temperature detecting unit detects a temperature, and outputs a signal of a level according to the detected temperature to the controller.

The failure-for-overheat diagnosing unit performs a failure diagnosis of the first temperature detecting unit. When it is determined that the first temperature detecting unit breaks down, the failure-for-overheat diagnosing unit causes the driving unit to block the supply of the driving current to the load and causes the second temperature detecting unit to output a signal of a level corresponding to a temperature out of a temperature range detectable by the second temperature detecting unit to the controller. As a result, the driving circuit can inform the controller of the presence or absence of a failure of the temperature detecting unit in the driving circuit.

When a signal of a level lower than a level corresponding to the lower limit of the temperature detectable by the first temperature detecting unit is output from the first temperature detecting unit, the failure-for-overheat diagnosing unit determines that the first temperature detecting unit breaks down. As a result, the driving circuit can detect a failure that the output of the first temperature detecting unit is fixed at an overheated state non-detection side.

When it is determined that the first temperature detecting unit breaks down, the failure-for-overheat diagnosing unit causes the second temperature detecting unit to output a signal of a level lower than a level corresponding to the lower limit of the temperature detectable by the second temperature detecting unit to the controller. As a result, the driving circuit can inform the controller of the generation of the failure that the output of the first temperature detecting unit is fixed at the overheated state non-detection side.

The driving circuit includes a current detecting unit, an overcurrent protecting unit, and a failure-for-overcurrent diagnosing unit. The current detecting unit detects a driving current to be supplied to the load from the driving unit, and outputs a signal of a level according to the detected current. When the level of the signal output from the current detecting unit is not more than the current threshold, the overcurrent protecting unit causes the driving unit to block the supply of the driving current to the load.

The failure-for-overcurrent diagnosing unit performs a failure diagnosis of the current detecting unit. When it is determined that the current detecting unit has a failure, the failure-for-overcurrent diagnosing unit causes the driving unit to block the supply of the driving current to the load, and causes the second temperature detecting unit to output a signal of a level corresponding to a temperature out of the temperature range detectable by the second temperature detecting unit to the controller. As a result, the driving circuit can inform the controller of the presence or absence of a failure of the current detecting unit in the driving circuit.

When a signal of a level lower than a level corresponding to the lower limit of the current detectable by the current detecting unit is output from the current detecting unit, the failure-for-overcurrent diagnosing unit determines that the current detecting unit has a failure. As a result, the driving circuit can detect a failure that the output of the current detecting unit is fixed at an overcurrent state non-detection side.

When it is determined that the current detecting unit has a failure, the failure-for-overcurrent diagnosing unit causes the second temperature detecting unit to output a signal of a level higher than a level corresponding to the upper limit of the temperature detectable by the second temperature detecting unit to the controller. As a result, the driving circuit can inform the controller of the generation of the failure that the output of the current detecting unit is fixed at the overcurrent state non-detection side, and can further cause the controller to distinguish between an overcurrent state and an overheated state.

The controller includes a failure specifying unit that specifies that the failure of the driving circuit is the failure of the first temperature detecting unit on the basis of the signal input from the second temperature detecting unit. As a result, because the driving circuit can use an output terminal of a signal indicating a temperature detected by the second temperature detecting unit as an output terminal of a signal indicating the failure of the first temperature detecting unit, it is possible to suppress the increase of the number of output terminals of the driving circuit and the number of input terminals of the controller.

The controller includes a storage that stores therein a specified result of a failure performed by the failure-for-overheat specifying unit. As a result, the control device can use the specified result of the failure stored in the storage for the check and checkback of the driving circuit.

The controller includes an output unit that outputs the specified result performed by the failure specifying unit. As a result, the control device can inform a user of the failure of the driving circuit.