CROSS-REFERENCE TO RELATED APPLICATIONS

The disclosure of Japanese Patent Application No. 2019-207942 filed on Nov. 18, 2019 including the specification, drawings and abstract is incorporated herein by reference in its entirety.

BACKGROUND

The present invention relates to a functional safety system. In recent years, in order to improve reliability of a system, an operation of the system is monitored by using a plurality of monitoring systems. Further, incorporating of a function for safety into the system is called functional safety. A related art is an example in which an operation of the system is monitored by using a plurality of monitoring systems.

A control device of the related art has a first MPU and a second MPU. The second MPU controls an output circuit including a voltage monitoring circuit. Specifically, the second MPU blocks a power source that supplies power to the voltage monitoring circuit. An output result from the voltage monitoring circuit is thereby observed by the first MPU, cross communication between the first MPU and the second MPU is executed, and abnormality of the output circuit is determined.

In this regard, there are disclosed techniques below.

[PATENT DOCUMENT 1] Japanese Unexamined Patent Application Publication No. Japanese unexamined Patent Application publication No. 2006-302614.

SUMMARY

However, in the related art, it is impossible to diagnose a breakdown of the voltage monitoring circuit itself. For that reason, there is a problem that reliability of the control device described in the related art is low. Another problem and a novel feature will be apparent from the description herein and accompanying drawings.

A functional safety system according to one embodiment includes: a first power source apparatus configured to generate a first power source voltage on a basis of an external power source; a first power source monitoring apparatus configured to receive the first power source voltage, and monitor the first power source voltage; and a first semiconductor device configured to receive the first power source voltage to operate on a basis of the first power source voltage. Further, the functional safety system also includes: a second power source apparatus configured to generate a second power source voltage on a basis of the external power source; a second power source monitoring apparatus configured to receive the second power source voltage, and monitor the second power source voltage; and a second semiconductor device configured to receive the second power source voltage to operate on a basis of the second power source voltage. Moreover, the functional safety system also includes: a first interruption circuit controlled by the first semiconductor device; a second interruption circuit controlled by the second semiconductor device; and a motor configured to receive a driving signal via the first interruption circuit and the second interruption circuit to operate on a basis of the driving signal. The first power source monitoring apparatus includes a first voltage converting circuit, a second voltage converting circuit, a first comparator circuit, and a second comparator circuit. The second semiconductor device has a first expected value and a second expected value. The first voltage converting circuit is configured to generate a first detected voltage from the first power source voltage on a basis of a first switching signal supplied from the second semiconductor device, and apply the first detected voltage to the first comparator circuit. The second voltage converting circuit is configured to generate a second detected voltage from the first power source voltage on a basis of the first switching signal, and apply the second detected voltage to the second comparator circuit. The first comparator circuit is configured to compare the first detected voltage with a first reference voltage, and supply a first voltage monitoring result to the second semiconductor device in accordance with a comparison result. The second comparator circuit is configured to compare the second detected voltage with the first reference voltage, and supply a second voltage monitoring result to the second semiconductor device in accordance with a comparison result. The second semiconductor device is configured to control the second interruption circuit so as to block the driving signal to be supplied to the motor in a case where the first voltage monitoring result is different from the first expected value or the second voltage monitoring result is different from the second expected value.

A functional safety system according to another embodiment includes: a first power source apparatus configured to generate a first power source voltage on a basis of an external power source and apply the first power source voltage to a first power source wiring; a first power source monitoring apparatus connected to the first power source wiring, the first power source monitoring apparatus being configured to monitor an electrical potential of the first power source wiring; and a first semiconductor device connected to the first power source wiring, the first semiconductor device being configured to operate on a basis of the first power source voltage. Further, the functional safety system also includes: a second power source apparatus configured to generate a second power source voltage on a basis of the external power source to apply the second power source voltage to a second power source wiring; a second power source monitoring apparatus connected to the second power source wiring, the second power source monitoring apparatus being configured to monitor an electrical potential of the second power source wiring; and a second semiconductor device connected to the second power source wiring, the second semiconductor device being configured to operate on a basis of the second power source voltage. Moreover, the functional safety system also includes: a first interruption circuit controlled by the first semiconductor device; a second interruption circuit controlled by the second semiconductor device; and a motor configured to receive a driving signal via the first interruption circuit and the second interruption circuit to operate on a basis of the driving signal. The first power source monitoring apparatus includes a first voltage converting circuit, a second voltage converting circuit, a first comparator circuit, and a second comparator circuit. The second semiconductor device has a first expected value and a second expected value. The first voltage converting circuit is configured to generate a first detected voltage from the first power source voltage on a basis of a first switching signal supplied from the second semiconductor device, and apply the first detected voltage to the first comparator circuit. The second voltage converting circuit is configured to generate a second detected voltage from the first power source voltage on a basis of the first switching signal, and apply the second detected voltage to the second comparator circuit. The first comparator circuit is configured to compare the first detected voltage with a first reference voltage, and supply a first voltage monitoring result to the second semiconductor device in accordance with a comparison result. The second comparator circuit is configured to compare the second detected voltage with the first reference voltage, and supply a second voltage monitoring result to the second semiconductor device in accordance with a comparison result. The second semiconductor device is configured to control the second interruption circuit so as to block the driving signal to be supplied to the motor in a case where the first voltage monitoring result is different from the first expected value or the second voltage monitoring result is different from the second expected value.

A functional safety system according to still another embodiment includes: a first power source apparatus configured to generate a first power source voltage on a basis of an external power source; a power source monitoring apparatus configured to receive the first power source voltage, and monitor the first power source voltage; and a first semiconductor device configured to receive the first power source voltage to operate on a basis of the first power source voltage. Further, the functional safety system also includes: a second power source apparatus configured to generate a second power source voltage on a basis of the external power source; and a second semiconductor device configured to receive the second power source voltage to operate on a basis of the second power source voltage. Moreover, the functional safety system also includes: an interruption circuit controlled by the second semiconductor device; and a motor configured to receive a driving signal via the interruption circuit to operate on a basis of the driving signal. The power source monitoring apparatus includes a voltage converting circuit and a comparator circuit. The second semiconductor device has a first value and a second value as an expected value. The voltage converting circuit is configured to generate a first divided voltage from the first power source voltage on a basis of a switching signal with a Low level, which is supplied from the second semiconductor device, and apply the first divided voltage to the comparator circuit. The voltage converting circuit is configured to generate a second divided voltage from the first power source voltage on a basis of the switching signal with a High level, and apply the second divided voltage to the comparator circuit. The comparator circuit is configured to compare the first divided voltage with a reference voltage to supply a first result value to the second semiconductor device on a basis of a comparison result thereof. The comparator circuit is further configured to compare the first divided voltage with the reference voltage to supply a second result value to the second semiconductor device on a basis of a comparison result thereof. The second semiconductor device is configured to control the interruption circuit so as to block the driving signal to be supplied to the motor in a case where the first result value is different from the first value or the second result value is different from the second value.

According to the embodiments, it is possible to provide a functional safety system with high reliability.

