Vehicle power supply system fault control method, redundant power supply controller and vehicle

Abstract

The application discloses a kind of vehicle power supply system fault control method, redundant power supply controller and vehicle.Therein, the method comprises: obtaining the real-time current parameter flowing through multiple switch components;In response to the current amplitude exceeding the first overcurrent protection threshold, determine the short-circuit fault point according to the current direction;In response to the short-circuit fault point being located in two side power input sections, control the target switch component in multiple switch components to perform the disconnecting action;After performing the disconnecting action, monitor the current state of the loop where the short-circuit fault point is located, and in response to the current amplitude continuously rising and reaching the second overcurrent protection threshold, control the backup switch component in multiple switch components to perform the disconnecting action.The application solves the technical problems of low fault isolation efficiency and poor fault isolation effect of the redundant power distribution architecture in related technologies when performing fault control.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and more specifically, to a fault control method for an automotive power system, a redundant power controller, and a vehicle. Background Technology

[0002] With the rapid development of autonomous driving technology, redundant design of vehicle electrical systems has become increasingly critical, aiming to ensure system safety and continuity under single-failure modes. Redundant power distribution architectures in related technologies are implemented through at least two power distribution controllers, each responsible for supplying power to a portion of the redundant loads. Under this redundant architecture, safe loads can be distributed between the two controllers, and the safe and non-safe power distribution areas are monitored and isolated for overcurrent through back-to-back (BTB) electronic fuse chips. However, when a short-circuit fault occurs at the power input or wiring harness, the current BTB electronic fuse isolation mechanism causes the entire safe power supply area to lose power, severely impacting the vehicle's safety functions. Therefore, the redundant power distribution architectures in related technologies suffer from insufficient fault isolation efficiency and poor fault isolation effect during fault control.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a method for fault control of a vehicle power system, a redundant power controller, and a vehicle, in order to at least solve the technical problems of low fault isolation efficiency and poor fault isolation effect in redundant power distribution architectures in the related art when performing fault control.

[0005] According to one aspect of the embodiments of this application, a fault control method for an automotive power system is provided, applied to a redundant power distribution architecture. The redundant power distribution architecture includes: a power supply trunk connected in series between a first power supply terminal and a second power supply terminal, and a plurality of switching components sequentially distributed along the power supply trunk. The plurality of switching components includes: a first switching component, a second switching component, a third switching component, and a fourth switching component. The fault control method for the automotive power system includes: configuring a first overcurrent protection threshold for the first switching component and the fourth switching component, and configuring a second overcurrent protection threshold for the second switching component and the third switching component, wherein the first overcurrent protection threshold is less than the second overcurrent protection threshold; acquiring real-time current parameters flowing through the plurality of switching components, wherein the real-time current parameters include: current. Amplitude and current direction; in response to the current amplitude exceeding the first overcurrent protection threshold, the short-circuit fault point is determined according to the current direction, wherein the short-circuit fault point includes: the power input sections on both sides of the power supply main circuit or the intermediate load output section; in response to the short-circuit fault point being located in the power input sections on both sides, the target switching component among multiple switching components is controlled to perform a disconnection action, wherein the target switching component is used to represent the switching component with the closest electrical distance to the short-circuit fault point; after performing the disconnection action, the current state of the circuit where the short-circuit fault point is located is monitored, and in response to the current amplitude continuously rising and reaching the second overcurrent protection threshold, the backup switching component among multiple switching components is controlled to perform a disconnection action, wherein the backup switching component is used to represent the secondary switching component adjacent to the short-circuit fault point.

[0006] Optionally, determining the short-circuit fault point based on the current flow direction includes: in response to detecting that the current flowing through the first switching component and the third switching component both point to the first power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold, determining that the short-circuit fault point is located on the input side of the first power supply terminal; in response to detecting that the current flowing through the second switching component and the fourth switching component both point to the second power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold, determining that the short-circuit fault point is located on the input side of the second power supply terminal.

[0007] Optionally, controlling a target switching component among multiple switching components to perform a disconnection action includes: generating a first control command in response to the short-circuit fault point being located on the input side of the first power supply terminal, and turning off the first switching component according to the first control command; and keeping the second, third, and fourth switching components in the conducting state in response to the successful turn-off of the first switching component, so as to establish an energy transmission path for supplying power from the second power supply terminal to the load on the first power supply terminal side via the power supply trunk.

[0008] Optionally, in response to the current amplitude continuously rising and reaching the second overcurrent protection threshold, controlling the backup switch component among the multiple switch components to perform a disconnection action includes: acquiring the current amplitude flowing through the third switch component within a preset monitoring window after generating the first control command; determining that the disconnection action of the first switch component has failed in response to the current amplitude being greater than or equal to the second overcurrent protection threshold; generating a second control command in response to the failure of the disconnection action of the first switch component, and turning off the third switch component according to the second control command, so as to isolate the load on the first power supply side and the intermediate load, and maintain the independent power supply from the second power supply side to the load on the second power supply side.

[0009] Optionally, the vehicle power system fault control method further includes: in response to detecting that the current flowing through the second switching component and the third switching component both point to the unsafe load node located between them, and the current amplitude exceeds the second overcurrent protection threshold, determining that the short-circuit fault point is located in the intermediate load output section; in response to the short-circuit fault point being located in the intermediate load output section, generating a third control command, and simultaneously or separately turning off the second switching component and the third switching component according to the third control command, so as to electrically isolate the unsafe load node from the first power supply terminal and the second power supply terminal.

[0010] Optionally, the first overcurrent protection threshold is an external protection threshold, and the second overcurrent protection threshold is an internal protection threshold; wherein, the current amplitude of the internal protection threshold is greater than the current amplitude of the external protection threshold, and the current amplitude of the external protection threshold is greater than the rated load current of the system, and the physical limit withstand current of the power supply trunk is greater than the current amplitude of the internal protection threshold.

[0011] Optionally, the vehicle power system fault control method further includes: starting a timer to count the duration for which the current amplitude exceeds the first overcurrent protection threshold; in response to the duration exceeding the first preset delay, performing a graded response step; in response to the duration exceeding the second preset delay, performing a backup protection step; wherein the first preset delay is less than the second preset delay.

[0012] Optionally, the vehicle power system fault control method further includes: during the system initialization phase, sending test pulse signals to multiple switching components respectively; diagnosing whether multiple switching components have gate drive faults or body short circuit faults based on the feedback results of the test pulse signals; and prohibiting the system from entering the dual power grid-connected power supply mode in response to the presence of a gate drive fault or body short circuit fault in any of the multiple switching components.

[0013] According to another aspect of the embodiments of this application, a redundant power controller is also provided, including: a memory for storing a computer program and preset protection threshold parameters; a processor coupled to the memory for executing the computer program to implement the method as described in any of the embodiments of this application; and a drive interface circuit connected to an external first switch assembly, a second switch assembly, a third switch assembly, and a fourth switch assembly, respectively, for outputting control signals.

[0014] According to another aspect of the embodiments of this application, a vehicle is also provided, including: a memory storing an executable program; and a processor for running the program, wherein the program executes the methods in various embodiments of this application when it runs.

[0015] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform the methods of various embodiments of this application.

[0016] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the methods of various embodiments of this application.

[0017] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the methods in various embodiments of this application.

[0018] According to another aspect of the embodiments of this application, a computer program is also provided, which, when executed by a processor, implements the methods of the various embodiments of this application.

[0019] In this embodiment, by configuring a first overcurrent protection threshold for the first and fourth switching components, and a second overcurrent protection threshold for the second and third switching components, real-time current parameters flowing through multiple switching components are obtained. Subsequently, in response to the current amplitude exceeding the first overcurrent protection threshold, a short-circuit fault point is determined based on the current flow direction. In response to the short-circuit fault point being located in the power input sections on both sides, the target switching component among the multiple switching components is controlled to perform a disconnection action. In response to the current amplitude continuously rising and reaching the second overcurrent protection threshold, the backup switching component among the multiple switching components is controlled to perform a disconnection action. Thus, through refined overcurrent protection threshold configuration and a hierarchical fault isolation strategy, not only is the speed and accuracy of fault detection improved, but the impact of a single-point fault on the overall system is also effectively avoided, significantly enhancing the stability and safety of the automotive power supply system. In the initial stage of a fault, the timely disconnection of the target switching component in this embodiment effectively reduces the impact range of the fault on the system. Meanwhile, the backup switch assembly ensures that even if the target switch assembly fails, the fault is prevented from escalating and the power supply continuity of critical loads is ensured. This achieves the technical effect of improving the fault isolation efficiency and effect of the redundant power distribution architecture, thereby solving the technical problems of low fault isolation efficiency and poor fault isolation effect in the fault control of the redundant power distribution architecture in related technologies. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 This is a schematic diagram of a redundant power distribution architecture based on relevant technologies;

[0022] Figure 2 This is a flowchart of a vehicle power system fault control method according to an embodiment of this application;

[0023] Figure 3 This is a schematic diagram of a redundant power distribution architecture according to an embodiment of this application;

[0024] Figure 4 This is a schematic diagram of yet another redundant power distribution architecture according to an embodiment of this application;

[0025] Figure 5 This is a schematic diagram of a fault control process according to an embodiment of this application;

[0026] Figure 6 This is a schematic diagram of another fault control process according to an embodiment of this application;

[0027] Figure 7This is a schematic diagram of another fault control process according to an embodiment of this application;

[0028] Figure 8 This is a schematic diagram of another fault control process according to an embodiment of this application;

[0029] Figure 9 This is a schematic diagram of a vehicle power system fault control method according to an embodiment of this application;

[0030] Figure 10 This is a schematic diagram of another vehicle power system fault control method according to an embodiment of this application;

[0031] Figure 11 This is a schematic diagram of another fault control process according to an embodiment of this application;

[0032] Figure 12 This is a schematic diagram of another vehicle power system fault control method according to an embodiment of this application;

[0033] Figure 13 This is a structural block diagram of a vehicle power system fault control device according to an embodiment of this application. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application.

[0035] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0036] Figure 1 This is a schematic diagram of a redundant power distribution architecture based on relevant technologies, such as... Figure 1As shown, the redundant power distribution architecture contains at least two power distribution controllers, each of which can independently provide redundant power to critical safety systems or functions on the vehicle, such as drive-by-wire chassis and autonomous driving functions, thus forming basic redundancy at the electrical level to cope with single points of failure.

[0037] To improve system reliability, redundant loads with redundancy safety requirements are distributed between two power distribution controllers to form redundant load combinations, such as redundant load 1A and redundant load 1B, redundant load 2A and redundant load 2B, redundant load 3A and redundant load 3B, etc., to ensure that even if one of the power distribution controllers fails, the safety loads can still receive power and maintain the vehicle's basic safety functions.

[0038] Figure 1 The redundant power distribution architecture shown can be divided into safe power distribution areas and unsafe power distribution areas. The safe power distribution area is equipped with power supplies and electronic fuse chips with functional safety levels. These components work together to provide power to redundant loads, ensuring that necessary safety functions can be maintained in the event of a fault.

[0039] The non-safety zone located between two power distribution controllers can be a Quality Management (QM) zone, typically a general electrical system or load area that does not require strict functional safety standards. It is equipped with power modules that do not have functional safety ratings, such as QM DC Direct Current Converters (DCDC), to power the loads within the QM zone. QM loads can be powered directly from the DCDC module using traditional fuses, or they can be powered more precisely by intelligent driver chips, such as High Side Drivers (HSDs), achieving a balance between flexibility and cost-effectiveness.

[0040] The related technology uses BTB-type electronic fuse chips between the safe power distribution area and the unsafe power distribution area, which enables the system to bidirectionally isolate and shut down the large current generated by short-circuit faults at any location. This effectively prevents the fault from spreading from the unsafe area to the safe area, ensuring electrical safety isolation between the two areas, thereby improving the overall safety and reliability of the vehicle's electrical system.

[0041] In the aforementioned redundant power distribution architecture, when a fault occurs in the safe power supply area, such as a short circuit in one battery, a BTB-type electronic fuse chip will trigger the isolating switch to automatically disconnect, thereby isolating the fault source. However, during isolation, the power distribution controller connected to the faulty battery and all its supported safe loads will immediately lose power, resulting in a complete interruption of the safe load's function. In this situation, the vehicle can only rely on the unaffected safe loads on the other side to maintain critical safety functions, leading to insufficient fault isolation accuracy and poor fault isolation effect, further reducing the overall redundancy of the system and its availability under fault conditions.

[0042] According to an embodiment of this application, a method embodiment for fault control of a vehicle power system is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0043] The vehicle power system fault control method in this application embodiment can be applied to a redundant power distribution architecture. The redundant power distribution architecture includes: a power supply trunk connected in series between a first power supply terminal and a second power supply terminal, and multiple switching components distributed sequentially along the power supply trunk. The multiple switching components include: a first switching component, a second switching component, a third switching component, and a fourth switching component.

[0044] Figure 2 This is a flowchart of a vehicle power system fault control method according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0045] Step S21: Configure a first overcurrent protection threshold for the first switch assembly and the fourth switch assembly, and configure a second overcurrent protection threshold for the second switch assembly and the third switch assembly, wherein the first overcurrent protection threshold is less than the second overcurrent protection threshold;

[0046] Step S22: Obtain real-time current parameters flowing through multiple switching components, wherein the real-time current parameters include: current amplitude and current direction;

[0047] Step S23: In response to the current amplitude exceeding the first overcurrent protection threshold, determine the short circuit fault point according to the current flow direction. The short circuit fault point includes: the power input sections on both sides of the power supply trunk or the intermediate load output section.

[0048] Step S24: In response to the short circuit fault point being located in the power input sections on both sides, control the target switching component among the multiple switching components to perform a disconnection action, wherein the target switching component is used to represent the switching component that is electrically closest to the short circuit fault point;

[0049] Step S25: After performing the disconnection action, monitor the current state of the circuit where the short-circuit fault point is located. In response to the current amplitude continuously rising and reaching the second overcurrent protection threshold, control the backup switch assembly among the multiple switch assemblies to perform the disconnection action. The backup switch assembly is used to represent the secondary switch assembly adjacent to the short-circuit fault point.

[0050] The aforementioned power supply trunk line can be the main power supply line connecting the first power supply end and the second power supply end. It is responsible for transmitting power from both ends to various loads in the entire system and is a key power transmission path in the architecture.

[0051] The aforementioned first and second power supply terminals represent different power input points, which can be different batteries or energy devices in the vehicle, providing redundant power supply to the system to ensure that backup power is available in the event of a single power source failure. In a redundant power distribution architecture, the first and second power supply terminals can be flexibly configured as various types of power devices to adapt to different power supply requirements and redundancy strategies. Specifically, the first power supply terminal can be a battery, serving as the vehicle's primary power source, providing a stable and continuous power supply. In a partially redundant design, the first power supply terminal can also include a battery and a DC-DC converter module, where the DC-DC converter module performs voltage regulation and conversion, converting higher-voltage DC power to lower-voltage DC power suitable for specific loads, thereby enhancing the power supply resilience and adaptability of the first power supply terminal. Correspondingly, the second power supply terminal can also be configured as a single battery, or a more complex configuration can be selected, including both a battery and a DC-DC converter module, to provide dual, complementary power support. This ensures that if either power supply terminal fails, such as when the battery is depleted or the DC-DC converter module is damaged, the other power supply terminal can immediately take over the power supply task and maintain the normal operation of the system.

[0052] The aforementioned multiple switching components are key control elements in the circuit, including a first switching component, a second switching component, a third switching component, and a fourth switching component. These multiple switching components manage current and isolate faults by controlling the on / off state of the control circuit. Specifically, these multiple switching components can be Metal-Oxide-Semiconductor Field-Effect Transistor (MOS) group switches; the first switching component can be represented as MOS_1, the second switching component as MOS_2, the third switching component as MOS_3, and the fourth switching component as MOS_4.

[0053] Figure 3 This is a schematic diagram of a redundant power distribution architecture according to an embodiment of this application, as shown below. Figure 3As shown, the redundant power distribution architecture includes: a power supply trunk line connected in series between the first power supply terminal and the second power supply terminal, and multiple switching components distributed sequentially along the power supply trunk line, including: a first switching component, a second switching component, a third switching component, and a fourth switching component. The first power supply terminal is equipped with battery 1 and DC-DC1, and the second power supply terminal is equipped with battery 2 and DC-DC2. Redundant safety loads 1A, 2A, and 3A can be located on the line between the first and second switching components, and redundant safety loads 1B, 2B, and 3B can be located on the line between the third and fourth switching components. The QM loads 1 and 2 under main power distribution domain control, and the QM loads 3 and 4 under redundant power supply domain control, can be located on the line between the second and third switching components. That is, the power output locations for safety loads are between MOS_1 and MOS_2, and between MOS_3 and MOS_4, respectively. The power output location for non-safety loads is between MOS_2 and MOS_3.

[0054] Figure 4 This is a schematic diagram of another redundant power distribution architecture according to an embodiment of this application, such as... Figure 4 As shown, each switching assembly contains at least three MOSFETs connected in parallel. The number of MOSFETs in parallel depends on the current magnitude and the overcurrent capability of the MOSFETs. The sources (S) of MOSFETs 1 and 4 face the external power supply, while the sources (S) of MOSFETs 2 and 3 are interconnected. Both the main power distribution domain controller and the redundant power supply domain controller contain MCU modules. Each MCU module can control two Efuse chip modules, and each Efuse chip module controls the switching of a set of MOSFETs through the gate (G) of the MOSFET. Each Efuse chip module has overcurrent diagnosis and shutdown capabilities, with the overcurrent shutdown direction as shown. Figure 4 As shown, the overcurrent diagnosis and shutdown directions of MOS_1 and MOS_4 are respectively oriented towards the external power input directions on both sides, while the overcurrent diagnosis and shutdown directions of MOS_2 and MOS_3 are both oriented towards the unsafe load power supply direction.

[0055] In this embodiment, the two power distribution controllers are sufficiently isolated to prevent simultaneous failure of their safe loads due to common-cause failures and cascading failures. This embodiment configures a first overcurrent protection threshold for the first and fourth switching components, while setting a higher second overcurrent protection threshold for the second and third switching components. By setting differentiated overcurrent protection thresholds, the fault location can be identified more accurately, and the area closest to the fault point can be isolated first, rather than blindly disconnecting the entire system, thereby improving the effectiveness of fault isolation and the overall availability of the system.

[0056] Real-time monitoring of current parameters flowing through all switching components, including current amplitude and current direction, enables immediate response to sudden current anomalies, providing accurate data support for subsequent fault location and isolation.

[0057] When the detected current amplitude exceeds the preset first overcurrent protection threshold, this embodiment of the application can immediately initiate a fault location procedure to determine the specific location of the short-circuit fault based on the current flow direction. For example, the short-circuit fault point can occur in the power input sections on both sides of the power supply main circuit or in the intermediate load output section. The power input sections on both sides can specifically include the input side of the first power supply terminal and the input side of the second power supply terminal, and the intermediate load output section can specifically be the power supply section between MOS_2 and MOS_3. Fault identification based on current flow can effectively avoid misjudgment and improve the accuracy of fault response.

[0058] After confirming that the short-circuit fault point is located in the power input section on both sides, the target switching component can be controlled to perform a disconnection action. The target switching component is the switching component that is electrically closest to the short-circuit fault point, thereby quickly isolating the fault area to prevent the fault from further affecting the entire system.

[0059] For example, Figure 5 This is a schematic diagram of a fault control process according to an embodiment of this application, such as... Figure 5 As shown, if the short-circuit fault is located on the input side of the first power supply terminal, it can cause the entire grid voltage to drop, resulting in the failure of all loads. This fault is a cascaded failure, meaning that a power supply failure on the left side simultaneously causes a power supply failure on the right side. In this case, the target switching component is MOS_1, and MOS_1 needs to be disconnected. After MOS_1 is turned off, the second power supply terminal on the right side can still supply power to the two domain-controlled loads.

[0060] For example, Figure 6 This is a schematic diagram of another fault control process according to an embodiment of this application, such as... Figure 6 As shown, if the short circuit fault point is located on the input side of the second power supply terminal, the target switching component is MOS_4. It is necessary to disconnect MOS_4. After turning off MOS_4, the first power supply terminal can still supply power to the two domain-controlled loads.

[0061] After the disconnection action is performed, the current status of the circuit where the short-circuit fault point is located is continuously checked. If the current amplitude continues to rise until it reaches the second overcurrent protection threshold, it means that the isolation effect of the target switching component is limited or the fault has not been completely contained. At this time, the control and backup switching components perform the disconnection action. The backup switching components are used to represent the secondary switching components adjacent to the short-circuit fault point, thereby forming multiple protections to ensure that the power supply of critical safety loads is not affected.

[0062] For example, Figure 7This is a schematic diagram of another fault control process according to an embodiment of this application, such as... Figure 7 As shown, if the short circuit fault point is located on the input side of the first power supply terminal, the target switching component is MOS_1. After MOS_1 is disconnected, the current status of the circuit where the fault point is located is monitored. If the current amplitude continues to rise and reaches the second overcurrent protection threshold, it indicates that MOS_1 has not been turned off. At this time, the backup switching component is MOS_3. MOS_3 is controlled to disconnect. At this time, the left-side safe load and all non-safe loads are completely shut down, and the second power supply terminal can maintain the safe load power supply of the right controller.

[0063] For example, Figure 8 This is a schematic diagram of another fault control process according to an embodiment of this application, such as... Figure 8 As shown, if the short-circuit fault point is located on the input side of the second power supply terminal, the target switching component is MOS_4. After MOS_4 is disconnected, the current status of the circuit where the fault point is located is monitored. If the current amplitude continues to rise and reaches the second overcurrent protection threshold, it indicates that MOS_4 has not been turned off. At this time, the backup switching component is MOS_2. MOS_2 is controlled to disconnect. At this time, the right-side safe load and all non-safe loads are all stopped from being powered, and the first power supply terminal can maintain the power supply of the safe load of the left controller.

[0064] Based on steps S21 to S25 above, by configuring a first overcurrent protection threshold for the first and fourth switching components, and a second overcurrent protection threshold for the second and third switching components, real-time current parameters flowing through multiple switching components are obtained. Subsequently, in response to the current amplitude exceeding the first overcurrent protection threshold, a short-circuit fault point is determined based on the current flow direction. In response to the short-circuit fault point being located in the power input sections on both sides, the target switching component among the multiple switching components is controlled to perform a disconnection action. In response to the current amplitude continuously rising and reaching the second overcurrent protection threshold, the backup switching component among the multiple switching components is controlled to perform a disconnection action. Thus, through refined overcurrent protection threshold configuration and hierarchical fault isolation strategy, not only is the speed and accuracy of fault detection improved, but the impact of a single point of failure on the overall system is also effectively avoided, significantly enhancing the stability and safety of the automotive power supply system. In the initial stage of a fault, the timely disconnection of the target switching component in this application embodiment can effectively reduce the impact range of the fault on the system. Meanwhile, the backup switch assembly ensures that even if the target switch assembly fails, the fault is prevented from escalating and the power supply continuity of critical loads is ensured. This achieves the technical effect of improving the fault isolation efficiency and effect of the redundant power distribution architecture, thereby solving the technical problems of low fault isolation efficiency and poor fault isolation effect in the fault control of the redundant power distribution architecture in related technologies.

[0065] The following is a further description of the vehicle power system fault control method in the embodiments of this application.

[0066] In an optional embodiment, in step S23, determining the short-circuit fault point based on the current flow direction includes:

[0067] In response to the detection that the current flowing through the first switching assembly and the third switching assembly both point to the first power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold, it is determined that the short circuit fault point is located on the input side of the first power supply terminal.

[0068] In response to the detection that the current flowing through the second and fourth switching components is directed towards the second power supply terminal and the current amplitude exceeds the first overcurrent protection threshold, it is determined that the short circuit fault point is located on the input side of the second power supply terminal.

[0069] Continuing as shown in Figure 5, when the current flowing through MOS_1 and MOS_3 points towards the first power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold, it indicates that the short-circuit fault is located on the input side of the first power supply terminal. Continuing as shown in Figure 6, when the current flowing through MOS_2 and MOS_4 both point towards the second power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold, it is determined that the short-circuit fault is located on the input side of the second power supply terminal. Monitoring the current flow direction can promptly identify abnormal states in the circuit, especially when the current suddenly reverses or abnormally increases, which usually indicates the possibility of a short circuit or other types of faults.

[0070] Based on the above optional embodiments, in response to the detection that the current flowing through the first switching component and the third switching component both point to the first power supply terminal and the current amplitude exceeds the first overcurrent protection threshold, it is determined that the short circuit fault point is located on the input side of the first power supply terminal. Similarly, in response to the detection that the current flowing through the second switching component and the fourth switching component both point to the second power supply terminal and the current amplitude exceeds the first overcurrent protection threshold, it is determined that the short circuit fault point is located on the input side of the second power supply terminal. This enables the immediate identification of short circuit faults in the redundant power distribution architecture and accurately determines whether the short circuit fault point is on the input side of the first power supply terminal or the input side of the second power supply terminal, thereby significantly improving the speed and accuracy of fault diagnosis.

[0071] In one alternative embodiment, controlling a target switching component among a plurality of switching components to perform a disconnection action includes:

[0072] In response to the short-circuit fault point being located on the input side of the first power supply terminal, a first control command is generated, and the first switching assembly is turned off according to the first control command;

[0073] In response to the successful turn-off of the first switching component, the second, third, and fourth switching components remain in the on state to establish an energy transmission path from the second power supply terminal to the load on the first power supply terminal via the power supply trunk.

[0074] Continue as Figure 5 As shown, when the short-circuit fault point is located on the input side of the first power supply terminal, a first control command is generated, and MOS_1 is controlled to change from the on state to the off state according to the first control command. If MOS_1 can be successfully turned off, MOS_2, MOS_3 and MOS_4 are kept in the on state to establish an energy transmission path from the second power supply terminal to the load on the first power supply terminal side through the power supply trunk. That is, the second power supply terminal can be used to supply power to the safe load and non-safe load in the main power distribution domain control and redundant power supply domain control.

[0075] For example, in response to the short circuit fault point being located on the input side of the second power supply terminal, a corresponding control command can be generated, and the fourth switch component can be turned off according to the control command; in response to the successful turn-off of the fourth switch component, the first switch component, the second switch component, and the third switch component remain in the conducting state to establish an energy transmission path from the first power supply terminal to the load on the second power supply terminal side via the power supply trunk.

[0076] Continue as Figure 6 As shown, when the short-circuit fault point is located on the input side of the second power supply terminal, a corresponding control command is generated, and MOS_4 is controlled to change from the on state to the off state according to the control command. If MOS_4 can be successfully turned off, MOS_1, MOS_2 and MOS_3 remain in the on state to establish an energy transmission path from the first power supply terminal to the load on the second power supply terminal side via the power supply trunk. That is, the first power supply terminal can be used to supply power to the safe load and non-safe load in the main power distribution domain control and redundant power supply domain control.

[0077] Based on the above optional embodiments, when the short-circuit fault point is confirmed to be located on the input side of the first power supply terminal, the MCU module quickly generates a first control command and accordingly shuts down MOS_1, achieving immediate isolation of the fault area. Simultaneously, MOS_2, MOS_3, and MOS_4 are kept in the on state, thereby establishing a temporary energy transfer path from the second power supply terminal to the load on the first power supply terminal side. This ensures that even if a fault occurs at the first power supply terminal, the safe and unsafe loads within the system can still receive sufficient power supply, preventing the entire system's function from being impaired due to a power supply failure on one side. This effectively improves the fault response capability and overall power supply continuity of the redundant power distribution architecture in this application embodiment, ensuring stable operation and data security of the system in the face of single-point power supply failures.

[0078] In one alternative embodiment, controlling a backup switching component among a plurality of switching components to perform a disconnection action in response to a continuous rise in current amplitude and reaching a second overcurrent protection threshold includes:

[0079] Within the preset monitoring window after the first control command is generated, the current amplitude flowing through the third switching component is acquired;

[0080] In response to a current amplitude greater than or equal to the second overcurrent protection threshold, the disconnection action of the first switching assembly is determined to have failed;

[0081] In response to the failure of the first switching component to disconnect, a second control command is generated, and the third switching component is turned off according to the second control command to isolate the first power supply side load and the intermediate load, and to maintain the independent power supply from the second power supply side to the second power supply side load.

[0082] The aforementioned preset monitoring window can be a set time interval after attempting to turn off MOS_1. Within the preset monitoring window, the MCU module will continuously monitor the current amplitude flowing through MOS_3 in the power supply trunk. The setting of this preset monitoring window can be based on the time required for the MOS_1 turn-off operation and possible current bounce or delayed response, ensuring that the MCU module has sufficient time to evaluate the actual turn-off effect of MOS_1.

[0083] The aforementioned preset monitoring window can also be a set time interval after attempting to turn off MOS_4. Within the preset monitoring window, the MCU module will continuously monitor the current amplitude flowing through MOS_2 in the power supply trunk. The setting of this preset monitoring window can be based on the time required for the MOS_4 turn-off operation and possible current bounce or delayed response, ensuring that the MCU module has sufficient time to evaluate the actual turn-off effect of MOS_4.

[0084] During the preset monitoring window, the MCU module can continuously read and record the current flowing through MOS_3 using a built-in current sensor or an external current detection device. This monitoring process forms the basis for determining whether MOS_1 has been successfully turned off and whether further action is needed, ensuring the intelligence and automation of the system's fault response and handling mechanisms.

[0085] The aforementioned second overcurrent protection threshold is another key parameter different from the first overcurrent protection threshold. In this embodiment, the second overcurrent protection threshold is higher than the first overcurrent protection threshold. When the previous fault control action fails to effectively prevent the short-circuit current, the setting of the second overcurrent protection threshold will serve as the triggering condition for subsequent fault isolation steps, aiming to ensure that the fault area can be isolated in a timely manner through a more stringent current limiting standard.

[0086] Figure 9 This is a schematic diagram of a vehicle power system fault control method according to an embodiment of this application, such as... Figure 9As shown, when the short-circuit fault point is located on the input side of the first power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold corresponding to MOS_1, MOS_1 is controlled to change from the on state to the off state. If MOS_1 can be successfully turned off, that is, when MOS_1 is disconnected and isolation is completed, MOS_2, MOS_3, and MOS_4 are kept in the on state, thus preserving... Figure 4 The power supply capacity for the safe load on the right side and the unsafe load in the middle.

[0087] When the MCU detects that the current flowing through MOS_3 reaches the second overcurrent protection threshold within the preset monitoring window, it means that MOS_1 has not completed its disconnection action as expected, i.e., it has failed to effectively isolate the short-circuit fault on the input side of the first power supply. At this time, the system automatically determines that the disconnection action of MOS_1 has failed. After the disconnection action of MOS_1 is determined to have failed, the MCU module will immediately generate a second control command to prevent the fault on the first power supply side from continuing to affect the stability of the entire power supply trunk, or even the load on the second power supply side.

[0088] When executing the second control instruction, the MCU module sends a control signal to MOS_3, causing MOS_3 to switch from the on state to the off state, i.e., turning off MOS_3. By turning off MOS_3, the remaining... Figure 4 The right-side safe load power supply capability achieves complete isolation of the power supply path for all safe loads on the first power supply side and the intermediate non-safe loads, avoiding the impact of short-circuit current on the above areas, while also ensuring that the independent power supply of the second power supply side to its own safe loads is not disturbed.

[0089] For example, if the short-circuit fault point is located on the input side of the second power supply terminal, and an attempt has been made to send a control command to turn off the fourth switching component, in response to the current amplitude being greater than or equal to the second overcurrent protection threshold, it is determined that the disconnection action of the second switching component has failed; in response to the failure of the disconnection action of the fourth switching component, a corresponding control command is generated, and the second switching component is turned off according to the control command, so as to isolate the load on the second power supply terminal side and the intermediate load, and maintain the independent power supply of the first power supply terminal to the load on the first power supply terminal side.

[0090] Figure 10 This is a schematic diagram of another vehicle power system fault control method according to an embodiment of this application, such as... Figure 10 As shown, when the short-circuit fault point is located on the input side of the second power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold corresponding to MOS_4, MOS_4 is controlled to change from the on state to the off state. If MOS_4 can be successfully turned off, that is, when MOS_4 is disconnected and isolation is completed, MOS_1, MOS_2, and MOS_3 remain in the on state, thus preserving... Figure 4 The power supply capacity for the safe load on the left and the unsafe load in the middle.

[0091] When the MCU detects that the current flowing through MOS_2 reaches the second overcurrent protection threshold within the preset monitoring window, it means that MOS_4 has not completed its disconnection action as expected, i.e., it has failed to effectively isolate the short-circuit fault on the input side of the second power supply. At this time, the system automatically determines that the disconnection action of MOS_4 has failed. Once the disconnection action of MOS_4 is determined to have failed, the MCU module will immediately generate control commands to prevent the fault on the second power supply side from continuing to affect the stability of the entire power supply trunk, or even affecting the load on the first power supply side.

[0092] The MCU module sends a control signal to MOS_2, causing MOS_2 to switch from the on state to the off state, i.e., turning off MOS_2. By turning off MOS_2, the remaining... Figure 4 The left-side safe load power supply capability achieves complete isolation of the power supply path for all safe loads on the second power supply side and the middle unsafe loads, avoiding the impact of short-circuit current on the above areas, while also ensuring that the independent power supply of the first power supply side to its own safe loads is not disturbed.

[0093] Based on the above optional embodiments, it is ensured that even under the most unfavorable fault scenarios, the problematic power supply path can be quickly disconnected, thereby significantly enhancing the fault tolerance and security of the redundant power distribution architecture and reducing the risk of system failure due to a single point of failure. Through multiple protection mechanisms, the embodiments of this application can provide robust power support for the continuous operation of vehicles and equipment in complex and ever-changing power environments.

[0094] In an optional embodiment, the vehicle power system fault control method in this application further includes:

[0095] In response to the detection that the current flowing through the second and third switching components both point to the unsafe load node located between them, and the current amplitude exceeds the second overcurrent protection threshold, it is determined that the short circuit fault point is located in the intermediate load output section.

[0096] In response to the short-circuit fault point being located in the intermediate load output section, a third control command is generated, and the second and third switching components are simultaneously or separately turned off according to the third control command, so as to electrically isolate the unsafe load node from the first power supply terminal and the second power supply terminal.

[0097] When the MCU module detects that the current flowing through MOS_2 and MOS_3 is directed towards the intermediate unsafe load node, and the current amplitude exceeds the second overcurrent protection threshold, it determines that the short-circuit fault point is located in the intermediate load output section. By monitoring the current changes across MOS_2 and MOS_3 in real time, the system aims to ensure that when a fault occurs in the intermediate unsafe area, it can quickly locate and isolate the problem point, preventing the fault from spreading to the safe load power supply paths on both sides.

[0098] After identifying the short-circuit fault location in the intermediate load output section, the MCU module will generate a third control command, indicating that emergency isolation measures need to be taken for the intermediate unsafe load node, including but not limited to turning off MOS_2 and MOS_3 to cut off the propagation path of the fault current. The third control command ensures the system's timely response and fault isolation capability when a fault occurs in the intermediate unsafe load area.

[0099] Figure 11 This is a schematic diagram of another fault control process according to an embodiment of this application, such as... Figure 11 As shown, according to the third control instruction, the MCU module will perform a shutdown operation on MOS_2 and MOS_3. The shutdown operation can be performed simultaneously, i.e., both MOS_2 and MOS_3 can be turned off at the same time, or separately, i.e., MOS_2 can be turned off first, followed by MOS_3. The specific order depends on the overcurrent protection threshold settings of MOS_2 and MOS_3 and the current flow direction under the current fault condition. By shutting down MOS_2 and MOS_3, electrical isolation is achieved between the intermediate unsafe load node and the first and second power supply terminals, thereby effectively preventing the impact of short-circuit current on the power supply terminals on both sides and the power supply path of the safe load, improving the stability and safety of the redundant power distribution architecture when facing faults in the intermediate unsafe area.

[0100] Figure 12 This is a schematic diagram of another vehicle power system fault control method according to an embodiment of this application, such as... Figure 12 As shown, when the short-circuit fault point is located in the intermediate load output section, it can cause the entire grid voltage to drop, resulting in the failure of all loads. This fault is a common-cause failure. At this time, MOS_2 and MOS_3 play a redundant shutdown role. Both have the same overcurrent shutdown threshold and are turned off simultaneously. The non-safe loads lose power supply, but the safe loads on both sides can still be powered normally.

[0101] Based on the above optional embodiments, when the current flowing through the second and third switching components both point to the intermediate unsafe load node and the current amplitude exceeds the second overcurrent protection threshold, the MCU module can accurately determine that the short-circuit fault point is located in the intermediate load output section. Subsequently, it quickly generates a third control command to simultaneously or separately shut down the second and third switching components as needed. This effectively achieves electrical isolation between the intermediate unsafe load node and the first and second power supply terminals, significantly improving the system's response speed and isolation efficiency when a fault occurs in the intermediate unsafe load area. This ensures that the power supply paths of the two power supply terminals and the safe load are not affected, enhancing the safety and stability of the entire redundant power distribution system.

[0102] In one optional embodiment, the first overcurrent protection threshold is an outer protection threshold, and the second overcurrent protection threshold is an inner protection threshold.

[0103] Among them, the current amplitude of the inner protection threshold is greater than that of the outer protection threshold, and the current amplitude of the outer protection threshold is greater than the rated load current of the system, while the physical limit withstand current of the power supply trunk is greater than that of the inner protection threshold.

[0104] The aforementioned external protection threshold is the current protection level set by MOS_1 and MOS_4. The purpose of setting the external protection threshold is to ensure that when a short circuit fault occurs on the input side of the first power supply terminal or the second power supply terminal, the corresponding protection mechanism can be quickly identified and triggered, that is, MOS_1 or MOS_4 is turned off, so as to avoid the fault current from damaging the entire power supply trunk and the load.

[0105] The aforementioned inner protection threshold is a protection standard for internal faults in the power supply trunk, specifically configured for MOS_2 and MOS_3. Compared to the outer protection threshold, the current amplitude of the inner protection threshold is set higher, meaning the power supply trunk can tolerate a certain degree of internal current fluctuation without immediately triggering protection. However, once the current amplitude exceeds the inner protection threshold, it will quickly take action, such as shutting down MOS_2 or MOS_3 to isolate the fault and protect the power supply terminals and loads on both sides.

[0106] The rated load current of the system described above represents the maximum average current that the power supply trunk is expected to carry under normal operating conditions. The rated load current is a crucial reference when designing the power supply trunk, ensuring that all switching components and distribution cables can withstand currents within their safe limits during long-term operation, thus preventing safety risks such as overheating, melting, or fire. Setting the rated load current below the external protection threshold ensures that the power supply system does not need to frequently trigger protection mechanisms within the normal operating range, reducing unnecessary circuit disconnections and thereby improving system efficiency and user experience.

[0107] The physical limit withstand current of the aforementioned power supply trunk can be the maximum transient current value that the circuit materials and design can withstand. The physical limit withstand current exceeds the maximum current under normal operating conditions and is used to assess the safety and stability of the circuit under extreme conditions. By setting the current amplitude of the internal protection threshold below the physical limit withstand current, the embodiments of this application ensure that even in the event of high-current events such as internal short circuits, the infrastructure of the entire power supply trunk remains relatively intact, avoiding large-scale power system collapse, and providing valuable time and opportunity for post-fault repair and recovery.

[0108] In an optional embodiment, the vehicle power system fault control method in this application further includes:

[0109] Start a timer to track the duration for which the current amplitude exceeds the first overcurrent protection threshold;

[0110] If the duration exceeds the first preset delay, a graded response procedure is executed.

[0111] In response to the duration exceeding the second preset delay, a backup protection step is executed; wherein the first preset delay is less than the second preset delay.

[0112] Specifically, when the current amplitude is detected to exceed the first overcurrent protection threshold for the first time, the duration of the over-limit state is recorded. The statistical analysis of the duration is a key basis for the system to determine whether further fault response measures are needed. The start of the timer signifies that the system has entered a phase of close monitoring of potential faults, preparing to decide on the next action based on the passage of time.

[0113] When the current amplitude exceeds the first overcurrent protection threshold for a duration exceeding a first preset time delay, the MCU module will execute a graded response step. In this step, specific switching components can be controlled to reduce current, for example... Figure 5 The shown shows the shutdown of MOS_1 or as follows Figure 6 The indicated shutdown of MOS_4, or adjustment of the power distribution of other components, aims to mitigate overcurrent conditions through a series of gradual control operations, avoiding the need for immediate, more stringent protection measures. The setting of the first preset delay reflects the system's consideration of balancing the maintenance of load power continuity with the safety of the protection circuit, preventing false triggering of the protection mechanism due to instantaneous current fluctuations and reducing unnecessary system interruptions.

[0114] If the current amplitude exceeds the first overcurrent protection threshold for a duration exceeding the second preset time delay, this embodiment will execute a more stringent backup protection step. The backup protection step involves shutting down all switching components connected to the faulty points, such as... Figure 6 The backup shutdown of MOS_2 is shown, or as follows: Figure 7The backup shutdown of MOS_3, as shown, achieves complete isolation of the entire power supply trunk to prevent short-circuit current from further damaging the circuit or endangering safe loads. The second preset delay setting reflects the system's trade-off between ensuring safety and maximizing load power supply time. When an overcurrent condition is detected and not effectively mitigated for an extended period, the system will switch to a more conservative protection mode, prioritizing the safety and stability of the power distribution system.

[0115] Based on the above optional embodiments, by starting a timer to count the duration for which the current amplitude exceeds the first overcurrent protection threshold, the system can accurately determine when to take appropriate response measures. When the duration of the overcurrent exceeds the limit reaches the first preset time delay, a graded response step is executed, attempting to resolve the overcurrent problem through local control, thus protecting the circuit while maintaining power supply to the load as much as possible. When the duration of the overcurrent exceeds the limit by more stringent second preset time delay, the system will decisively execute a backup protection step, shutting down all switching components related to the fault point to completely isolate the fault and prevent it from causing greater damage to the system. The graded fault response mechanism based on duration monitoring not only improves the system's flexibility and intelligence in dealing with short-circuit faults but also effectively balances the requirements of safety and load power supply continuity, thereby fundamentally improving the stability and reliability of the redundant power distribution architecture.

[0116] In an optional embodiment, the vehicle power system fault control method in this application further includes:

[0117] During the system initialization phase, test pulse signals are sent to multiple switching components respectively;

[0118] Based on the feedback results of the test pulse signals, diagnose whether multiple switching components have gate drive faults or body short circuit faults.

[0119] In response to a gate drive fault or a short circuit fault in any of the multiple switching components, the system is prohibited from entering the dual power supply grid-connected mode.

[0120] During system initialization, the MCU module can send test pulse signals to each switching component, namely MOS_1, MOS_2, MOS_3, and MOS_4. Specifically, a brief voltage pulse can be applied to the gate of the switching component to observe its response behavior, thereby evaluating the integrity of its gate drive circuit and the electrical performance of the switching element itself. By sending pulse signals and monitoring the feedback results, it is possible to detect whether the switching component can correctly turn on or off at a specified gate voltage, and whether there are any internal circuit phenomena, laying the foundation for the subsequent stable operation of the system.

[0121] Gate drive failure primarily refers to the inability of the drive circuit to generate sufficient gate voltage to correctly control the switching state of the switching components. This may result in the switching components failing to conduct when required or exhibiting leakage current when required to be off. Body short-circuit failure, on the other hand, refers to an improper electrical connection between the source and drain within the switching component, allowing current to flow freely even without a gate drive signal, thus posing a serious threat to the safety of the power distribution system. By diagnosing these two types of failures, the system can ensure that all switching components reliably perform their intended functions in a dual-power grid-connected supply mode.

[0122] When a gate drive fault or short-circuit fault is detected in any switching component during system initialization, the MCU module will prevent the system from entering the dual-power grid-connected mode. The dual-power grid-connected mode allows the first and second power supply terminals to simultaneously supply power to the power supply trunk and the load, achieving system efficiency and redundancy. However, if any switching component is faulty, enabling the dual-power grid-connected mode may lead to the amplification of the fault, or even jeopardize the safety of the entire system. Therefore, this embodiment of the application performs fault diagnosis before system startup, ensuring that the system is only allowed to enter the dual-power grid-connected mode when all switching components are normal and fault-free. This prevents potential safety hazards and ensures the stability and reliability of the power distribution system.

[0123] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0124] According to an embodiment of this application, an apparatus embodiment for a vehicle power system fault control method is provided. It should be noted that the apparatus can be used to execute the above-described vehicle power system fault control method.

[0125] Figure 13 This is a structural block diagram of a vehicle power system fault control device according to an embodiment of this application, applied to a redundant power distribution architecture. The redundant power distribution architecture includes: a power supply trunk connected in series between a first power supply terminal and a second power supply terminal, and multiple switching components sequentially distributed along the power supply trunk. The multiple switching components include: a first switching component, a second switching component, a third switching component, and a fourth switching component. Figure 13 As shown, the device includes:

[0126] Configuration module 1301 is used to configure a first overcurrent protection threshold for the first switch assembly and the fourth switch assembly, and to configure a second overcurrent protection threshold for the second switch assembly and the third switch assembly, wherein the first overcurrent protection threshold is less than the second overcurrent protection threshold;

[0127] The acquisition module 1302 is used to acquire real-time current parameters flowing through multiple switching components, wherein the real-time current parameters include: current amplitude and current flow direction;

[0128] The determination module 1303 is used to determine the short circuit fault point according to the current flow direction in response to the current amplitude exceeding the first overcurrent protection threshold. The short circuit fault point includes: the power input sections on both sides of the power supply main circuit or the intermediate load output section.

[0129] The first control module 1304 is used to control a target switch assembly among multiple switch assemblies to perform a disconnection action in response to the short circuit fault point being located in the power input sections on both sides. The target switch assembly is used to represent the switch assembly that is electrically closest to the short circuit fault point.

[0130] The second control module 1305 is used to monitor the current state of the circuit where the short-circuit fault point is located after the disconnection action is performed. In response to the continuous rise of the current amplitude and the achievement of the second overcurrent protection threshold, it controls the backup switch component among the multiple switch components to perform the disconnection action. The backup switch component is used to represent the secondary switch component adjacent to the short-circuit fault point.

[0131] Optionally, the determining module 1303 is further configured to: determine that the short circuit fault point is located on the input side of the first power supply terminal in response to detecting that the current flowing through the first switching component and the third switching component both point to the first power supply terminal and the current amplitude exceeds the first overcurrent protection threshold; and determine that the short circuit fault point is located on the input side of the second power supply terminal in response to detecting that the current flowing through the second switching component and the fourth switching component both point to the second power supply terminal and the current amplitude exceeds the first overcurrent protection threshold.

[0132] Optionally, the first control module 1304 is further configured to: generate a first control command in response to the short-circuit fault point being located on the input side of the first power supply terminal, and turn off the first switching component according to the first control command; and keep the second switching component, the third switching component and the fourth switching component in the conducting state in response to the successful turn-off of the first switching component, so as to establish an energy transmission path for supplying power from the second power supply terminal to the load on the first power supply terminal side via the power supply trunk.

[0133] Optionally, the second control module 1305 is further configured to: acquire the current amplitude flowing through the third switching component within a preset monitoring window after the first control command is generated; determine that the disconnection action of the first switching component has failed in response to the current amplitude being greater than or equal to the second overcurrent protection threshold; generate a second control command in response to the failure of the disconnection action of the first switching component, and turn off the third switching component according to the second control command, so as to isolate the first power supply side load and the intermediate load, and maintain the independent power supply from the second power supply side to the second power supply side load.

[0134] Optionally, the vehicle power system fault control device further includes: a third control module 1306, configured to: determine that the short-circuit fault point is located in the intermediate load output section in response to detecting that the current flowing through the second switching component and the third switching component both point to the unsafe load node located between them, and the current amplitude exceeds the second overcurrent protection threshold; generate a third control command in response to the short-circuit fault point being located in the intermediate load output section, and simultaneously or separately turn off the second switching component and the third switching component according to the third control command, so as to electrically isolate the unsafe load node from the first power supply terminal and the second power supply terminal.

[0135] Optionally, the first overcurrent protection threshold is an external protection threshold, and the second overcurrent protection threshold is an internal protection threshold; wherein, the current amplitude of the internal protection threshold is greater than the current amplitude of the external protection threshold, and the current amplitude of the external protection threshold is greater than the rated load current of the system, and the physical limit withstand current of the power supply trunk is greater than the current amplitude of the internal protection threshold.

[0136] Optionally, the vehicle power system fault control device further includes: a statistics module 1307, used to start a timer to count the duration for which the current amplitude exceeds the first overcurrent protection threshold; and an execution module 1308, used to: execute a graded response step in response to the duration exceeding a first preset delay; and execute a backup protection step in response to the duration exceeding a second preset delay; wherein the first preset delay is less than the second preset delay.

[0137] Optionally, the vehicle power system fault control device further includes: a sending module 1309, used to send test pulse signals to multiple switching components respectively during the system initialization phase; a diagnostic module 1310, used to diagnose whether multiple switching components have gate drive faults or body short circuit faults based on the feedback results of the test pulse signals; and a processing module 1311, used to prevent the system from entering the dual power grid-connected power supply mode in response to the presence of a gate drive fault or body short circuit fault in any of the multiple switching components.

[0138] Embodiments of this application also provide a redundant power controller, including: a memory for storing a computer program and preset protection threshold parameters; a processor coupled to the memory for executing the computer program to implement the method as described in any of the embodiments of this application; and a drive interface circuit connected to an external first switch assembly, a second switch assembly, a third switch assembly, and a fourth switch assembly, respectively, for outputting control signals.

[0139] Embodiments of this application also provide a vehicle, including: a memory storing an executable program; and a processor for running the program, wherein the program executes the methods described in various embodiments of this application when it runs.

[0140] Embodiments of this application also provide a computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform the methods of various embodiments of this application.

[0141] Embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the methods of various embodiments of this application.

[0142] Embodiments of this application also provide a computer program product, including a non-volatile computer-readable storage medium for storing a computer program that, when executed by a processor, implements the methods in various embodiments of this application.

[0143] Embodiments of this application also provide a computer program that, when executed by a processor, implements the methods described in the various embodiments of this application.

[0144] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0149] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A fault control method for an automotive power supply system, characterized in that, The method is applied to a redundant power distribution architecture, the redundant power distribution architecture including a power supply trunk connected in series between a first power supply terminal and a second power supply terminal, and a plurality of switching components distributed sequentially along the power supply trunk, the plurality of switching components including a first switching component, a second switching component, a third switching component, and a fourth switching component; the method includes: A first overcurrent protection threshold is configured for the first and fourth switching components, and a second overcurrent protection threshold is configured for the second and third switching components, wherein the first overcurrent protection threshold is less than the second overcurrent protection threshold; The real-time current parameters flowing through the plurality of switching components are obtained, wherein the real-time current parameters include: current amplitude and current direction; In response to the current amplitude exceeding the first overcurrent protection threshold, a short-circuit fault point is determined according to the current flow direction, wherein the short-circuit fault point includes: the power input sections on both sides of the power supply trunk or the intermediate load output section; In response to the short-circuit fault point being located in the power input sections on both sides, a target switching component among the plurality of switching components is controlled to perform a disconnection action, wherein the target switching component is used to represent the switching component that is electrically closest to the short-circuit fault point; After performing the disconnection action, the current state of the circuit where the short-circuit fault point is located is monitored. In response to the current amplitude continuously rising and reaching the second overcurrent protection threshold, the backup switch component among the plurality of switch components is controlled to perform the disconnection action, wherein the backup switch component is used to represent the secondary switch component adjacent to the short-circuit fault point.

2. The method according to claim 1, characterized in that, Determining the short-circuit fault point based on the current flow direction includes: In response to the detection that the current flowing through the first switching assembly and the third switching assembly both point towards the first power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold, it is determined that the short circuit fault point is located on the input side of the first power supply terminal. In response to the detection that the current flowing through the second switching assembly and the fourth switching assembly both point towards the second power supply terminal, and the current amplitude exceeds the first overcurrent protection threshold, it is determined that the short-circuit fault point is located on the input side of the second power supply terminal.

3. The method according to claim 2, characterized in that, The step of controlling the target switching component among the plurality of switching components to perform a disconnection action includes: In response to the short-circuit fault being located on the input side of the first power supply terminal, a first control command is generated, and the first switching assembly is turned off according to the first control command; In response to the successful turn-off of the first switching component, the second, third, and fourth switching components remain in the on state to establish an energy transmission path from the second power supply terminal to the load on the first power supply terminal via the power supply trunk.

4. The method according to claim 3, characterized in that, The step of controlling the backup switch assembly among the plurality of switch assemblies to perform a disconnection action in response to the current amplitude continuously rising and reaching the second overcurrent protection threshold includes: Within a preset monitoring window after the first control command is generated, the current amplitude flowing through the third switching component is acquired; In response to the current amplitude being greater than or equal to the second overcurrent protection threshold, it is determined that the disconnection action of the first switching component has failed; In response to the failure of the disconnection action of the first switching component, a second control command is generated, and the third switching component is turned off according to the second control command to isolate the first power supply side load and the intermediate load, and maintain the independent power supply of the second power supply side load to the second power supply side load.

5. The method according to claim 1, characterized in that, The method further includes: In response to the detection that the current flowing through the second switching assembly and the third switching assembly both point to the unsafe load node located between them, and the current amplitude exceeds the second overcurrent protection threshold, it is determined that the short-circuit fault point is located in the intermediate load output section; In response to the short-circuit fault point being located in the intermediate load output section, a third control command is generated, and the second switching component and the third switching component are simultaneously or separately turned off according to the third control command, so as to electrically isolate the unsafe load node from the first power supply terminal and the second power supply terminal.

6. The method according to claim 1, characterized in that, The first overcurrent protection threshold is the outer protection threshold, and the second overcurrent protection threshold is the inner protection threshold; Wherein, the current amplitude of the inner protection threshold is greater than the current amplitude of the outer protection threshold, and the current amplitude of the outer protection threshold is greater than the rated load current of the system, and the physical limit withstand current of the power supply trunk is greater than the current amplitude of the inner protection threshold.

7. The method according to claim 1, characterized in that, The method further includes: Start a timer to count the duration for which the current amplitude exceeds the first overcurrent protection threshold; In response to the duration exceeding a first preset delay, a graded response step is executed; In response to the duration exceeding the second preset delay, a backup protection step is executed; wherein the first preset delay is less than the second preset delay.

8. The method according to claim 1, characterized in that, The method further includes: During the system initialization phase, test pulse signals are sent to the multiple switching components respectively; Based on the feedback results of the test pulse signal, diagnose whether the multiple switching components have gate drive faults or body short circuit faults. In response to the presence of a gate drive fault or a body short circuit fault in any of the plurality of switching components, the system is prohibited from entering the dual power grid-connected power supply mode.

9. A redundant power supply controller, characterized in that, include: Memory, used to store computer programs and preset protection threshold parameters; A processor, coupled to the memory, is configured to execute the computer program to implement the method as described in any one of claims 1 to 8; The drive interface circuit is connected to the external first switch assembly, second switch assembly, third switch assembly and fourth switch assembly respectively, and is used to output control signals.

10. A vehicle, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the storage medium is located to perform the method according to any one of claims 1 to 8.

Images