Control method, power distribution device, control device, and vehicle

Abstract

The application provides a control method, a power distribution device, a control device and a vehicle, relates to the electrical technical field, is applied to the power distribution device, and the power distribution device comprises a first power distribution channel, the first power distribution channel comprises a first power supply circuit between a first load and a power supply, and a first discharge circuit connected with the first load, the control method comprises the following steps: in response to the first load failure, the first power supply circuit is cut off; the first discharge circuit is turned on to discharge the residual charge of the first load; in response to the first load meeting the reset condition, the first discharge circuit is cut off, and the first power supply circuit is turned on, and the reset condition is used to indicate that the first load completes the release of the residual charge. Based on the scheme, after the power distribution device cuts off the power supply circuit of the load, the electrical state of the load side can be quickly restored to the safe state, so that the time consumption of the power distribution device in the load failure recovery process is shortened, and the reliability of the recovered load power supply is improved.

Description

Technical Field

[0001] This application relates to the field of electrical technology, specifically to control methods, power distribution devices, control devices, and vehicles. Background Technology

[0002] With the development of vehicle electrical systems, power distribution units are widely used in the power supply control of on-board loads. These power distribution units typically control electronic switches to enable or disable the power supply circuit. For example, when a load fault is detected, the power distribution unit will disconnect the aforementioned power supply circuit.

[0003] However, after the power supply circuit is cut off, the electrical state of the load side is usually difficult to restore to a safe state quickly. If the load is directly restarted, abnormal transient electrical signals are likely to be generated on the load side. These abnormal transient electrical signals pose a risk of damaging hardware components and can easily cause the load to experience logical state abnormalities or fail to reset. This results in the power distribution equipment taking a long time and having low reliability during the load fault recovery process. Summary of the Invention

[0004] This application provides a control method, a power distribution device, a control device, and a vehicle, which can quickly restore the electrical state of the load side to a safe state after the power distribution device cuts off the power supply circuit of the load, thereby shortening the time consumed by the power distribution device in the load fault recovery process and improving the reliability of restoring the power supply to the load.

[0005] In a first aspect, a control method is provided, applied to a power distribution device, the power distribution device including a first power distribution channel, the first power distribution channel including a first power supply circuit between a first load and a power source, and a first discharge circuit connected to the first load, the control method including: in response to a fault in the first load, disconnecting the first power supply circuit; connecting the first discharge circuit to discharge residual charge of the first load; in response to the first load meeting a reset condition, disconnecting the first discharge circuit and connecting the first power supply circuit, the reset condition being used to indicate that the first load has completed the release of residual charge.

[0006] For example, the aforementioned power distribution device can be applied to vehicle electrical systems. Of course, it can also be applied to other electrical systems, such as industrial control systems, communication base station power systems, or power management systems for data center servers.

[0007] For example, in the aforementioned industrial control systems, communication base station power systems, or data center servers, there are often electrical loads containing energy storage devices, and these systems require stable electrical recovery when faced with power outages. By applying the aforementioned power distribution device to these other electrical systems, it is possible to actively intervene in the switching sequence of the power supply circuit and the discharge circuit to discharge residual charge on the load side, thereby eliminating abnormal transient electrical signals that are easily generated when the power supply circuit is reconnected.

[0008] Based on the above technical solution, by responding to a fault and disconnecting the power supply circuit between the load and the power source, the continuous action of the fault on the circuit, which could damage components and cause safety hazards, is avoided. Furthermore, by actively intervening to open the discharge circuit to release residual charge on the load side, and combined with a reset condition determination mechanism for the first load, abnormal transient electrical signals caused by the interaction between residual charge not fully discharged in the first load and the reconnected power supply are prevented. This process not only eliminates the risk of hardware component damage due to electrical surges but also ensures that the logic units inside the load can be cleared and reset. Through this collaborative control mechanism, the power distribution device achieves rapid and safe automatic recovery in response to fault scenarios, shortening the time consumed during load fault recovery and improving the reliability of restoring power supply to the load.

[0009] In conjunction with the first aspect, in some implementations of the first aspect, the fault includes a first type of fault and a second type of fault; wherein, the first type of fault includes the current flowing through the first power distribution channel being greater than the overcurrent threshold; and the second type of fault includes the failure of the first load to undergo an over-the-air (OTA) upgrade.

[0010] For example, the first type of fault can be a hardware fault occurring in a component located in the first power supply circuit, such as a short circuit fault or an overcurrent fault, where the current flowing through the first power distribution channel exceeds the overcurrent threshold. The second type of fault can be a software fault related to the load service, such as an OTA upgrade failure of the first load.

[0011] For example, depending on the type of fault, the power distribution unit can respond to the fault and disconnect the first power supply circuit through different triggering mechanisms.

[0012] In conjunction with the first aspect, in some implementations of the first aspect, a first type of fault occurs in the first load, the first power supply circuit is disconnected, and the disconnection state of the first power supply circuit is locked.

[0013] For example, performing a lockout operation for Type I faults (such as hardware-level faults like overcurrent and short circuits) is primarily based on electrical safety considerations of the underlying hardware. Type I faults typically have highly destructive and long-lasting physical characteristics. If the power supply circuit is simply disconnected without any restrictions on this disconnection state, the electrical system's conventional retry mechanisms or abnormal software logic may frequently issue turn-on commands, causing short-circuit currents to repeatedly impact the power supply circuit. This can easily burn out the switching devices inside the power distribution equipment and may even trigger serious system-level safety hazards such as thermal runaway.

[0014] For example, hardware latching circuits (such as integrated latches or triggers) can be integrated into the power distribution unit to maintain the level signal corresponding to the cut-off state, thereby relying on the underlying hardware logic to block control signals attempting to reconnect the first power supply circuit. Alternatively, a fixed fault flag can be written into the non-volatile memory of the microcontroller inside the power distribution unit to reject subsequent turn-on commands at the software logic level. Alternatively, a combination of hardware latching and software flags can be used to achieve dual locking.

[0015] Based on the above technical solution, by locking the disconnection state of the first type of fault, the fault node is forcibly isolated from the physical or logical level, preventing repeated impacts of dangerous current caused by abnormal closure of the first power supply circuit, thereby ensuring the electrical safety of the power distribution device and the underlying hardware.

[0016] In conjunction with the first aspect, in some implementations of the first aspect, a first instruction message is received, the first instruction message being used to indicate the release of the lock on the cut-off state; and the first discharge circuit is turned on according to the first instruction message.

[0017] For example, the aforementioned first indication information may be issued by the vehicle controller in the vehicle's electrical system, an external diagnostic device, or a cloud-based backend. The aforementioned first indication information may be a specific unlock message transmitted via an onboard communication bus (such as a controller area network (CAN) bus), or it may be a specific level trigger signal transmitted via a dedicated hardwire.

[0018] For example, the aforementioned first indication information may be generated and sent to the underlying power distribution device only after the vehicle controller has completed in-depth system-level diagnostics and determined that the fault source has been isolated, or after maintenance personnel have cleared the corresponding hardware fault codes using diagnostic equipment. This first indication information may be the aforementioned reset command. Furthermore, to prevent false alarms, the first indication information may also carry a specific security authentication key, and the power distribution device will only respond after successful verification.

[0019] For example, considering that first-type faults usually require manual intervention or high-level system diagnostics to confirm and resolve, delegating the unlocking authority of the first power supply circuit to specific instruction information from the upper-level system (such as the vehicle controller or diagnostic tool) to trigger it, rather than having the lower-level power distribution device automatically retry, can effectively ensure the safety and rigor of the restart decision.

[0020] Based on the above technical solution, by locking the disconnected state of the first power supply circuit when the first load experiences a first type of fault, repeated impacts of abnormal current on the underlying circuitry are avoided, achieving electrical isolation of the faulty node. Furthermore, by releasing the lock in response to the first indication information and activating the first discharge circuit, it is ensured that the reset process is initiated only upon receiving a definite unlocking command, and a definite zero-potential reference can be provided to the first load before power is restored. This mechanism not only avoids continuous damage to circuit components caused by the first type of fault but also ensures the safe restart of the first load after fault clearance, thereby improving the closed-loop control capability and reliability of the power distribution device in dealing with the aforementioned faults.

[0021] In conjunction with the first aspect, in some implementations of the first aspect, a second type of fault occurs in the first load, and a second indication message is received, which is used to indicate that the first power distribution channel is reset; according to the second indication message, the first power supply circuit is disconnected.

[0022] For example, in the case of a second type of fault occurring in the first load (such as software program freezing, OTA upgrade failure, etc.), since the second type of fault is not a low-level hardware fault such as overcurrent, it can usually be detected by vehicle controllers or upper-level diagnostic modules through communication heartbeat monitoring, software verification, etc.

[0023] Based on the above technical solutions, the power distribution equipment can respond to system-level resets or software execution anomalies, providing an action triggering mechanism to deal with software operation freezes or upgrade interruptions.

[0024] In conjunction with the first aspect, in some implementations of the first aspect, before disconnecting the first power supply circuit according to the second instruction information, a precondition is verified, the precondition including at least one of the following: the equipment where the first load is located meets the static condition, the first load belongs to the load whitelist, or the electrical system where the first load is located is in OTA upgrade mode, the load whitelist is used to indicate loads that are allowed to be powered off; and it is determined that the precondition is met.

[0025] For example, blindly cutting off the load power supply during vehicle operation in the event of a power outage and restart triggered by a software malfunction could pose a driving safety risk. Therefore, to ensure the electrical safety of the vehicle under different operating conditions, a precondition verification is performed before disconnecting the first power supply circuit according to the aforementioned second instruction information.

[0026] For example, in a vehicle electrical system scenario, the power distribution unit can determine whether the aforementioned preconditions are met by acquiring messages on the vehicle communication bus (e.g., CAN bus or Ethernet): For the vehicle speed meeting the stationary condition, the power distribution unit can acquire real-time data from the vehicle speed sensor or vehicle speed messages sent by the body control module. When the indicated vehicle speed is zero or the vehicle is in park (P) gear, the stationary condition is determined to be met, ensuring that a power-off operation is not performed while the vehicle is moving.

[0027] For example, when the vehicle is in OTA upgrade mode, the power distribution unit can read the electrical system state machine flag bit issued by the upper-level vehicle controller or main control equipment. When the flag bit indicates that the current electrical system is in a safe upgrade and maintenance state (e.g., in OTA upgrade mode), the condition is determined to be met, and at this time, power-off retry is allowed for the relevant load.

[0028] For example, regarding the condition that the first load belongs to the load whitelist, especially in the scenario of a vehicle electrical system, the aforementioned load whitelist can include loads whose automotive safety integrity level (ASIL) is lower than a target safety level, which is dynamically determined based on the vehicle's current operating conditions. In practical applications, each load connected to each power distribution channel of the aforementioned power distribution device has corresponding identification information (such as hardware port number, communication node identifier, or device type code). The aforementioned power distribution device can pre-store this identification information or parse and obtain it when receiving the second instruction information. Based on this, the power distribution device can determine whether the first load is currently allowed to be de-energized by comparing the identification information of the first load with the current load whitelist.

[0029] Based on the above technical solution, by introducing a precondition verification mechanism before responding to the reset command issued by the upper layer, and only cutting off the power supply circuit when the verification is satisfied, the risk of vehicle malfunction caused by blindly performing power-off operations on critical loads under unsafe operating conditions is avoided. This mechanism not only ensures the safety of the underlying power supply of the electrical system containing the first load, but also ensures that the first load can successfully perform a power-off reset to restore normal operation under safe operating conditions.

[0030] In conjunction with the first aspect, in some implementations of the first aspect, the load whitelist includes loads with a security level lower than the target security level, and the target security level is determined based on the operating conditions of the device in which the first load is located.

[0031] For example, the vehicle's electrical system can dynamically adjust the target safety level based on the vehicle's real-time operating conditions (e.g., high-speed driving, low-speed crawling, stationary parking, etc.), thereby adaptively updating the load whitelist. Furthermore, the updated load whitelist can be sent to the power distribution unit; alternatively, the power distribution unit itself can calculate and adjust the whitelist in real time based on received operating condition information. When the vehicle is in a high-speed driving condition, the target safety level is set to the highest, and only loads with extremely low ASIL levels (such as non-safety-related entertainment system loads) are allowed to be included in the load whitelist. When the vehicle is stationary, the target safety level is lowered, and some driver assistance sensor loads can also be included in the whitelist.

[0032] For example, in the context of vehicle electrical systems, in addition to using ASIL as the aforementioned safety level, the functional domain classification level of the load can also be used as the aforementioned safety level. For instance, the aforementioned functional domain levels may include: a first functional domain level (such as loads involving core driving control functions like vehicle braking and steering), a second functional domain level (such as intelligent driving loads involving environmental perception and driver assistance), a third functional domain level (such as basic vehicle control loads involving basic driving assistance), and a fourth functional domain level (such as entertainment and comfort loads involving cabin experience).

[0033] For example, the power distribution priority level pre-set based on the vehicle power management strategy can also be used as the aforementioned safety level. The aforementioned power distribution priority level (e.g., P0 to Pn, where n is a positive integer greater than 1) is used to characterize the order in which loads are disconnected under low battery or power degradation conditions. Correspondingly, when verifying the preconditions, the power distribution device compares the power distribution priority of the load to be reset with the target safety level (i.e., the target priority threshold) corresponding to the current operating condition.

[0034] Based on the above technical solution, by combining real-time operating conditions with dynamic configuration of the load whitelist, precise reset control of loads with different security levels in different scenarios is achieved.

[0035] In conjunction with the first aspect, in some implementations of the first aspect, the reset condition includes at least one of the following: the voltage of the first load is lower than a voltage threshold; the conduction duration of the first discharge circuit is greater than a duration threshold; the discharge current of the first discharge circuit is less than a current threshold; and the voltage change rate of the first load is less than a change rate threshold.

[0036] For example, the aforementioned power distribution device may integrate a voltage detection circuit, which is electrically connected to the first load to acquire the voltage signal of the first load in real time. When the current voltage indicated by the voltage signal decays to less than a set voltage threshold (e.g., 0.5V), it indicates that the residual charge of the first load has been basically discharged, meaning that the first load has met the reset condition.

[0037] For example, the aforementioned power distribution device can record the duration for which the first discharge circuit is in the conducting state through an internally integrated timing module. When the conduction duration indicated by the internal timing module exceeds the aforementioned duration threshold, it indicates that the residual charge of the first load has been substantially discharged, meaning that the current first load has met the reset condition.

[0038] For example, the aforementioned power distribution device may integrate a current sampling circuit (e.g., a shunt resistor or a current transformer), which is located in the first discharge circuit to acquire the discharge current signal flowing through the first discharge circuit in real time. When the current discharge current indicated by the discharge current signal decays to less than a set current threshold, it indicates that the residual charge on the first load side has been substantially discharged, meaning that the current first load has met the reset condition.

[0039] For example, the aforementioned power distribution device can also calculate the voltage change rate of the first load based on the voltage signal obtained by the voltage detection circuit, using an internally integrated microcontroller or differentiating circuit. When the calculated current voltage change rate is less than a set change rate threshold, it indicates that the voltage on the first load side has entered a stable low-level state, thereby determining that the residual charge of the first load has been basically discharged, i.e., the current first load has met the reset condition. The aforementioned reset conditions can be used individually or in combination to further improve the accuracy of state determination.

[0040] Based on the above technical solution, by introducing a reset condition characterizing the charge release state, a closed-loop state confirmation mechanism is essentially constructed on the power supply side. In this embodiment, after the first power supply circuit is disconnected, power restoration is not blindly performed based on fixed time parameters. Instead, it is determined whether the first load meets the conditions for normal reset based on the actual electrical state or discharge progress of the first load. This mechanism ensures that the first discharge circuit is disconnected and the first power supply circuit is reconnected only when the residual charge of the first load is discharged to a safe level (i.e., the reset condition is met), thus ensuring that the logic unit inside the load can complete the zeroing reset. This ensures that the first load can be safely and stably restarted, reducing the risk of load restart failure.

[0041] In conjunction with the first aspect, in some implementations of the first aspect, the voltage threshold, duration threshold, current threshold, or rate of change threshold is related to the type of the first load.

[0042] For example, the aforementioned voltage threshold, duration threshold, current threshold, or rate of change threshold can be pre-calibrated based on the hardware parameters of the first load and statically configured in the aforementioned power distribution device; alternatively, the aforementioned thresholds can also be dynamically determined by the vehicle controller based on the load type or real-time operating status and sent to the power distribution device via a communication network. Furthermore, the aforementioned thresholds can also be adaptively adjusted in conjunction with external parameters such as the current ambient temperature to eliminate the influence of physical factors on charge discharge characteristics.

[0043] Based on the above technical solution, the influence of physical factors on charge discharge characteristics can be eliminated, thereby further improving the accuracy of state determination.

[0044] In conjunction with the first aspect, in some implementations of the first aspect, the first power supply circuit is gradually turned on so that the voltage of the first load rises smoothly.

[0045] For example, the aforementioned switching device can be a metal-oxide-semiconductor field-effect transistor (MOSFET). Accordingly, the power distribution device can control the output of a pulse width modulation (PWM) signal with a gradually increasing duty cycle to the control terminal (e.g., the gate) of the aforementioned switching device, causing the equivalent on-resistance of the switching device to gradually decrease from high to low. Alternatively, the power distribution device can utilize an internally integrated resistor-capacitor (RC) charging and discharging network to control the drive voltage at the control terminal of the aforementioned switching device to rise slowly at a set slope, thereby causing the switching device to operate in the linear amplification region and gradually transition to a fully saturated on-state.

[0046] Based on the above technical solution, by gradually controlling the power supply circuit to conduct, the surge current at the moment of power restoration is effectively suppressed. This mechanism not only effectively avoids damage to circuit components from the surge current, but also avoids drastic fluctuations in the power supply bus voltage, ensuring the stability and safety of the power restoration process.

[0047] In conjunction with the first aspect, in some implementations of the first aspect, the power distribution device further includes a second power distribution channel, which includes a second power supply circuit between the second load and the power source, and a second discharge circuit connected to the second load. Before the first discharge circuit is disconnected and the first power supply circuit is connected, the second power supply circuit is disconnected due to a second load fault. The first priority of the first power distribution channel and the second priority of the second power distribution channel are obtained. If the first priority is determined to be greater than or equal to the second priority, the first discharge circuit is disconnected and the first power supply circuit is connected. Alternatively, if the first priority is determined to be less than the second priority, the first discharge circuit is disconnected and the first power supply circuit is connected after the second discharge circuit is disconnected and the second power supply circuit is connected.

[0048] For example, the aforementioned priorities can be static configuration parameters pre-installed in the non-volatile memory of the power distribution unit, and can be stored in the form of a mapping table. Alternatively, they can be dynamically changing. The power distribution unit can receive dynamic priority messages issued by the upper-level vehicle controller based on the current operating conditions of the system (e.g., the vehicle is traveling at high speed, stationary, or charging), and parse them to obtain the real-time priority of each power distribution channel.

[0049] For example, considering the possibility that multiple power distribution channels may have the same priority, to ensure the uniqueness and determinism of the queue order, the following arbitration mechanism can be introduced: When it is determined that at least two power distribution channels have the same priority, secondary determination parameters of the aforementioned at least two power distribution channels (such as hardware channel number, rated load current, or the order in which faults occurred) can be further obtained. Then, a secondary sorting is performed based on these secondary determination parameters.

[0050] For example, in order to completely avoid the superposition of electrical stress at the moment of power-on of the two channels, when the power supply circuits of two adjacent power distribution channels (such as the preceding channel and the following channel) are turned on in order of priority, real-time monitoring or timing can be started after the reset operation of the preceding channel is completed; when the electrical parameters (such as load voltage or current) of the preceding power distribution channel are detected to have reached the set stable state, or when the waiting time reaches the preset surge protection time threshold (such as tens of milliseconds to hundreds of milliseconds), the reset operation of the following power distribution channel is then performed.

[0051] Based on the above technical solution, when multiple power distribution channels are waiting for power restoration at the same time, the order of priority is determined according to the importance of the load, and each power supply circuit is turned on one by one. This realizes the time-sharing of multiple power supply circuits, thereby effectively avoiding the sudden drop in bus voltage and the superposition of surge current caused by multiple loads being powered on at the same time, and ensuring the overall electrical stability of the power distribution system during the complex fault recovery process.

[0052] In conjunction with the first aspect, in some implementations of the first aspect, after the first power supply circuit is turned on, the reset result of the first power distribution channel is monitored; if the reset result is a reset failure, the first power distribution channel is reset again.

[0053] Based on the above technical solution, a closed-loop monitoring and retry mechanism for the reset result is introduced into the reset process, which can confirm whether the reset operation has truly eliminated the fault, thereby providing a basis for subsequent safety control.

[0054] In conjunction with the first aspect, in some implementations of the first aspect, a reset failure includes situations where, after the first power supply circuit is turned on, the current flowing through the first power distribution channel is still greater than the overcurrent threshold, or the first load still experiences an OTA upgrade failure.

[0055] Based on the above technical solution, continuous anomaly verification is achieved in both physical hardware and software logic dimensions.

[0056] In conjunction with the first aspect, in some implementations of the first aspect, the number of retries for resetting the first power distribution channel is recorded; in response to the number of retries reaching the threshold and the first power distribution channel still failing to reset, the disconnection state of the first power supply circuit is locked and fault information for the first load is reported.

[0057] For example, the microcontroller inside the power distribution unit can record the number of retries by setting a dedicated counter variable. To achieve more refined safety control, the threshold number can be a pre-set fixed value (e.g., 3 or 5 times) or a dynamically allocated, differentiated threshold based on the fault type. For instance, for type I faults such as short circuits or overcurrents, to maximize the protection of the underlying hardware, the corresponding threshold number can be set to a smaller value (e.g., 1 or 2 times); while for type II faults such as failed OTA upgrades, considering that software flashing and handshaking may require multiple attempts, the corresponding threshold number can be set to a larger value (e.g., 5 times).

[0058] Based on the above technical solution, by introducing a retry mechanism that monitors the reset result and limits the number of retry attempts after the power supply circuit is turned on, it is possible to automatically recover from intermittent faults and avoid repeated power-on attempts when persistent faults occur. This approach effectively prevents abnormal currents or persistent software errors from causing repeated impacts on the power distribution equipment and power supply bus, achieves effective isolation and information reporting of permanent faults, and improves the operational stability and safety of the power distribution system.

[0059] Secondly, a control method is provided, applied to a control device, the control device being communicatively connected to a power distribution device, the power distribution device including a first power distribution channel, the first power distribution channel including a first power supply circuit between a first load and a power source, and a first discharge circuit connected to the first load, the control method including: determining that a fault has occurred in the first load; generating target indication information based on the fault; sending the target indication information to the power distribution device to instruct the power distribution device to conduct the first discharge circuit to discharge the residual charge of the first load, and re-conducting the first power supply circuit after a reset condition is met.

[0060] For example, in other electrical systems (such as industrial control systems, communication base stations, or data centers), the vehicle controller that communicates and coordinates with the power distribution unit can be replaced by the main control equipment, central computing unit, or host computer controller in the electrical system (these devices all fall under the category of controllers / control devices).

[0061] Based on the above technical solution, the control device realizes a complete closed-loop control mechanism for fault reporting and reset strategy issuance through interaction with the power distribution device.

[0062] In conjunction with the second aspect, in certain implementations of the second aspect, determining that the first load has failed includes any one of the following: receiving status information reported by the power distribution device and determining that the first load has experienced a first type of failure based on the status information, wherein the status information indicates that an overcurrent has occurred in the first power distribution channel and the first power supply circuit has been disconnected, and the first type of failure includes the current flowing through the first power distribution channel being greater than the overcurrent threshold; or, detecting that the first load has experienced a second type of failure, wherein the second type of failure includes the first load experiencing an OTA upgrade failure.

[0063] For example, when the power distribution unit responds to a first type of fault through its internal fault detection circuit and triggers the power outage of the first power supply circuit, the power distribution unit can report status information, including fault channel identifier and fault type (such as short circuit, overcurrent diagnostic code, etc.), to the vehicle controller in real time through the vehicle communication bus to trigger the vehicle controller's subsequent reset strategy.

[0064] For example, if the OTA management module or diagnostic module of the vehicle controller detects a load write verification failure or communication timeout during the process of software writing, upgrading or data interaction of the first load, it can determine that the first load has experienced a second type of fault.

[0065] Based on the above technical solution, differentiated status perception can be achieved for faults at different levels, providing a reliable basis for the subsequent accurate issuance of reset commands.

[0066] In conjunction with the second aspect, in some implementations of the second aspect, before sending the target indication information to the power distribution device, a target functional module that has a business association with the first load is identified; a third indication information is sent to the target functional module, the third indication information being used to instruct the target functional module to back up data about the first load.

[0067] Based on the above technical solution, the associated target functional modules can save key operating data or execute safe exit logic in advance, avoiding data loss or abnormal system status due to the subsequent power outage reset process of the power distribution device.

[0068] In conjunction with the second aspect, in some implementations of the second aspect, before generating target indication information based on the fault, the type of the first load is obtained; based on the type of the first load, target reset parameters are determined, the target reset parameters including the threshold corresponding to the reset condition, and the target indication information carries the target reset parameters.

[0069] Based on the above technical solution, the reset threshold can be dynamically configured according to the hardware discharge characteristics of different types of loads, thereby improving the adaptability and compatibility of the reset strategy.

[0070] Thirdly, a power distribution device is provided, including at least one power distribution channel, the power distribution channel including: a first switch connected in series between a power source and a load to form a power supply circuit; a second switch connected in series between the load and a discharge terminal to form a discharge circuit, the discharge terminal being used to receive residual charge from the load; and a control circuit electrically connected to the first switch and the second switch respectively, the control circuit being used to: control the first switch to open and the second switch to close in response to a load fault.

[0071] Based on the above technical solution, this power distribution device achieves proactive intervention in fault handling by disconnecting the first switch to physically isolate the faulty node when a load fault occurs, and turning on the second switch to actively discharge the residual charge on the load side. This mechanism not only effectively avoids the faulty load from remaining in an abnormal state for a long time due to residual energy not being cleared, but also shortens the time required for the load's electrical state to recover to a safe baseline, thereby improving the reliability of the underlying hardware protection of the power distribution system.

[0072] In conjunction with the third aspect, in some implementations of the third aspect, the control circuit is also used to: control the second switch to open and control the first switch to open after the load meets the reset condition, wherein the reset condition is used to indicate that the load has completed the release of residual charge.

[0073] Based on the above technical solution, not only is the abnormal transient impact caused by the superposition of residual charge and connected power supply eliminated, but the logic unit inside the load is also guaranteed to execute the standard power-on reset procedure, thereby improving the recovery success rate of the power distribution device in dealing with various faults.

[0074] In conjunction with the third aspect, in some implementations of the third aspect, the control circuit includes a main control unit, which is used to control the first switch and the second switch to be turned on or off respectively.

[0075] Based on the above technical solution, a hardware foundation with logic execution and program control capabilities can be provided for the opening and closing of the first and second switches.

[0076] In conjunction with the third aspect, in some implementations of the third aspect, the first switch and the second switch are transistors; the first terminal of the first switch is electrically connected to the positive terminal of the power supply, the second terminal of the first switch is electrically connected to the positive terminal of the load, and the control terminal of the first switch is electrically connected to the first output terminal of the main control unit; the first terminal of the second switch is electrically connected to the positive terminal of the load, the second terminal of the second switch is electrically connected to the discharge terminal, and the control terminal of the second switch is electrically connected to the second output terminal of the main control unit.

[0077] In conjunction with the third aspect, in some implementations of the third aspect, the control circuit further includes: a fault detection circuit, the input of which is electrically connected to the power supply circuit, and the output of which is electrically connected to the control terminal of the first switch; the fault detection circuit is used to: continuously output a latch signal when it detects that the current flowing through the power supply circuit is greater than the overcurrent threshold, and the latch signal is used to control the opening of the first switch.

[0078] For example, to be compatible with various loads with different starting current characteristics, the fault detection circuit described above can have a programmable threshold configuration function. The control circuit can dynamically adjust the reference voltage preset by its internal comparator according to the characteristics of different loads, thereby realizing the dynamic configuration and adjustment of the overcurrent protection threshold.

[0079] Based on the above technical solution, the fault detection circuit achieves a rapid-response hardware protection mechanism. When a first-type fault such as a short circuit occurs in the load, this part of the circuit can automatically cut off the first switch in a short time, avoiding the response delay caused by the main control unit due to software polling cycle or program interruption, and preventing the damage of huge surge current to the electronic components and power supply bus inside the power distribution channel.

[0080] In conjunction with the third aspect, in some implementations of the third aspect, the fault detection circuit includes: a shunt resistor connected in series between the first switch and the load; a comparator circuit, the input of which is electrically connected to the shunt resistor; and a latch circuit, the input of which is electrically connected to the output of the comparator circuit, and the output of which is electrically connected to the control terminal of the first switch.

[0081] Based on the above technical solution, the two voltage sampling lines used to connect the differential amplifier are independently led out from the two ends of the shunt resistor, and are physically separated from the high current power transmission lines, thereby effectively eliminating the interference caused by the parasitic impedance of the power supply circuit lines to the small sampling voltage.

[0082] In conjunction with the third aspect, in some implementations of the third aspect, the comparator circuit is used to detect the current flowing through the shunt resistor and outputs a trigger signal when the current is greater than the overcurrent threshold. The trigger signal is used to trigger the latch circuit to output a latch signal.

[0083] Based on the above technical solution, the comparison circuit's comparison of these two voltage signals is physically and logically equivalent to the comparison of the real-time current in the power supply circuit with the overcurrent threshold, which can accurately capture the instantaneous short-circuit pulse in the power supply circuit.

[0084] In conjunction with the third aspect, in some implementations of the third aspect, the controlled terminal of the latch circuit is electrically connected to the third output terminal of the main control unit.

[0085] In conjunction with the third aspect, in some implementations of the third aspect, the main control unit is also used to: send an unlock signal to the latch circuit before controlling the first switch to turn on, the unlock signal being used to control the latch circuit to stop outputting the latch signal.

[0086] For example, in actual business processing, when the system confirms that the fault has been eliminated, or receives a retry command, the main control unit can send an unlock signal to the latch circuit through this third output terminal. This unlock signal is used to clear the memory state of the trigger, causing the latch circuit to stop outputting the aforementioned latch signal.

[0087] Based on the above technical solution, after successfully unlocking the physical lock of the underlying hardware, the main control unit regains control of the first switch and then normally starts the subsequent active discharge and power supply reset process.

[0088] In conjunction with the third aspect, in some implementations of the third aspect, the control circuit further includes: a voltage detection circuit, the input terminal of which is electrically connected to the positive terminal of the load, and the output terminal of which is electrically connected to the input terminal of the main control unit. The voltage detection circuit is used to detect the voltage of the load and output a voltage signal. Specifically, the main control unit is used to determine that the load meets the reset condition when the voltage indicated by the voltage signal is less than the voltage threshold.

[0089] Based on the above technical solution, by introducing a voltage detection circuit, the control circuit can perform hardware-level closed-loop monitoring of the discharge status of residual charge on the load side, avoiding the evaluation error that may be caused by software fixed delay, thereby ensuring the safety of subsequent reclosing of the power supply circuit.

[0090] In conjunction with the third aspect, in some implementations of the third aspect, the control circuit further includes: a drive circuit, wherein the first output terminal and the second output terminal of the main control unit are electrically connected to the control terminal of the first switch and the control terminal of the second switch, respectively, through the drive circuit.

[0091] Based on the above technical solution, the low-voltage signal can be boosted and converted into a large current drive signal higher than the power supply potential, so as to quickly overcome the internal parasitic capacitance of the transistor and fully drive the first switch to conduct; the push-pull amplifier circuit can provide a large transient current, thereby improving the slew rate and load capacity of the control signal and ensuring the rapid action response of the second switch during the active discharge process.

[0092] In conjunction with the third aspect, in some implementations of the third aspect, the main control unit includes: a control logic circuit, a signal isolation circuit, and a main controller; the first output terminal, the second output terminal, and the third output terminal of the main control unit are output terminals of the control logic circuit; the first side port of the signal isolation circuit is electrically connected to the main controller, and the second side port of the signal isolation circuit is electrically connected to the control logic circuit; the main controller is used to output control commands and transmit them to the control logic circuit through the signal isolation circuit; the control logic circuit is used to execute the control commands.

[0093] Based on the above technical solution, the signal isolation circuit allows control commands to be transmitted bidirectionally in the form of optical signals or high-frequency magnetic fields, and blocks the direct electrical conduction path, thereby preventing common-mode interference and surge voltage from damaging the main controller in the event of a short circuit or power failure in the power supply circuit.

[0094] Fourthly, a power distribution device is provided, including a module or unit for performing the method as described in any of the possible implementations of the first aspect above.

[0095] Fifthly, a power distribution device is provided, including at least one processor coupled to at least one memory, the at least one processor being configured to execute a computer program or instructions stored in the at least one memory to cause the device to perform a method as described in any of the possible implementations of the first aspect above.

[0096] In a sixth aspect, a control device is provided, comprising a module or unit for performing the method as described in any of the possible implementations of the second aspect above.

[0097] In a seventh aspect, a control device is provided, comprising at least one processor coupled to at least one memory, the at least one processor being configured to execute a computer program or instructions stored in the at least one memory to cause the device to perform a method as described in any of the possible implementations of the second aspect above.

[0098] Eighthly, an electrical system is provided, including a power distribution device as described in the fourth or fifth aspect, and a control device as described in the sixth or seventh aspect, the control device being communicatively connected to the power distribution device.

[0099] In a ninth aspect, a vehicle is provided, including an electrical system as described in the ninth aspect.

[0100] In a tenth aspect, a computer program product is provided, the computer program product comprising: computer program code, which, when the computer program code is run on a computer, causes the computer to perform a method in any possible implementation of the first aspect, or to perform a method in any possible implementation of the second aspect.

[0101] Eleventhly, a computer-readable storage medium is provided, which stores a computer program that, when run on a computer, causes the computer to perform the method in any possible implementation of the first aspect or the method in any possible implementation of the second aspect. Attached Figure Description

[0102] Figure 1 This is a functional schematic diagram of the vehicle 100 provided in the embodiments of this application; Figure 2 This is a topology diagram of a vehicle electrical system 200; Figure 3 This is a schematic diagram of the circuit topology of a power distribution device 300 according to an embodiment of this application; Figure 4 This is a flowchart illustrating a control method 400 proposed in an embodiment of this application; Figure 5 This is a schematic diagram of the processing paths for two types of faults proposed in the embodiments of this application; Figure 6 This is a flowchart illustrating a multi-channel reset method 600 proposed in an embodiment of this application; Figure 7 This is a schematic diagram of a fault handling process 700 proposed in an embodiment of this application; Figure 8 This is a schematic diagram of another fault handling process 800 proposed in the embodiments of this application; Figure 9 This is a circuit diagram of a power distribution device 900 according to an embodiment of this application; Figure 10 This is a partial signal timing diagram of the power distribution device during operation according to an embodiment of this application; Figure 11 This is a circuit diagram of another power distribution device 900 proposed in an embodiment of this application; Figure 12 This is a circuit diagram of another power distribution device 900 proposed in an embodiment of this application; Figure 13 This is a circuit diagram of another power distribution device 900 proposed in an embodiment of this application; Figure 14 This is a schematic block diagram of a power distribution device 1400 proposed in an embodiment of this application; Figure 15 This is a schematic block diagram of a control device 1500 proposed in an embodiment of this application; Figure 16 This is a schematic block diagram of a control device 1600 proposed in an embodiment of this application. Detailed Implementation

[0103] It should be noted that, in the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in this article is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone.

[0104] In the embodiments of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more, and "at least one" and "one or more" refer to one, two, or more than two. The singular expressions "a," "an," "the," "the," "the," and "this" are intended to also include expressions such as "one or more," unless the context explicitly indicates otherwise.

[0105] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0106] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0107] Figure 1 This is a functional schematic diagram of the vehicle 100 provided in the embodiments of this application.

[0108] Vehicle 100 may include multiple subsystems, such as perception system 110 and computing platform 120. Optionally, vehicle 100 may include more or fewer subsystems, and each subsystem may include one or more components. In addition, each subsystem and component of vehicle 100 may be interconnected via wired or wireless means.

[0109] The perception system 110 may include several types of sensors for sensing information about the environment surrounding the vehicle 100. For example, the perception system 110 may include a positioning system, which may be a global positioning system (GPS), a BeiDou system, or another positioning system. The perception system 110 may include one or more of the following: an inertial measurement unit (IMU), lidar, millimeter-wave radar, ultrasonic radar, and a camera device.

[0110] Some or all of the functions of vehicle 100 can be controlled by computing platform 120. Computing platform 120 may include processors 121 to 12n (n being a positive integer). A processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a central processing unit (CPU), microprocessor unit (MPU), graphics processing unit (GPU) (which can be understood as a type of microprocessor), or digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. These logical relationships are fixed or reconfigurable. For example, the processor may be a hardware circuit implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as a field-programmable gate array (FPGA). In reconfigurable hardware circuits, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement related functions. Furthermore, the processor can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), tensor processing unit (TPU), deep learning processing unit (DPU), etc. In addition, the computing platform 120 may also include a memory for storing instructions. Some or all of the processors 121 to 12n can call the instructions in the memory to implement the corresponding functions.

[0111] The computing platform 120 can control the functions of the vehicle 100 based on inputs received from various subsystems (e.g., the sensing system 110). In some embodiments, the computing platform 120 can be used to provide control over many aspects of the vehicle 100 and its subsystems.

[0112] Optionally, the above components are just an example. In actual applications, the components in each of the above modules may be added or deleted as needed.

[0113] The vehicle 100 in this application may include: road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the vehicle 100 may be a means of transportation (such as commercial vehicles, passenger cars, motorcycles, flying cars, trains, etc.), industrial vehicles (such as forklifts, trailers, tractors, etc.), engineering vehicles (such as excavators, bulldozers, cranes, etc.), agricultural equipment (such as lawnmowers, harvesters, etc.), amusement equipment, toy vehicles, etc.; or the vehicle 100 may include a mobile device with wheels or tracks, etc. The embodiments of this application do not specifically limit the type of vehicle.

[0114] With the development of vehicle electrical systems, power distribution devices are widely used in the power supply control of loads.

[0115] Figure 2 This is a topology diagram of a vehicle electrical system 200.

[0116] refer to Figure 2 As shown, the vehicle electrical system 200 belongs to a conventional on-board power distribution architecture. The vehicle electrical system 200 includes a power supply 210, a power distribution unit 220, one or more loads 230, and a domain controller 240 for performing central dispatch management.

[0117] The aforementioned power distribution device 220 is connected in series between the power supply 210 and the load 230 to form a power supply circuit between the power supply 210 and the load 230. The power distribution device 220 typically uses internal switching devices or protective components to connect or disconnect this power supply circuit. During normal operation, the domain controller 240 is responsible for monitoring the status of the load 230 and managing software upgrades.

[0118] At present, in order to achieve power distribution and protection functions, power distribution device 220 usually adopts a solution of conventional fuses combined with relays, a solution of integrated protection chips, or a solution of microcontrollers controlling electronic switches through software logic.

[0119] For example, in a solution using conventional fuses combined with relays, the fuse provides overcurrent protection, while the relay controls on / off switching. However, conventional fuses can only blow once, requiring manual physical replacement after a fault, and cannot be remotely reset via software commands. Furthermore, relays have a delayed response time and are limited by their mechanical lifespan, and this solution struggles to achieve independent isolation control at the channel level.

[0120] For example, in solutions employing integrated protection chips (such as electronic fuse chips), these chips typically integrate overcurrent protection and diagnostic functions, and some integrated protection chips are equipped with active discharge pins. However, the above solutions usually only provide chip-level local protection functions. When performing complex system-level fault recovery or power-off retry operations in conjunction with the domain controller 240, they lack a coordination mechanism with the upper-level software domain of the system.

[0121] For example, in a scheme using a microcontroller to control an electronic switch, the power distribution device 220 typically relies on the microcontroller's software program to periodically collect and analyze the electrical signals of the power supply circuit. After determining that a fault such as overcurrent has occurred on the load side, the microcontroller processes the data and outputs a control signal to instruct the electronic switch to open, thereby cutting off the power supply circuit. However, the response mechanism based on the periodic polling and calculation of the software program requires a corresponding processing cycle. When a severe short circuit or other condition occurs on the load side, the microcontroller's response is delayed, causing the fault current to continue flowing through the power supply circuit during the aforementioned processing cycle, which can easily cause the electronic switch to be damaged due to overheating.

[0122] Furthermore, in scenarios involving system-level resets or software upgrades, if the domain controller 240 detects a software malfunction, write verification failure, or communication timeout on the load side, it will generate a reset command or power-off control command and send it to the underlying power distribution unit 220 via the vehicle's internal communication network. Upon receiving the command, the power distribution unit 220 controls its internal switching devices to disconnect the power supply circuit. After a pre-defined software delay, it then controls the switching devices to close again to attempt to reconnect the power supply circuit, thereby cooperating with the domain controller to complete the power-off and restart operations for the load 230.

[0123] However, during the restart process based on the domain controller 240's instructions, since some loads 230 typically contain energy storage devices such as large-capacity capacitors, the residual charge on the load side takes a long time to dissipate naturally after the power supply circuit is cut off, resulting in slow voltage decay at the load end. When the power distribution device 220 directly reconnects the power supply circuit according to the restart command from the domain controller 240, the residual charge that has not been completely discharged interacts with the reconnected power supply, making it easy for abnormal transient electrical signals to be generated on the load side. These abnormal transient electrical signals pose a risk of damaging hardware components and may cause the logic state inside the load 230 to fail to reset.

[0124] Based on the above analysis, it can be seen that in the process of power distribution device 220 cooperating with domain controller 240 to perform power outage and restart, when dealing with complex fault conditions or upgrade interruption scenarios, it is unable to stably eliminate the abnormal electrical state of the load, making it impossible for the system to achieve fast and safe automatic recovery, thereby reducing the reliability of power distribution device 220 in the fault recovery process and the overall upgrade success rate of the system.

[0125] In view of this, embodiments of this application propose a control method that can be implemented based on a power distribution device with the following circuit structure proposed in embodiments of this application, in order to solve the above problems.

[0126] Figure 3 This is a schematic diagram of the circuit topology of a power distribution device 300 proposed in an embodiment of this application.

[0127] refer to Figure 3 As shown, the power distribution device 300 may include multiple power distribution channels. For ease of description, this... Figure 3 Only the circuit topology of the first power distribution channel is shown. The first power distribution channel includes a first power supply circuit between a first load and a power source, and a first discharge circuit connected to the first load.

[0128] In some possible embodiments, the aforementioned power distribution device 300 can be applied to vehicle electrical systems. Of course, it can also be applied to other electrical systems, such as industrial control systems, communication base station power systems, or data center server power management systems. In these application scenarios, such as industrial control systems, communication base station power systems, or data center servers, there are usually electrical loads containing energy storage devices, and the corresponding systems require stability in restoring their electrical state when facing power outages. By applying the aforementioned power distribution device 300 to these other electrical systems, residual charge on the load side can be discharged by actively intervening in the switching sequence of the power supply circuit and the discharge circuit, thereby eliminating abnormal transient electrical signals that are easily generated when the power supply circuit is reconnected. Based on this cross-scenario application method, the reliability of these other electrical systems during power restoration is improved. For ease of description, this application uses a vehicle electrical system as the main application scenario to provide a detailed description of the embodiments.

[0129] The aforementioned power distribution channels are electrical control units within the power distribution device 300 used for independent power supply management to specific loads. Each power distribution channel is independent in physical structure and control logic to achieve independent isolation and control of power supply states for different loads.

[0130] The aforementioned first power supply circuit is a power transmission channel located between the power source and the first load. The power distribution device 300 has the capability to control the on / off state of the aforementioned first power supply circuit. Under normal power supply conditions, the power distribution device 300 can control the first power supply circuit to be in a conducting state, so that the power output from the power source is continuously transmitted to the first load through the first power supply circuit; in the event of a fault or receipt of a specific control command, the power distribution device 300 can control the first power supply circuit to be switched to a disconnected state, so as to block the electrical connection between the power source and the first load.

[0131] The aforementioned first discharge circuit is a charge release channel located between the first load and the discharge terminal (e.g., grounding terminal). The power distribution device 300 also has the capability to control the on / off state of the aforementioned first discharge circuit. When the aforementioned first power supply circuit is in a disconnected state, the power distribution device 300 can control the first discharge circuit to switch to a conducting state. By activating the aforementioned first discharge circuit, the power distribution device 300 constructs a release path for the residual charge remaining in the energy storage device inside the first load, thereby accelerating the restoration of the electrical state on the first load side.

[0132] Based on the above architecture, the power distribution device 300 can actively intervene in the power supply, power outage, and residual charge discharge process of the first load by coordinating and controlling the on / off timing of the first power supply circuit and the first discharge circuit. The specific hardware components used within the power distribution device 300 to implement the aforementioned circuit on / off control will be described in detail later.

[0133] For the aforementioned power distribution device 300, the embodiments of this application propose the following control method.

[0134] Figure 4 This is a schematic flowchart of a control method 400 proposed in an embodiment of this application. The control method 400 can be executed by the aforementioned power distribution device 300.

[0135] refer to Figure 4 As shown, the control method 400 may include the following operations: S410: In response to a fault in the first load, disconnect the first power supply circuit.

[0136] In some possible embodiments, the circumstances under which the first load fails include, but are not limited to: abnormal current flowing through the power supply circuit (e.g., short circuit fault, overcurrent fault, etc.), abnormal operation of the software inside the load, timeout of the communication network, or failure of the vehicle to perform OTA upgrade task.

[0137] In some possible embodiments, the above-mentioned faults can be divided into two categories: a first type of fault and a second type of fault. The first type of fault may be a hardware fault occurring in a component located in the first power supply circuit, such as a short circuit fault or an overcurrent fault, where the current flowing through the first power distribution channel exceeds the overcurrent threshold. The second type of fault may be a software fault related to the load service, such as an OTA upgrade failure of the first load.

[0138] For different types of faults, the power distribution unit can respond to the fault and cut off the first power supply circuit through different triggering mechanisms.

[0139] In one possible implementation, the aforementioned fault can be monitored by the vehicle controller in the vehicle's electrical system. The vehicle controller can be a central domain controller (CDC) or a vehicle control unit (VCU). When the vehicle controller determines through software logic that the first load has experienced an OTA upgrade failure or a software program freeze, it generates a specific instruction (e.g., a power-off retry instruction or a reset instruction) to indicate the fault in the first load and sends it to the power distribution unit 300 via a communication network. Upon receiving the instruction, the power distribution unit 300 disconnects the first power supply circuit according to the control information carried in the instruction. Of course, this fault feedback and handling method can also be used in the event of a hardware fault.

[0140] In another possible implementation, the power distribution device can monitor the electrical parameters of the first power supply circuit in real time using an internally integrated fault detection circuit (such as a current sampling and comparison circuit). When the fault detection circuit detects that the current flowing through the first power supply circuit exceeds a set overcurrent threshold, the power distribution device can directly control and disconnect the first power supply circuit at the underlying hardware level. This circuit architecture is detailed in subsequent embodiments and will not be elaborated upon here.

[0141] S420: Turn on the first discharge circuit to discharge the residual charge of the first load.

[0142] After the first power supply circuit is disconnected, considering that the first load usually contains energy storage devices such as large-capacity capacitors, a certain amount of charge will remain on the first load side. Therefore, by activating the first discharge circuit, the power distribution device establishes a low-impedance charge discharge path between the first load and the discharge terminal. The charge remaining on the first load side can flow quickly to the discharge terminal along this first discharge circuit, thereby significantly shortening the charge discharge time (e.g., reducing the time from seconds of natural discharge to milliseconds). Based on this, it is possible to avoid the first load being in a state of functional interruption for an extended period due to long recovery times, while also avoiding abnormal transient electrical signals caused by directly reactivating the power supply circuit before the residual charge has been completely discharged, and avoiding reset anomalies caused by the load's internal logic units not being cleared. This provides a safe reset environment with a defined state for the first load.

[0143] In some possible embodiments, during the process of controlling the opening of the first discharge circuit, the power distribution device can simultaneously maintain the first power supply circuit in a disconnected state. For example, this can be achieved by interlocking the power supply and discharge logic in the time dimension, i.e., when the first power supply circuit is open, the first discharge circuit cannot be closed; when the first discharge circuit is open, the first power supply circuit cannot be closed. Based on this, abnormal opening of the first discharge circuit when the power supply circuit is open can be avoided, preventing the electrical energy output from the power supply from flowing directly to the discharge reference terminal through the first discharge circuit, thereby eliminating the safety hazard of power short circuit in the electrical system.

[0144] S430: In response to the first load satisfying the reset condition, the first discharge circuit is disconnected and the first power supply circuit is turned on, wherein the reset condition is used to indicate that the first load has completed the release of residual charge.

[0145] The aforementioned reset conditions can serve as a basis for determining whether the electrical state of the first load side has been restored to a safe level.

[0146] It should be noted that, in the embodiments of this application, the above-mentioned "reset" can refer to the complete restart process of powering off and then powering on the load (i.e., the power supply circuit switches from a closed state to an open state and then switches back to a closed state), or it can refer to the restoration action of reconnecting the power supply circuit after disconnecting it (i.e., the power supply circuit switches from an open state to a closed state).

[0147] In some possible embodiments, the reset condition includes at least one of the following: the voltage of the first load is lower than a voltage threshold, the conduction duration of the first discharge circuit is greater than a duration threshold, the discharge current of the first discharge circuit is less than a current threshold, or the voltage change rate of the first load is less than a change rate threshold.

[0148] In some possible embodiments, the power distribution device described above may integrate a voltage detection circuit, which is electrically connected to the first load to acquire the voltage signal of the first load in real time. When the current voltage indicated by the voltage signal decays to less than a set voltage threshold (e.g., 0.5V), it indicates that the residual charge of the first load has been substantially discharged, meaning that the current first load has met the reset condition.

[0149] In some possible embodiments, the aforementioned power distribution device can record the duration of the first discharge circuit being in the conducting state through an internally integrated timing module. This duration threshold can be pre-calculated based on the equivalent capacitance parameters of the energy storage device inside the first load and the equivalent resistance parameters of the first discharge circuit, and configured in the power distribution device, or calculated or configured by the vehicle controller, and sent to the power distribution device when the vehicle controller instructs the power distribution device to disconnect the first power supply circuit. When the conduction duration indicated by the internal timing module exceeds the aforementioned duration threshold, it indicates that the residual charge of the first load has been substantially discharged, meaning that the current first load has met the reset condition.

[0150] In some possible embodiments, the aforementioned power distribution device may integrate a current sampling circuit (e.g., a shunt resistor or a current transformer), which is located in the first discharge circuit to acquire the discharge current signal flowing through the first discharge circuit in real time. Based on the discharge physical characteristics of the energy storage device, the discharge current gradually decreases as residual charge is released. When the current discharge current indicated by the discharge current signal decreases to less than a set current threshold, it indicates that the residual charge on the first load side has been substantially discharged, meaning that the first load has met the reset condition.

[0151] In some possible embodiments, the power distribution device can also calculate the voltage change rate of the first load based on the voltage signal obtained by the voltage detection circuit, using an internally integrated microcontroller or differentiating circuit. At the end of the charge discharge process, the decreasing trend of the load-side voltage will gradually level off. When the calculated current voltage change rate is less than a set change rate threshold, it indicates that the voltage on the first load side has entered a stable low-level state, thus determining that the residual charge of the first load has been essentially discharged, meaning that the first load has met the reset condition.

[0152] In some possible embodiments, the aforementioned voltage threshold, duration threshold, current threshold, or rate of change threshold can be pre-calibrated based on the hardware parameters of the first load and statically configured in the aforementioned power distribution device; alternatively, the aforementioned thresholds can also be dynamically determined by the vehicle controller based on the load type or real-time operating status and sent to the power distribution device via a communication network. Furthermore, the aforementioned thresholds can also be adaptively adjusted in conjunction with external parameters such as the current ambient temperature to eliminate the influence of physical factors on charge discharge characteristics.

[0153] In some possible embodiments, the above reset conditions can be used individually or in combination to further improve the accuracy of state determination.

[0154] During the execution of the above control method, in the state recovery phase after the power supply circuit is cut off due to a fault in the first load, this embodiment does not wait for the residual charge inside the first load to dissipate naturally before blindly restarting. Instead, after cutting off the first power supply circuit, this control method actively discharges the residual energy remaining on the load side by connecting the first discharge circuit, forcibly and quickly lowering the voltage on the load side, reducing the time required for state recovery, and thus avoiding the important load being in a state of functional interruption due to excessively long fault recovery time.

[0155] On the other hand, this application embodiment introduces a reset condition characterizing the charge release state, which is equivalent to constructing a closed-loop state confirmation mechanism on the power supply side. In this application embodiment, after the first power supply circuit is cut off, the power supply restoration is not blindly performed based on fixed time parameters, but rather based on the actual electrical state or discharge progress of the first load to determine whether the first load has the conditions for normal reset. This mechanism ensures that when the residual charge of the first load is discharged to a safe level (i.e., the reset condition is met), that is, when the logic unit inside the load can complete the zeroing reset, the first discharge circuit is cut off and the first power supply circuit is reconnected to perform the reset operation, thereby ensuring that the first load can be restarted safely and stably, reducing the risk of load restart failure.

[0156] Based on the above technical solution, by responding to a fault and disconnecting the power supply circuit between the load and the power source, the continuous action of the fault on the circuit, which could damage components and cause safety hazards, is avoided. Furthermore, by actively intervening to open the discharge circuit to release residual charge on the load side, and combined with a reset condition determination mechanism for the first load, abnormal transient electrical signals caused by the interaction between residual charge not fully discharged in the first load and the reconnected power supply are prevented. This process not only eliminates the risk of damage to hardware components due to electrical surges but also ensures that the logic units inside the load can be cleared and reset. Through this collaborative control mechanism, the power distribution device achieves rapid and safe automatic recovery in scenarios such as complex faults or OTA upgrade failures, reducing the time consumed in the load fault recovery process and improving the reliability of restoring power supply to the load.

[0157] Furthermore, this application provides corresponding fault handling methods for different types of faults.

[0158] Figure 5 This is a schematic diagram of the processing paths for two types of faults proposed in the embodiments of this application.

[0159] In some possible embodiments, reference Figure 5 As shown, in the event of a first type of fault in the first load, while cutting off the first power supply circuit based on the first type of fault, the disconnection status of the first power supply circuit can also be further locked.

[0160] The locking operation for Type I faults (such as hardware-level faults like overcurrent and short circuits) is primarily based on electrical safety considerations at the underlying hardware level. Type I faults typically exhibit highly destructive and prolonged physical characteristics. If the power supply circuit is simply disconnected without any restrictions on this disconnection state, the electrical system's conventional retry mechanisms or abnormal software logic may frequently issue reconnection commands, causing repeated short-circuit current surges into the power supply circuit. This can easily burn out the switching devices inside the power distribution equipment and may even trigger serious system-level safety hazards such as thermal runaway.

[0161] In one possible embodiment, a hardware latching circuit (such as an integrated latch or trigger) can be integrated into the power distribution device to maintain the level signal corresponding to the cut-off state, thereby relying on the underlying hardware logic to block the control signal attempting to reconnect the first power supply circuit. Alternatively, a fixed fault flag can be written into the non-volatile memory of the microcontroller inside the power distribution device to reject subsequent turn-on commands at the software logic level. Alternatively, a combination of hardware latching and software flags can be used to achieve dual locking; this embodiment of the application does not specifically limit this approach.

[0162] Based on the above fault latching mechanism, by locking the disconnection state of the first type of fault, the fault node is forcibly isolated from the physical or logical level, preventing repeated impacts of dangerous current caused by abnormal closure of the first power supply circuit, thereby ensuring the electrical safety of the power distribution device and the underlying hardware.

[0163] However, although the aforementioned locking mechanism ensures the underlying security of the system, it is still necessary to control the power distribution device to release the locked state in order to attempt to restore normal power supply after the vehicle has been repaired, the fault has been eliminated, or the system has confirmed that the incident was an isolated accident. Therefore, this application further proposes a corresponding unlocking mechanism, which includes the following operation: the power distribution device can receive a first indication message, which instructs the release of the lock on the aforementioned disconnected state, so that the power distribution device, simultaneously with or after releasing the lock according to the first indication message, connects the aforementioned first discharge circuit.

[0164] In some possible embodiments, the aforementioned first instruction information may be issued by the vehicle controller in the vehicle's electrical system, an external diagnostic device, or a cloud-based backend.

[0165] In some possible embodiments, the aforementioned first indication information may be a specific unlock message transmitted via an onboard communication bus (such as a CAN bus) or a specific level trigger signal transmitted via a dedicated hardwire.

[0166] In some possible embodiments, the first indication information may be generated and sent to the underlying power distribution device only after the vehicle controller has completed in-depth system-level diagnostics and determined that the fault source has been isolated, or after the maintenance personnel have cleared the corresponding hardware fault codes through diagnostic equipment. The first indication information may be the reset command mentioned above.

[0167] In addition, to prevent misunderstandings, the first instruction message can also carry a specific security authentication key, and the power distribution device will only execute a response after the verification is successful.

[0168] In the above unlocking mechanism, considering that the first type of fault usually requires manual intervention or high-level system diagnosis to confirm and eliminate, the unlocking authority of the first power supply circuit is handed over to the specific indication information of the upper-level system (such as vehicle controller or diagnostic tool) to trigger it, rather than being automatically retried by the lower-level power distribution device. This can effectively ensure the safety and rigor of the restart decision.

[0169] Meanwhile, upon receiving the unlocking instruction, the power distribution unit does not directly activate the power supply circuit, but instead first activates the first discharge circuit. This is because even if the fault source has been eliminated, after a prolonged period of locking, the electrical state of the load side often still exhibits abnormal residual charge. By prioritizing the activation of the discharge circuit, a definite zero-potential reference can be established for the load side.

[0170] Based on the above technical solution, by locking the disconnected state of the first power supply circuit when the first load experiences a first type of fault, repeated impacts of abnormal current on the underlying circuitry are avoided, achieving electrical isolation of the faulty node. Furthermore, by releasing the lock in response to the first indication information and activating the first discharge circuit, it is ensured that the reset process is initiated only upon receiving a definite unlocking command, and a definite zero-potential reference can be provided to the first load before power is restored. This mechanism not only avoids continuous damage to circuit components caused by the first type of fault but also ensures the safe restart of the first load after fault clearance, thereby improving the closed-loop control capability and reliability of the power distribution device in dealing with the aforementioned faults.

[0171] In some possible embodiments, reference Figure 5As shown, in the case of a second type of fault (such as software program freeze, OTA upgrade failure, etc.) occurring in the first load, since this second type of fault is not a low-level hardware fault such as overcurrent, it can usually be detected by methods such as vehicle controllers or upper-level diagnostic modules through communication heartbeat packet monitoring, software verification, etc. Accordingly, in this scenario, the power distribution device can perform the following operations: receive a second indication message, which is used to instruct the first power distribution channel to be reset; and then, according to the second indication message, disconnect the first power supply circuit.

[0172] In some possible embodiments, blindly cutting off the load power supply during vehicle operation in the event of a power failure-triggered restart operation could pose a driving safety risk. Therefore, to ensure the electrical safety of the vehicle under different operating conditions, a precondition verification is performed before cutting off the first power supply circuit according to the second instruction information. This precondition includes at least one of the following: the device (e.g., the vehicle) containing the first load is stationary; the first load is on a load whitelist; or the electrical system containing the first load is in OTA (Over-The-Air) upgrade mode. The load whitelist is used to indicate the loads that are allowed to perform power-off operations. The electrical system can be a vehicle electrical system, or other electrical systems such as drones, industrial control systems, communication base stations, and data center servers.

[0173] In some possible embodiments, the aforementioned load whitelist may include loads with a security level lower than a target security level, where the security level may be pre-configured for the load. The target security level may be determined based on the operating conditions of the equipment containing the first load or power distribution device. That is, as the operating conditions of the equipment change in real time, the target security level may also be dynamically adjusted adaptively.

[0174] For example, in the context of a vehicle electrical system, the power distribution unit can determine whether the aforementioned preconditions are met by acquiring messages on the vehicle communication bus (such as CAN bus or Ethernet): If the vehicle speed meets the stationary condition, the power distribution unit can obtain real-time data from the vehicle speed sensor or vehicle speed messages sent by the body control module. When the indicated vehicle speed is zero or the vehicle is in park (P) gear, it is determined that the stationary condition is met, to ensure that the power cut-off operation will not be performed while the vehicle is moving.

[0175] When the vehicle is in OTA upgrade mode, the power distribution unit can read the electrical system state machine flags issued by the upper-level vehicle controller or main control equipment. When the flag indicates that the current electrical system is in a safe upgrade and maintenance state (e.g., in OTA upgrade mode), the condition is determined to be met, and power-off retry is allowed for the relevant loads.

[0176] Regarding the condition that the first load belongs to the load whitelist, especially in vehicle electrical system scenarios, the aforementioned load whitelist can include loads with an ASIL lower than the target safety level, which is dynamically determined based on the vehicle's current operating conditions. In practical applications, each load connected to each power distribution channel of the aforementioned power distribution device has corresponding identification information (such as hardware port number, communication node identifier, or device type code). The aforementioned power distribution device can pre-store this identification information or parse and obtain it when receiving the second instruction information. Based on this, the power distribution device can determine whether the first load is currently allowed to be de-energized by comparing the identification information of the first load with the current load whitelist. In some possible embodiments, the vehicle electrical system can dynamically adjust the target safety level based on the vehicle's real-time operating conditions (e.g., high-speed driving, low-speed crawling, stationary parking, etc.), thereby adaptively updating the load whitelist. Furthermore, the updated load whitelist can be distributed to the power distribution unit; alternatively, the power distribution unit itself can calculate and adjust the whitelist in real time based on the received operating condition information.

[0177] For example, when the vehicle is traveling at high speed, the target safety level is set to the highest, and only loads with extremely low ASIL levels (such as non-safety-related entertainment system loads) are allowed to be included in the load whitelist; while when the vehicle is stationary, the target safety level is lowered, and the loads of some driver assistance sensors can also be included in the whitelist.

[0178] In some possible embodiments, in the context of vehicle electrical systems, in addition to using ASIL as the aforementioned safety level, the functional domain classification level where the load is located can also be used as the aforementioned safety level.

[0179] For example, the power distribution unit or vehicle controller can classify the loads connected to each power distribution channel into different functional domain levels according to their functional importance. For instance, these functional domain levels may include: a first functional domain level (such as loads related to core vehicle control functions like braking and steering), a second functional domain level (such as intelligent driving loads related to environmental perception and driver assistance), a third functional domain level (such as basic vehicle control loads related to basic driving assistance), and a fourth functional domain level (such as entertainment and comfort loads related to cabin experience), with the safety level thresholds for these four functional domain levels decreasing sequentially. Accordingly, the power distribution unit can set a corresponding target safety level (i.e., target functional domain level) based on the vehicle's current real-time operating conditions. For example, when the vehicle is traveling at high speed, the target safety level is set to the highest threshold, allowing only loads belonging to the fourth functional domain level to enter the load whitelist for power-off retry; while when the vehicle is stationary, the target safety level threshold is relaxed, allowing loads belonging to the second or third functional domain level to enter the load whitelist for power-off reset.

[0180] In some possible embodiments, the power distribution priority level pre-set based on the vehicle power management strategy can also be used as the aforementioned safety level.

[0181] For example, the aforementioned power distribution priority levels (e.g., P0 to Pn, where n is a positive integer greater than 1) are used to characterize the order in which loads are disconnected when the vehicle is in a low-battery or degraded power condition. For instance, P0 corresponds to the highest priority (i.e., the core safety load that cannot be disconnected), and the disconnection priorities corresponding to P1 to Pn decrease sequentially (i.e., Pn corresponds to the lowest priority load that is disconnected first). Correspondingly, when verifying the preconditions, the power distribution device compares the power distribution priority of the load to be reset with the target safety level (i.e., the target priority threshold) corresponding to the current operating condition. For example, when the vehicle is in normal driving condition, the target safety level can be set to a strictly limited lowest priority threshold, allowing only loads with a power distribution priority lower than this threshold (such as low-priority loads like Pn) to enter the load whitelist for power disconnection retry; while when the vehicle is in a stationary parking condition or maintenance mode, the target priority threshold can be increased, thereby allowing loads with higher power distribution priorities (such as medium-to-high priority loads like P1 or P2) to enter the load whitelist for power cycle reset.

[0182] After completing the above verification, the corresponding processing logic can be executed based on the verification results: When it is determined that the above preconditions are met (e.g., any one condition is met, or multiple conditions are met simultaneously), the second instruction information can be responded to to perform the operation of cutting off the first power supply circuit, and sequentially trigger the subsequent process of turning on the first discharge circuit to discharge residual charge, thereby providing a safe restart and reset for the first load that has experienced a software failure.

[0183] Conversely, if the aforementioned preconditions are not met (e.g., the vehicle is traveling at high speed and the load is not currently on the whitelist), the power-off operation can be refused, maintaining the continuity of the first power supply circuit. Furthermore, indication information, such as an error response code, can be fed back to the vehicle controller to indicate a refusal to reset.

[0184] Based on the above technical solution, a precondition verification mechanism is introduced before responding to the reset command issued by the upper layer. The power supply circuit is only cut off when the verification is satisfied, thus avoiding the risk of vehicle malfunction caused by blindly performing power-off operations on critical loads under unsafe operating conditions. Furthermore, by combining real-time operating condition dynamic configuration of a load whitelist, precise reset control of loads with different safety levels in different scenarios is achieved. This mechanism not only ensures the underlying power supply safety of the electrical system containing the first load, but also ensures that, under safe operating conditions, the first load can successfully perform a power-off reset to restore normal operation.

[0185] Furthermore, as can be seen from the foregoing embodiments, after the charge discharge is completed and the first load is confirmed to meet the reset conditions, the first power supply circuit can be reconnected to restore power supply. Therefore, to avoid physical damage caused by the instant of power-on, this application embodiment further restricts the operation of reconnecting the power supply circuit accordingly.

[0186] In some possible embodiments, the operation of turning on the first power supply circuit described above can be performed in the following manner: controlling the first power supply circuit to gradually turn on so that the voltage of the first load rises smoothly.

[0187] Typically, the first load contains energy storage devices such as large-capacity capacitors for voltage regulation and filtering connected in parallel. If a direct power-on method is used, the rated voltage of the power supply will be applied instantaneously to the load at zero potential. This will generate a large transient voltage difference between the power supply and the load capacitor, thereby generating a surge current (i.e., inrush current) with a high amplitude in the first power supply circuit.

[0188] To suppress the aforementioned surge current, the power distribution unit can perform soft-start control on the internal switching devices used to control the on or off of the first power supply circuit through the underlying hardware drive circuit.

[0189] In some possible embodiments, the aforementioned switching device can be a MOSFET. Accordingly, the power distribution device can control a PWM signal with a gradually increasing duty cycle to the control terminal (e.g., the gate) of the aforementioned switching device, causing the equivalent on-resistance of the switching device to gradually decrease from large to small. Alternatively, the power distribution device can utilize an internally integrated RC charging and discharging network to control the drive voltage at the control terminal of the aforementioned switching device to rise slowly at a set slope, thereby causing the switching device to operate in the linear amplification region and gradually transition to a fully saturated conduction state.

[0190] It should be noted that, in the embodiments of this application, the aforementioned "controlling the first power supply circuit to gradually conduct" refers to a smooth transition process where the power supply circuit switches from the off state to the on state, rather than an instantaneous change. This process can constrain and control the conduction rate of the power supply circuit according to a set target slope (e.g., voltage rise rate dV / dt or current rise rate dI / dt), so that the voltage of the first load rises smoothly based on the target slope, thereby suppressing the surge current at the moment of power restoration within a set safe range.

[0191] In some possible embodiments, the target slope can be a fixed linear slope value, or it can be an equivalent changing slope or slope envelope range determined by the underlying hardware circuit (such as the RC delay network or programmable current source mentioned above) or software logic (such as the PWM step control mentioned above). For example, the voltage rise waveform of the first load can be represented as a linear slope, an RC exponential curve, or a stepped shape.

[0192] Based on the above technical solution, by gradually controlling the power supply circuit to conduct, the surge current at the moment of power restoration is effectively suppressed. This mechanism not only effectively avoids damage to circuit components from the surge current, but also avoids drastic fluctuations in the power supply bus voltage, ensuring the stability and safety of the power restoration process.

[0193] In practical applications, power distribution units typically integrate multiple distribution channels to simultaneously supply power to multiple different loads. When a local network anomaly occurs or multiple loads fail successively, multiple distribution channels within the power distribution unit may be simultaneously disconnected due to the fault and awaiting reset. For example, in a multi-channel cascaded fault scenario, when a load connected to a certain distribution channel experiences a short circuit or overcurrent fault, the transient fault current may momentarily drop the power supply bus voltage within the power distribution unit. This voltage drop can easily trigger the under-voltage protection (UVP) mechanism within other normally operating distribution channels, causing the power supply circuits of multiple distribution channels to disconnect successively or simultaneously. In this scenario, if the power supply circuits of all channels awaiting reset are directly and simultaneously reconnected, the surge currents generated by the simultaneous start-up of multiple loads can superimpose, easily lowering the power supply bus voltage and even triggering the overload protection of the upstream power supply.

[0194] To ensure power distribution stability and priority recovery of critical services under multi-load fault scenarios, this application provides a priority-based multi-channel sequential reset control mechanism.

[0195] Figure 6 This is a flowchart illustrating a multi-channel reset method 600 proposed in an embodiment of this application.

[0196] refer to Figure 6 As shown, the method 600 may include the following operations: S610: Get the priority of all multiple power distribution channels that are currently in a pending reset state.

[0197] In some possible embodiments, the aforementioned priority can be used to characterize the urgency or safety level of the loads connected to the power distribution channel. The setting and acquisition of this priority can include various implementation methods: For example, the aforementioned priorities can be static configuration parameters pre-installed in the non-volatile memory of the power distribution unit, and can be stored in the form of a mapping table. When obtaining the priority of the power distribution channel, the power distribution unit can directly read the locally stored mapping table. Specifically, the static priority of load channels related to core vehicle safety or chassis control (such as braking, steering, or vehicle controllers, which typically correspond to higher ASIL levels) can be set higher than the static priority of comfort load channels that are not related to safety (such as seat heating or ambient lighting).

[0198] For example, the aforementioned priorities can be dynamically changed. The power distribution unit can receive dynamic priority messages from the upper-level vehicle controller based on the current operating conditions of the system (e.g., the vehicle is traveling at high speed, parked, or charging), and parse them to obtain the real-time priority of each power distribution channel. For instance, in autonomous driving mode, the priority of the power distribution channel where the perception sensors are located is dynamically increased; while in parking and charging mode, the priority of the power distribution channel where the battery management system is located is adjusted to the highest level.

[0199] S620: Establish a reset queue according to the priority of each power distribution channel from high to low.

[0200] In some possible embodiments, considering the possibility that multiple power distribution channels may have the same priority, an arbitration mechanism can be introduced to ensure the uniqueness and determinism of the queue order: when at least two power distribution channels are determined to have the same priority, secondary determination parameters of the at least two power distribution channels (e.g., hardware channel number, load rated current, or the order in which the faults occurred) can be further obtained. Then, a secondary sorting is performed based on these secondary determination parameters (e.g., the channel with the smaller number is given priority, or the channel that failed first is given priority to enter the queue), thereby completing the establishment of the recovery queue. Alternatively, it is sufficient to ensure that these power distribution channels are adjacent in the reset queue.

[0201] S630: According to the above reset queue, perform reset operations on each power distribution channel in sequence. That is, sequentially disconnect the corresponding discharge circuit and connect the corresponding power supply circuit.

[0202] In some possible embodiments, in order to completely avoid the superposition of electrical stress at the moment of power-on of the two channels, when the power supply circuits of two adjacent power distribution channels (e.g., the preceding channel and the following channel) are turned on in order of priority, real-time monitoring or timing can be started after the reset operation of the preceding channel is completed; when the electrical parameters (such as load voltage or current) of the preceding power distribution channel are detected to have reached the set stable state, or when the waiting time reaches the preset surge protection time threshold (e.g., tens of milliseconds to hundreds of milliseconds), the reset operation of the following power distribution channel is then performed.

[0203] Based on the multi-channel reset process of S610 to S630 described above, when the multiple power distribution channels in the state to be reset include the first power distribution channel and the second power distribution channel in the foregoing embodiments of this application (i.e., before the first discharge circuit is cut off and the first power supply circuit is connected, the second power supply circuit of the second power distribution channel is in the disconnected state due to a fault in the second load), then the reset operation for the first power distribution channel mentioned in the foregoing embodiments can further include the following process: First, obtain the first priority of the first power distribution channel and the second priority of the second power distribution channel; Then, based on the priority relationship between the first and second priorities, the reset operations for these two power distribution channels are executed sequentially: When it is determined that the first priority is greater than or equal to the second priority, the restoration operation of the first power distribution channel can be performed first, that is, the first discharge circuit is cut off and the first power supply circuit is connected. Conversely, when it is determined that the first priority is lower than the second priority, the restoration of the first power distribution channel can be temporarily suspended. Instead, the restoration operation of the second power distribution channel can be performed first, that is, the second discharge circuit is cut off and the second power supply circuit is connected. Then, the operation of cutting off the first discharge circuit and connecting the first power supply circuit is performed to complete the reset of the first power distribution channel.

[0204] Based on the above technical solution, when multiple power distribution channels are waiting for power restoration at the same time, the order of priority is determined according to the importance of the load, and each power supply circuit is turned on one by one. This realizes the time-sharing of multiple power supply circuits, thereby effectively avoiding the sudden drop in bus voltage and the superposition of surge current caused by multiple loads being powered on at the same time, and ensuring the overall electrical stability of the power distribution system during the complex fault recovery process.

[0205] After completing the aforementioned operation of reconnecting the first power supply circuit, in order to confirm whether the reset operation has truly eliminated the fault, this embodiment of the application also introduces a closed-loop monitoring and retry mechanism for the reset result in the reset process.

[0206] In some possible embodiments, after the first power supply circuit is turned on, the above control method further includes the following operations: monitoring the reset result of the first power distribution channel; if the reset result is a reset failure, re-performing the reset of the first power distribution channel.

[0207] The aforementioned reset failures can encompass persistent anomalies in both physical hardware and software logic. Accordingly, monitoring of these reset results can be performed by combining the aforementioned fault types with targeted verification: For example, if the fault is a Type I fault (i.e., a low-level hardware fault), the power distribution unit can continuously monitor the electrical parameters after power restoration through its internal fault detection circuit. If the current flowing through the first power distribution channel is still greater than a preset overcurrent threshold (indicating that physical fault points such as short circuits or severe overloads still exist, and the fault has not been physically isolated or eliminated), the first power supply circuit is triggered to disconnect again. Furthermore, this re-disconnection of the first power supply circuit can be detected by the vehicle controller. Based on this, the vehicle controller can send a reset failure message to the power distribution unit, enabling the power distribution unit to determine that the first power distribution path reset failed.

[0208] On the other hand, if the historical fault is a type II fault (i.e., a software logic fault), the vehicle controller can monitor the software operating status of the load through methods such as communication heartbeat packets or state machine flags. If it is determined that the first load still experiences OTA upgrade failure, program freezes continuously, or fails to respond to heartbeat messages normally, it is also determined to be a reset failure. Based on this, the vehicle controller can send the reset failure information to the power distribution unit so that the power distribution unit can determine that the first power distribution path has failed to reset.

[0209] In some possible embodiments, if a reset fails, the power distribution unit will again disconnect the first power supply circuit and attempt to re-perform the aforementioned reset operation on the first power distribution channel (i.e., initiate a new round of power-off restart process). However, if the load has a permanent hard breakdown or core firmware damage, unlimited cyclic power-on retrying will not only fail to restore functionality but will also cause short-circuit current to repeatedly impact the power supply circuit, resulting in heat accumulation and thermal breakdown of the switching devices inside the power distribution unit, and even posing a safety risk to the entire vehicle. Therefore, to avoid the system falling into an infinite retry trap, the above control method also includes the following operations: recording the number of retry attempts to reset the first power distribution channel; in response to the retry count reaching a threshold and the first power distribution channel still failing to reset, locking the disconnected state of the first power supply circuit and reporting fault information for the first load.

[0210] In some possible embodiments, taking the vehicle electrical system as an example, the fault information reported by the aforementioned power distribution device may be a diagnostic message sent to the upper-level control node (such as the vehicle controller, central computing platform, or vehicle controller) via the vehicle communication bus. Upon receiving this fault information, the upper-level control node may take one or more of the following coordinated response actions: Redundancy switching or safety degradation can be performed. For example, if the first failed load involves core safety, the upper-level control node can activate the redundant backup node in the system to take over the function of the first load; if there is no backup node, the vehicle's degraded operation mode is triggered (such as disengaging from autonomous driving or limiting vehicle speed) to ensure vehicle safety.

[0211] It can trigger human-machine interaction alarms. For example, fault information can be converted into alarm prompts and output through the vehicle's instrument panel or central control screen to clearly inform the driver of a partial fault that cannot be automatically recovered and to prompt for repair.

[0212] It can be synchronized with the cloud and remotely diagnosed. For example, fault information can be uploaded to the cloud server through the vehicle network module so that the backend can investigate the specific cause of the fault. In addition, after troubleshooting and eliminating false alarms, the backend can directly issue a remote unlocking command to instruct the vehicle controller to re-control the power distribution device to restore power supply to the primary load.

[0213] In some possible embodiments, the microcontroller inside the power distribution unit can record the number of retries by setting a dedicated counter variable. To achieve more refined safety control, the threshold number can be a pre-set fixed value (e.g., 3 or 5 times) or a dynamically allocated, differentiated threshold based on the fault type. For example, for first-type faults such as short circuits or overcurrents, to maximize the protection of the underlying hardware, the corresponding threshold number can be set to a smaller value (e.g., 1 or 2 times); while for second-type faults such as failed OTA upgrades, considering that software flashing and handshaking may require multiple attempts, the corresponding threshold number can be set to a larger value (e.g., 5 times).

[0214] When the number of retries reaches the aforementioned threshold, and the monitoring results (e.g., the detection results from the fault detection circuit or the fault indication information received from the vehicle controller) determine that the first power distribution channel still fails to reset, the power distribution device will determine that the fault is a permanent fault that cannot be automatically recovered. At this time, the disconnected state of the first power supply circuit can be completely locked, that is, before the current driving cycle or the next manual unlocking command, the conduction command for the first power distribution channel will be refused; at the same time, the power distribution device will report fault information including fault type, channel identifier, etc. to the vehicle controller or instrument panel through the communication bus, such as generating the corresponding diagnostic trouble code (DTC) to prompt maintenance personnel to intervene for physical inspection or software rewriting.

[0215] Based on the above technical solution, by introducing a retry mechanism that monitors the reset result and limits the number of retry attempts after the power supply circuit is turned on, it is possible to automatically recover from intermittent faults and avoid repeated power-on attempts when persistent faults occur. This approach effectively prevents abnormal currents or persistent software errors from causing repeated impacts on the power distribution equipment and power supply bus, achieves effective isolation and information reporting of permanent faults, and improves the operational stability and safety of the power distribution system.

[0216] In conjunction with the foregoing embodiments, this application further proposes business logic from the perspective of the entire vehicle for the two types of faults mentioned above.

[0217] For Type I faults (such as hardware overcurrent, short circuit, etc.), the power distribution unit and the vehicle controller can handle the Type I fault through the following coordinated operation.

[0218] Figure 7 This is a schematic diagram of a fault handling process 700 proposed in an embodiment of this application.

[0219] refer to Figure 7 As shown, process 700 may include the following operations: S710: The power distribution unit triggers a hardware power-off and reports status information to the vehicle controller.

[0220] In some possible embodiments, when the power distribution unit responds to a first type of fault through its internal fault detection circuit and triggers a power outage in the first power supply circuit, the power distribution unit can report status information, including fault channel identifier and fault type (such as short circuit, overcurrent diagnostic code, etc.), to the vehicle controller in real time via the vehicle communication bus to trigger the vehicle controller's subsequent reset strategy. The status information indicates that an overcurrent has occurred in the first power distribution channel and that the first power supply circuit has been disconnected.

[0221] S720: The vehicle controller sends a third instruction to the relevant functional module.

[0222] In some possible embodiments, before issuing instructions to the power distribution unit, the vehicle controller can first identify a target functional module that has a business association with the first load, and send a third instruction message (or power failure warning instruction or status pre-notification message) to the target functional module through the vehicle communication network. This third instruction message can be used to instruct the target functional module to back up data related to the first load, enabling the associated target functional module to save critical operating data or execute safe exit logic in advance, thus avoiding data loss or system status abnormalities due to the power distribution unit subsequently executing a power failure reset process.

[0223] S730: The vehicle controller sends target indication information, and the power distribution unit responds to the command and performs a reset.

[0224] In some possible embodiments, the vehicle controller can obtain the type of the first load and determine the target reset parameters based on that type (the target reset parameters include voltage thresholds or duration thresholds corresponding to the reset conditions, etc.). Subsequently, the vehicle controller generates target indication information including a target channel identifier and target reset parameters (in this hardware fault scenario, the target indication information can be the first indication information or a reset command in the aforementioned embodiments, used to instruct the power distribution device to release the lock on the first power supply circuit disconnection state), and sends it to the power distribution device via the communication bus. After parsing the target indication information, the power distribution device can trigger the corresponding reset action according to the parameters therein (for example, sequentially executing the conduction of the first discharge circuit to discharge residual charge, and re-conducting the first power supply circuit after the residual charge has been discharged and the reset conditions are met). It should be noted that the specific reset process has been described in detail in the aforementioned embodiments, and the execution details of the underlying power distribution device will not be repeated here.

[0225] S740: The power distribution unit and vehicle controller perform closed-loop status confirmation and reset determination.

[0226] In some possible embodiments, after the power distribution unit reconnects the first power supply circuit, the power distribution unit and the vehicle controller work together to determine the reset result of the first power distribution channel. If the overcurrent phenomenon has been eliminated and the first load successfully sends a handshake confirmation signal, the power distribution unit sends a reset feedback message to the vehicle controller (indicating that the first power supply circuit has been successfully reconnected), confirming the success of the reset and maintaining normal power supply.

[0227] If the overcurrent problem persists, the power distribution device triggers a power outage again and records the number of retries. If the number of retries does not reach the preset threshold, the power distribution device can report the status information again to trigger the next reset; if the number of retries reaches the threshold and the reset still fails, the power distribution device completely locks the first power supply circuit in a disconnected state and reports the fault information for the first load to the vehicle controller.

[0228] Upon receiving the fault information, the vehicle controller confirms that the channel reset has failed and enters a continuously locked state, thereby ceasing to issue commands. It may further activate the corresponding redundant backup node or control the vehicle to enter a degraded operation mode. For the second type of fault (such as OTA upgrade failure, communication timeout, or program crash), the power distribution unit and the vehicle controller can handle this type of fault through the following coordinated operation.

[0229] Figure 8 This is a schematic diagram of another fault handling process 800 proposed in the embodiments of this application.

[0230] refer to Figure 8 As shown, the process 800 may include the following operations: S810: The vehicle controller detected a second type of fault in the first load.

[0231] In some possible embodiments, if the OTA management module or diagnostic module of the vehicle controller detects a load write verification failure (such as a checksum error) or a communication timeout during the process of software writing, upgrading, or data interaction of the first load, it can determine that the first load has experienced a second type of fault.

[0232] S820: The vehicle controller determines the target reset parameters and generates target indication information.

[0233] In some possible embodiments, the vehicle controller can acquire the type of the first load (such as a microcontroller, sensor, or display screen) and determine the target reset parameters based on that type (the target reset parameters include a duration threshold or voltage threshold corresponding to the reset condition, such as a dynamic power-off duration matched to the discharge characteristics of the load's internal capacitance and register). Subsequently, the vehicle controller can generate target indication information including a target channel identifier and target reset parameters (in this software fault scenario, the target indication information can be the second indication information or a reset command in the aforementioned embodiments, used to instruct the power distribution device to perform a power cycle reset of the first power distribution channel), and send it to the power distribution device via the communication bus.

[0234] S830: The power distribution unit responds to the target indication information and performs a reset.

[0235] In some possible embodiments, after receiving the target indication information, the power distribution device can first verify the preconditions (e.g., whether the equipment where the first load is located meets the static condition, whether the first load belongs to the load whitelist that allows power outage, or whether the system is in OTA upgrade mode, etc.). After the precondition verification is passed, the power distribution device parses the target indication information, cuts off the first power supply circuit, and conducts the first discharge circuit to discharge residual charge. After maintaining the target reset parameter for the corresponding time threshold or after the reset condition is met, the first discharge circuit is turned off and the first power supply circuit is re-conducted to complete the power supply cycle reset. It should be noted that the specific reset process has been described in detail in the foregoing embodiments, and the underlying execution details of the power distribution device will not be repeated here.

[0236] S840: The power distribution unit and vehicle controller perform closed-loop status confirmation and reset determination.

[0237] In some possible embodiments, after the power distribution unit reconnects the first power supply circuit, the vehicle controller waits for a handshake confirmation signal from the first load within a set timeout threshold. If the handshake confirmation signal is received, the power distribution unit sends a reset feedback message to the vehicle controller (indicating that the first power supply circuit has been successfully reconnected), confirming the success of the reset. The vehicle controller can then re-initiate data writing or resume normal service interaction.

[0238] If no handshake confirmation signal is received within the timeout threshold, the reset is deemed a failure, and the vehicle controller records the number of retries and updates the retry count. If the number of retries does not reach the preset threshold, the vehicle controller can regenerate and send the target indication information to trigger the next power cycle reset. If the number of retries reaches the threshold and the reset still fails, the vehicle controller determines that the fault is an unrecoverable hardware fault, sends a command to the power distribution unit to completely lock the disconnected state of the first power supply circuit, and reports the fault information for the first load.

[0239] After confirming that the reset has failed and the vehicle controller has entered a continuous lockout state, it stops issuing reset commands and can further activate the corresponding redundant backup nodes or control the vehicle to enter a degraded operation mode.

[0240] Furthermore, besides handling OTA upgrade failures or program freezes, the reset logic based on the second type of fault can also be extended to power loop scenarios where vehicle sleep wake-up fails. In practical applications, some vehicle loads will cut off the ignition signal (usually referred to as KL15) in sleep mode, but still need to maintain constant power supply (usually referred to as KL30) to maintain a low-power standby state. If the load experiences a low-level logic lock-up under constant power supply, even if the vehicle controller sends a wake-up pulse to the load or reapplies the ignition signal (KL15), the load cannot respond normally. For this scenario, the vehicle controller can send a reset command to the power distribution unit; after the power distribution unit responds to the command, it actively cuts off the constant power (KL30) power supply circuit corresponding to the load, conducts the discharge circuit to discharge, completely drains the residual charge maintained by constant power to force the load to cold start restart, and then restores constant power supply and sends a wake-up pulse, thereby effectively solving the wake-up dead loop problem in deep sleep scenarios.

[0241] It should be noted that, although the above Figure 7 and Figure 8 The corresponding embodiments are described in detail using a vehicle electrical system as an example. However, those skilled in the art should understand that the above-described collaborative processing business logic is also applicable to other types of electrical systems. In other electrical systems (such as industrial control systems, communication base stations, or data centers), the vehicle controller that communicates and coordinates with the power distribution device can be replaced by the main control equipment, central computing unit, or host computer controller in the electrical system (these devices all fall under the category of controllers / control devices). This application does not specifically limit this aspect.

[0242] Furthermore, in order to implement any of the control methods or fault handling services proposed in the embodiments of this application, the embodiments of this application also propose a power distribution device with the following structural form.

[0243] Any of the power distribution devices proposed in the following embodiments can cooperate with the upper-level controller to implement the aforementioned fault handling logic. The specific upper-level business control logic executed by the power distribution device when facing different types of faults (such as the first type of hardware fault or the second type of software fault), such as locking and unlocking the fault disconnection state, verifying the power outage preconditions, and interactive reporting of status / fault information, has been described in detail in the aforementioned method embodiments. To maintain the brevity of the specification, this embodiment will focus on the implementation principle of the hardware circuit topology and underlying electrical timing of the power distribution device; the specific business control details involved can be found in the corresponding descriptions in the aforementioned method section, and will not be repeated here.

[0244] Figure 9 This is a circuit diagram of a power distribution device 900 proposed in an embodiment of this application.

[0245] refer to Figure 9 As shown, the power distribution device 900 may include at least one power distribution channel 905, wherein the power distribution channel 905 includes: The first switch 911 is connected in series between the power supply 1010 and the load 1020 to form a power supply circuit 901; The second switch 912 is connected in series between the load 1020 and the discharge terminal 1030 to form a discharge circuit 902, and the discharge terminal 1030 is used to receive the residual charge of the load 1020. The control circuit 920 is electrically connected to the first switch 911 and the second switch 912 respectively. The control circuit 920 is used to: control the first switch 911 to open and the second switch 912 to open in response to a failure of the load 1020.

[0246] In the circuit topology described above, the first switch 911 acts as a node controlling the on / off state of the power supply circuit 901, allowing the electrical energy output by the power supply 1010 to be continuously transmitted to the downstream load 1020 when it is on. The second switch 912 acts as a bypass node controlling the discharge circuit 902, providing a low-impedance release path for the residual charge stored in the large-capacity capacitors and other energy storage devices inside the load 1020 when the power supply circuit 901 is off and the second switch 912 is on.

[0247] In some possible embodiments, the first switch 911 and the second switch 912 described above can be mechanical relays, or electronic switching devices, such as metal-oxide-semiconductor field-effect transistors (MOSFETs), insulated-gate bipolar transistors (IGBTs), or bipolar junction transistors (BJTs), can be used to achieve high-speed response at the microsecond level and long-life control.

[0248] Taking an N-channel MOSFET as an example, the first terminal (e.g., drain) of the first switch 911 is electrically connected to the positive terminal of the power supply 1010, the second terminal (e.g., source) of the first switch 911 is electrically connected to the positive terminal of the load 1020, and the control terminal (e.g., gate) of the first switch 911 is electrically connected to the control circuit 920. Correspondingly, the first terminal (drain) of the second switch 912 is electrically connected to the positive terminal of the load 1020, the second terminal (source) of the second switch 912 is electrically connected to the bleeder terminal 1030, and the control terminal (gate) of the second switch 912 is electrically connected to the control circuit 920. Through the above transistor hardware architecture, the control circuit 920 can independently and quickly control the conduction and disconnection of these two switches by outputting high and low level signals. Other types of transistors are similar, and are listed here one by one.

[0249] In some possible embodiments, to prevent the second switch 912 from short-circuiting and causing safety risks, the power distribution channel 905 may further include a drain voltage monitoring circuit. This drain voltage monitoring circuit is electrically connected to the second switch 912 and is used to monitor the drain voltage of the second switch 912 in real time. If an abnormal drain voltage is detected (e.g., the second switch 912 is determined to be short-circuited), the control circuit 920 will prevent the first switch 911 from being powered on and will report the corresponding fault information, thereby achieving failure protection for the discharge circuit.

[0250] In some possible embodiments, considering that actual vehicle electrical circuits typically contain parasitic inductance in the wiring harness, or that the load 1020 itself has inductive characteristics, the sudden change in circuit current at the instant the first switch 911 or the second switch 912 is rapidly disconnected can easily generate extremely high reverse voltage spikes across the switching devices. To prevent these transient voltage spikes from damaging the switching devices, the aforementioned power distribution channel 905 may also include a body diode bypass protection circuit.

[0251] In some possible embodiments, a Schottky diode can be connected in parallel across the aforementioned electronic switching devices (e.g., the first switch 911 and / or the second switch 912) to form the aforementioned body diode bypass protection circuit. Taking the first switch 911 as an N-channel MOSFET as an example, the cathode of the Schottky diode is electrically connected to the first terminal (i.e., the drain) of the first switch 911, and the anode of the Schottky diode is electrically connected to the second terminal (i.e., the source) of the first switch 911. Based on the physical characteristics of the Schottky diode, such as low forward voltage and extremely fast high-frequency response, this Schottky diode can provide a discharge bypass for the residual energy of the inductive load or loop inductance at the moment the switch is turned off. This mechanism not only effectively bypasses the parasitic body diode inside the MOSFET, which has a slow self-recovery time, but also absorbs and clamps transient voltage spikes, thereby further improving the electrical reliability of the power distribution device under complex loads and frequent switching conditions from the underlying hardware level.

[0252] In some possible embodiments, the aforementioned discharge terminal 1030 is a physical node in an electrical system that provides a low potential reference for receiving and dissipating residual charge. The discharge terminal 1030 can typically be a common reference ground in the electrical system or a specially configured discharge network.

[0253] For example, in the application scenario of vehicle electrical systems, the discharge terminal 1030 can have various specific hardware manifestations. For instance, the discharge terminal 1030 can be the metal body frame of the vehicle or the body grounding point, so as to quickly dissipate residual charge using the low impedance of the vehicle's metal structure; or, the discharge terminal 1030 can be the grounded copper plane on the printed circuit board (PCB) inside the power distribution device; or, the discharge terminal 1030 can also be a negative busbar connected to the negative terminal of the vehicle's low-voltage battery (such as a 12V or 48V battery). This application embodiment does not limit the specific hardware form of the discharge terminal 1030. Any physical node that can absorb residual energy to lower the load terminal voltage falls within the scope of the discharge terminal covered by this application embodiment.

[0254] In the circuit architecture of the aforementioned power distribution device 900, under normal power supply conditions, the control circuit 920 can maintain the first switch 911 on and the second switch 912 off. When the load 1020 fails, the control circuit 920 can stop the drive signal to the first switch 911 and output a drive signal to the control terminal of the second switch 912, thereby achieving physical isolation and charge discharge at the hardware level.

[0255] After the power supply circuit 901 is disconnected, the control circuit 920 can quickly drain the residual energy on the load side by turning on the second switch 912, causing the load voltage to drop to a safe reset level in a very short time (e.g., milliseconds). Furthermore, in terms of timing control, the control circuit 920 ensures that the first switch 911 and the second switch 912 are interlocked through internal hardware logic or low-level control program, preventing both from being turned on simultaneously to avoid the safety risk of a short circuit to ground caused by the power supply 1010 directly passing through these two switches.

[0256] Figure 10 This is a partial signal timing diagram of the power distribution device 900 during operation according to an embodiment of this application.

[0257] refer to Figure 10 As shown, the dynamic timing process of the power distribution device 900 executing the aforementioned coordinated control can be clearly seen. Before time t0, the control circuit 920 receives target indication information for triggering a reset operation (e.g., a reset command or OTA retry command in the aforementioned embodiment). In response to this target indication information, at time t0, the control circuit 920 first cancels the conduction level signal output to the control terminal of the first switch 911, causing the first switch 911 to quickly open, thereby cutting off the power supply circuit 901. At the same time, under the safety guarantee of the interlocking mechanism, the control circuit 920 outputs a conduction level signal to the control terminal of the second switch 912, controlling the second switch 912 to conduct, establishing a discharge circuit 902 to initiate the active discharge process.

[0258] During the time period from t0 to t1, as the discharge circuit 902 remains open, the residual charge on the load 1020 side is rapidly released. Figure 10 As can be seen from the voltage waveform of the load 1020, the load voltage drops rapidly during this active discharge period. When time reaches t1, the control circuit 920 (or the voltage detection circuit connected to the load 1020) detects that the voltage of the load 1020 has dropped to the voltage threshold (such as 0.5V), and determines that the load 1020 has met the reset condition. At this time, the residual charge inside the load has been basically cleared, and it has entered a safe and certain zero potential reference state.

[0259] At time t1, after confirming that the reset condition is met, the control circuit 920 immediately cancels the drive signal of the second switch 912 to cut off the discharge circuit 902. Then, the control circuit 920 starts to re-control the first switch 911 to conduct in order to restore the power supply circuit 901.

[0260] It should be noted that, in order to avoid the electrical shock caused by the huge voltage difference at the moment of power-on, the control circuit 920 does not directly output a sudden full-amplitude drive signal, but outputs a soft-start signal with a gradually increasing duty cycle or voltage amplitude to the control terminal of the first switch 911. That is, the signal input to the control terminal of the first switch 911 presents a ramp-up waveform in the t1 to t2 stage.

[0261] During the time interval t1 to t2, driven by the aforementioned ramp-up signal, the first switch 911 gradually turns on, and its equivalent on-resistance decreases smoothly. Under this control, Figure 10 The voltage of load 1020 in the circuit exhibits a gradual recovery trend during the period from t1 to t2, rather than a sudden jump. Thanks to this gradual conduction design, the recovery current of power supply circuit 901 maintains high stability (no surge) during the power-on process, eliminating the huge surge current spikes that are prone to occur in traditional hard-start modes. This timing control mechanism not only ensures the accuracy of the reset logic but also effectively avoids physical damage to hardware components caused by transient abnormal currents, improving the safety and reliability of the power distribution device 900.

[0262] In some possible embodiments, the control circuit 920 described above can control one power distribution channel 905 in the power distribution device 900, or it can control multiple power distribution channels 905 in the power distribution device 900 simultaneously.

[0263] Based on the above technical solution, this power distribution device achieves proactive intervention in fault handling by disconnecting the first switch to physically isolate the faulty node when a load fault occurs, and turning on the second switch to actively discharge the residual charge on the load side. This mechanism not only effectively avoids the faulty load from remaining in an abnormal state for a long time due to residual energy not being cleared, but also shortens the time required for the load's electrical state to recover to a safe baseline, thereby improving the reliability of the underlying hardware protection of the power distribution system.

[0264] As can be seen from the foregoing method embodiments, the faults occurring in the load 1020 can be mainly divided into a first type of fault (such as hardware overcurrent, short circuit, etc.) and a second type of fault (such as OTA upgrade flashing failure, program freeze, etc., software logic faults). In order to further realize the automatic recovery and reset business logic for the above-mentioned faults (such as restoring power supply after the first type of fault is unlocked, or performing power cycle retry in the case of the second type of fault), the control circuit 920 of the power distribution device 900 proposed in this application embodiment can also be used to: control the second switch 912 to open and control the first switch 911 to open after the load 1020 meets the reset condition.

[0265] The reset condition is used to instruct the load 1020 to complete the release of residual charge, as detailed in the aforementioned corresponding embodiment. This control logic, which closes the first switch 911 after the second switch 912 is opened, ensures that the load 1020 can be re-energized at a defined zero potential reference. This mechanism not only eliminates abnormal transient impacts caused by the superposition of residual charge and the connected power supply, but also ensures that the logic unit inside the load can execute a standard power-on reset procedure, improving the recovery success rate of the power distribution device in dealing with various faults.

[0266] In order to achieve the above-mentioned functions of the control circuit 920, the embodiments of this application further design the circuit structure of the power distribution device 900.

[0267] Figure 11 This is a circuit diagram of another power distribution device 900 proposed in the embodiments of this application.

[0268] Compared to Figure 9 The power distribution device 900 shown is... Figure 11 The detailed circuit configuration of the control circuit in the power distribution unit 900 is further illustrated. (Reference) Figure 11 As shown, the control circuit includes a main control unit 921, which is used to control the first switch 911 and the second switch 912 to be turned on or off respectively.

[0269] In some possible embodiments, the main control unit 921 described above may be a chip or circuit module with logic execution and program control capabilities, such as a microcontroller unit (MCU), DSP, FPGA or ASIC.

[0270] Taking the first switch 911 and the second switch 912 as transistors as an example, the control terminal of the first switch 911 can be electrically connected to the first output terminal of the main control unit 921; the control terminal of the second switch 912 is electrically connected to the second output terminal of the main control unit 921.

[0271] In combination with the above Figure 10 The timing control principle shown allows for surge-free recovery of the power supply circuit 901 during the reset and retry phase. The first output of the main control unit 921 can be configured as an output pin supporting the PWM function. When the first switch 911 is re-controlled to turn on, the main control unit 921 does not directly output a full-amplitude level. Instead, it sends a PWM signal with a gradually increasing duty cycle to the first switch 911 through this first output. By adjusting the duty cycle, the main control unit 921 can smoothly control the equivalent on-resistance of the first switch 911, thereby achieving the aforementioned soft-start ramp-up control.

[0272] Furthermore, to improve the response speed of the power distribution unit 900 to the first type of fault, the control circuit may further include: The fault detection circuit 922 has its input terminal electrically connected to the power supply circuit 901 and its output terminal electrically connected to the control terminal of the first switch 911. The fault detection circuit 922 is used to continuously output a latch signal when it detects that the current flowing through the power supply circuit 901 is greater than the overcurrent threshold. The latch signal is used to control the opening of the first switch 911.

[0273] In some possible embodiments, reference Figure 11 As shown, in order to achieve the above-mentioned functions of the fault detection circuit 922, the fault detection circuit 922 may include: Shunt resistor 9221 is connected in series between the first switch 911 and the load 1020; Comparator circuit 9222, the input of which is electrically connected to shunt resistor 9221; The latch circuit 9223 has its input terminal electrically connected to the output terminal of the comparator circuit 9222, and its output terminal electrically connected to the control terminal of the first switch 911.

[0274] In some possible embodiments, the shunt resistor 9221 described above can be a sampling resistor. To ensure sampling accuracy under high current, the shunt resistor 9221 can be used in conjunction with a differential amplifier (or current sense amplifier) ​​to form a current sampling circuit. For example, the input terminal of the differential amplifier and the shunt resistor 9221 can be connected in a Kelvin manner; that is, the two voltage sampling lines used to connect the differential amplifier are independently led out from the two pins of the shunt resistor 9221, physically separated from the high-current power traces that transmit electrical energy. The large current flowing through the power supply circuit 901 generates a small voltage drop across the shunt resistor 9221. The differential amplifier obtains this voltage drop through the sampling lines and amplifies it into a voltage signal suitable for subsequent comparison, thereby effectively eliminating the interference caused by the parasitic impedance of the power supply circuit traces on the small sampling voltage.

[0275] In some possible embodiments, the comparison circuit 9222 may include a voltage comparator. The first input terminal of the voltage comparator (e.g., the non-inverting input terminal) is electrically connected to the shunt resistor 9221. For example, in a basic circuit without the differential amplifier, the first input terminal can directly obtain the voltage drop across the shunt resistor 9221; while in a circuit with the differential amplifier, the first input terminal can be electrically connected to the shunt resistor 9221 through the differential amplifier to receive the real-time voltage signal output by the differential amplifier. The second input terminal of the voltage comparator (e.g., the inverting input terminal) is connected to a preset reference voltage Vref, which numerically corresponds to the overcurrent threshold of the aforementioned first type of fault. During operation, the comparison circuit 9222 compares the magnitudes of these two voltage signals in real time. When the current flowing through the power supply circuit 901 increases sharply (e.g., a physical short circuit occurs in the load), causing the real-time voltage signal to exceed the reference voltage Vref, the output terminal of the comparison circuit 9222 will undergo a level flip, instantaneously outputting a hardware trigger signal characterizing the occurrence of an overcurrent.

[0276] The voltage signal connected to the comparison circuit 9222 is positively correlated with the current flowing through the power supply circuit 901, and the reference voltage Vref is equivalent to the overcurrent threshold. Therefore, the comparison of these two voltage signals by the comparison circuit 9222 is physically and logically equivalent to the comparison of the real-time current in the power supply circuit 901 with the overcurrent threshold.

[0277] In some possible embodiments, in order to accurately capture instantaneous short-circuit pulses in the power supply circuit 901, the sampling frequency of the current detection circuit based on the shunt resistor 9221 can be set to be greater than or equal to a certain frequency threshold, such as 10kHz. Furthermore, to be compatible with various loads with different starting current characteristics, the fault detection circuit 922 (e.g., the comparator circuit 9222) can have a programmable threshold configuration function. The control circuit can dynamically adjust the preset reference voltage Vref of its internal comparator according to the characteristics of different loads, thereby realizing the dynamic configuration and adjustment of the overcurrent protection threshold.

[0278] In some possible embodiments, the latch circuit 9223 described above can employ a digital logic device with memory retention function, such as a set / reset flip-flop (SR) trigger or a data flip-flop (also known as a D flip-flop). Taking an SR trigger as an example, its set terminal (denoted as S terminal) is electrically connected to the output terminal of the comparator circuit 9222 as an input terminal, and its output terminal (e.g., Q terminal or non-Q terminal, depending on the turn-off level logic of the first switch 911) is electrically connected to the control terminal of the first switch 911. When the latch circuit 9223 receives a hardware trigger signal output by the comparator circuit 9222, the internal state of the trigger instantly flips and is locked, thereby continuously outputting a latch signal at its output terminal. This latch signal directly takes over the gate drive of the first switch 911, forcibly turning it off. Furthermore, regardless of how the input signal of the comparator circuit 9222 changes (even if the short-circuit current disappears due to the first switch 911 being turned off), this latch signal will be physically maintained by hardware to prevent abnormal conduction of the power supply circuit 901.

[0279] Based on the circuit structure constructed from the aforementioned shunt resistor 9221, comparator circuit 9222, and latch circuit 9223, the fault detection circuit 922 implements a rapid-response hardware protection mechanism. When a first-type fault such as a short circuit occurs in the load 1020, this circuit can automatically disconnect the first switch 911 within a short time, avoiding response delays caused by software polling cycles or program interruptions in the main control unit 921, and preventing damage to the internal electronic components and power supply busbars from massive surge currents.

[0280] Furthermore, to implement the unlock retry logic in the aforementioned embodiments, the controlled terminal of the latch circuit 9223 (e.g., the reset terminal of the SR flip-flop (denoted as the R terminal)) can be electrically connected to the third output terminal of the main control unit 921. In actual business processing, when the system confirms that the fault has been eliminated, or receives a retry command, the main control unit 921 can send an unlock signal to the latch circuit 9223 through the third output terminal. This unlock signal is used to clear the memory state of the flip-flop, causing the latch circuit 9223 to stop outputting the aforementioned latch signal. After successfully unlocking the physical lock of the underlying hardware, the main control unit 921 regains control of the first switch 911, and then normally starts the subsequent active discharge and power supply reset process.

[0281] In some possible embodiments, reference Figure 11 As shown, in order for the main control unit 921 to accurately obtain the reset condition of the aforementioned load 1020, the control circuit may further include: a voltage detection circuit 923. Figure 11 (The text is shown using dashed lines). The input terminal of the voltage detection circuit 923 is electrically connected to the positive terminal of the load 1020, and the output terminal of the voltage detection circuit 923 is electrically connected to the input terminal of the main control unit 921 (e.g., an internally integrated analog-to-digital converter pin). During the active discharge process of the load 1020 (i.e., the stage when the first switch 911 is open and the second switch 912 is open), the voltage detection circuit 923 is used to detect the attenuated voltage at the load 1020 terminal in real time and continuously output the collected voltage signal to the main control unit 921.

[0282] Accordingly, the main control unit 921 is specifically used to: receive the voltage signal, and determine that the load 1020 has met the reset condition when the real-time voltage indicated by the voltage signal is less than a preset voltage threshold (e.g., a safe level such as 0.5V in the aforementioned embodiment). By introducing the voltage detection circuit 923, the control circuit can perform hardware-level closed-loop monitoring of the discharge state of residual charge on the load side, avoiding evaluation errors that may be caused by software fixed delays, thereby ensuring the safety of subsequent reclosing of the power supply circuit.

[0283] In some possible embodiments, to achieve accurate and safe voltage acquisition, the voltage detection circuit 923 may include a high-precision resistor divider network and a signal amplifier. The resistor divider network attenuates the higher voltage on the load side proportionally to a low-voltage sampling range acceptable to the main control unit 921; the signal amplifier performs impedance matching and filtering on the attenuated voltage signal to remove high-frequency switching noise, thereby outputting the acquired voltage signal.

[0284] In addition to the circuit structure of the resistor divider network and signal amplifier mentioned above, the voltage detection circuit 923 can also be constructed using hardware circuits with voltage sampling and conversion functions such as Hall voltage sensors, voltage transformers, or isolated ADC chips. The specific hardware form of the voltage detection circuit 923 is not absolutely limited in this application embodiment.

[0285] Considering that the current drive capability of the main control unit 921's own pins is typically weak (e.g., only 3.3V or 5V microcontroller logic levels), and that the transistors in the power distribution channel 905 (especially the high-side N-channel MOSFET acting as the first switch 911) typically require higher gate drive voltages to turn on quickly and fully, the circuit structure of the power distribution device 900 has been further designed in this embodiment.

[0286] Figure 12 This is a circuit diagram of another power distribution device 900 proposed in the embodiments of this application.

[0287] refer to Figure 12 As shown, compared to Figure 9 , Figure 11The power distribution device 900 shown is shown. Figure 12 The control circuit in the power distribution device 900 shown may further include: a drive circuit 924; The first and second output terminals of the main control unit 921 can be electrically connected to the control terminals of the first switch 911 and the second switch 912 respectively through the drive circuit 924.

[0288] In some possible embodiments, the driving circuit 924 may include a driving chip and a push-pull amplifier circuit. Taking the first switch 911 and the second switch 912 as MOSFETs as an example, for the first switch 911 side, the driving circuit 924 (which may be a gate driving circuit) may integrate a charge pump or a bootstrap circuit to receive the low-voltage logic signal or duty cycle-modulated soft-start signal output by the main control unit 921, and boost the low-voltage signal into a high-current driving signal higher than the power supply potential, so as to quickly overcome the internal parasitic capacitance of the transistor and fully drive the first switch 911 to conduct. For the lower-side second switch 912, since the source potential of the second switch 912 is low, the driving circuit 924 can directly provide a fast charging and discharging path for the second switch 912 through the push-pull amplifier circuit. The push-pull amplifier circuit can provide a large transient current, thereby improving the slew rate and load capacity of the control signal, ensuring the fast response of the second switch 912 during the active discharge process.

[0289] In addition to the aforementioned driver chip and push-pull circuit structure, the aforementioned driver circuit 924 can also be implemented using other hardware topologies with boost or power amplification functions, such as a totem-pole driver circuit built with discrete transistors, an optocoupler-isolated driver, a magnetically isolated gate driver chip, or a transformer-coupled driver circuit. This application embodiment does not impose any restrictions on this.

[0290] Considering that in actual power distribution systems (especially vehicle-mounted high-voltage high-power power distribution platforms), the high voltage and high current in the power supply circuit 901 are prone to generating huge surge spikes and EMI when performing frequent switching operations or short-circuit faults; and in order to prevent the timing of the underlying switch control from being delayed due to the execution of complex business logic by the upper-layer software, the circuit structure of the power distribution device 900 in this application embodiment has been further designed.

[0291] Figure 13 This is a circuit diagram of another power distribution device 900 proposed in the embodiments of this application.

[0292] Compared to Figure 9 , Figure 11 , Figure 12 The power distribution device 900 shown is shown. Figure 12The detailed circuit configuration of the control unit 921 in the power distribution unit 900 is further illustrated. (Reference) Figure 13 As shown, the main control unit 921 may include: a control logic circuit 9211, a signal isolation circuit 9212, and a main controller 9213; The first, second, and third output terminals of the main control unit 921 are output terminals of the control logic circuit 9211; the first port of the signal isolation circuit 9212 is electrically connected to the main controller 9213, and the second port of the signal isolation circuit 9212 is electrically connected to the control logic circuit 9211; the main controller 9213 is used to output control commands and transmit them to the control logic circuit 9211 through the signal isolation circuit 9212; the control logic circuit 9211 is used to execute the control commands.

[0293] In some possible embodiments, the main controller 9213 can be a computing unit such as an MCU, a system-on-chip (SoC), or a DSP. The main controller 9213 is used to execute the business strategies and state interactions described in the aforementioned method embodiments. Taking a vehicle electrical system application scenario as an example, the main controller 9213 can be used to communicate with the upper-level vehicle controller, receive reset commands or OTA retry commands issued by the vehicle controller, and generate corresponding control commands (such as discharge commands, power-on reset commands, or unlock commands) based on the aforementioned command information. These control commands are then sent to the backend control logic circuit 9211.

[0294] In some possible embodiments, the signal isolation circuit 9212 described above can be an optocoupler, a capacitive digital isolation chip, or a magnetically coupled isolation chip. This signal isolation circuit 9212 establishes a physical insulation barrier between the main controller 9213 and the control logic circuit 9211 (and its connected power distribution channel 905). This signal isolation circuit 9212 allows the aforementioned control commands to be transmitted bidirectionally in the form of optical signals or high-frequency magnetic fields, and blocks direct electrical conduction paths, thereby preventing common-mode interference and surge voltage from damaging the main controller 9213 in the event of a short circuit or power failure in the power supply circuit 901.

[0295] In some possible embodiments, the control logic circuit 9211 described above can employ logic devices such as FPGA, complex programmable logic device (CPLD), or ASIC. This control logic circuit 9211 is used to receive and respond to control commands issued by the main controller 9213, thereby generating specific control signals to drive the underlying switching devices. For example, the control logic circuit 9211 can output an unlock signal to the latch circuit 9223 through its third output terminal; or generate a PWM signal with a corresponding duty cycle through its first output terminal to achieve soft start; furthermore, the control logic circuit 9211, based on its internal hardware logic gate circuits, implements hardware interlocking between the first switch 911 and the second switch 912 to prevent them from overlapping conduction.

[0296] By adopting the circuit architecture of decoupling the main controller 9213 and the control logic circuit 9211, the main controller 9213 can focus on the execution and interaction of the upper-level fault handling strategy, while the control logic circuit 9211 executes the lower-level actions based on logic gates. The response speed is faster than the execution cycle of software code, and it can avoid the lower-level control dead zone caused by program interruption nesting or software crash of the main controller 9213, thereby improving the safety and reliability of the power distribution channel 905 when performing power control and fault disconnection.

[0297] In some possible embodiments, to achieve efficient linkage between the power distribution channel 905 and the main control unit 921, each power distribution channel 905 in the aforementioned power distribution device 900 may also reserve a dedicated status feedback pin, such as a general-purpose input / output (GPIO) interrupt pin. This status feedback pin can be electrically connected to the aforementioned main controller 9213 to provide real-time feedback on the fault latching status, switching status, and enable status of the corresponding power distribution channel 905. By deploying an interrupt-based status feedback pin, the main controller 9213 can perceive the underlying fault isolation and switching status within microseconds and trigger reporting or control without periodic software polling.

[0298] In addition, this application also provides another power distribution device.

[0299] Figure 14 This is a schematic block diagram of a power distribution device 1400 proposed in an embodiment of this application.

[0300] The power distribution device 1400 includes a first power distribution channel, which includes a first power supply circuit between the first load and the power source, and a first discharge circuit connected to the first load. Further, the power distribution device 1400 may include: Control unit 1410 is configured to, in response to a fault in the first load, disconnect the first power supply circuit; connect the first discharge circuit to discharge the residual charge of the first load; and, in response to the first load meeting a reset condition, disconnect the first discharge circuit and connect the first power supply circuit, wherein the reset condition is used to indicate that the first load has completed the release of the residual charge.

[0301] In some possible embodiments, the above-mentioned faults include a first type of fault and a second type of fault; wherein, the first type of fault includes the current flowing through the first power distribution channel being greater than the overcurrent threshold; and the second type of fault includes the first load experiencing an OTA upgrade failure.

[0302] In some possible embodiments, in the event of a first type of fault in the first load, the control unit 1410 is specifically configured to: disconnect the first power supply circuit and lock the disconnected state of the first power supply circuit.

[0303] In some possible embodiments, the power distribution device 1400 further includes: a receiving unit 1420 for receiving first indication information, the first indication information being used to indicate the release of the lock on the cut-off state; the control unit 1410 is specifically used to: conduct the first discharge circuit according to the first indication information.

[0304] In some possible embodiments, in the event of a second type of fault in the first load, the receiving unit 1420 is further configured to: receive second indication information, the second indication information being used to indicate a reset of the first power distribution channel; the control unit 1410 is specifically configured to: cut off the first power supply circuit according to the second indication information.

[0305] In some possible embodiments, the power distribution device 1400 further includes: a verification unit 1430, configured to verify preconditions before the control unit 1410 cuts off the first power supply circuit according to the second instruction information. The preconditions include at least one of the following: the equipment where the first load is located meets the static condition; the first load belongs to the load whitelist; or the electrical system where the first load is located is in OTA upgrade mode. The load whitelist is used to indicate loads that are allowed to be powered off. After determining that the preconditions are met, the control unit 1410 is instructed to cut off the first power supply circuit according to the second instruction information.

[0306] In some possible embodiments, the above-mentioned load whitelist includes loads with a security level lower than a target security level, the target security level being determined based on the operating conditions of the device in which the first load is located.

[0307] In some possible embodiments, the reset conditions include at least one of the following: the voltage of the first load is lower than a voltage threshold; the conduction duration of the first discharge circuit is greater than a duration threshold; the discharge current of the first discharge circuit is less than a current threshold; and the voltage change rate of the first load is less than a change rate threshold.

[0308] In some possible embodiments, the voltage threshold, duration threshold, current threshold, or rate of change threshold mentioned above are related to the type of the first load.

[0309] In some possible embodiments, the control unit 1410 is specifically used to: control the first power supply circuit to gradually turn on so that the voltage of the first load rises smoothly.

[0310] In some possible embodiments, the power distribution device further includes a second power distribution channel, which includes a second power supply circuit between the second load and the power source, and a second discharge circuit connected to the second load. Before the first discharge circuit is disconnected and the first power supply circuit is connected, the second power supply circuit is disconnected due to a second load fault. The power distribution device 1400 further includes an acquisition unit 1440, used to acquire a first priority of the first power distribution channel and a second priority of the second power distribution channel. The control unit 1410 is specifically used to: disconnect the first discharge circuit and connect the first power supply circuit when the first priority is determined to be greater than or equal to the second priority; or, when the first priority is determined to be less than the second priority, disconnect the first discharge circuit and connect the first power supply circuit after disconnecting the second discharge circuit and connecting the second power supply circuit.

[0311] In some possible embodiments, the power distribution device 1400 further includes: a monitoring unit 1450, configured to monitor the reset result of the first power distribution channel after the control unit 1410 turns on the first power supply circuit; the control unit 1410 is further configured to: re-perform a reset on the first power distribution channel if the reset result is a reset failure.

[0312] In some possible embodiments, a reset failure includes the current flowing through the first power distribution channel still being greater than the overcurrent threshold after the first power supply circuit is turned on, or the first load still experiencing an OTA upgrade failure.

[0313] In some possible embodiments, the monitoring unit 1450 is further configured to: record the number of retries to reset the first power distribution channel; the control unit 1410 is further configured to: lock the disconnection state of the first power supply circuit and report fault information for the first load in response to the number of retries reaching the threshold and the first power distribution channel still failing to reset.

[0314] In addition, this application also provides a control device.

[0315] Figure 15 This is a schematic block diagram of a control device 1500 proposed in an embodiment of this application.

[0316] The control device 1500 is communicatively connected to the power distribution device, which includes a first power distribution channel, a first power supply circuit between the first load and the power source, and a first discharge circuit connected to the first load.

[0317] refer to Figure 15 As shown, the control device 1500 includes: Determining unit 1510 is used to determine whether the first load has failed; The generation unit 1520 is used to generate target indication information based on the fault when the determination unit 1510 determines that the first load has failed. The sending unit 1530 is used to send target indication information to the power distribution device to instruct the power distribution device to conduct the first discharge circuit to discharge the residual charge of the first load, and to re-conduct the first power supply circuit after the reset condition is met.

[0318] In some possible embodiments, the determining unit 1510 may determine that a fault has occurred by any of the following: receiving status information reported by the power distribution device and determining that a first type of fault has occurred in the first load based on the status information, wherein the status information indicates that an overcurrent has occurred in the first power distribution channel and the first power supply circuit has been disconnected, and the first type of fault includes the current flowing through the first power distribution channel being greater than the overcurrent threshold; or, detecting that a second type of fault has occurred in the first load, wherein the second type of fault includes the failure of an OTA upgrade of the first load.

[0319] In some possible embodiments, before sending the target indication information to the power distribution device, the determining unit 1510 is further configured to: determine the target functional module that has a business association with the first load; the sending unit 1530 is further configured to send third indication information to the target functional module, the third indication information being used to instruct the target functional module to back up data about the first load.

[0320] In some possible embodiments, the control device 1500 further includes: an acquisition unit 1540, configured to acquire the type of the first load; the determination unit 1510 is further configured to: determine a target reset parameter according to the type of the first load, the target reset parameter including a threshold corresponding to a reset condition, and the target indication information carrying the target reset parameter.

[0321] This application embodiment also provides a control device 1600. Figure 16 This is a schematic block diagram of a control device 1600 according to an embodiment of this application. The control device 1600 can be used to implement any of the control methods proposed in the embodiments of this application.

[0322] Figure 16 The circuit control device 1600 shown includes a memory 1610 and a processor 1620.

[0323] In some possible embodiments, the memory 1610 and the processor 1620 can communicate via bus 1640.

[0324] In some possible embodiments, the circuit control device 1600 further includes a communication interface 1630. Accordingly, the memory 1610, the processor 1620, and the communication interface 1630 are interconnected via a bus 1640.

[0325] The memory 1610 may be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1610 may store a program, and when the program stored in the memory 1610 is executed by the processor 1620, the processor 1620 is used to execute the various steps of the control method proposed in the embodiments of this application.

[0326] The processor 1620 may be a general-purpose central processing unit (CPU), microprocessor, application-specific integrated circuit (ASIC), graphics processing unit (GPU), or one or more integrated circuits, used to execute relevant programs to implement the control method proposed in the embodiments of this application.

[0327] The processor 1620 can also be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the control method proposed in this application embodiment can be completed by the hardware integrated logic circuit in the processor 1620 or by software instructions.

[0328] The processor 1620 described above can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods involved in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 1610, and processor 1620 reads information from memory 1610 and executes the control method proposed in the embodiments of this application.

[0329] The communication interface 1630 uses a transceiver device, such as, but not limited to, a transceiver, to enable communication between the circuit control device 1600 and other devices or communication networks.

[0330] Bus 1640 may include a pathway for transmitting information between various components of circuit control device 1600 (e.g., memory 1610, processor 1620, communication interface 1630).

[0331] It should be understood that although the above-described device 1600 only shows a memory, processor, and communication interface, those skilled in the art should understand that in specific implementations, device 1600 may also include other devices necessary for normal operation. Furthermore, depending on specific needs, those skilled in the art should understand that device 1600 may also include hardware devices for implementing other additional functions. Moreover, those skilled in the art should understand that device 1600 may also include only the devices necessary for implementing the embodiments of this application, and not necessarily include... Figure 16 All the devices shown.

[0332] It should be understood that the processor in the embodiments of this application can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0333] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0334] Furthermore, this application also proposes an electrical system that includes any of the control devices and power distribution devices proposed in this application, wherein the control device and the power distribution device are communicatively connected.

[0335] This application also proposes a vehicle that includes the electrical system proposed in this application.

[0336] This application also provides a computer program product containing instructions that, when executed by a processor, cause a device to perform the control method described above.

[0337] This application also provides a computer-readable storage medium storing instructions thereon, which, when executed by a processor, cause the processor to perform the control method described above.

[0338] In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software. The method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or by a combination of hardware and software modules within the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, power-on erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are omitted here.

[0339] It should be understood that in the embodiments of this application, the memory may include read-only memory and random access memory, and provides instructions and data to the processor.

[0340] It should also be understood that, in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0341] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0342] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0343] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0344] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0345] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0346] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0347] The detailed descriptions and accompanying drawings of the above embodiments are used to exemplarily illustrate the principles of this application, but should not be used to limit the scope of this application; that is, this application is not limited to the described embodiments. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A control method, characterized in that, The method is applied to a power distribution device, which includes a first power distribution channel, comprising a first power supply circuit between a first load and a power source, and a first discharge circuit connected to the first load. In response to a failure in the first load, the first power supply circuit is disconnected; The first discharge circuit is turned on to discharge the residual charge of the first load; In response to the first load meeting the reset condition, the first discharge circuit is disconnected and the first power supply circuit is turned on, wherein the reset condition is used to indicate that the first load has completed the release of residual charge.

2. The control method according to claim 1, characterized in that, The faults include first-type faults and second-type faults; The first type of fault includes a current flowing through the first power distribution channel that exceeds an overcurrent threshold; the second type of fault includes a failure of the first load to download an over-the-air (OTA) upgrade.

3. The control method according to claim 2, characterized in that, When the first load experiences the first type of fault, disconnecting the first power supply circuit includes: Disconnect the first power supply circuit and lock the disconnected state of the first power supply circuit.

4. The control method according to claim 3, characterized in that, The process of activating the first discharge circuit includes: Receive a first indication message, the first indication message being used to indicate the release of the lock on the cut-off state; The first discharge circuit is activated according to the first instruction information.

5. The control method according to claim 2, characterized in that, When the first load experiences the second type of fault, disconnecting the first power supply circuit includes: Receive a second instruction message, which is used to instruct the first power distribution channel to be reset; According to the second instruction, the first power supply circuit is disconnected.

6. The control method according to claim 5, characterized in that, Before disconnecting the first power supply circuit according to the second indication information, the control method further includes: Verification of preconditions, the preconditions include at least one of the following: the device where the first load is located meets the static condition, the first load belongs to the load whitelist, or the electrical system where the first load is located is in OTA upgrade mode, the load whitelist is used to indicate loads that are allowed to be powered off; It is determined that the aforementioned preconditions are met.

7. The control method according to claim 6, characterized in that, The load whitelist includes loads with a security level lower than the target security level, and the target security level is determined based on the operating conditions of the device in which the first load is located.

8. The control method according to any one of claims 1 to 7, characterized in that, The reset condition includes at least one of the following: The voltage of the first load is lower than the voltage threshold; The conduction duration of the first discharge circuit is greater than the duration threshold; The discharge current of the first discharge circuit is less than the current threshold. The voltage change rate of the first load is less than the change rate threshold.

9. The control method according to claim 8, characterized in that, The voltage threshold, the duration threshold, the current threshold, or the rate of change threshold is related to the type of the first load.

10. The control method according to any one of claims 1 to 9, characterized in that, The process of activating the first power supply circuit includes: The first power supply circuit is gradually turned on so that the voltage of the first load rises slowly.

11. The control method according to any one of claims 1 to 10, characterized in that, The power distribution device further includes a second power distribution channel, which includes a second power supply circuit between the second load and the power source, and a second discharge circuit connected to the second load. Before the first discharge circuit is disconnected and the first power supply circuit is connected, the second power supply circuit is disconnected due to a fault in the second load. The disconnection of the first discharge circuit and connection of the first power supply circuit includes: Obtain the first priority of the first power distribution channel and the second priority of the second power distribution channel; If the first priority is determined to be greater than or equal to the second priority, the first discharge circuit is disconnected, and the first power supply circuit is connected; or, If the first priority is determined to be lower than the second priority, after disconnecting the second discharge circuit and connecting the second power supply circuit, the first discharge circuit is then disconnected and the first power supply circuit is connected.

12. The control method according to any one of claims 1 to 11, characterized in that, After the first power supply circuit is turned on, the control method further includes: Monitor the reset result of the first power distribution channel; If the reset result is a reset failure, the first power distribution channel is reset again.

13. The control method according to claim 12, characterized in that, The reset failure includes situations where, after the first power supply circuit is turned on, the current flowing through the first power distribution channel is still greater than the overcurrent threshold, or the first load still experiences an OTA upgrade failure.

14. The control method according to claim 12 or 13, characterized in that, The control method further includes: Record the number of retries performed to reset the first power distribution channel; In response to the retry count reaching the threshold and the first power distribution channel still failing to reset, the disconnection status of the first power supply circuit is locked and fault information for the first load is reported.

15. A control method, characterized in that, The control method is applied to a control device that is communicatively connected to a power distribution device. The power distribution device includes a first power distribution channel, which includes a first power supply circuit between a first load and a power source, and a first discharge circuit connected to the first load. It has been determined that the first load has failed; Target indication information is generated based on the fault; The target indication information is sent to the power distribution device to instruct the power distribution device to conduct the first discharge circuit to discharge the residual charge of the first load, and to re-conduct the first power supply circuit after the reset condition is met.

16. The control method according to claim 15, characterized in that, The determination that the first load has failed includes any one of the following: The system receives status information reported by the power distribution device and determines that the first load has experienced a first type of fault based on the status information. The status information indicates that the first power distribution channel has experienced an overcurrent and the first power supply circuit has been disconnected. The first type of fault includes the current flowing through the first power distribution channel being greater than the overcurrent threshold. or, A second type of fault was detected in the first load, the second type of fault including OTA upgrade failure of the first load.

17. The control method according to claim 15 or 16, characterized in that, Before sending the target indication information to the power distribution unit, the control method further includes: Identify the target functional modules that have a business relationship with the first load; A third instruction message is sent to the target functional module, the third instruction message being used to instruct the target functional module to back up data related to the first load.

18. The control method according to any one of claims 15 to 17, characterized in that, Before generating target indication information based on the fault, the control method further includes: Obtain the type of the first load; Based on the type of the first load, a target reset parameter is determined. The target reset parameter includes a threshold corresponding to the reset condition, and the target indication information carries the target reset parameter.

19. A power distribution device, characterized in that, Includes at least one power distribution channel, said power distribution channel comprising: The first switch is connected in series between the power source and the load to form a power supply circuit; A second switch is connected in series between the load and the discharge terminal to form a discharge circuit, wherein the discharge terminal is used to receive the residual charge of the load; A control circuit, which is electrically connected to the first switch and the second switch respectively, is used to: control the first switch to open and the second switch to open in response to a load failure.

20. The power distribution device according to claim 19, characterized in that, The control circuit is also used for: After the load meets the reset condition, the second switch is controlled to open and the first switch is controlled to close. The reset condition is used to indicate that the load has completed the release of residual charge.

21. The power distribution device according to claim 20, characterized in that, The control circuit includes a main control unit, which is used to control the first switch and the second switch to be turned on or off respectively.

22. The power distribution device according to claim 21, characterized in that, The first switch and the second switch are transistors; The first terminal of the first switch is electrically connected to the positive terminal of the power supply, the second terminal of the first switch is electrically connected to the positive terminal of the load, and the control terminal of the first switch is electrically connected to the first output terminal of the main control unit. The first terminal of the second switch is electrically connected to the positive terminal of the load, the second terminal of the second switch is electrically connected to the discharge terminal, and the control terminal of the second switch is electrically connected to the second output terminal of the main control unit.

23. The power distribution device according to claim 22, characterized in that, The control circuit also includes: A fault detection circuit, wherein the input terminal of the fault detection circuit is electrically connected to the power supply circuit, and the output terminal of the fault detection circuit is electrically connected to the control terminal of the first switch; The fault detection circuit is used to: continuously output a latch signal when it detects that the current flowing through the power supply circuit is greater than the overcurrent threshold, and the latch signal is used to control the opening of the first switch.

24. The power distribution device according to claim 23, characterized in that, The fault detection circuit includes: A shunt resistor is connected in series between the first switch and the load; A comparator circuit, wherein the input terminal of the comparator circuit is electrically connected to the shunt resistor; A latching circuit is provided, wherein the input terminal of the latching circuit is electrically connected to the output terminal of the comparator circuit, and the output terminal of the latching circuit is electrically connected to the control terminal of the first switch.

25. The power distribution device according to claim 24, characterized in that, The comparison circuit is used to detect the current flowing through the shunt resistor, and outputs a trigger signal when the current is greater than the overcurrent threshold. The trigger signal is used to trigger the latch circuit to output the latch signal.

26. The power distribution device according to claim 24 or 25, characterized in that, The controlled terminal of the latch circuit is electrically connected to the third output terminal of the main control unit.

27. The power distribution device according to claim 26, characterized in that, The main control unit is further configured to: send an unlock signal to the latch circuit before controlling the first switch to be turned on, the unlock signal being used to control the latch circuit to stop outputting the latch signal.

28. The power distribution device according to any one of claims 22 to 27, characterized in that, The control circuit also includes: A voltage detection circuit is provided, wherein the input terminal of the voltage detection circuit is electrically connected to the positive terminal of the load, and the output terminal of the voltage detection circuit is electrically connected to the input terminal of the main control unit. The voltage detection circuit is used to detect the voltage of the load and output a voltage signal. The main control unit is specifically used to: determine that the load meets the reset condition when the voltage indicated by the voltage signal is less than the voltage threshold.

29. The power distribution device according to any one of claims 22 to 28, characterized in that, The control circuit also includes: The driving circuit connects the first output terminal and the second output terminal of the main control unit to the control terminal of the first switch and the control terminal of the second switch, respectively.

30. The power distribution device according to any one of claims 22 to 29, characterized in that, The main control unit includes: control logic circuit, signal isolation circuit, and main controller; The first output terminal, the second output terminal, and the third output terminal of the main control unit are the output terminals of the control logic circuit. The first port of the signal isolation circuit is electrically connected to the main controller, and the second port of the signal isolation circuit is electrically connected to the control logic circuit. The main controller is used to output control commands and transmit them to the control logic circuit through the signal isolation circuit; the control logic circuit is used to execute the control commands.

31. A power distribution device, characterized in that, Includes modules or units for performing the control method as described in any one of claims 1 to 14.

32. A power distribution device, characterized in that, The device includes at least one processor coupled to at least one memory, the at least one processor being configured to execute a computer program or instructions stored in the at least one memory to cause the device to perform the method as described in any one of claims 1 to 14.

33. A control device, characterized in that, Includes modules or units for performing the control method as described in any one of claims 15 to 18.

34. A control device, characterized in that, The device includes at least one processor coupled to at least one memory, the at least one processor being configured to execute a computer program or instructions stored in the at least one memory to cause the device to perform the method as described in any one of claims 15 to 18.

35. An electrical system, characterized in that, It includes a power distribution device as described in any one of claims 19 to 32, and a control device as described in claim 33 or 34, wherein the power distribution device is communicatively connected to the control device.

36. A vehicle, characterized in that, Including the electrical system as described in claim 35.

37. A computer-readable storage medium, characterized in that, It stores instructions that, when executed by a processor, cause the processor to implement the method as described in any one of claims 1 to 14, or the method as described in any one of claims 15 to 18.

38. A computer program product, characterized in that, It includes instructions that, when executed by a processor, cause the method as described in any one of claims 1 to 14 to be performed, or cause the method as described in any one of claims 15 to 18 to be performed.

Images