A pure hardware trigger-based high-voltage car-mounted fusing power-off module

Abstract

This invention provides a vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering, relating to the field of high-voltage safety hardware technology for new energy vehicles. This vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering includes a mechanical triggering mechanism, a pyrotechnic fuse, and an independent energy storage power supply component. The mechanical triggering mechanism is arranged in the vehicle's passenger compartment or body structure and includes operating components capable of generating physical displacement in response to manual operation or collision impact. The pyrotechnic fuse is connected in series in the vehicle's high-voltage main circuit and includes an ignition device, a gas generating device, and a breakable conductor. The independent energy storage power supply component is independent of the vehicle's low-voltage main power supply. This invention relies entirely on pure hardware for triggering decisions, without relying on software or a bus. The independent energy storage power supply component ensures that high-voltage disconnection can still be completed even when the vehicle's low-voltage system completely fails. It supports multi-channel signal verification to prevent false triggering and also has passive overcurrent fuse redundancy protection.

Description

Technical Field

[0001] This invention relates to the field of high-voltage safety hardware technology for new energy vehicles, specifically to an on-board high-voltage fuse power-off module based on pure hardware triggering. Background Technology

[0002] Safety protection of the high-voltage system in new energy vehicles is an important part of the overall vehicle safety design. According to the mandatory national standard GB18384-2025 "Safety Requirements for Electric Vehicles", vehicles must be equipped with a physical mechanical power-off device that can be triggered by a single action of the driver. This device must be a purely mechanical structure and not rely on software control.

[0003] Existing high-voltage power outage solutions can be mainly classified into the following categories: The first type is a software-controlled relay or contactor power-off solution. This solution relies on the vehicle's ECU or BMS to issue software commands to control the relay to disconnect. This solution has the following drawbacks: when the vehicle is involved in a severe collision causing damage to the low-voltage lines, a break in the CAN bus, or a system crash, the power-off function will directly fail; software control is also susceptible to systemic risks such as being tampered with, bypassed, or experiencing program malfunctions.

[0004] The second type is the manual maintenance switch (MSD) solution. This solution relies on the occupant manually pulling out the high-voltage connector to achieve physical disconnection. This solution has the following drawbacks: during a collision, the occupant may be unconscious or trapped and unable to perform manual operation; the response time of manual operation is uncontrollable and cannot meet the millisecond-level rapid disconnection requirement.

[0005] The third type is the traditional pyrotechnic fuse solution. This solution uses an ignition device to detonate a gas generator, which pushes a piston to cut off the conductive copper busbar, achieving millisecond-level power cutoff. However, most existing pyrotechnic fuses are driven by generator signals from the BMS or vehicle ECU, belonging to a "software decision, hardware execution" mode. They cannot independently cut off high voltage after the vehicle's electronic control system fails. Furthermore, their triggering power is drawn from the vehicle's low-voltage main power supply. If the low-voltage battery is damaged or the low-voltage wiring harness breaks during a collision, even with a triggering signal, power cannot be supplied to the ignition device.

[0006] The fourth category is commercial vehicle-grade Pyrofuse driver chip solutions, such as dedicated driver chips provided by manufacturers like ST or TI. This solution offers improvements in integration and diagnostic capabilities compared to traditional discrete device solutions, but its underlying logic still relies on the SPI communication bus to receive software instructions from the main control MCU, essentially remaining a "software decision, hardware execution" model. When the vehicle's low-voltage power supply fails, both the driver chip and the load switch cannot function, failing to meet the national standard requirements for physical power-off capability under vehicle power failure conditions. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides a vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering, which solves the technical problems of existing solutions relying on software control, vehicle low-voltage power supply, and failure of vehicle electronic control to complete high-voltage cutoff.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solution: a vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering, including a mechanical triggering mechanism, a pyrotechnic fuse and an independent energy storage power supply component; The mechanical triggering mechanism is arranged in the vehicle passenger compartment or body structure and includes operating components that can generate physical displacement in response to manual operation or collision impact. The pyrotechnic fuse is connected in series in the high-voltage main circuit of the vehicle and includes an ignition device, a gas generating device and a breakable conductor. The independent energy storage power supply unit is independent of the vehicle's low-voltage main power supply and is used to provide working power to the ignition device of the pyrotechnic fuse when the vehicle's main power supply fails completely. The mechanical triggering mechanism has no microprocessor, no programmable logic device, and no storage medium with executable program; it relies on a pure hardware structure to achieve triggering control. The mechanical triggering mechanism and the pyrotechnic fuse are physically connected to transmit triggering signals. When the operating component is displaced or deformed, the mechanical triggering mechanism directly connects the ignition device power supply circuit of the pyrotechnic fuse. The ignition device detonates the pyrotechnic fuse, pushing the breakable conductor to disconnect, thereby physically cutting off the high-voltage main circuit of the entire vehicle.

[0009] Preferably, the physical connection includes a mechanical linkage and a hard wire connection. The mechanical linkage is used to transmit the mechanical displacement generated by the operating component, and the hard wire is used to construct the electrical path for power supply to the ignition device. The mechanical triggering mechanism is provided with a mechanical contact group, which realizes the connection and disconnection of the power supply circuit of the ignition device.

[0010] Preferably, the operating component is selected from one or more of the following: emergency handle of the central control panel, collision slider, and high-pressure maintenance cover linkage lever.

[0011] Preferably, the mechanical triggering mechanism has a built-in pure hardware RC delay circuit. After receiving the displacement signal, it delays for a preset time to turn on the power supply circuit of the ignition device. The preset time does not exceed 5ms. During the delay interval, the mechanical triggering mechanism synchronously drives the alarm device to output a pre-alarm prompt signal.

[0012] Preferably, the mechanical triggering mechanism is equipped with at least two independent physical signal acquisition terminals. Multiple signals are sent to a pure hardware comparator array for parallel comparison. The hardware triggering signal is only output when at least two acquired signals synchronously exceed a preset safety threshold.

[0013] Preferably, the pyrotechnic fuse is a one-time action device that cannot be reset after activation and requires complete replacement.

[0014] Preferably, the response time of the pyrotechnic fuse is 1ms to 5ms, and the total response time for physical disconnection of the high-voltage circuit of the whole vehicle is ≤1s.

[0015] Preferably, an electrical hardware isolation architecture is provided between the mechanical triggering mechanism and the power supply circuit of the pyrotechnic fuse ignition device.

[0016] Preferably, the pyrotechnic fuse integrates a passive fuse element, which is set independently of the ignition device, gas generating device and breakable conductor. When the high-voltage main circuit current exceeds a preset threshold, the passive fuse element melts automatically, realizing hardware redundancy protection independent of the ignition triggering link.

[0017] Preferably, the independent energy storage power supply is housed in an independent sealed cavity, and a physical isolation structure is provided between the independent energy storage power supply and the vehicle's low-voltage main power supply. The charging circuit of the independent energy storage power supply is equipped with a unidirectional conduction device, allowing only external power to charge the independent energy storage power supply and prohibiting the independent energy storage power supply from feeding back into the vehicle's low-voltage main power supply. The independent energy storage power supply has a built-in pure hardware undervoltage lockout circuit and a pure hardware temperature monitoring branch. The undervoltage lockout circuit cuts off the output when the energy storage output voltage is lower than a preset threshold. The temperature monitoring branch monitors the temperature of the energy storage device and outputs a hardware alarm signal. The undervoltage lockout circuit and the temperature monitoring branch are all built with discrete hardware components, without a microprocessor or programmable devices.

[0018] Preferably, the module includes a hardware final decision circuit. The hardware final decision circuit permanently determines its decision logic based on the physical connection relationship of the hardware circuit. It cannot be rewritten after leaving the factory. It has no microprocessor and no programmable firmware. The hardware final decision circuit can be used as an auxiliary decision path or replace the original path as the main decision path. The software interaction domain only reads the hardware status in one direction. There is no electrical path for software to interfere with the hardware decision in reverse.

[0019] Preferably, the module is configured with a pure hardware thermal status monitoring branch, which collects multiple temperature signals from the pyrotechnic fuse, independent energy storage power supply, and high-voltage terminals. The thermal status is compared by a pure hardware comparator array and hardware logic gates. When multiple thermal parameters deviate from the preset safety threshold simultaneously, the hardware circuit directly outputs a level signal to turn on the power supply circuit of the ignition device.

[0020] Preferably, the purely hardware structure of the mechanical triggering mechanism directly connects the power supply circuit of the ignition device through the mechanical contact group, the mechanical linkage transmits the mechanical displacement generated by the operating components, and the hard wire constitutes the electrical path for power supply to the ignition device.

[0021] This invention provides a vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering. It has the following advantages: 1. This invention adopts a pure hardware mechanical triggering architecture, which does not rely on MCU, software program, or CAN bus, avoiding the risk of power failure caused by software crashes, firmware tampering, or bus disconnection, and reliably completes high voltage cut-off under accident conditions.

[0022] 2. This invention can achieve rapid disconnection in 1ms to 5ms using a pyrotechnic fuse. The fast disconnection speed makes it suitable for extreme scenarios such as collisions, high-voltage short circuits, and precursors to thermal runaway.

[0023] 3. By configuring an independent energy storage power supply component, which is physically isolated from the vehicle's low-voltage main power supply, this invention can still output power to the ignition device even when the vehicle's low-voltage is damaged or completely loses power, thus solving the fatal flaw of traditional solutions that cannot be triggered when power is lost.

[0024] 4. This invention supports two modes: manual triggering and collision-triggered passive triggering, through the operating components. The driver can operate it manually, and it can be automatically triggered when a collision occurs, forming a dual protection.

[0025] 5. This invention achieves multiple physical signals through a pure hardware comparator array verification, requiring multiple signals to exceed limits simultaneously before outputting a trigger signal, filtering out false triggers caused by vibration and electromagnetic interference, and avoiding accidental high-voltage disconnection in non-accident scenarios.

[0026] 6. This invention possesses passive overcurrent fusing capability. When an active link failure occurs, the circuit is cut off by the passive fuse, thus constructing dual hardware protection of active ignition fusing and passive overcurrent fusing. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the overall structure assembly of the present invention; Figure 2 This is a schematic diagram of the internal mechanical contact structure of the mechanical triggering mechanism of the present invention; Figure 3 This is a schematic diagram of the electrical principle of the independent energy storage power supply device of the present invention.

[0028] Among them, 1. Mechanical triggering mechanism; 2. Mechanical linkage; 3. Pyrotechnic fuse; 4. Independent energy storage power supply; 5. Alarm device; 6. Vehicle low-voltage main power supply; 7. Thermal status monitoring branch. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Example 1: like Figure 1-3 As shown, this embodiment of the invention provides a vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering. The mechanical triggering mechanism 1 is mounted inside the left panel of the center console in the driver's seat. The outer shell is injection molded from flame-retardant ABS engineering plastic, and the internal cavity is divided into two independent areas, a mechanical cavity and a circuit cavity, by a partition. The operating component is the emergency handle of the center console, which is exposed on the surface of the center console. The pulling stroke is 15mm, and the maximum operating force is no more than 30N. The handle is connected to the moving contact bracket inside the mechanical cavity through a mechanical linkage 2.

[0031] The mechanical cavity houses a group of mechanical contacts made of silver alloy, including an upper stationary contact, a lower stationary contact, and a middle moving contact, with a contact gap of 1mm to 2mm. A return spring, made of stainless steel, is installed between the moving contact support and the outer shell, with a free length of 8mm and a pre-compression of 2mm, ensuring that the moving contact automatically returns to its initial open position after the operating force is released. The circuit cavity contains an RC delay circuit, consisting of a resistor R1 (typically 10kΩ), a capacitor C1 (typically 470nF), and a hardware comparator. The delay time τ = R1 × C1, and after configuration, the delay does not exceed 5ms.

[0032] The pyrotechnic fuse 3 uses an 800V rated withstand voltage device, connected in series in the high-voltage main circuit of the power battery's positive terminal, and installed in an independent compartment inside the high-voltage distribution box. The pyrotechnic fuse internally includes an electric ignition head, a gas-generating agent, a copper breakable conductor, and a piston-driven mechanism. The electric ignition head has a rated ignition voltage of 9V to 16V and a minimum ignition current of 1.5A. The gas-generating agent uses a pyrotechnic agent with stable gas generation temperature and controllable gas generation rate. The breakable conductor is made of T2 copper, with a cross-sectional area configured according to the rated current carrying capacity, which is not less than 500A. The pyrotechnic fuse is a one-time action device; after activation, the gas-generating agent is completely consumed, and the breakable conductor is irreversibly disconnected and cannot be restored, requiring complete replacement.

[0033] The independent energy storage power supply unit 4 uses a high-temperature resistant lithium manganese battery pack with a rated voltage of 12V and a capacity of 2000mAh. It is located in an independent sealed cavity under the rear seats. The independent energy storage power supply unit is physically isolated from the vehicle's 12V low-voltage battery. The charging circuit is equipped with a unidirectional diode to prevent reverse power feeding. It also has an undervoltage lockout and temperature monitoring circuit built with discrete components.

[0034] The alarm device 5 includes a red LED indicator and a buzzer. The LED indicator is located next to the emergency handle on the center console, and the buzzer is located inside the instrument panel. The alarm device is connected to the output of the RC delay circuit and outputs a sound and light pre-alarm signal synchronously within the delay interval.

[0035] An electrical hardware isolation architecture is set up between the mechanical triggering mechanism 1 and the ignition device power supply circuit of the pyrotechnic fuse 3. An optocoupler is used to achieve electrical isolation between the input side and the output side. The isolation withstand voltage is not less than 2500VAC, ensuring that there is no direct electrical connection between the low voltage signal on the mechanical triggering side and the power supply side of the ignition device, and preventing high voltage or large current on the ignition side from being reversed into the mechanical triggering side and causing secondary damage.

[0036] In an emergency, when the driver pulls the emergency stop handle, the operating components shift, causing the moving contact bracket to compress the return spring via mechanical linkage 2. This closes the moving contact with the upper and lower stationary contacts, and the ignition device power supply circuit is then connected via a hard wire. The RC delay circuit generates a delay of no more than 5ms. During this delay, the alarm device 5 outputs a pre-alarm. After the delay ends, the independent energy storage power supply unit 4 outputs ignition energy to the electric igniter via a hard wire. The igniter ignites the propellant, and within 1ms to 5ms, it pushes the piston to cut off the breakable conductor, disconnecting the vehicle's high-voltage main circuit. The response time of the pyrotechnic fuse is 1ms to 5ms, and the total physical disconnection response time of the vehicle's high-voltage circuit is ≤1s.

[0037] In a simulated 50km / h frontal collision test, the vehicle's low-voltage wiring harness broke and the vehicle's low-voltage main power supply completely failed. After pulling the emergency handle, the pyrotechnic fuse detonated, and the total high-voltage circuit cutoff time was 320ms, meeting the requirement of a total cutoff time of ≤1s. The module can work stably in the full temperature range of -40℃ to 125℃. After vibration, shock, and EMC tests, there were no false triggering or failure to trigger.

[0038] Example 2: Multi-path verification application for commercial new energy trucks The 4.5-ton pure electric van has a rated battery voltage of 540V. The mechanical triggering mechanism is equipped with both an emergency handle on the center console and a collision slider. The collision slider is located inside the front bumper and transmits the collision displacement to the mechanical triggering mechanism through mechanical linkage 2. The trigger displacement threshold of the collision slider is set to 8mm, corresponding to a collision acceleration of approximately 15g.

[0039] The pyrotechnic fuse is a 1000V rated fuse, connected in series with the positive and negative terminals of the power battery to form a dual-polarity cutoff structure. The independent energy storage power supply unit uses a 16.8V, 100F supercapacitor module, which is installed in the sealed cavity inside the longitudinal beam of the vehicle frame. The supercapacitor module has a wide temperature range operation capability, and its capacity retention rate is not less than 80% at -40℃.

[0040] The mechanical triggering mechanism has two independent physical signal acquisition terminals. The first terminal acquires the displacement signal of the collision slider, and the second terminal acquires the displacement signal of the emergency handle on the central control panel. Each signal is converted into an electrical signal through an independent mechanical contact group and then sent to a pure hardware comparator array for parallel comparison. The comparator array consists of two independent hardware comparators and AND logic gates. The AND logic gates only output a hardware trigger signal when both acquired signals synchronously exceed a preset safety threshold (displacement ≥ 8mm and duration ≥ 2ms).

[0041] When a vehicle travels over a bumpy road, only the collision slider experiences instantaneous vibration displacement (displacement less than 8mm or duration less than 2ms), the handle remains stationary, the comparator array does not meet the synchronization limit condition, and the module does not trigger. However, in the event of a 40km / h frontal collision, the signals from both the collision slider and the handle synchronously meet the condition, the comparator array outputs a trigger signal, and the dual high-voltage circuits physically disconnect, with a total response time of 180ms. This multi-channel verification architecture effectively filters out false triggers caused by vibration and electromagnetic interference, preventing accidental high-voltage disconnection in non-accident scenarios.

[0042] Example 3: Passive Redundancy Application of Mobile Energy Storage Charging Vehicle The mobile energy storage and charging vehicle has a rated system voltage of 750V and a battery capacity of 300kWh. The operating components are equipped with a high-voltage maintenance cover linkage lever and an emergency handle on the center console. The high-voltage maintenance cover linkage lever is located inside the high-voltage distribution box cover. When the high-voltage maintenance cover is opened, the linkage lever moves with the cover to trigger the mechanism. The emergency handle is located on the center console in the driver's seat as a backup triggering method.

[0043] The pyrotechnic fuse has a rated withstand voltage of 1000V and a rated current carrying capacity of 800A, with an internally integrated passive fuse element; the independent energy storage power supply adopts a hybrid energy storage scheme of lithium manganese battery and supercapacitor, taking into account both energy density and power density.

[0044] The passive fuse is a separate component independent of the ignition device, gas generator, and breakable conductor. Made of a low-melting-point alloy, it is connected in series in the high-voltage main circuit and is physically completely separated from the active ignition triggering link. The rated fusing current of the passive fuse is configured according to the system's short-circuit protection requirements. When the high-voltage main circuit current exceeds the 1200A threshold, the passive fuse automatically melts due to Joule heating to its melting point, without requiring any triggering signal.

[0045] When the short-circuit current in the high-voltage circuit exceeds the 1200A threshold, indicating a failure of the active triggering link (such as mechanical contact jamming or ignition head malfunction), the passive fuse automatically melts and cuts off the high-voltage circuit. Under a short-circuit current of 1500A, the passive fuse completes melting in 2.3ms, achieving redundant protection. This passive protection function is independent of the mechanical triggering mechanism and the ignition device power supply circuit, forming a dual independent hardware protection architecture of active ignition fuse and passive overcurrent fuse.

[0046] All components of this module meet automotive-grade requirements, with an operating temperature range of -40℃ to 125℃. Environmental reliability tests were conducted, including 48 hours of continuous operation at 125℃, operation at -40℃, 100 temperature cycles from -40℃ to 125℃, random vibration, mechanical shock, radiation immunity, electrostatic discharge, and 96 hours of neutral salt spray testing. The module structure remained intact, and all functions were normal.

[0047] Example 4: Physical Isolation and Protection Structure for Independent Energy Storage Power Supply Components This embodiment further explains the physical isolation and protection structure of the independent energy storage power supply device.

[0048] The independent energy storage power supply unit 4 is housed in an independent sealed cavity with an IP67 protection rating. The cavity is made of die-cast aluminum alloy with an anodized anti-corrosion treatment. The cavity is filled with thermally conductive potting compound to ensure that the energy storage element does not shift relative to other components under vibration conditions. A physical isolation structure is set between the independent energy storage power supply unit and the vehicle's 12V low-voltage battery and BMS power supply circuit. This physical isolation structure adopts a dual isolation method of independent cavity partition and electrical break: there is no direct electrical connection between the positive and negative output terminals of the independent energy storage power supply unit 4 and the vehicle's low-voltage main power supply 6. The two are only isolated by an insulating partition with an insulation resistance of not less than 100MΩ.

[0049] The charging circuit of the independent energy storage power supply unit 4 adopts an ideal diode unidirectional conduction structure, which only allows external charging power to charge the energy storage element and prohibits the energy storage element from feeding back power to the low-voltage side of the vehicle. This unidirectional conduction structure is implemented by a series-connected diode or MOSFET ideal diode circuit, with a forward conduction voltage drop of no more than 0.3V and a reverse leakage current of no more than 10μA, ensuring that the independent energy storage power supply unit 4 can still maintain independent power output when the low-voltage side of the vehicle completely fails, and is not affected by short circuits or grounding faults on the low-voltage side of the vehicle.

[0050] The independent energy storage power supply unit 4 incorporates a pure hardware undervoltage lockout circuit, consisting of a resistor divider network (R3, R4) and a hardware comparator U1. The voltage division ratio is configured according to the undervoltage threshold. When the energy storage voltage falls below the preset threshold (typically 9V), the comparator output flips, cutting off the output via MOSFET Q1 to prevent irreversible damage caused by over-discharge of the energy storage element. Simultaneously, it incorporates a pure hardware temperature monitoring branch, consisting of an NTC thermistor RT (nominal resistance 10kΩ at 25℃, B value 3950K) connected in series with a hardware comparator U2. This monitors the energy storage element temperature across a full temperature range of -40℃ to 125℃. When the temperature exceeds the preset threshold (typically 105℃), the comparator output flips, outputting a hardware alarm signal ALARM. Both the undervoltage lockout circuit and the temperature monitoring branch are built entirely of discrete hardware components and do not involve MCUs or programmable devices.

[0051] Example 5: Integrated Solution for Hardware Final Judgment Circuit As a higher-order implementation of the present invention, the pure hardware decision logic can be integrated into a single chip in the form of a solidified hardware circuit.

[0052] This solidified hardware circuit integrates a hardware comparator array, an RC delay network, a logic gate array, and a driver output stage. All decision logic is permanently determined by the physical connections of the hardware circuit and cannot be rewritten after leaving the factory. It has no microprocessor, no programmable firmware, and no online upgrade interface. The comparator threshold inside the circuit is fixedly configured by an on-chip bandgap reference source and a resistor divider network. The resistor divider ratio is permanently determined during wafer fabrication using a photolithography mask and cannot be modified through an external interface after packaging.

[0053] This fixed hardware circuit can serve as an auxiliary decision path within the module, or it can replace the original mechanical contact path as the main decision path. When the operating component is displaced, the physical signal is processed by the internal hardware decision link of the fixed hardware circuit and then output as a drive signal to activate the ignition device power supply circuit. At this time, the mechanical contact group serves as a backup redundant path, and the ignition circuit can still be directly activated through the pure hardware mechanical contacts if the fixed hardware circuit fails. The two paths are connected in parallel through hardware or logic gates, and a trigger signal can be output if either path meets the conditions, eliminating the risk of overall failure due to a single point of failure.

[0054] The software interaction domain reads the hardware state in only one direction, reading the comparator output state, delay circuit state, and driver output stage state through the read-only register interface. There is no electrical path for software to interfere with hardware decisions in reverse, and the software cannot write any registers or configuration parameters that affect the decision logic.

[0055] This solidified hardware circuit solution can further reduce module size and improve electromagnetic interference resistance, making it suitable for next-generation vehicle platforms with higher integration requirements.

[0056] Example 6: Pure Hardware Thermal State Collaborative Decision Scheme Based on the core solution of this invention, a pure hardware thermal state monitoring branch 7 can be further configured to realize real-time acquisition and hardware judgment of temperature signals from multiple points such as the pyrotechnic fuse 3, the independent energy storage power supply 4, and the high-voltage terminal.

[0057] The thermal condition monitoring branch 7 is equipped with three temperature acquisition points: the first point is located on the surface of the pyrotechnic fuse 3 to monitor the fuse's operating temperature; the second point is located inside the cavity of the independent energy storage power supply unit 4 to monitor the temperature of the energy storage element; and the third point is located at the high-voltage terminal to monitor the terminal temperature. Each acquisition point uses an NTC thermistor as the temperature sensing element, with a nominal resistance of 10kΩ and a B value of 3950K at 25℃, and a temperature measurement range of -40℃ to 150℃.

[0058] The three temperature signals are each fed into an independent hardware comparator and compared with their respective temperature threshold voltages: typical threshold values ​​for fuses are 125°C, for energy storage devices are 105°C, and for terminals are 110°C. The outputs of the three comparators are fed into a hardware AND gate array. The AND gates only output a trigger level signal when at least two temperature signals synchronously deviate from the preset safety threshold. This multi-parameter synchronous decision mechanism effectively avoids false triggering caused by single-point temperature sensor failure or localized instantaneous temperature rise.

[0059] The thermal state monitoring branch 7 collects temperature signals from multiple points and performs thermal state comparison through a pure hardware comparator array and hardware logic gates, without analog-to-digital conversion or microprocessor calculation. When multiple thermal parameters simultaneously deviate from the preset safety threshold, the hardware circuit directly outputs a level signal to conduct the ignition device power supply circuit, triggering the pyrotechnic fuse 3 in advance to complete the high-voltage cutoff, actively isolating high-voltage energy before thermal runaway occurs.

[0060] The hot decision branch 7 can work in parallel with the main trigger link or operate independently. All decision logic is implemented by discrete hardware or fixed hardware circuits.

[0061] Example 7: Redundant Protection of Independent Passive Fuse The pyrotechnic fuse 3 integrates a passive fuse element, which is a separate component independent of the ignition device, gas generating device and breakable conductor, and is completely separated from the active ignition triggering link in physical structure.

[0062] The passive fuse is made of a low-melting-point alloy, typically a tin, silver, and copper alloy, with a melting point ranging from 200℃ to 400℃ depending on the rated fusing current. Connected in series in the high-voltage main circuit, its cross-sectional area is designed based on the rated current carrying capacity. Under normal operating current, the temperature rise does not exceed 60K, ensuring long-term operational reliability. The fusing characteristics of the passive fuse meet the following requirements: no melting within 1 hour at 1.5 times the rated current, melting within 60 seconds at 2 times the rated current, and melting within 10 ms at 10 times the rated current.

[0063] When the high-voltage main circuit current exceeds the preset safety threshold (typically 1200A), the passive fuse will automatically melt due to rapid Joule heating to its melting point, without any trigger signal. This passive protection function is independent of the mechanical triggering mechanism and the ignition device power supply circuit. Even if the active triggering link completely fails (such as mechanical contact jamming, ignition head failure, or depletion of the independent energy storage power supply), the high-voltage circuit can still be physically cut off through passive melting, forming a dual independent hardware protection architecture of active ignition melting and passive overcurrent melting.

[0064] The distance between the broken ends after the passive fuse blows shall not be less than 8mm, which meets the high voltage insulation requirements. It cannot be restored after blowing and must be replaced as a whole with the pyrotechnic fuse.

[0065] Example 8 Electrical Hardware Isolation Architecture This embodiment further explains the electrical hardware isolation architecture between the mechanical triggering mechanism and the power supply circuit of the pyrotechnic fuse ignition device.

[0066] The output side of the mechanical trigger mechanism 1 is a low-voltage weak signal circuit, with an operating voltage not exceeding 16V and an operating current not exceeding 100mA; the ignition device power supply circuit of the pyrotechnic fuse 3 is a low-voltage high-current circuit, with an operating voltage of 9V to 16V and an operating current not less than 1.5A. An electrical hardware isolation architecture is set between the two circuits to ensure that there is no direct electrical connection between the weak signal on the mechanical trigger side and the power supply side of the ignition device, preventing high current or voltage spikes on the ignition side from being reverse-currented into the mechanical trigger side, causing mechanical contact erosion, damage to the RC delay circuit, or false triggering.

[0067] Electrical hardware isolation architecture can be implemented in any of the following ways: 1. Optocoupler isolation method: The input LED and the output phototransistor are electrically isolated by using optocouplers. The isolation withstand voltage is not less than 2500VAC and the response time is not greater than 10μs. 2. Electromagnetic relay isolation method: A small signal relay is used to achieve electrical isolation between the coil side and the contact side. The rated current of the contact is not less than 5A, and the coil driving voltage is 12V. 3. Pulse transformer isolation method: A miniature pulse transformer is used to achieve electrical isolation between the primary and secondary sides. The isolation withstand voltage is not less than 3000VAC, and the transmission signal frequency range is 1kHz to 100kHz.

[0068] The isolation methods described above all involve purely hardware devices and do not involve microprocessors or programmable logic. The input side of the isolation device is connected to the mechanical contact output of the mechanical trigger mechanism, and the output side is connected to the drive stage of the power supply circuit of the pyrotechnic fuse ignition device. When the mechanical contact is closed, the input side of the isolation device is conducting, and the output side is correspondingly conducting, transmitting the trigger signal to the power supply circuit of the ignition device; when the mechanical contact is open, the input side of the isolation device is cut off, and the output side is correspondingly cut off, cutting off the transmission of the trigger signal.

[0069] This electrical hardware isolation architecture effectively improves the module's electromagnetic compatibility performance and anti-interference capability, enabling reliable operation even in strong electromagnetic environments in vehicles (such as PWM interference from motor controllers and switching noise from DC-DC converters), preventing false triggering or failure to trigger. The isolation devices themselves meet automotive-grade requirements, with an operating temperature range of -40℃ to 125℃, and are AEC-Q100 or AEC-Q200 certified.

[0070] Alternative Implementation and Avoidance Path Analysis Based on the core concept of this invention, several modified embodiments exist. The following modified embodiments are all derived from the core concept of this invention, and can be used in combination within this module or independently to form new technical solutions, serving as the technical basis for subsequent divisional applications.

[0071] Method A: The RC delay circuit is removed, and the mechanical triggering mechanism directly connects the ignition circuit after receiving the displacement signal. This implementation can achieve the basic high-voltage cutoff function, but loses the pre-alarm indication function. This implementation does not use the RC delay circuit structure described in claim 4, and only falls within the protection scope of claim 1.

[0072] Method B: Eliminate the multi-channel mutually isolated signal acquisition and use only a single-channel signal for triggering. This solution can achieve basic triggering functionality, but its resistance to false triggering is reduced. This implementation does not include the multi-channel mutually isolated signal acquisition structure described in claim 5, and only falls within the protection scope of claim 1.

[0073] Method C: The independent energy storage power supply unit eliminates physical isolation from the vehicle's low-voltage side and removes unidirectional conduction devices, resulting in an electrical connection between the energy storage and the vehicle's low-voltage system. In this method, the stored energy may be consumed by the vehicle-side fault when the vehicle's low-voltage system fails, reducing reliability under extreme conditions. This implementation does not utilize the physical isolation and unidirectional conduction structure described in claims 9 and 10, and only falls within the protection scope of claim 1.

[0074] Method D: The passive fuse element inside the pyrotechnic fuse is removed, retaining only the active ignition and cut-off function. This solution loses passive overcurrent hardware redundancy protection. This implementation does not configure the passive fuse element structure described in claim 9, and only falls within the protection scope of claim 1.

[0075] Method E: The decision logic is implemented with a fixed hardware circuit, the logical connection relationship of which is permanently determined during the manufacturing stage and cannot be rewritten after leaving the factory; this method falls within the protection scope of claim 11, and also falls within the protection scope of claim 1.

[0076] Method F: Add a pure hardware thermal state decision branch to trigger the fuse based on the condition that the temperature parameters at multiple points simultaneously deviate from the safety threshold. This method falls within the protection scope of claim 12, and also falls within the protection scope of claim 1.

[0077] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering, characterized in that, It includes a mechanical triggering mechanism (1), a pyrotechnic fuse (3), and an independent energy storage power supply component (4); The mechanical triggering mechanism (1) is arranged in the vehicle passenger compartment or body structure and includes operating components that can generate physical displacement in response to manual operation or collision impact. The pyrotechnic fuse (3) is connected in series in the high-voltage main circuit of the vehicle and includes an ignition device, a gas generating device and a breakable conductor; The independent energy storage power supply component (4) is independent of the vehicle's low-voltage main power supply (6) and is used to provide working power to the ignition device of the pyrotechnic fuse (3) when the vehicle's main power supply fails completely. The mechanical triggering mechanism (1) has no microprocessor, no programmable logic device, and no storage medium with executable program. It relies on a pure hardware structure to achieve triggering control. The mechanical triggering mechanism (1) and the pyrotechnic fuse (3) transmit triggering signals through a physical connection. When the operating component is displaced or deformed, the mechanical triggering mechanism (1) directly connects the ignition device power supply circuit of the pyrotechnic fuse (3), and the ignition device detonates the pyrotechnic fuse (3), pushing the breakable conductor to disconnect, thereby realizing the physical disconnection of the high-voltage main circuit of the whole vehicle.

2. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The physical connection includes a mechanical link (2) and a hard wire connection. The mechanical link (2) is used to transmit the mechanical displacement generated by the operating component. The hard wire is used to construct the electrical path for power supply of the ignition device. The mechanical triggering mechanism (1) is equipped with a mechanical contact group, which realizes the conduction and disconnection of the power supply circuit of the ignition device through the mechanical contact group.

3. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The operating component is selected from one or more of the following: emergency handle of the central control panel, collision slider, and high-pressure maintenance cover linkage lever.

4. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The mechanical triggering mechanism (1) has a built-in pure hardware RC delay circuit. After receiving the displacement signal, it delays for a preset time to turn on the power supply circuit of the ignition device. The preset time does not exceed 5ms. The mechanical triggering mechanism (1) synchronously drives the alarm device (5) to output a pre-alarm prompt signal within the delay interval.

5. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The mechanical triggering mechanism (1) is equipped with at least two independent physical signal acquisition terminals. Multiple signals are sent to a pure hardware comparator array for parallel comparison. The hardware triggering signal is only output when at least two acquisition signals synchronously exceed a preset safety threshold.

6. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The pyrotechnic fuse (3) is a one-time action device that cannot be reset after it is activated and needs to be replaced as a whole.

7. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The response time of the pyrotechnic fuse (3) is 1ms to 5ms, and the total response time of the physical disconnection of the high voltage circuit of the whole vehicle is ≤1s.

8. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: An electrical hardware isolation architecture is provided between the mechanical triggering mechanism (1) and the power supply circuit of the ignition device of the pyrotechnic fuse (3).

9. A vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The pyrotechnic fuse (3) integrates a passive fuse element. The passive fuse element is set independently of the ignition device, gas generating device and breakable conductor. When the high-voltage main circuit current exceeds the preset threshold, the passive fuse element melts by itself, realizing hardware redundancy protection independent of the ignition triggering link.

10. A vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The independent energy storage power supply unit (4) is housed in an independent sealed cavity. The independent energy storage power supply unit (4) is physically isolated from the vehicle's low-voltage main power supply (6). The charging circuit of the independent energy storage power supply unit (4) is equipped with a unidirectional conduction device, which only allows external power to charge the independent energy storage power supply unit (4) and prohibits the independent energy storage power supply unit (4) from feeding back power to the vehicle's low-voltage main power supply (6). The independent energy storage power supply unit (4) has a built-in pure hardware undervoltage lockout circuit and a pure hardware temperature monitoring branch. The undervoltage lockout circuit cuts off the output when the energy storage output voltage is lower than a preset threshold. The temperature monitoring branch monitors the temperature of the energy storage unit and outputs a hardware alarm signal. The undervoltage lockout circuit and the temperature monitoring branch are all built with discrete hardware components, without microprocessors or programmable devices.

11. A vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The module includes a hardware final decision circuit. The hardware final decision circuit permanently determines its decision logic based on the physical connection relationship of the hardware circuit. It cannot be rewritten after leaving the factory. It has no microprocessor and no programmable firmware. The hardware final decision circuit can be used as an auxiliary decision path or replace the original path as the main decision path. The software interaction domain only reads the hardware status in one direction. There is no electrical path for software to interfere with the hardware decision in reverse.

12. The vehicle-mounted high-voltage fuse power-off module based on pure hardware triggering according to claim 1, characterized in that: The module is equipped with a pure hardware thermal state monitoring branch (7) to collect temperature signals from multiple points, including the pyrotechnic fuse (3), the independent energy storage power supply (4), and the high-voltage terminal. The thermal state is compared with the hardware logic gate through a pure hardware comparator array. When multiple thermal parameters deviate from the preset safety threshold simultaneously, the hardware circuit directly outputs a level signal to connect the power supply circuit of the ignition device.

Images