Safety power-off control method and device for high-voltage short-circuit fault and vehicle

Abstract

The application relates to the technical field of electric vehicles, and discloses a high-voltage short-circuit fault safety power-off control method and device and a vehicle. The method comprises the following steps: acquiring a short-circuit fault detection signal of a high-voltage loop, and performing emergency locking on each high-voltage load in the high-voltage loop in response to the short-circuit fault detection signal; determining a breaking working condition type of a main relay in the high-voltage loop after the emergency locking, and determining a corresponding hierarchical breaking strategy based on the breaking working condition type; triggering the main relay to perform a corresponding breaking action and triggering a main active energy discharge circuit to discharge the high-voltage loop according to the hierarchical breaking strategy, so that the high-voltage loop is safely powered off. According to the application, the high-voltage load is first interrupted by hardware after fault detection, and then the main relay is triggered to break and the main active energy discharge circuit is triggered to discharge based on the hierarchical breaking strategy, so that the risk of the main relay being welded under a high-voltage short-circuit fault is effectively avoided, and the reliability of safe power-off under a high-voltage short-circuit working condition is significantly improved.

Description

Technical Field

[0001] This application relates to the field of electric vehicle technology, and in particular to a safe power-off control method, device and vehicle for high-voltage short-circuit faults. Background Technology

[0002] When an electric vehicle collides and causes a short circuit on the high-voltage load side, it is necessary to ensure that the high-voltage power supply can be reliably disconnected so that the vehicle meets the requirements for protection against electric shock. In related technologies, vehicle high-voltage safety power-off schemes typically employ a main relay disconnection strategy based on a collision sensor. An acceleration sensor triggers a high-voltage disconnection command, driving the main relay to disconnect the high-voltage circuit.

[0003] However, in the event of a collision causing a high-voltage load or wiring harness short circuit, the current that the main relay needs to disconnect may far exceed its safe disconnecting capacity, posing a risk of contact welding, which could lead to the main relay failing to disconnect, preventing the high-voltage circuit from being properly disconnected, and seriously affecting the safety of the vehicle's high-voltage system. Summary of the Invention

[0004] This application provides a safe power-off control method, device, and vehicle for high-voltage short-circuit faults. It solves the technical problem that the main relay is prone to welding due to interrupting large currents under high-voltage load short-circuit conditions, resulting in insufficient reliability of safe power-off. By first performing a hardware interruption on the high-voltage load after fault detection, and then determining a graded shutdown strategy based on the interruption condition type of the main relay, and triggering the main relay to disconnect and the active energy discharge circuit to discharge, the risk of welding of the main relay under high-voltage short-circuit faults is effectively avoided, and the reliability of safe power-off under high-voltage short-circuit conditions is significantly improved.

[0005] To achieve the above objectives, the main technical solutions adopted in this application include: In a first aspect, this application provides a safe power-off control method for high-voltage short-circuit faults, the method comprising: Acquire a short-circuit fault detection signal of the high-voltage circuit, and in response to the short-circuit fault detection signal, perform emergency blocking on each high-voltage load in the high-voltage circuit; Determine the disconnection condition type of the main relay in the high-voltage circuit after the emergency blockade, and determine the corresponding graded disconnection strategy based on the disconnection condition type; According to the graded disconnection strategy, the main relay is triggered to perform the corresponding disconnection action, and the active energy discharge circuit is triggered to discharge the high-voltage circuit so that the high-voltage circuit is safely de-energized.

[0006] The proposed safe power-off control method, before physically disconnecting the main relay, first performs an emergency blockade on the high-voltage load in response to a short-circuit fault detection signal. This forces the power switch inside the load to shut down, cutting off the supply path of short-circuit current to the short-circuit point at the source, thus significantly reducing the current flowing through the main relay before disconnection. Simultaneously, based on the current value flowing through the main relay after the emergency blockade, the disconnection condition type is determined, and a corresponding graded disconnection strategy is matched according to different disconnection condition types to avoid the main relay blindly disconnecting large currents and bearing excessive arc energy. Furthermore, while triggering the main relay to perform the disconnection action, the active energy discharge circuit is also triggered to discharge, consuming the electrical energy stored in the high-voltage circuit and accelerating the bus voltage drop. This provides current attenuation conditions for the main relay disconnection, reducing the risk of welding of the main relay contacts due to high arc temperature, thereby improving the reliability and safety of vehicle power-off under high-voltage short-circuit conditions.

[0007] Optionally, acquiring the short-circuit fault detection signal of the high-voltage circuit includes: Real-time acquisition of the bus voltage, circuit current, and insulation resistance value of the high-voltage circuit; If the voltage drop rate of the bus voltage and the loop current meet the first preset condition, or if the amplitude of the bus voltage, the loop current, and the insulation resistance value meet the second preset condition, then the short-circuit fault detection signal is output.

[0008] By acquiring bus voltage, loop current, and insulation resistance values ​​in real time, and utilizing multi-dimensional electrical parameters in short-circuit fault determination, the risk of misjudgment or missed detection caused by relying on a single physical quantity is avoided. Simultaneously, by combining first and second preset conditions, short-circuit faults are analyzed from both rate and amplitude dimensions, covering the electrical characteristics of different short-circuit fault modes. This improves the robustness and accuracy of short-circuit fault diagnosis, providing precise decision-making basis for the reliable execution of subsequent emergency shutdown and power-off strategies.

[0009] Optionally, the first preset condition is that the voltage drop rate of the bus voltage is greater than a preset drop rate threshold, and the duration for which the loop current exceeds a preset short-circuit current threshold is greater than a preset time threshold. The second preset condition is that the amplitude of the bus voltage is lower than a preset percentage of the rated voltage, the insulation resistance value is lower than a preset resistance threshold, and the duration for which the circuit current exceeds a preset short-circuit current threshold is greater than a preset time threshold.

[0010] This application introduces a rate analysis dimension in the first preset condition, using the rate of decrease of the bus voltage to characterize the transient electrical characteristics of a low-impedance short circuit in the high-voltage circuit. Furthermore, it introduces an amplitude dimension in the second preset condition, combining the bus voltage amplitude drop with the sudden drop in insulation resistance to characterize the electrical characteristics of special fault modes such as high-impedance short circuits or insulation failures. In addition, the introduction of a duration dimension for abnormal circuit current effectively distinguishes between genuine short-circuit faults and transient interference signals, avoiding misjudgments caused by current transients and further improving the accuracy and anti-interference capability of fault identification.

[0011] Optionally, the emergency blocking of each high-voltage load in the high-voltage circuit in response to the short-circuit fault detection signal includes: An emergency shutdown command is generated based on the short-circuit fault detection signal and sent to each of the high-voltage loads through a hard-wired trigger channel and a bus broadcast channel. The power switches of each of the high-voltage loads are triggered to shut down in response to the emergency shutdown command, thereby completing the emergency shutdown.

[0012] The hard-wired triggering channel is independent of communication links and software protocols, ensuring reliable delivery of emergency shutdown commands even in the event of communication interruption or controller malfunction. The bus broadcast channel serves as a redundant backup, enhancing the reliability of command transmission. This dual-channel collaboration ensures timely shutdown of high-voltage loads, providing the prerequisite for the safe disconnection of the main relay.

[0013] Optionally, determining the disconnection condition type of the main relay in the high-voltage circuit after the emergency shutdown includes: Monitor the current value of the main relay flowing through the high-voltage circuit; The disconnection condition type is determined based on the current range in which the current value is located.

[0014] This application monitors the current value flowing through the main relay after an emergency shutdown and determines the tripping condition type based on the current range in which the current value is located. This ensures that the selection of subsequent tripping strategies can match the actual current state and prevents the main relay from blindly performing tripping actions before the current has decayed to a safe level.

[0015] Optionally, the types of disconnection conditions include completely arc-free disconnection conditions, weak arc disconnection conditions, and dangerous disconnection conditions. Wherein, when the current current value is less than or equal to the first preset current threshold, the disconnection condition type is determined to be the completely arc-free disconnection condition type. If the current current value is greater than the first preset current threshold and less than or equal to the second preset current threshold, the disconnection condition type is determined to be the weak arc disconnection condition type. When the current current value is greater than the second preset current threshold, the disconnection condition type is determined to be the dangerous disconnection condition type.

[0016] By setting a first preset current threshold and a second preset current threshold, the breaking conditions are divided into completely arc-free breaking conditions, weak arc breaking conditions, and dangerous breaking conditions. This allows the main relay to perform its breaking action differently based on different current ranges, thereby reducing the arc energy borne by the contacts while ensuring breaking reliability and reducing the risk of contact welding.

[0017] Optionally, the step of triggering the main relay to perform the corresponding disconnection action and triggering the active energy discharge circuit to discharge the high-voltage circuit according to the hierarchical disconnection strategy includes: When the interruption condition type is the completely arc-free interruption condition type, the corresponding hierarchical interruption strategy is determined to be the immediate interruption strategy, so as to drive the main relay to immediately perform the interruption action according to the immediate interruption strategy, and trigger the active energy discharge circuit to conduct after a first preset delay. When the interruption condition type is the weak arc interruption condition type, the corresponding graded interruption strategy is determined to be the delayed interruption strategy, so that the main relay is driven to perform the interruption action after the second preset delay according to the delayed interruption strategy, and the active energy discharge circuit is triggered to conduct after the first preset delay. When the disconnection condition type is the dangerous disconnection condition type, the corresponding graded disconnection strategy is determined to be the enhanced discharge post-discharge disconnection strategy. The active energy discharge circuit is immediately triggered to conduct according to the enhanced discharge post-discharge disconnection strategy. When the current current value is less than or equal to the second preset current threshold, the main relay is driven to perform the disconnection action after the second preset delay.

[0018] In a completely arc-free interruption condition, the main relay immediately disconnects and the discharge circuit conducts after a first preset delay, ensuring that the disconnection is completed before discharge. In a weak-arc interruption condition, the main relay disconnects after a second preset delay, allowing time for further current decay. Simultaneously, the discharge circuit remains on after the first preset delay, achieving timing coordination between disconnection and discharge. In a dangerous interruption condition, the discharge circuit immediately conducts to prioritize consuming bus power and accelerate current decay. Once the current value drops to a safe range, the main relay is then driven to disconnect, ensuring that the main relay only disconnects when the current is within a safe range. Therefore, by combining different timing sequences for disconnection and discharge under these three conditions, the system avoids the main relay being subjected to excessive arc energy during disconnection under excessive current, while ensuring timely intervention in the energy discharge process, thus improving the reliability of the safe power-off process.

[0019] Optionally, after the active energy discharge circuit is triggered to discharge the high-voltage circuit, the method further includes: The bus voltage, bus capacitor energy, and insulation resistance value of the high-voltage circuit are acquired in real time to verify whether the high-voltage circuit is safely de-energized based on the bus voltage, bus capacitor energy, and insulation resistance value. If the bus voltage, the bus capacitor energy, and the insulation resistance value meet the preset safety conditions, then the high-voltage circuit is determined to have been successfully and safely de-energized. If any one of the bus voltage, the bus capacitor energy, and the insulation resistance value fails to meet the preset safety conditions, the power-down is determined to have failed, and the active energy discharge circuit is controlled to remain in the conducting state, while triggering an emergency alarm.

[0020] After the active energy discharge circuit is triggered to discharge, this application comprehensively verifies whether the high-voltage circuit is safely powered down by acquiring the bus voltage, bus capacitor energy, and insulation resistance value in real time, from three dimensions: voltage level, residual energy, and insulation status, to ensure the accurate determination of the power-down execution result.

[0021] Secondly, this application provides a safe power-off control device for high-voltage short-circuit faults, the device comprising: The fault diagnosis module is used to acquire the short-circuit fault detection signal of the high-voltage circuit and, in response to the short-circuit fault detection signal, to perform emergency blocking of each high-voltage load in the high-voltage circuit. The disconnection analysis module is used to determine the disconnection condition type of the main relay in the high-voltage circuit after the emergency blockade, and to determine the corresponding graded disconnection strategy based on the disconnection condition type. The power-down execution module is used to trigger the main relay to perform the corresponding disconnection action according to the hierarchical disconnection strategy and to trigger the active energy discharge circuit to discharge the high-voltage circuit so as to safely power down the high-voltage circuit.

[0022] The safe power-off control device proposed in this application, before physically disconnecting the main relay, first responds to a short-circuit fault detection signal to perform an emergency blockade on the high-voltage load, forcibly shutting off the power switch inside the load. This cuts off the supply path of the short-circuit current to the short-circuit point at the source, significantly reducing the current flowing through the main relay before disconnection. Simultaneously, based on the current value flowing through the main relay after the emergency blockade, the disconnection condition type is determined, and a corresponding graded disconnection strategy is matched according to different disconnection condition types to avoid the main relay blindly disconnecting large currents and bearing excessive arc energy. Furthermore, while triggering the main relay to perform the disconnection action, the active energy discharge circuit is also triggered to discharge, consuming the electrical energy stored in the high-voltage circuit and accelerating the bus voltage drop. This provides current attenuation conditions for the main relay disconnection, reducing the risk of welding of the main relay contacts due to high arc temperatures, thereby improving the reliability and safety of vehicle power-off under high-voltage short-circuit conditions.

[0023] Thirdly, this application provides a vehicle, the vehicle comprising: High-voltage system; And the aforementioned high-voltage short-circuit fault safety power-off control device, the device being used to perform safety power-off control on the high-voltage system. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0025] Figure 1 One of the flowcharts for a safe power-off control method for a high-voltage short-circuit fault provided in this application embodiment; Figure 2 This is a schematic diagram of the execution timing of the timing controller in the embodiments of this application; Figure 3 A second schematic flowchart illustrating a safe power-off control method for high-voltage short-circuit faults provided in this application embodiment; Figure 4 The third flowchart illustrates a safe power-off control method for high-voltage short-circuit faults provided in this application embodiment; Figure 5 The fourth flowchart illustrates a safe power-off control method for high-voltage short-circuit faults provided in this application embodiment. Figure 6 This is a schematic diagram of a safe power-off control device for high-voltage short-circuit faults provided in an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] In the event of a vehicle collision, the high-voltage circuit may experience a short circuit due to structural deformation or component damage. In such cases, it is necessary to reliably disconnect the high-voltage power supply and discharge the residual electrical energy on the high-voltage busbar to prevent secondary injuries such as electric shock to occupants and vehicle fire.

[0028] In related technologies, vehicle high-voltage safety power-off solutions typically employ a main relay disconnection strategy based on collision sensors. This approach places acceleration sensors at critical locations within the vehicle. When an acceleration signal exceeding a preset threshold is detected, the safety controller determines a collision has occurred and sends a high-voltage cutoff command to the battery management system via the CAN bus, driving the main relay to disconnect the high-voltage circuit. However, in practical applications, this solution suffers from several drawbacks. When a high-voltage load experiences a short circuit, the impedance at the short-circuit point approaches zero, causing the circuit current to surge to tens of thousands of amperes. The main relay is forced to disconnect under this high short-circuit current, generating a high-intensity electric arc between the contacts. The high temperature of the arc melts the contact material, which then bonds together upon cooling, leading to relay welding failure and preventing the high-voltage circuit from disconnecting.

[0029] Furthermore, since only collision mechanical signals are collected and high-voltage electrical parameters are not used to participate in power-down decisions, the system cannot identify load short-circuit faults and can only execute the same power-down strategy for all collision events, which greatly increases the probability of relay welding failure and seriously affects the reliability of safe power-down.

[0030] Other related technologies employ an active discharge scheme based on airbag signals. This scheme is typically triggered after the airbag control unit sends an deployment signal. The motor controller uses its internal power switching devices and motor windings to form a discharge circuit, dissipating the electrical energy stored in the DC bus capacitor. However, the active discharge in this scheme is executed primarily by the motor controller. Its internal power switching devices, drive circuits, and main control chip constitute the necessary components of the discharge circuit. If the relay fails due to welding, the high-voltage circuit loses its only physical break point, and the high-voltage bus continues to carry a dangerous voltage. In this case, active discharge relies on the normal operation of the motor controller and the integrity of the low-voltage power supply and communication link. If a collision causes communication interruption, low-voltage power supply failure, or controller failure, the active discharge function will not be able to activate.

[0031] It is evident that the safety power-off schemes in related technologies cannot promptly identify the fault type and take targeted disconnection measures after a short circuit occurs. This forces the relay to disconnect under a short-circuit current of tens of thousands of amperes, which can easily lead to contact welding failure. This prevents the high-voltage circuit from being reliably disconnected, causing the vehicle to fail to meet the electric shock protection requirements stipulated in relevant standards, and posing serious risks of electric shock and fire.

[0032] To ensure the clarity and completeness of the technical solution in this application, the key terms involved in this invention are first defined and explained.

[0033] High-voltage load short circuit: This refers to an electrical fault where high-voltage load equipment such as the Motor Control Unit (MCU), PTC heater, air conditioning compressor, and on-board charger (OBC) or its connecting wiring harness is damaged in a collision, resulting in a direct connection between the high-voltage positive and negative terminals, or a low-impedance connection between the high-voltage positive / negative terminals and the vehicle body ground. After a short circuit occurs, the impedance at the short-circuit point drops sharply to near zero ohms, and a short-circuit current of tens of thousands of amperes will be generated in the circuit.

[0034] Main relays: These refer to the combined positive and negative main relays located inside the battery pack, used to connect or disconnect the high-voltage circuit under normal conditions. Main relays employ an electromagnetically driven mechanical contact structure, providing physical isolation. While current mainstream high-voltage DC relays have breaking capacities of several thousand amperes, their short-circuit currents can reach tens of thousands of amperes, far exceeding safe breaking limits.

[0035] Relay welding: This refers to a fault phenomenon where the moving and stationary contacts of the main relay, when interrupting a large current, partially melt due to the high temperature of the electric arc, and fuse together after cooling. This results in a situation where, although the relay receives a disconnect command, the contacts remain in a conductive state and cannot be separated. Relays generally require current control below 20A to ensure damage-free disconnection. During short-circuit high-current disconnection, the contacts are extremely prone to melting and bonding, which is the most common and serious failure mode for DC high-voltage relays.

[0036] To address the aforementioned technical problems, this application provides an embodiment of a safe power-off control method for high-voltage short-circuit faults. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0037] This embodiment provides a safe power-off control method for high-voltage short-circuit faults. Figure 1 This is a flowchart of a safe power-off control method according to an embodiment of this application, such as... Figure 1As shown, the process includes the following steps: Step S1: Obtain the short-circuit fault detection signal of the high-voltage circuit, and in response to the short-circuit fault detection signal, perform emergency blocking on each high-voltage load in the high-voltage circuit.

[0038] Specifically, the short-circuit fault detection signal in the high-voltage circuit indicates that a load-side short-circuit fault has occurred in the high-voltage circuit. In response to this signal, an emergency shutdown is implemented for each high-voltage load in the high-voltage circuit. These high-voltage loads include electrical equipment such as motor controllers, PTC heaters, air conditioning compressors, and on-board chargers. The emergency shutdown specifically refers to forcibly shutting down the power switching devices inside each high-voltage load, such as IGBTs or MOSFETs, cutting off the supply path of the short-circuit current in the high-voltage circuit. If the power switches inside the high-voltage load remain on during a short-circuit fault, the high-voltage battery will continuously supply a large current to the short-circuit point through the load, with the circuit current reaching tens of thousands of amperes.

[0039] Through emergency shutdown, the power switch inside the load is forcibly shut down in response to the shutdown command, preventing the high-voltage battery from supplying current to the short-circuit point through the load. This cuts off the supply path of the short-circuit current at the source, allowing the current flowing through the main relay to drop rapidly from the tens of thousands of amperes at the time of the short circuit, reducing the risk of high-temperature arcing caused by large current interruption.

[0040] Step S3: Determine the disconnection condition type of the main relay in the high-voltage circuit after emergency blocking, and determine the corresponding graded disconnection strategy based on the disconnection condition type.

[0041] Determining the tripping condition type of the main relay after an emergency shutdown involves assessing the tripping conditions based on the actual current state faced by the main relay after the emergency shutdown. After an emergency shutdown, the supply path of the short-circuit current has been cut off, and the current flowing through the main relay will decrease significantly. However, due to the energy stored in the high-voltage bus capacitor and the residual impedance at the short-circuit point, the current flowing through the main relay may still be at different levels. Monitoring the current value flowing through the main relay and determining the tripping condition type based on the current current range aims to assess the magnitude of the arc energy that the main relay will withstand between its contacts when performing a tripping action under the current current conditions. This allows for a preliminary assessment of the welding risk associated with the main relay performing a tripping action at this time, and subsequently, the selection of corresponding graded tripping strategies based on different levels of risk warnings.

[0042] The graded disconnection strategy is a differentiated disconnection strategy that matches different disconnection conditions. When the residual current is extremely low, immediate disconnection can be selected to shorten the power-off time, while when the residual current is still high, auxiliary measures such as delay waiting or active discharge need to be introduced.

[0043] Step S5: According to the graded disconnection strategy, the main relay is triggered to perform the corresponding disconnection action and the active energy discharge circuit is triggered to discharge the high-voltage circuit so as to safely de-energize the high-voltage circuit.

[0044] Specifically, the main relay is a protective switching device located at the output terminal of the power battery, used to achieve physical isolation of the high-voltage circuit. The active energy discharge circuit includes a controllable switching device and a power resistor connected in series, connected between the positive and negative terminals of the high-voltage circuit bus. Its working principle is to dissipate the electrical energy stored in the high-voltage bus capacitor as heat energy through the discharge circuit formed by the controllable switching device and the power resistor connected in series. For example, the controllable switching device has a withstand voltage of not less than 1200V and a rated current of not less than 300A. The power resistor has a resistance of 100Ω and a rated power of not less than 2kW.

[0045] When the main relay performs its disconnection action, the current path in the high-voltage circuit is physically cut off. However, residual electrical energy is still stored in the high-voltage bus capacitor. If this residual energy is not released in time, the bus voltage will remain at a dangerous level. Therefore, by discharging through the active energy discharge circuit, the bus voltage can be quickly reduced to the preset safe range, ensuring the safe energization of the high-voltage circuit.

[0046] It should be noted that the triggering channel of the active energy discharge circuit is independent of the vehicle's low-voltage power supply system and the communication links of each high-voltage load. Specifically, the active energy discharge circuit has a power supply scheme independent of the vehicle's 12V low-voltage system, using a backup energy storage unit (such as a supercapacitor or backup battery) for power. This backup energy storage unit is independent of the high-voltage system and can provide millisecond-level high current. Under normal vehicle conditions, the 12V system charges the backup energy storage unit. When the 12V low-voltage system fails or the high-voltage bus fails to supply power, the backup energy storage unit instantly takes over, supplying power to the safety controller and corresponding drive circuits. Therefore, even in extreme cases such as main relay welding, motor controller failure, communication network interruption, or low-voltage power failure, the safety controller can still send a conduction signal to the discharge circuit through an independent drive channel, ensuring that the active energy discharge circuit can be reliably triggered.

[0047] It should also be noted that the embodiments of this application use a timing controller to uniformly schedule the execution timing of steps such as emergency blockade, disconnection condition determination, graded disconnection, and energy release, so as to ensure that each link is connected in an orderly manner according to a preset sequence. Specifically, as follows Figure 2As shown, the start time of the timing controller is defined as the moment when the diagnosis is completed and the mode is determined, denoted as T0. At T0 plus 0.1 milliseconds, the timing controller outputs an emergency shutdown command for the load; at T0 plus 0.5 milliseconds, the safety controller begins monitoring the decreasing trend of the loop current; at T0 plus 0.8 milliseconds, the timing controller performs a disconnection condition assessment of the load; at T0 plus 1.0 milliseconds, the timing controller executes a graded disconnection strategy, driving the main relay to perform contact separation, and then triggering the conduction command of the active energy discharge circuit. Thus, through the precise control of the execution time of each of the above stages by the timing controller, an orderly timing coordination is ensured between emergency shutdown, graded disconnection, and energy discharge, avoiding delays that could affect the reliability of safe power-off.

[0048] The safe power-down control method provided in this application embodiment first performs an emergency blockade on the high-voltage load in response to a short-circuit fault detection signal before controlling the physical disconnection of the main relay. This forces the power switch inside the load to shut down, cutting off the supply path of the short-circuit current to the short-circuit point at the source, thus significantly reducing the current flowing through the main relay before disconnection. Simultaneously, the disconnection condition type is determined based on the current current value flowing through the main relay after the emergency blockade, and a corresponding graded disconnection strategy is matched according to different disconnection condition types to avoid the main relay blindly disconnecting large currents and bearing excessive arc energy. Furthermore, while triggering the main relay to perform the disconnection action, the active energy discharge circuit is also triggered to discharge, consuming the electrical energy stored in the high-voltage circuit and accelerating the bus voltage drop. This provides current attenuation conditions for the main relay disconnection, reducing the risk of welding of the main relay contacts due to high arc temperature, thereby improving the reliability and safety of vehicle power-down under high-voltage short-circuit conditions.

[0049] Figure 3 A flowchart illustrating step S1 of an embodiment of this application is shown, as follows: Figure 3 As shown, step S1 above may include the following steps: Step S11: Real-time acquisition of the bus voltage, circuit current, and insulation resistance value of the high-voltage circuit.

[0050] Specifically, in this embodiment of the application, high-speed data acquisition is initiated in response to a vehicle collision signal. The vehicle collision signal may be a trigger signal generated by a collision sensor or an airbag control unit.

[0051] Specifically, a voltage sampling unit is used to acquire the bus voltage of the high-voltage circuit. This unit is connected across the positive and negative terminals of the high-voltage bus and continuously samples the bus voltage using an isolated differential amplifier topology at a sampling rate of at least 100 kHz. A current sensor is used to acquire the loop current of the high-voltage circuit. This current sensor is connected in series in the high-voltage circuit and uses the closed-loop Hall effect principle to measure the total loop current at the battery pack output terminal with a bandwidth of at least 200 kHz. An insulation detection unit is used to measure the insulation resistance of the high-voltage system to ground using an active injection method at a refresh rate of at least 100 Hz.

[0052] Step S13: If the voltage drop rate of the bus voltage and the loop current meet the first preset condition, or the amplitude of the bus voltage, the loop current and the insulation resistance value meet the second preset condition, then output a short-circuit fault detection signal.

[0053] By acquiring bus voltage, loop current, and insulation resistance values ​​in real time, and utilizing multi-dimensional electrical parameters in short-circuit fault determination, the risk of misjudgment or missed detection caused by relying on a single physical quantity is avoided. Simultaneously, by combining first and second preset conditions, short-circuit faults are analyzed from both rate and amplitude dimensions, covering the electrical characteristics of different short-circuit fault modes. This improves the robustness and accuracy of short-circuit fault diagnosis, providing precise decision-making basis for the reliable execution of subsequent emergency shutdown and power-off strategies.

[0054] Furthermore, in some embodiments of this application, the first preset condition is that the voltage drop rate of the bus voltage is greater than a preset drop rate threshold, and the duration for which the loop current exceeds a preset short-circuit current threshold is greater than a preset time threshold. The second preset condition is that the amplitude of the bus voltage is lower than a preset proportion of the rated voltage, the insulation resistance value is lower than a preset resistance threshold, and the duration for which the loop current exceeds a preset short-circuit current threshold is greater than a preset time threshold.

[0055] Specifically, the first preset condition corresponds to the rate analysis dimension, focusing on capturing the transient impact characteristics caused by short-circuit faults. The rate of decrease of the bus voltage within a preset time window is calculated. When this rate of decrease exceeds a preset rate of decrease threshold, it indicates that the bus voltage is dropping at an abnormal rate, a typical transient characteristic of a low-impedance short circuit occurring on the load side. Simultaneously, the duration for which the loop current exceeds a preset short-circuit current threshold must be greater than a preset time threshold to confirm that the short-circuit fault has been established and remains stable, rather than being a transient disturbance.

[0056] The second preset condition corresponds to the amplitude analysis dimension, focusing on characterizing the steady-state abnormalities after a short-circuit fault is established. The amplitude of the current bus voltage is compared with the system's rated voltage. When the bus voltage amplitude is lower than a preset proportion of the rated voltage, it indicates that the bus voltage has dropped to an abnormal level. Simultaneously, combined with the condition that the insulation resistance value is lower than a preset resistance threshold, it is used to characterize that the high-voltage circuit's insulation performance to ground has severely deteriorated, assisting in confirming special fault modes such as high-impedance short circuits or insulation failures. Furthermore, it is also required that the duration for which the circuit current exceeds the preset short-circuit current threshold is greater than a preset time threshold to eliminate misjudgments caused by transient current surges.

[0057] It is understood that the first and second preset conditions are determined in parallel using a logical "OR" relationship. A short-circuit fault detection signal is output as soon as either condition is met, providing a trigger for subsequent emergency shutdown. For example, if the bus voltage drop rate exceeds 500V per millisecond and the loop current exceeds 1500A for a duration of 0.5 milliseconds, the first preset condition is deemed met. If the bus voltage has dropped to 30% of the rated voltage, and the insulation resistance value has decreased to 100Ω per volt, while the loop current exceeds 1500A for a duration of 0.5 milliseconds, the second preset condition is deemed met.

[0058] Taking an 800V system as an example, if the bus voltage drops from 800V to 160V in approximately 0.6 milliseconds, the voltage drop rate is approximately 1067V / ms, satisfying the dual conditions that the voltage drop rate is greater than a preset drop rate threshold and the duration is greater than a preset time threshold. This matching relationship indicates that the diagnostic threshold setting in this application embodiment is consistent with the physical characteristics of typical short-circuit scenarios, and can balance the timeliness and accuracy of fault identification.

[0059] Therefore, this application's embodiments introduce a rate analysis dimension in the first preset condition, using the rate of decrease of the bus voltage to characterize the transient electrical characteristics of a low-impedance short circuit in the high-voltage circuit. Furthermore, the second preset condition introduces an amplitude dimension, combining the bus voltage amplitude drop with the sudden drop in insulation resistance to characterize the electrical characteristics of special fault modes such as high-impedance short circuits or insulation failures. In addition, the introduction of a duration dimension for abnormal circuit current effectively distinguishes between genuine short-circuit faults and transient interference signals, avoiding misjudgments caused by current transients, and further improving the accuracy of fault identification and anti-interference capability.

[0060] In some embodiments of this application, such as Figure 3 As shown, step S1 above also includes: Step S15: Generate an emergency shutdown command based on the short-circuit fault detection signal, and send the emergency shutdown command to each high-voltage load through the hard-wire trigger channel and the bus broadcast channel, so that the power switch of each high-voltage load responds to the emergency shutdown command and triggers a shutdown action to complete the emergency shutdown.

[0061] This application embodiment employs a dual-redundancy architecture with hard-wired triggering channels and bus broadcast channels running in parallel to transmit emergency blocking commands. This ensures that even under extreme conditions such as vehicle collisions, severe electrical faults causing damage to the communication network, or controller software malfunctions, the emergency blocking commands can still be reliably delivered to every high-voltage load.

[0062] Specifically, within 100 microseconds of generating an emergency shutdown command, an emergency shutdown signal is simultaneously sent to each high-voltage load via both the hard-wired trigger channel and the bus broadcast channel. The hard-wired trigger channel employs a low-level-active design. Under normal conditions, the open-collector transistor output of the safety controller is high. When a shutdown is required, the safety controller pulls the output low, and this low-level signal propagates along the hard-wired network to the fault pins of each high-voltage load within 50 microseconds. Upon detecting the low level, the optocoupler at each high-voltage load input immediately triggers an internal hardware interrupt, executing a hardware shutdown operation on the power switching devices. Therefore, the hard-wired trigger channel is independent of communication links and software protocols, ensuring reliable delivery of emergency shutdown commands even in the event of communication interruption or controller malfunction.

[0063] For the bus broadcast channel, an emergency block message is broadcast simultaneously with the signal emitted by the hard-wired trigger channel via the CAN FD interface. This message uses a preset priority identifier and has the highest priority in the standard CAN arbitration mechanism. The bus controllers of each high-voltage load complete the reception, verification, and execution within 100 microseconds. The bus broadcast channel serves as a redundant backup, improving the reliability of command transmission.

[0064] When all the power switches of the high-voltage loads are turned off, the supply path of the short-circuit current is cut off. At this time, only the electrical energy stored in the bus capacitor in the high-voltage circuit is discharged through the short-circuit point. The circuit current drops sharply from tens of thousands of amperes at the beginning of the short circuit to between tens of amperes and one hundred amperes, providing the precondition for the safe disconnection of the main relay.

[0065] The hard-wired triggering channel is independent of communication links and software protocols, ensuring reliable delivery of emergency shutdown commands even in the event of communication interruption or controller malfunction. The bus broadcast channel serves as a redundant backup, enhancing the reliability of command transmission. This dual-channel collaboration ensures timely shutdown of high-voltage loads, providing the prerequisite for the safe disconnection of the main relay.

[0066] Figure 4 A flowchart illustrating step S3 of an embodiment of this application is shown, as follows: Figure 4As shown, step S3 above may include the following steps: Step S31: Monitor the current value of the current flowing through the main relay in the high-voltage circuit.

[0067] Specifically, after the emergency shutdown is completed, the loop current of the high-voltage circuit, i.e., the current value flowing through the main relay, continues to be acquired via a current sensor. Since the emergency shutdown has cut off the supply path of the short-circuit current, the current flowing through the main relay has significantly decreased from tens of thousands of amperes at the beginning of the short circuit. However, due to the energy stored in the bus capacitor and the residual impedance at the short-circuit point, the current may still be at different levels. Monitoring this current value provides a quantitative basis for determining the subsequent disconnection condition.

[0068] Step S33: Determine the disconnection condition type based on the current range in which the current value is located.

[0069] Furthermore, in some embodiments of this application, the disconnection condition types include a completely arc-free disconnection condition, a weak arc disconnection condition, and a dangerous disconnection condition. Specifically, when the current value is less than or equal to a first preset current threshold, the disconnection condition type is determined to be a completely arc-free disconnection condition. For example, the first preset current threshold is set to 10A. If the current value is below 10A, it indicates that the circuit current is extremely low, and the arc energy generated between the contacts of the main relay during disconnection is extremely small, insufficient to melt or significantly erode the metal material on the contact surface. The contacts are undamaged, and this is considered the most ideal safe operating window, enabling completely arc-free disconnection. In this case, the main relay can immediately perform the disconnection action.

[0070] When the current value is greater than a first preset current threshold and less than or equal to a second preset current threshold, the disconnection condition is determined to be a weak arc disconnection condition. For example, the second preset current threshold is 100A. It should be noted that if the current value is between 10A and 20A, a small arc is generated between the contacts when the main relay disconnects; the damage to the contacts is negligible. If the current value is between 20A and 100A, a weak arc is generated between the contacts when the main relay disconnects, which has some impact on the contact lifespan, but is acceptable in emergency power-off scenarios. Therefore, in this embodiment, the condition with a current value between 10A and 100A is uniformly classified as a weak arc disconnection condition. The main relay will generate a certain degree of arc between its contacts when disconnecting, but the arc energy is within a controllable range. In this case, the main relay can delay and wait for the current to further decay before performing the disconnection action.

[0071] If the current value exceeds the second preset current threshold, the tripping condition is classified as a dangerous tripping condition. If the current value is above 100A, it indicates that the circuit current is still very high, and the main relay will withstand excessive arc energy during tripping, posing a risk of contact welding. In this case, the enhanced discharge mode should be activated first to accelerate the discharge of the bus capacitor, and the tripping action should be performed only after the current drops to a safe range.

[0072] By setting a first preset current threshold and a second preset current threshold, the breaking conditions are divided into completely arc-free breaking conditions, weak arc breaking conditions, and dangerous breaking conditions. This allows the main relay to perform its breaking action differently based on different current ranges, thereby reducing the arc energy borne by the contacts while ensuring breaking reliability and reducing the risk of contact welding.

[0073] Furthermore, step S5 above includes: When the interruption condition is a completely arc-free interruption condition, the corresponding hierarchical interruption strategy is determined to be an immediate interruption strategy. The main relay is driven to immediately perform the interruption action according to the immediate interruption strategy, and the active energy discharge circuit is triggered to conduct after a first preset delay.

[0074] Specifically, under these operating conditions, the current flowing through the main relay has dropped to an extremely low level, and almost no arc will be generated when the contacts separate. Therefore, the primary goal of the system is to achieve the physical disconnection of the high-voltage circuit as quickly as possible. At this time, the safety controller directly sends a disconnection drive signal to the main relay, causing it to begin mechanical disconnection within microseconds. Simultaneously, after the disconnection action is executed, the timing controller outputs a discharge circuit trigger signal after a first preset delay (e.g., 0.1 milliseconds), causing the active energy discharge circuit to conduct and begin consuming the residual energy stored in the bus capacitor.

[0075] When the breaking condition type is a weak arc breaking condition type, the corresponding graded breaking strategy is determined to be a time-delay breaking strategy. According to the time-delay breaking strategy, the main relay is driven to perform the breaking action through the second preset delay, and the active energy discharge circuit is triggered to conduct through the first preset delay.

[0076] Specifically, under these conditions, the current flowing through the main relay has significantly decreased but has not yet dropped to a completely arc-free level. If the circuit is immediately disconnected, a certain degree of arcing will still occur between the contacts, affecting their lifespan. Therefore, the safety controller first monitors the decreasing trend of the circuit current, confirming that the current is in a continuous decay process. After a second preset delay (e.g., 0.5 milliseconds), it drives the main relay to perform the disconnection action. At this time, the current has further decayed, and the arc energy has dropped to a controllable range. Simultaneously, during the disconnection action, after a first preset delay, the safety controller outputs a discharge circuit trigger signal, causing the active energy discharge circuit to conduct, forming a timing coordination with the main relay's disconnection action to ensure that the electrical energy stored in the high-voltage circuit is released in a timely manner.

[0077] When the disconnection condition type is a dangerous disconnection condition type, the corresponding graded disconnection strategy is determined to be the enhanced discharge disconnection strategy. According to the enhanced discharge disconnection strategy, the active energy discharge circuit is immediately triggered to conduct. When the current value is less than or equal to the second preset current threshold, the main relay is driven to perform the disconnection action after the second preset delay.

[0078] Specifically, under these operating conditions, the current flowing through the main relay remains at a high level. If the relay were to disconnect directly, the contacts would experience excessive arc energy, posing a risk of welding. Therefore, the safety controller immediately outputs a discharge circuit trigger signal, prioritizing the activation of the active energy discharge circuit. This accelerates the dissipation of the energy stored in the bus capacitor through the power resistor, causing the circuit current to decay rapidly. Simultaneously, the safety controller continuously monitors the current value. When the current value drops to less than or equal to the second preset current threshold, it indicates that the main relay is in the safe disconnection range. At this point, after a second preset delay, the safety controller drives the main relay to perform the disconnection action, ensuring that the main relay only disconnects when the current is within the safe range, effectively preventing contact welding failure.

[0079] In a completely arc-free interruption condition, the main relay immediately disconnects and the discharge circuit conducts after a first preset delay, ensuring that the disconnection is completed before discharge. In a weak-arc interruption condition, the main relay disconnects after a second preset delay, allowing time for further current decay. Simultaneously, the discharge circuit remains on after the first preset delay, achieving timing coordination between disconnection and discharge. In a dangerous interruption condition, the discharge circuit immediately conducts to prioritize consuming bus power and accelerate current decay. Once the current value drops to a safe range, the main relay is then driven to disconnect, ensuring that the main relay only disconnects when the current is within a safe range. Therefore, by combining different timing sequences for disconnection and discharge under these three conditions, the system avoids the main relay being subjected to excessive arc energy during disconnection under excessive current, while ensuring timely intervention in the energy discharge process, thus improving the reliability of the safe power-off process.

[0080] In some embodiments of this application, after step S5 described above, the method further includes step S7, such as... Figure 5 As shown, step S7 may include the following steps: Step S71: Real-time acquisition of the bus voltage, bus capacitor energy, and insulation resistance value of the high-voltage circuit, in order to verify whether the high-voltage circuit is safely powered down based on the bus voltage, bus capacitor energy, and insulation resistance value.

[0081] Step S73: If the bus voltage, bus capacitor energy, and insulation resistance value meet the preset safety conditions, then the high-voltage circuit is successfully and safely powered down.

[0082] Specifically, after the active energy discharge circuit is turned on, the system records the bus voltage change curve over time at a sampling rate of no less than 1 kHz and executes three independent verification items. The voltage verification item monitors whether the bus voltage drops below a preset safe voltage within a preset verification time; the energy verification item calculates whether the total remaining energy in the bus capacitor drops below a preset energy threshold through integration; and the insulation verification item monitors whether the insulation resistance reaches or exceeds a preset resistance threshold. When all three verification items pass, the verification module determines that the high-voltage circuit has been successfully and safely powered down. The system then writes the complete event data packet to the non-volatile memory and enters a safe standby state.

[0083] In step S75, if any one of the bus voltage, bus capacitor energy, and insulation resistance value fails to meet the preset safety conditions, the power-down is determined to have failed, and the active energy discharge circuit is controlled to remain in the conducting state, while triggering an emergency alarm.

[0084] Specifically, if any one of the three verification items fails, the verification module determines that the power-off has failed and immediately initiates the emergency handling procedure. The discharge circuit remains continuously conducting, forcibly continuing to consume the electrical energy stored in the high-voltage circuit, and enters emergency mode. At this time, the safety controller illuminates the highest-level hazard warning light and activates the audible alarm, while simultaneously sending an emergency message through the remote information processing unit. It should be noted that, in this embodiment, exiting the emergency mode must be completed by a maintenance personnel performing a manual reset operation.

[0085] In this embodiment, after the active energy discharge circuit is triggered to discharge, the bus voltage, bus capacitor energy, and insulation resistance value are acquired in real time. The high-voltage circuit is comprehensively verified from three dimensions: voltage level, residual energy, and insulation status, to ensure the accurate determination of the power-down execution result.

[0086] Accordingly, please refer to Figure 6 This application provides a safe power-off control device for high-voltage short-circuit faults, the device comprising: The fault diagnosis module 100 is used to acquire the short-circuit fault detection signal of the high-voltage circuit and, in response to the short-circuit fault detection signal, to perform emergency blocking of each high-voltage load in the high-voltage circuit. For details, please refer to step S1. The disconnection analysis module 200 is used to determine the disconnection condition type of the main relay in the high-voltage circuit after emergency blocking, and to determine the corresponding graded disconnection strategy based on the disconnection condition type. For details, please refer to step S3. The power-down execution module 300 is used to trigger the main relay to perform the corresponding disconnection action according to the hierarchical disconnection strategy and to trigger the active energy discharge circuit to discharge the high-voltage circuit so as to safely power down the high-voltage circuit. For details, please refer to step S5.

[0087] Accordingly, this application provides a vehicle including a high-voltage system and a high-voltage short-circuit fault safety power-off control device as described in the above embodiments, the device being used to perform safety power-off control on the high-voltage system.

[0088] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0089] It should be noted that the safety power-off control device in the embodiments of this application is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0090] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices) according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0092] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0093] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0094] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0095] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

[0096] Although embodiments of this application have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of this application, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A safe power-off control method for high-voltage short-circuit faults, characterized in that, The method includes: Acquire a short-circuit fault detection signal of the high-voltage circuit, and in response to the short-circuit fault detection signal, perform emergency blocking on each high-voltage load in the high-voltage circuit; Determine the disconnection condition type of the main relay in the high-voltage circuit after the emergency blockade, and determine the corresponding graded disconnection strategy based on the disconnection condition type; According to the graded disconnection strategy, the main relay is triggered to perform the corresponding disconnection action, and the active energy discharge circuit is triggered to discharge the high-voltage circuit so that the high-voltage circuit is safely de-energized.

2. The method according to claim 1, characterized in that, The acquisition of the short-circuit fault detection signal of the high-voltage circuit includes: Real-time acquisition of the bus voltage, circuit current, and insulation resistance value of the high-voltage circuit; If the voltage drop rate of the bus voltage and the loop current meet the first preset condition, or if the amplitude of the bus voltage, the loop current, and the insulation resistance value meet the second preset condition, then the short-circuit fault detection signal is output.

3. The method according to claim 2, characterized in that, The first preset condition is that the voltage drop rate of the bus voltage is greater than a preset drop rate threshold, and the duration for which the loop current exceeds a preset short-circuit current threshold is greater than a preset time threshold. The second preset condition is that the amplitude of the bus voltage is lower than a preset percentage of the rated voltage, the insulation resistance value is lower than a preset resistance threshold, and the duration for which the circuit current exceeds a preset short-circuit current threshold is greater than a preset time threshold.

4. The method according to claim 1, characterized in that, The emergency blocking of each high-voltage load in the high-voltage circuit in response to the short-circuit fault detection signal includes: An emergency shutdown command is generated based on the short-circuit fault detection signal and sent to each of the high-voltage loads through a hard-wired trigger channel and a bus broadcast channel. The power switches of each of the high-voltage loads are triggered to shut down in response to the emergency shutdown command, thereby completing the emergency shutdown.

5. The method according to claim 1, characterized in that, Determining the tripping condition type of the main relay in the high-voltage circuit after the emergency shutdown includes: Monitor the current value of the main relay flowing through the high-voltage circuit; The disconnection condition type is determined based on the current range in which the current value is located.

6. The method according to claim 5, characterized in that, The types of disconnection conditions include completely arc-free disconnection conditions, weak arc disconnection conditions, and dangerous disconnection conditions. Wherein, when the current current value is less than or equal to the first preset current threshold, the disconnection condition type is determined to be the completely arc-free disconnection condition type. If the current current value is greater than the first preset current threshold and less than or equal to the second preset current threshold, the disconnection condition type is determined to be the weak arc disconnection condition type. When the current current value is greater than the second preset current threshold, the disconnection condition type is determined to be the dangerous disconnection condition type.

7. The method according to claim 6, characterized in that, The step of triggering the main relay to perform the corresponding disconnection action according to the hierarchical disconnection strategy and triggering the active energy discharge circuit to discharge the high-voltage circuit includes: When the interruption condition type is the completely arc-free interruption condition type, the corresponding hierarchical interruption strategy is determined to be the immediate interruption strategy, so as to drive the main relay to immediately perform the interruption action according to the immediate interruption strategy, and trigger the active energy discharge circuit to conduct after a first preset delay. When the interruption condition type is the weak arc interruption condition type, the corresponding graded interruption strategy is determined to be the delayed interruption strategy, so that the main relay is driven to perform the interruption action after the second preset delay according to the delayed interruption strategy, and the active energy discharge circuit is triggered to conduct after the first preset delay. When the disconnection condition type is the dangerous disconnection condition type, the corresponding graded disconnection strategy is determined to be the enhanced discharge post-discharge disconnection strategy. The active energy discharge circuit is immediately triggered to conduct according to the enhanced discharge post-discharge disconnection strategy. When the current current value is less than or equal to the second preset current threshold, the main relay is driven to perform the disconnection action after the second preset delay.

8. The method according to claim 1, characterized in that, After the active energy discharge circuit is triggered to discharge the high-voltage circuit, the method further includes: The bus voltage, bus capacitor energy, and insulation resistance value of the high-voltage circuit are acquired in real time to verify whether the high-voltage circuit is safely de-energized based on the bus voltage, bus capacitor energy, and insulation resistance value. If the bus voltage, the bus capacitor energy, and the insulation resistance value meet the preset safety conditions, then the high-voltage circuit is determined to have been successfully and safely de-energized. If any one of the bus voltage, the bus capacitor energy, and the insulation resistance value fails to meet the preset safety conditions, the power-down is determined to have failed, and the active energy discharge circuit is controlled to remain in the conducting state, while triggering an emergency alarm.

9. A safe power-off control device for high-voltage short-circuit faults, characterized in that, The device includes: The fault diagnosis module is used to acquire the short-circuit fault detection signal of the high-voltage circuit and, in response to the short-circuit fault detection signal, to perform emergency blocking of each high-voltage load in the high-voltage circuit. The disconnection analysis module is used to determine the disconnection condition type of the main relay in the high-voltage circuit after the emergency blockade, and to determine the corresponding graded disconnection strategy based on the disconnection condition type. The power-down execution module is used to trigger the main relay to perform the corresponding disconnection action according to the hierarchical disconnection strategy and to trigger the active energy discharge circuit to discharge the high-voltage circuit so as to safely power down the high-voltage circuit.

10. A vehicle, characterized in that, The vehicles include: High-voltage system; And the safe power-off control device for high-voltage short-circuit faults as described in claim 9, wherein the device is used to perform safe power-off control on the high-voltage system.

Images