An energy control method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to an energy control method and device, an electronic device and a storage medium. The energy control method comprises: after receiving an upper high voltage instruction, if the instruction of the battery management system of the controller and the standby controller of the two machine controllers is consistent, the relay diagnosis instruction and the relay closing instruction are sequentially sent to the battery management system; after receiving a lower high voltage instruction, if the motor speed is lower than the idle speed and the instruction of the controller and the standby controller of the two machine controllers to the battery management system is consistent, the relay opening instruction is sent to the battery management system; after receiving the signal of the emergency fault sent by the battery management system, if the instruction of the controller and the standby controller of the two machine controllers to the battery management system is consistent, the relay opening instruction is sent to the battery management system. The method effectively reduces the probability of the single machine controller sending an error instruction to the battery management system.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of aviation, and in particular to an energy control method and device, an electronic device and a storage medium. BACKGROUND

[0002] A vertical take-off and landing electric aircraft (EVTOL) can realize vertical take-off and landing by relying on an electric motor. In order to ensure sufficient safety margin, the energy system of the vertical take-off and landing aircraft adopts a parallel connection mode of multiple battery packs to provide high-voltage energy for the aircraft. Each battery pack in the energy system contains an independent battery management system (BMS), and these battery management systems need to receive instructions from a vehicle controller (VCU) similar to an electric vehicle to control the high-voltage relays inside the battery management system. The VCU serves as a control source. If the control function is lost or an incorrect control instruction is sent during the vertical take-off or flight of the vertical take-off and landing electric aircraft, the power source of the energy system may be lost, causing the aircraft to be destroyed and people to be killed, and the safety performance is low. SUMMARY

[0003] In view of this, the present disclosure provides an energy control technical solution.

[0004] According to an aspect of the present disclosure, an energy control method is provided for a master controller in a vehicle controller. The method comprises: after receiving a high-voltage up instruction sent by a flight control system, sequentially sending a relay diagnosis instruction and a relay closing instruction to a battery management system in the case that the instruction of the battery management system from the master controller is consistent with the instruction of the battery management system from a backup controller in the vehicle controller; after receiving a high-voltage down instruction sent by the flight control system, sending a relay opening instruction to the battery management system in the case that the motor speed is lower than the idle speed and the instruction of the battery management system from the master controller is consistent with the instruction of the battery management system from the backup controller; after receiving a signal indicating an emergency fault sent by the battery management system, sending a relay opening instruction to the battery management system in the case that the instruction of the battery management system from the master controller is consistent with the instruction of the battery management system from the backup controller; and the number of the backup controllers is two.

[0005] In a possible implementation, the method further comprises: after receiving a signal that the vertical take-off and landing electric aircraft is powered on by the battery, performing self-checking and determining whether the master controller can receive messages from the backup controller; in the case that the self-checking fails or the master controller cannot receive messages from the backup controller, setting the master controller as the backup controller; and in the case that the self-checking passes, the master controller can receive messages from the backup controller, and the master controller has the highest priority in the vehicle controller, setting the master controller as the master controller.

[0006] In a possible implementation, the method further includes: after receiving the high-voltage-up command from the flight control system, setting the instruction of the controller to the battery management system as a relay diagnosis instruction; in the case that the relay diagnosis instruction is consistent with the instruction of at least one of the backup controllers to the battery management system, sending the relay diagnosis instruction to the battery management system; in the case that the relay diagnosis instruction is inconsistent with the instruction of both of the backup controllers to the battery management system, nominating a main controller from the two backup controllers according to the priority order of the backup controllers, and setting the controller as a backup controller; in the case that a signal of passing the relay diagnosis is received, setting the instruction of the controller to the battery management system as a relay closing instruction; in the case that the relay closing instruction is consistent with the instruction of at least one of the backup controllers to the battery management system, sending the relay closing instruction to the battery management system; in the case that the relay closing instruction is inconsistent with the instruction of both of the backup controllers to the battery management system, nominating a main controller from the two backup controllers according to the priority order of the backup controllers, and setting the controller as a backup controller.

[0007] In a possible implementation, the method further includes: after receiving the high-voltage-down command from the flight control system, setting the instruction of the controller to the battery management system as a relay opening instruction; in the case that the motor speed is lower than the idle speed and the relay opening instruction is consistent with the instruction of at least one of the backup controllers to the battery management system, sending the relay opening instruction to the battery management system; in the case that the relay opening instruction is inconsistent with the instruction of both of the backup controllers to the battery management system, nominating a main controller from the two backup controllers according to the priority order of the backup controllers, and setting the controller as a backup controller.

[0008] In a possible implementation, the method further includes: in a case where the main controller does not send any message to the battery management system and the controller can receive all feedback information of the battery management system, setting the controller as the main controller in a case where an instruction sent by the main controller is received, in which the instruction nominates the controller as the main controller; or setting the controller as the main controller in a case where no instruction is sent by the main controller and the controller has the highest priority among the backup controllers.

[0009] According to another aspect of the present disclosure, an energy control method for a backup controller in a main controller is provided, including: sending an instruction of the controller to a main controller in the main controller after receiving an up high voltage instruction sent by a flight control system, and setting the controller as the main controller in a case where an instruction sent by the main controller is received, in which the instruction nominates the controller as the main controller; sending an instruction of the controller to the main controller after receiving a down high voltage instruction sent by the flight control system, and setting the controller as the main controller in a case where an instruction sent by the main controller is received, in which the instruction nominates the controller as the main controller; sending an instruction of the controller to the main controller after receiving an emergency fault signal sent by a battery management system, and setting the controller as the main controller in a case where an instruction sent by the main controller is received, in which the instruction nominates the controller as the main controller.

[0010] In a possible implementation, the method further includes: in a case where the main controller does not send any message to the battery management system and the controller can receive all feedback information of the battery management system, setting the controller as the main controller in a case where an instruction sent by the main controller is received, in which the instruction nominates the controller as the main controller; or setting the controller as the main controller in a case where no instruction is sent by the main controller and the controller has the highest priority among the backup controllers.

[0011] According to another aspect of the present disclosure, an energy control device for a main controller in a whole machine controller is provided, comprising: an up high voltage module for, after receiving an up high voltage instruction issued by a flight control system, sequentially issuing a relay diagnosis instruction and a relay closing instruction to a battery management system if an instruction of the battery management system by the present controller is consistent with an instruction of the battery management system by a backup controller in the whole machine controller; a normal down high voltage module 102 for, after receiving a down high voltage instruction issued by the flight control system, issuing a relay opening instruction to the battery management system if a motor speed is lower than an idle speed and the instruction of the battery management system by the present controller is consistent with the instruction of the battery management system by the backup controller; an abnormal down high voltage module 103 for, after receiving a signal of an emergency fault issued by the battery management system, issuing a relay opening instruction to the battery management system if the instruction of the battery management system by the present controller is consistent with the instruction of the battery management system by the backup controller; wherein the number of the backup controllers is two.

[0012] In a possible implementation, the device further comprises: a self-checking module for, after receiving a signal of the vertical take-off and landing electric aircraft being powered by the battery, performing self-checking and determining whether the present controller can receive a message of the backup controller; a backup controller setting module for, in a case that the self-checking fails or the present controller cannot receive the message of the backup controller, setting the present controller as the backup controller; and a main controller setting module for, in a case that the self-checking passes, the present controller can receive the message of the backup controller, and the present controller has the highest priority in the whole machine controller, setting the present controller as the main controller.

[0013] In a possible implementation, the upper high-voltage module comprises: a first instruction setting submodule, configured to set the instruction of the controller to the battery management system as a relay diagnosis instruction after receiving an upper high-voltage instruction issued by the flight control system; a diagnosis instruction sending submodule, configured to send the relay diagnosis instruction to the battery management system in a case where the relay diagnosis instruction is consistent with the instruction of at least one of the backup controllers to the battery management system; a first main controller nomination submodule, configured to nominate a main controller from the two backup controllers according to the priority order of the backup controllers and set the controller as a backup controller in a case where the relay diagnosis instruction is inconsistent with the instruction of both of the backup controllers to the battery management system; a second instruction setting submodule, configured to set the instruction of the controller to the battery management system as a relay closing instruction in a case where a signal that the relay diagnosis is passed is received; a closing instruction sending submodule, configured to send the relay closing instruction to the battery management system in a case where the relay closing instruction is consistent with the instruction of at least one of the backup controllers to the battery management system; and a second main controller nomination submodule, configured to nominate a main controller from the two backup controllers according to the priority order of the backup controllers and set the controller as a backup controller in a case where the relay closing instruction is inconsistent with the instruction of both of the backup controllers to the battery management system.

[0014] In a possible implementation, the normal lower high-voltage module comprises: an instruction setting submodule, configured to set the instruction of the controller to the battery management system as a relay opening instruction after receiving a lower high-voltage instruction issued by the flight control system; an opening instruction sending submodule, configured to send the relay opening instruction to the battery management system in a case where the motor speed is lower than the idle speed and the relay opening instruction is consistent with the instruction of at least one of the backup controllers to the battery management system; and a main controller nomination submodule, configured to nominate a main controller from the two backup controllers according to the priority order of the backup controllers and set the controller as a backup controller in a case where the relay opening instruction is inconsistent with the instruction of both of the backup controllers to the battery management system.

[0015] In a possible implementation, the abnormal low-voltage module comprises: an instruction setting submodule, configured to set the instruction of the controller to the battery management system as a relay opening instruction after receiving a signal indicating an emergency fault of the battery management system; an opening instruction sending submodule, configured to send a relay opening instruction to the battery management system if the relay opening instruction is consistent with the instruction of at least one of the backup controllers to the battery management system; and a main controller nominating submodule, configured to nominate a main controller from the two backup controllers according to the priority order of the backup controllers if the relay opening instruction is inconsistent with the instruction of both of the backup controllers to the battery management system, and set the controller as a backup controller.

[0016] According to another aspect of the present disclosure, an energy control device for a backup controller in a main controller is provided, comprising: an upper high-voltage module, configured to send the instruction of the controller to the battery management system to a main controller in the main controller after receiving an upper high-voltage instruction sent by a flight control system, and set the controller as the main controller if an instruction sent by the main controller nominating the controller as the main controller is received; a normal low-voltage module, configured to send the instruction of the controller to the battery management system to the main controller after receiving a lower high-voltage instruction sent by the flight control system, and set the controller as the main controller if an instruction sent by the main controller nominating the controller as the main controller is received; and an abnormal low-voltage module, configured to send the instruction of the controller to the battery management system to the main controller after receiving a signal indicating an emergency fault sent by the battery management system, and set the controller as the main controller if an instruction sent by the main controller nominating the controller as the main controller is received.

[0017] In a possible implementation, the energy control device further comprises: a first main controller setting module, configured to set the controller as the main controller if an instruction sent by the main controller nominating the controller as the main controller is received after detecting that the main controller does not send any message to the battery management system and the controller can receive all feedback information of the battery management system; and a second main controller setting module, configured to set the controller as the main controller if the main controller does not send any instruction of nomination and the priority of the controller is the highest among the backup controllers after detecting that the main controller does not send any message to the battery management system and the controller can receive all feedback information of the battery management system.

[0018] In the embodiments of the present disclosure, the main controller of the vertical take-off and landing electric aircraft adopts a mutual voting strategy of three whole machine controllers when performing the up / down high voltage operation of the upper energy system and emergency fault processing. Only when the instructions of the main controller and the majority of the whole machine controllers are consistent, the related operation of the relay is performed. This process effectively reduces the probability of the single whole machine controller issuing an error instruction to the battery management system, and improves the safety performance of the aircraft system.

[0019] Other features and aspects of the present disclosure will become apparent from the following detailed description of example embodiments, taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate example embodiments, features, and aspects of the present disclosure and serve to explain the principles of the present disclosure.

[0021] Figure 1 A flowchart of an energy control method according to an embodiment of the present disclosure is shown.

[0022] Figure 2 A distributed architecture diagram of a typical whole machine control system and battery management system according to the present disclosure is shown.

[0023] Figure 3 A flowchart of an energy control method according to an embodiment of the present disclosure is shown.

[0024] Figure 4 A control flowchart of the backup controller detecting the abnormality of the main controller according to an embodiment of the present disclosure is shown.

[0025] Figure 5 A flowchart of the main controller and the backup controller judging after power-on initialization according to an embodiment of the present disclosure is shown.

[0026] Figure 6 A flowchart of the vertical take-off and landing electric aircraft performing the up high voltage operation according to an embodiment of the present disclosure is shown.

[0027] Figure 7 A flowchart of the vertical take-off and landing electric aircraft performing the normal down high voltage operation according to an embodiment of the present disclosure is shown.

[0028] Figure 8 A flowchart of the vertical take-off and landing electric aircraft performing the abnormal down high voltage operation according to an embodiment of the present disclosure is shown.

[0029] Figure 9 A block diagram of an energy control device according to an embodiment of the present disclosure is shown.

[0030] Figure 10 A block diagram of an energy control device according to an embodiment of the present disclosure is shown.

[0031] Figure 11 A block diagram of an electronic device according to an embodiment of the disclosure is shown.

[0032] Figure 12 A block diagram of an electronic device according to an embodiment of the disclosure is shown. DETAILED DESCRIPTION

[0033] Various exemplary embodiments, features, and aspects of the disclosure will be explained below in detail with reference to the accompanying drawings. The same reference numerals are used throughout the drawings and the same elements are represented by the same characters without redundant description in order to clearly describe the present disclosure. Although various aspects of embodiments are illustrated in the drawings, the drawings are not necessarily drawn to scale.

[0034] The term "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any implementation described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations.

[0035] The term "and / or" used in the present document is only used to describe associated objects, and can represent three meanings, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. In addition, the term "at least one of" used in the present document means any one of a plurality of or at least two of a plurality of in any combination, for example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0036] In addition, in order to better illustrate the disclosure, numerous specific details are given in the following detailed description. It should be understood by those skilled in the art that the disclosure can also be implemented without some specific details. In some examples, methods, means, elements and circuits that are well known to those skilled in the art are not described in detail in order to highlight the main idea of the disclosure.

[0037] The vertical take-off and landing electric aircraft (EVTOL) can rely on electric motors to achieve vertical take-off, and the flight process is to provide lift for vertical take-off by one or more lift motor propellers, when the aircraft is vertically lifted to a certain height, the thrust motor propeller provides thrust, when the flight reaches a certain speed, the lift is generated by the wings, and the motor providing lift can stop working or be converted into a thrust motor. The unique power structure of EVTOL makes it have many advantages and unique qualities compared with traditional general aviation aircraft. Among them, the most prominent advantage of EVTOL is energy saving and environmental protection, high efficiency and low energy consumption, while achieving near zero emission, low noise and vibration level, good ride comfort, and is a truly environmentally friendly aircraft. Secondly, vertical take-off makes its application scenarios similar to helicopters, and no longer needs airports and runways. In addition, EVTOL also has the characteristics of safety and reliability (no explosion and fuel leakage), simple structure, easy operation and use, good maintenance and low cost, good economy, etc. EVTOL also has many advantages in design: flexible overall layout, can adopt the best layout and unconventional / innovative layout; can design aircraft with super performance to meet special purpose requirements, etc.

[0038] The battery system of the vertical take-off and landing electric aircraft includes a plurality of parallel battery packs, each battery pack includes independently controlled main positive relay (Relay positive, Rp), main negative relay (Relay negative, Rn) and pre-charge relay (Relay pre-Charge, Rpre). In the vertical take-off and landing aircraft, each of these battery packs includes an independent battery management system (Battery Management System, BMS) to control these main positive relays, main negative relays and pre-charge relays for fault diagnosis and opening / closing, but these battery management systems do not complete fault diagnosis and opening / closing operation autonomously, so an additional control source, the vehicle control unit (VCU), is needed to issue fault diagnosis and opening / closing control instructions to the battery management system. As the working center of the energy system of the vertical take-off and landing electric aircraft, the safety level of the vehicle control unit is very important. If its function is lost, the high voltage state control of the battery system will be lost; if it issues an incorrect control instruction, it will cause the battery system to incorrectly open the high voltage relay, resulting in the power and battery capacity of the vertical take-off and landing electric aircraft being unable to meet the normal safe flight. Among them, the loss of the vehicle control unit is B level in the functional safety level of the vertical take-off and landing electric aircraft, and the incorrect control instruction of the vehicle control unit is A level in the functional safety level.

[0039] In order to make the energy system of the vertical take-off and landing electric aircraft have sufficient safety margin and fault tolerance margin, it is necessary to ensure that the functional safety level of the vertical take-off and landing electric aircraft reaches A level.

[0040] The present disclosure provides an energy control method, Figure 1 A flow chart of an energy control method according to an embodiment of the present disclosure is shown, which can be applied to a main controller in a whole machine controller of a vertical take-off and landing electric aircraft. The main controller can be a terminal device, a server or other processing device, etc. The terminal device can be a user equipment (UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc.

[0041] In some possible implementation manners, the energy control method can be implemented by a processor invoking computer readable instructions stored in a memory.

[0042] As Figure 1 shown, the energy control method can include:

[0043] Step S11, after receiving the high voltage raising instruction issued by the flight control system, if the instruction of the battery management system in the present controller is consistent with the instruction of the battery management system in the standby controller in the whole machine controller, the relay diagnosis instruction and the relay closing instruction are sequentially issued to the battery management system.

[0044] The main controller can be a whole machine controller capable of real-time control of the battery management system, and the standby controller can be a whole machine controller capable of taking over the control of the battery management system when the main controller loses control of the battery management system or the main controller fails. The number of standby controllers can be selected according to actual needs, and the present disclosure does not make specific limitations on the number of standby controllers, which can meet the condition that the instruction made by the main controller to the battery management system is consistent with the instruction made by the majority (more than 1 / 2) of the whole machine controllers to the battery management system. In order to better illustrate the present disclosure and highlight the main idea of the present disclosure, the specific embodiments in this paper are described with the number of standby controllers being two. It should be understood that the number of standby controllers in the present disclosure is only exemplary and explanatory, but not limiting the present disclosure.

[0045] Figure 2The application discloses a distributed architecture of a whole machine controller, a battery management system and a flight control system (FCU) of a typical vertical take-off and landing electric aircraft. The distributed architecture comprises three whole machine controllers VCU A, VCU B and VCU C, and the three whole machine controllers have the same software and hardware. The whole machine controllers interact with all the battery management systems through a bus, the whole machine controllers realize internal control instruction and state synchronization / verification through a high-speed bus, and the whole machine controllers receive high-voltage instructions (i.e. indicating that the whole machine controller is about to enter a flight state) or feedback energy system state information from the FCU through the bus. The hardware of the whole machine controller can be an independent controller or a software system running on a specific platform. In order to prevent the loss of multiple related software caused by the loss of one controller, in a possible implementation manner, the software of the whole machine controller has a physical mutual isolation feature.

[0046] The three whole machine controllers are distinguished by configurations. In a possible implementation manner, the three whole machine controllers VCU A, VCU B and VCU C can be distinguished by different external connector pin feet or other ways. The application stipulates that the initial priority after power-on (i.e. the battery management system controls the battery to realize power supply) is VCU A>VCU B>VCU C, and only the main controller sends messages to the battery management system and the FCU at any stage, and the standby controller does not send any message to the battery management system and the FCU. The application does not make a specific limitation on the distinguishing method of the whole machine controller, and all methods capable of distinguishing the whole machine controller can be used.

[0047] The whole machine control modes mainly include a low-voltage state, a flight state, a charging state and an external power supply state. The low-voltage state represents that the electric aircraft is powered on only by the battery; the flight state represents that the FCU requires the whole machine controller to be powered on by high voltage for flight; the charging state represents a charging state by a charging gun; and the external power supply state represents that the aircraft is powered by an external high-voltage power supply.

[0048] The states of the whole machine controller mainly include Standby (representing that the controller is self-checking, and the self-checking time exceeding 100 ms represents that the self-checking fails), Run (representing that the controller passes the self-checking and can perform normal control operation), Preshutdown (representing that the device starts to enter a shutdown state) and Shutdown (representing normal shutdown).

[0049] The control instructions sent by the whole machine controller to the battery management system mainly include Offline (representing disconnection), FaultCheck (representing relay diagnosis), Online (representing relay closure) and Shutdown (representing relay disconnection operation). The control instructions sent by the whole machine controller contain control instructions of all parallel battery packs.

[0050] The instructions sent by the main controller in the whole machine controller to the backup controller mainly include: VCU x (representing that the current main controller is about to quit as a backup and nominates VCU x as the main controller). In a possible implementation manner, in the case of loss of the main controller, the backup controller can also nominate itself as the main controller.

[0051] When the whole machine controller receives the high-voltage-up instruction from the flight control, the high-voltage-up operation is performed, and the whole machine control mode is changed to the flight mode. The relay plays the roles of automatic adjustment, safety protection, and conversion circuit in the circuit. The relay diagnosis is to judge the state of the relay, and the purpose of the diagnosis is to exclude the faulty relay before the high-voltage-up operation; the relay closure can make the battery supply to realize the high-voltage-up operation.

[0052] The instructions of the battery management system sent by the main controller in the whole machine controller are consistent with the instructions of the battery management system sent by the backup controller in the whole machine controller, and the instructions of the battery management system sent by the main controller can be consistent with the instructions of the battery management system sent by at least one of the two backup controllers. Since the number of backup controllers is two, this case can ensure that the main controller in the whole machine controller is consistent with the majority of the whole machine controller in the instructions of the battery management system, effectively reduces the probability of the main controller sending an incorrect high-voltage-up instruction, and improves the safety performance of the aircraft system.

[0053] In step S12, after receiving the high-voltage-down instruction sent by the flight control system, in the case that the motor speed is lower than the idle speed and the instructions of the battery management system sent by the main controller are consistent with the instructions of the battery management system sent by the backup controller, a relay opening instruction is sent to the battery management system.

[0054] When the whole machine controller receives the high-voltage-down instruction from the flight control system, the high-voltage-down operation is performed, and the whole machine control mode is changed from the flight mode to other modes. In a possible implementation manner, after receiving the high-voltage-down instruction, the motor speed can be first judged, and then the instruction sent to the battery management system is determined when the motor speed is lower than the idle speed, to prevent the engine from suddenly stalling due to the sudden opening of the relay when the motor speed is too high.

[0055] The instructions of the battery management system sent by the main controller in the whole machine controller are consistent with the instructions of the battery management system sent by the backup controller in the whole machine controller, and the instructions of the battery management system sent by the main controller can be consistent with the instructions of the battery management system sent by at least one of the two backup controllers. Since the number of backup controllers is two, this case can ensure that the main controller in the whole machine controller is consistent with the majority of the whole machine controller in the instructions of the battery management system, effectively reduces the probability of the main controller sending an incorrect high-voltage-down instruction, and improves the safety performance of the aircraft system.

[0056] Step S13, after receiving the signal of emergency failure of the battery management system, the relay opening instruction is sent to the battery management system when the instruction of the battery management system from the local controller is consistent with the instruction of the battery management system from the backup controller.

[0057] The emergency failure of the battery management system includes limit over-temperature, limit under-voltage, limit over-voltage, short circuit or thermal runaway.

[0058] The instruction of the battery management system from the local controller is consistent with the instruction of the battery management system from the backup controller in the main controller, which can be the instruction of the battery management system from the main controller consistent with the instruction of the battery management system from at least one of the two backup controllers. Since the number of backup controllers is two, this case can ensure that the instruction of the battery management system from the main controller in the main controller is consistent with the instruction of the battery management system from the majority of the main controllers, effectively reducing the probability of the main controller sending incorrect high-voltage instruction when the battery management system has emergency failure, and improving the safety performance of the aircraft system.

[0059] In the embodiment of the present disclosure, the main controller of the vertical take-off and landing electric aircraft adopts the mutual voting strategy of the three main controllers when performing the high / low voltage operation of the battery management system and the emergency failure processing. Only when the instruction of the main controller is consistent with the instruction of the majority of the main controllers, the related operation of the relay is performed. This process effectively reduces the probability of the single main controller sending incorrect instruction to the battery management system, and improves the safety performance of the aircraft system.

[0060] In a possible implementation, the method further includes:

[0061] After receiving the signal of the vertical take-off and landing electric aircraft powered by the battery, self-checking is performed, and it is judged whether the local controller can receive the message of the backup controller. In the case that the self-checking fails or the local controller cannot receive the message of the backup controller, the local controller is set as the backup controller. In the case that the self-checking passes, the local controller can receive the message of the backup controller, and the priority of the local controller is the highest among the main controllers, the local controller is set as the main controller.

[0062] The signal received by the vertical take-off and landing electric aircraft through the battery power-on represents that the battery in the battery management system has started to power the vertical take-off and landing electric aircraft. After the vertical take-off and landing electric aircraft is powered on, self-checking of the whole machine controller is performed first, and the state of all whole machine controllers can be judged to avoid the control of the battery management system by the whole machine controller with faults; whether the whole machine controller can receive the message of the standby controller is judged, so that the possibility that the main controller cannot issue instructions due to network problems can be effectively reduced.

[0063] In a possible implementation, the whole machine controller that fails the self-checking can be self-isolated and stop sending all messages to avoid the whole machine controller with faults from issuing incorrect instructions. Further, when the main controller is isolated, the main controller can be re-determined in the standby controller that passes the self-checking and can receive the information of other standby controllers, so as to avoid that there is no whole machine controller to manage the battery management system. In a possible implementation, the self-checking time can be limited, and the main controller that exceeds the self-checking time is the whole machine controller that fails the self-checking and cannot perform normal control operations.

[0064] In the process of powering on the vertical take-off and landing electric aircraft, if the whole machine controller has experienced abnormal restart, it indicates that the whole machine controller may have faults. To avoid the control of the energy system by the abnormal whole machine controller, in a possible implementation, before the whole machine controller performs self-checking, whether the whole machine controller sends a message to the network is judged. When it is known that there is a whole machine controller that sends a message to the network, the whole machine controller that sends the message is set as a standby controller.

[0065] Since the priority of the initial VCU A>VCU B>VCU C is agreed after power-on (the battery management system controls the battery to implement power supply) in the application, in a possible implementation, when the main controller is re-determined in the standby controller that passes the self-checking and can receive the information of other standby controllers, the whole machine controller with high priority is preferentially selected as the main controller.

[0066] In the embodiments of the present disclosure, the main controller can effectively reduce the probability that the main controller with faults issues instructions and exclude the main controller with network faults after receiving the signal of battery power-on through self-checking and judging whether the message of the standby controller can be received, and the safety performance of subsequent high-voltage operation is improved.

[0067] In a possible implementation, step S11 comprises:

[0068] After receiving the high-voltage-on instruction issued by the flight control system, the instruction of the controller to the battery management system is set as a relay diagnosis instruction;

[0069] in case the relay diagnostic instruction is consistent with the instruction of the battery management system from at least one of the backup controllers, sending the relay diagnostic instruction to the battery management system;

[0070] in case the relay diagnostic instruction is inconsistent with the instruction of the battery management system from both of the backup controllers, nominating a main controller from the two backup controllers according to the priority order of the backup controllers, setting the current controller as a backup controller;

[0071] in case a signal of all relay diagnostics passing is received, setting the instruction of the battery management system from the current controller as a relay closing instruction;

[0072] in case the relay closing instruction is consistent with the instruction of the battery management system from at least one of the backup controllers, sending the relay closing instruction to the battery management system;

[0073] in case the relay closing instruction is inconsistent with the instruction of the battery management system from both of the backup controllers, nominating a main controller from the two backup controllers according to the priority order of the backup controllers, setting the current controller as a backup controller.

[0074] wherein, during the high-voltage operation, the backup controllers only perform normal relay instruction judgment logic and voting, and do not send messages to the battery management system and nominate the main controller (unless the main controller is lost, the backup controller becomes the main controller).

[0075] In a possible implementation, when the main controller does not receive the high-voltage signal from the flight control system, the main controller can set the high-voltage control instruction of all the battery management systems as Offline. In step S11, the instruction of the battery management system from the main controller is in turn a relay diagnostic (Fault Check) and a relay closing (Online). Before the relay diagnostic instruction and the relay closing instruction are issued, the main controller and the backup controllers need to set and vote on the instruction of the battery management system. When the instruction of the battery management system from the main controller is consistent with the instruction of the battery management system from most of the main controllers, the main controller sends the corresponding instruction to the battery management system. This process can effectively reduce the probability of the main controller issuing an incorrect diagnostic instruction and / or closing instruction, and improve the safety level of the energy system.

[0076] Further, after all the relay diagnostics pass, the main controller can set the control instruction of all the battery management systems as Online. All the controllers vote on the Online state to issue the relay closing instruction in the next step.

[0077] In case the instruction of the main controller to the battery management system is inconsistent with the instruction of most of the whole machine controllers to the battery management system, a new main controller can be re-determined from the standby controllers. In one possible implementation, the main controller can specify a new main controller from the standby controllers, and set the original main controller as a standby controller. Further, the method of specifying a new main controller from the standby controllers can be to select a standby controller with a high priority as the new main controller from the standby controllers according to the priority order of the standby controllers.

[0078] In the embodiments of the present disclosure, before the relay diagnosis instruction and the relay closing instruction are issued to the battery management system in the high-voltage charging stage, the main controller needs to vote the instruction set to the battery management system by the main controller and the instruction set to the battery management system by the standby controllers, and implement the strategy of majority over minority. When the instruction set to the battery management system by the main controller is consistent with the instruction of most of the whole machine controllers, the corresponding instruction is issued to the battery management system. When the instruction set to the battery management system by the main controller is inconsistent with the instruction of most of the whole machine controllers, a new main controller is nominated to ensure that the instruction issued to the battery management system is the instruction voted by most of the whole machine controllers. This process effectively reduces the probability of error of the instruction issued to the battery management system in the high-voltage charging stage, and improves the safety level of the aircraft system.

[0079] In one possible implementation, the step S12 comprises:

[0080] After receiving the low-voltage charging instruction issued by the flight control system, the instruction of the controller to the battery management system is set to the relay opening instruction;

[0081] In case the motor speed is lower than the idle speed and the relay opening instruction is consistent with the instruction of at least one standby controller to the battery management system, the relay opening instruction is sent to the battery management system;

[0082] In case the relay opening instruction is inconsistent with the instruction of both standby controllers to the battery management system, a main controller is nominated from the two standby controllers according to the priority order of the standby controllers, and the controller is set as a standby controller.

[0083] In step S12, the main controller sets a shutdown instruction for the battery management system. Before the shutdown instruction is sent, the motor speed needs to be confirmed. When the motor speed is lower than the idle speed, the main controller and the backup controller need to set and vote on the instruction for the battery management system. When the instruction for the battery management system of the main controller is consistent with the instruction for the battery management system of the majority of the machine controllers, the main controller sends the shutdown instruction to the battery management system. This process can effectively avoid sending incorrect diagnostic instructions and / or closing instructions by the main controller when the high voltage is normal, and improve the safety level of the energy system.

[0084] When the instruction for the battery management system of the main controller is consistent with the instruction for the battery management system of the majority of the machine controllers, a new main controller can be determined from the backup controllers. In one possible implementation, the main controller can specify a new main controller from the backup controllers, and set the original main controller as a backup controller. In one possible implementation, the method of specifying a new main controller from the backup controllers can be to determine a new main controller from the backup controllers according to the priority order of the backup controllers.

[0085] In the embodiments of the present disclosure, before the shutdown instruction for the battery management system is sent in the high voltage stage, it is first determined whether the motor speed is lower than the idle speed. When the motor speed is lower than the idle speed, the main controller needs to vote on the instruction for the battery management system set by the backup controller, and implement the strategy of majority over minority. When the instruction for the battery management system set by the main controller is consistent with the instruction for the battery management system of the majority of the machine controllers, the corresponding instruction is sent to the battery management system. When the instruction for the battery management system set by the main controller is inconsistent with the instruction for the battery management system of the majority of the machine controllers, a new main controller is nominated again, so as to ensure that the instruction sent to the battery management system is the instruction voted by the majority of the machine controllers. This process can avoid sudden engine shutdown caused by closing the relay when the motor speed is higher than the idle speed, and effectively reduce the probability of sending incorrect instructions to the battery management system in the high voltage stage, thereby improving the safety level of the aircraft system.

[0086] In one possible implementation, the step S13 includes:

[0087] After receiving the signal that an emergency fault occurs in the battery management system, the instruction of the controller for the battery management system is set as a shutdown instruction.

[0088] instructing the battery management system to shut down the relay in the case that the relay shutdown instruction is consistent with the instructions of the battery management system from at least one of the backup controllers;

[0089] in the case that the relay shutdown instruction is inconsistent with the instructions of the battery management system from two of the backup controllers, nominating a primary controller from the two backup controllers according to the priority order of the backup controllers, and setting the current controller as a backup controller.

[0090] In the case that the battery management system has an emergency failure, the battery management system sends a signal of emergency failure to the main controller, and the main controller and the backup controllers need to set and vote the instructions of the battery management system. In the case that the instructions of the battery management system from the main controller are consistent with the instructions of the battery management system from the majority of the main controllers, the main controller sends a shutdown instruction to the battery management system, which can effectively avoid the main controller sending an incorrect diagnosis instruction and / or a closing instruction in the case of abnormal high voltage, and improve the safety level of the energy system.

[0091] In the case that the instructions of the battery management system from the main controller are consistent with the instructions of the battery management system from the majority of the main controllers, a new main controller can be determined from the backup controllers. In a possible implementation, the main controller can specify a new main controller from the backup controllers, and set the original main controller as a backup controller. In a possible implementation, the method of specifying a new main controller from the backup controllers can be to determine a new main controller from the backup controllers according to the priority order of the backup controllers.

[0092] In a possible implementation, if the main controller receives more than one signal of emergency failure from the battery management system, the high voltage instruction can be kept unchanged to ensure the emergency landing of the aircraft.

[0093] In the embodiment of the present disclosure, before issuing a relay disconnection instruction to the battery management system during an abnormal high-voltage stage, the main controller needs to vote on the instruction set for the battery management system and the instruction set for the battery management system by the backup controller, and implement the strategy of minority obeys majority. Only when the instruction set for the battery management system by the main controller is consistent with the instruction of the majority of the whole machine control system, the corresponding instruction is issued to the battery management system. When the instruction set for the battery management system by the main controller is inconsistent with the instruction of the majority of the whole machine control system, a new main controller is re-nominated to ensure that the instruction issued to the battery management system is the instruction voted by the majority of the whole machine control system. This process effectively reduces the probability of issuing erroneous instructions to the battery management system during the abnormal high-voltage stage, and improves the safety level of the aircraft system.

[0094] Figure 3 A flowchart of an energy control method according to an embodiment of the present disclosure is shown. The method can be applied to a backup controller in an energy control device, which can be a terminal device, a server, or other processing device. Two or more backup controllers can be provided, and this disclosure does not limit this. The energy control device can be a user equipment (UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, an in-vehicle device, a wearable device, etc.

[0095] In some possible implementations, the energy control method may be implemented by a processor calling computer-readable instructions stored in a memory.

[0096] like Figure 3 As shown, the energy control method may include:

[0097] Step S31, after receiving the high voltage instruction issued by the flight control system, the controller sends the instruction of the battery management system to the main controller in the whole machine controller, and when receiving the instruction sent by the main controller to nominate the controller as the main controller, the controller is set as the main controller.

[0098] Step S32, after receiving the high voltage lowering instruction from the flight control system, the controller sends the instruction to the battery management system to the main controller, and when receiving the instruction from the main controller to nominate the controller as the main controller, the controller is set as the main controller.

[0099] Step S33, after receiving the emergency fault signal sent by the battery management system, the controller sends the instruction of the battery management system to the main controller, and in the case of receiving the instruction sent by the main controller to nominate the controller as the main controller, the controller is set as the main controller.

[0100] The distributed architecture of the whole machine controller, the battery management system and the flight control system (hereinafter referred to as the flight control system) of the vertical take-off and landing electric aircraft and the setting of the main controller and the standby controller in the whole machine controller can be consistent with Figure 2 , which will not be described in detail here.

[0101] Specifically, after receiving the high-voltage up instruction and the high-voltage down instruction sent by the flight control system and the emergency fault signal sent by the battery management system, the standby controller sends the instruction of the battery management system to the main controller. Further, the main controller sends the instruction to the battery management system according to the received instruction of the battery management system and the instruction of the battery management system. In one possible implementation, the main controller sends the instruction to the battery management system when the instruction of the battery management system is consistent with the instruction of the battery management system.

[0102] In one possible implementation, the standby controller receives the instruction sent by the main controller to nominate the standby controller as the main controller, and the standby controller sets the controller as the main controller.

[0103] In the embodiments of the present disclosure, the standby controller of the vertical take-off and landing electric aircraft sends the instruction of the battery management system to the main controller when performing the high-voltage up / down operation of the upper energy system and the emergency fault processing, so that the main controller sends the instruction to the battery management system when the instruction of the battery management system is consistent with the instruction of the battery management system. This process effectively reduces the probability of sending incorrect instructions by a single whole machine controller and improves the safety performance of the aircraft system. At the same time, when the main controller fails, the standby controller can set the controller as the main controller according to the instruction of the main controller to nominate the standby controller as the main controller, so as to ensure that the main controller is the fault-free controller in the whole machine controller and improve the accuracy of the instruction sent by the main controller.

[0104] In one possible implementation, when the whole machine controller controls all the battery management systems to complete the high-voltage up, unless the flight control system notifies the whole machine controller to perform the high-voltage down or the battery has a serious fault, the whole machine controller should keep all the high-voltage relays closed to ensure the normal power supply of the aircraft battery.

[0105] In a possible implementation, the method further includes:

[0106] In a case where it is detected that the main controller does not send any message to the battery management system and the controller can receive all feedback information of the battery management system,

[0107] In a case where the instruction of nominating the controller as the main controller sent by the main controller is received, the controller is set as the main controller.

[0108] In a case where the main controller does not send any nomination instruction and the priority of the controller is the highest among the backup controllers, the controller is set as the main controller.

[0109] The specific flow of the method is shown in Figure 4 In a case where the backup controller detects that the main controller loses the control over the battery management system and the backup controller can receive all feedback information of the battery management system, when the main controller sends the instruction of nominating the backup controller to the backup controller and the nominated backup controller can receive all feedback information of the battery management system, the backup controller designated by the main controller is set as the main controller; when the main controller does not send any nomination instruction, in a possible implementation, the new main controller can be determined from the backup controllers that can receive all feedback information of the battery management system according to the priority of the backup controllers.

[0110] In the embodiments of the present disclosure, when the main controller loses the control over the battery management system, the new main controller is determined from the backup controllers according to the priority of the main controller or the backup controllers, the long-time loss of the main controller over the battery management system can be avoided, and the safety performance of the vertical take-off and landing electric aircraft is improved.

[0111] Application scenario example 1

[0112] The embodiments of the present disclosure provide an energy control method applied to a main controller and backup controllers in a main controller of a whole machine, wherein the backup controllers are two.

[0113] In the embodiments of the present disclosure, the energy control method can include the following processes:

[0114] Firstly, after the electric aircraft is initially powered by the battery, the main controller is determined.

[0115] Figure 5 The flow chart for determining the main controller after the electric aircraft is initially powered. As shown in Figure 5As shown, in the S51 stage, it is judged whether the whole machine controller is VCU A. After power-on, the S510 stage first judges whether there is a VCU to send a message to the network. If yes, it enters the S55 stage, which represents that the VCU has experienced abnormal restart. Otherwise, it enters the S52 stage. In the S52 stage, if it is not passed through self-checking, it carries out the S53 stage to isolate itself and stop sending all messages. If it is passed through the self-checking in the S52 stage, it is judged in the S54 stage whether the synchronization information of other controllers can be received. If not, it is considered that there is a problem in the network itself, and to prevent abnormality, it enters the S55 stage to set itself as a backup controller. Otherwise, the VCU A device itself is a main controller. If the S51 stage judges that it is not VCU A after power-on, the S52 and S54 stages are also judged. If the VCU synchronization information is not received in the S58 stage, it is displayed that there is a main controller loss, and it lasts for 1000 ms. Then, the VCU with higher configuration (B is prior to C) sets itself as a main controller, and the remaining controllers remain as backup controllers.

[0116] In the second step, after receiving the high-voltage rising instruction issued by the flight control system, the main controller issues an instruction to the battery management system.

[0117] Figure 6 The flow chart of the main controller issuing an instruction to the battery management system in the high-voltage stage of the electric aircraft is as follows. Figure 6As shown, in S61 stage, it is judged whether the whole machine controller receives the high voltage command from the flight control system. If the high voltage command from the flight control system is not received, in S62 stage, the high voltage relay command of all the battery management systems is set to Offline. If the high voltage command from the flight control system is received, in S63 stage, the BMS control command in the internal of the VCU is set to FaultCheck. In S64 stage, all the VCUs perform internal voting, and the minority is subject to the majority. In S65 stage, if the main controller finds that its command is inconsistent with other backup controllers, in S67 stage, the VCU closest to the configuration is nominated as the main controller, and the self becomes the backup controller, and reenters S61 step. If the command is consistent with at least one of the other controllers, in S66 stage, the FaultCheck information is sent to all the BMSs. When the VCU receives the diagnosis result of the feedback from the BMS in S68 stage, in S69 stage, it is judged whether there is a relay that does not pass. If there is a relay that does not pass, it is considered that the battery system has a problem, and enters S610 stage to end the high voltage. If all the relays pass the diagnosis, in S611 stage, the control command of all the internal BMSs is set to Online. In S612 stage, the controller votes for the Online state. If the main controller is inconsistent with other controllers in S613 stage, in S615 stage, the VCU closest to the configuration is nominated as the main controller, and the self becomes the backup controller, and reenters S611 stage. If the main controller is consistent with at least one of the other backup controllers, in S614 stage, the Online command is sent to all the BMSs.

[0118] The third step is that, after receiving the high voltage command from the flight control system, the main controller sends a command to the battery management system.

[0119] Figure 7 The flow chart of the command sent by the main controller to the battery management system in the normal high voltage stage of the electric aircraft is shown in FIG. 6. Figure 7 As shown, in S71 stage, it is judged whether the high voltage command from the flight control system is received. If the high voltage command from the flight control system is not received, in S72 stage, the high voltage command is kept unchanged. If the high voltage command from the flight control system is received, in S73 stage, it is judged whether the rotation speed of all the motors is lower than the idle speed value. If the rotation speed is lower than the idle speed value, in S74 stage, all the VCUs vote for the high voltage command. If the control command of the main VCU is inconsistent with other two VCUs, in S76 stage, the VCU closest to the configuration is nominated as the main controller, and the self becomes the backup controller. Otherwise, in S77 stage, the Shutdown command is sent to all the BMSs.

[0120] The fourth step is that, after receiving the signal that an emergency fault occurs from the battery management system, the main controller sends a command to the battery management system.

[0121] Figure 8 This is a flow chart showing the main controller sending instructions to the battery management system during the abnormal high voltage stage of the electric aircraft. Figure 8 As shown, in the S81 stage, it is determined whether the communication between the VCU and the BMS is interrupted. If there is an interruption fault, the VCU enters the S82 stage to nominate a new VCU as the main controller and sets itself as the backup; if the communication is normal, the VCU enters the S83 stage to determine whether a high-level fault is received from the BMS, such as extreme overtemperature, extreme undervoltage, extreme overvoltage, short circuit or thermal runaway; if it is received, the VCU enters the S84 stage to set the control instruction inside the BMS to Shutdown, and the instructions of all the whole machine controllers are voted in the S85 stage. If the control instruction of the main controller is inconsistent with that of other VCUs in the S86 stage, the VCU nominates a new VCU as the main controller and sets itself as the backup. Otherwise, the BMS Shutdown control instruction is sent out in the S87 stage; in the subsequent S88 stage, if the VCU still receives a high-level fault from other BMSs, the VCU enters the S89 stage at this time, and all VCUs will maintain the high-voltage instruction unchanged to ensure the emergency landing of the aircraft.

[0122] In the disclosed embodiment, the main controller of the vertical take-off and landing electric aircraft adopts a mutual voting strategy among the three whole-machine controllers when performing up / down high-voltage operations and emergency fault handling of the upper energy system. The relevant operations of the relay are only performed when the instructions of the main controller are consistent with those of the majority of the whole-machine controllers. This process effectively reduces the probability of a single whole-machine controller issuing erroneous instructions to the battery management system, thereby improving the safety performance of the aircraft system.

[0123] It is understood that the above-mentioned various method embodiments mentioned in this disclosure can be combined with each other to form combined embodiments without violating the principle logic. Due to space limitations, this disclosure will not go into details. It is understood by those skilled in the art that in the above-mentioned methods of specific implementation, the specific execution order of each step should be determined by its function and possible internal logic.

[0124] In addition, the present disclosure also provides two energy control devices, electronic devices, computer-readable storage media, and programs, all of which can be used to implement any energy control method provided by the present disclosure. The corresponding technical solutions and descriptions can be found in the corresponding records in the method section and will not be repeated here.

[0125] Figure 9 A block diagram of an energy control device according to an embodiment of the present disclosure is shown. The energy control device is used as a main controller in a whole machine controller, which can be a processing device such as a server.

[0126] like Figure 9As shown, the energy control device 90 can include:

[0127] An upper high voltage module 91 is configured to, after receiving an upper high voltage instruction from the flight control system, sequentially send a relay diagnosis instruction and a relay closing instruction to the battery management system if the instruction of the battery management system from the main controller is consistent with the instruction of the battery management system from the backup controller.

[0128] A normal lower high voltage module 92 is configured to, after receiving a lower high voltage instruction from the flight control system, send a relay opening instruction to the battery management system if the motor speed is lower than the idle speed and the instruction of the battery management system from the main controller is consistent with the instruction of the battery management system from the backup controller.

[0129] An abnormal lower high voltage module 93 is configured to, after receiving a signal indicating an emergency fault from the battery management system, send a relay opening instruction to the battery management system if the instruction of the battery management system from the main controller is consistent with the instruction of the battery management system from the backup controller.

[0130] In one possible implementation, the number of backup controllers is two.

[0131] In one possible implementation, the device further includes a self-checking module configured to, after receiving a signal indicating that the vertical take-off and landing electric aircraft is powered on by the battery, perform self-checking and determine whether the main controller can receive messages from the backup controller; a backup controller setting module configured to, if the self-checking fails or the main controller cannot receive messages from the backup controller, set the main controller as the backup controller; and a main controller setting module configured to, if the self-checking passes, the main controller can receive messages from the backup controller, and the main controller has the highest priority in the whole machine controller, set the main controller as the main controller.

[0132] In a possible implementation, the upper high-voltage module comprises: a first instruction setting submodule, configured to set the instruction of the controller to the battery management system as a relay diagnosis instruction after receiving an upper high-voltage instruction sent by the flight control system; a diagnosis instruction sending submodule, configured to send the relay diagnosis instruction to the battery management system in a case where the relay diagnosis instruction is consistent with the instruction of at least one of the backup controllers to the battery management system; a first main controller nomination submodule, configured to nominate a main controller from the two backup controllers according to the priority order of the backup controllers and set the controller as a backup controller in a case where the relay diagnosis instruction is inconsistent with the instruction of both of the backup controllers to the battery management system; a second instruction setting submodule, configured to set the instruction of the controller to the battery management system as a relay closing instruction in a case where a signal that the relay diagnosis is passed is received; a closing instruction sending submodule, configured to send the relay closing instruction to the battery management system in a case where the relay closing instruction is consistent with the instruction of at least one of the backup controllers to the battery management system; and a second main controller nomination submodule, configured to nominate a main controller from the two backup controllers according to the priority order of the backup controllers and set the controller as a backup controller in a case where the relay closing instruction is inconsistent with the instruction of both of the backup controllers to the battery management system.

[0133] In a possible implementation, the normal lower high-voltage module comprises: an instruction setting submodule, configured to set the instruction of the controller to the battery management system as a relay opening instruction after receiving a lower high-voltage instruction sent by the flight control system; an opening instruction sending submodule, configured to send the relay opening instruction to the battery management system in a case where the motor speed is lower than the idle speed and the relay opening instruction is consistent with the instruction of at least one of the backup controllers to the battery management system; and a main controller nomination submodule, configured to nominate a main controller from the two backup controllers according to the priority order of the backup controllers and set the controller as a backup controller in a case where the relay opening instruction is inconsistent with the instruction of both of the backup controllers to the battery management system.

[0134] In a possible implementation, the abnormal high-voltage module comprises: an instruction setting submodule, configured to set an instruction of the controller to the battery management system as a relay opening instruction after receiving a signal indicating that the battery management system has an emergency fault; an opening instruction sending submodule, configured to send a relay opening instruction to the battery management system when the relay opening instruction is consistent with an instruction of at least one of the backup controllers to the battery management system; and a main controller nominating submodule, configured to nominate a main controller from the two backup controllers according to a priority order of the backup controllers when the relay opening instruction is inconsistent with the instructions of the two backup controllers to the battery management system, and set the controller as a backup controller.

[0135] Figure 10 A block diagram of an energy control apparatus according to an embodiment of the present disclosure is shown. The energy control apparatus can be used as a backup controller in a main controller, and can be a terminal device, a server, or another processing device, etc. The terminal device can be a user equipment (UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc.

[0136] In some possible implementations, the energy control apparatus can be implemented by a processor invoking computer readable instructions stored in a memory.

[0137] As shown in Figure 10 The energy control apparatus 100 comprises:

[0138] The high-voltage sending module 101 is configured to send an instruction of the controller to the battery management system to a main controller in a main controller after receiving a high-voltage sending instruction from a flight control system, and set the controller as the main controller when receiving an instruction sent by the main controller to nominate the controller as the main controller.

[0139] The normal high-voltage module 102 is configured to send an instruction of the controller to the battery management system to the main controller after receiving a low-voltage sending instruction from the flight control system, and set the controller as the main controller when receiving an instruction sent by the main controller to nominate the controller as the main controller.

[0140] An abnormal high voltage module 103 is configured to send the instructions of the controller to the main controller after receiving the signal of emergency failure from the battery management system, and set the controller as the main controller in the case that the controller receives the instruction of nominating the controller as the main controller from the main controller.

[0141] In a possible implementation, the energy control device further includes a first main controller setting module configured to set the controller as the main controller in the case that the controller receives the instruction of nominating the controller as the main controller from the main controller, and in the case that the main controller does not send any message to the battery management system and the controller can receive all the feedback information of the battery management system.

[0142] In some embodiments, the apparatus provided by the embodiments of the present disclosure has the functions or includes the modules for performing the methods described in the above method embodiments, and the specific implementation can refer to the description of the above method embodiments. For brevity, details are not described here.

[0143] The embodiments of the present disclosure further provide a computer readable storage medium having computer program instructions stored therein, and the computer program instructions are executed by a processor to implement the above method. The computer readable storage medium can be a volatile or non-volatile computer readable storage medium.

[0144] The embodiments of the present disclosure further provide an electronic device, including a processor, and a memory for storing processor executable instructions, wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0145] The embodiments of the present disclosure further provide a computer program product, including computer readable code or a non-volatile computer readable storage medium carrying computer readable code, and when the computer readable code is run in the processor of an electronic device, the processor in the electronic device executes the above method.

[0146] Figure 11 FIG. 8 is a block diagram of an apparatus 800 for energy control according to an exemplary embodiment. For example, the apparatus 800 can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, and the like.

[0147] Referring to Figure 11 The device 800 can include one or more of the following components: a processing component 802, a memory 804, a power supply component 806, a multimedia component 808, an audio component 810, an input / output (I / O) interface 812, a sensor component 814 and a communication component 816.

[0148] The processing component 802 usually controls overall operations of the device 800, such as operations associated with displaying, making phone calls, data communications, camera operations and recording operations. The processing component 802 can include one or more processors 820 to execute instructions to complete all or part of steps of the above methods. In addition, the processing component 802 can include one or more modules to facilitate interaction between the processing component 802 and other components. For example, the processing component 802 can include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0149] The memory 804 is configured to store various types of data to support operations of the device 800. Examples of these data include instructions for any application or methods operating on the device 800, contact data, phonebook data, messages, pictures, videos and so on. The memory 804 can be implemented by any type of volatile or non-volatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0150] The power supply component 806 provides power for various components of the device 800. The power supply component 806 can include a power supply management system, one or more power supplies and other components associated with generating, managing and distributing power for the device 800.

[0151] The multimedia component 808 includes a screen providing an output interface between the device 800 and a user. In some embodiments, the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors for sensing a touch, a slide and a gesture on the touch panel. The touch sensor can not only sense a boundary of a touching or a sliding action, but also detect duration and pressure related to the touching or sliding action. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operation mode, such as a shooting mode or a video mode, the front camera and / or the rear camera can receive external multimedia data.

[0152] The audio component 810 is configured to output and / or input an audio signal. For example, the audio component 810 includes a microphone (MIC) configured to receive an external audio signal when the device 800 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, the audio component 810 further includes a speaker for outputting an audio signal.

[0153] The input / output interface 812 provides an interface between the processing component 802 and peripheral interface modules, which can be a keypad, a click wheel, buttons, and the like. The buttons can include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0154] The sensor component 814 includes one or more sensors for providing status assessments of various aspects of the device 800. For example, the sensor component 814 can detect an open / closed position of the device 800, relative positioning of components, such as a display and a keypad of the device 800, a change of position of the device 800 or a component of the device 800, presence or absence of user contact with the device 800, a change in orientation of the device 800 or acceleration / deceleration of the device 800, and a temperature change of the device 800, among a plethora of other examples. The sensor component 814 can include an orientation sensor, an acceleration sensor, a proximity sensor, a gesture sensor, a gravity sensor, a biometric sensor, a temperature sensor, a humidity sensor, and an illuminance sensor, among a plethora of other examples.

[0155] The communication component 816 is configured to facilitate wired or wireless communication between the device 800 and other devices. The device 800 can access a wireless network based on a communication standard, such as WiFi, 2G, or 3G, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0156] In an exemplary embodiment, the device 800 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic components, for performing the above-described methods.

[0157] In an exemplary embodiment, a non-transitory computer readable storage medium, such as the memory 804 including computer program instructions, is also provided, which can be executed by the processor 820 of the device 800 to complete the above-described methods.

[0158] Figure 12 is a block diagram of a device 1900 for energy control according to an exemplary embodiment. For example, the device 1900 can be provided as a server or a terminal device. Referring to Figure 12 , the device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932, for storing instructions, such as application programs, executable by the processing component 1922. The application programs stored in the memory 1932 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above-described methods.

[0159] The device 1900 can also include a power component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 can operate based on an operating system stored in the memory 1932, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM or the like.

[0160] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by the processing component 1922 of the apparatus 1900 to perform the above-described method.

[0161] The present disclosure may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0162] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0163] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0164] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0165] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0166] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0167] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0168] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0169] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative, and not restrictive, of the disclosed embodiments. Many modifications and variations of the described embodiments are possible, and all such modifications and variations are intended to be within the scope of the described embodiments. The description used herein is intended to best explain the principles of the various embodiments, the practical application, and the best mode of using the present disclosure, and to enable others skilled in the art to understand the disclosure, various embodiments, and the application, devices, and apparatuses.

Claims

1. An energy control method for a main controller in an overall machine controller, characterized by, The application relates to a vertical take-off and landing electric aircraft control system. After receiving a high-voltage-up command from a flight control system, the controller sets a command to a battery management system as a relay diagnosis command, and sends the relay diagnosis command and a relay closing command to the battery management system in sequence when the command of the controller to the battery management system is consistent with a command of a backup controller in a whole-machine controller to the battery management system. After receiving a high-voltage-down command from the flight control system, the controller sets a command to the battery management system as a relay opening command, and sends the relay opening command to the battery management system when the motor speed is lower than an idle speed and the command of the controller to the battery management system is consistent with the command of the backup controller to the battery management system. After receiving a signal indicating an emergency fault from the battery management system, the controller sets a command to the battery management system as a relay opening command, and sends the relay opening command to the battery management system when the command of the controller to the battery management system is consistent with the command of the backup controller to the battery management system. The number of the backup controllers is two.

2. The method of claim 1, wherein, The method further comprises: After receiving a signal indicating that the vertical take-off and landing electric aircraft is powered on by the battery, the controller performs self-checking and judges whether the controller can receive messages of the backup controllers. When the self-checking fails or the controller cannot receive the messages of the backup controllers, the controller is set as a backup controller. When the self-checking passes, the controller can receive the messages of the backup controllers, and the priority of the controller in the whole-machine controller is the highest, the controller is set as a main controller.

3. The method of claim 1, wherein, After receiving the high-voltage-up command from the flight control system, the controller sends the relay diagnosis command and the relay closing command to the battery management system in sequence when the command of the controller to the battery management system is consistent with the command of the backup controller in the whole-machine controller to the battery management system, and the method comprises the following steps. When the relay diagnosis command is consistent with the command of at least one of the backup controllers to the battery management system, the relay diagnosis command is sent to the battery management system. When the relay diagnosis command is inconsistent with the command of two of the backup controllers to the battery management system, a main controller is nominated from the two backup controllers according to the priority order of the backup controllers, and the controller is set as a backup controller. When a signal indicating that the relay diagnosis is all passed is received, the command of the controller to the battery management system is set as the relay closing command. When the relay closing command is consistent with the command of at least one of the backup controllers to the battery management system, the relay closing command is sent to the battery management system. When the relay closing command is inconsistent with the command of two of the backup controllers to the battery management system, a main controller is nominated from the two backup controllers according to the priority order of the backup controllers, and the controller is set as a backup controller.

4. The method of claim 1, wherein, The method further comprises: In the case that the motor speed is lower than the idle speed and the relay opening instruction is consistent with the instruction of the battery management system from at least one of the backup controllers, the relay opening instruction is sent to the battery management system; In the case that the relay opening instruction is inconsistent with the instructions of the battery management system from both of the backup controllers, a main controller is nominated from the two backup controllers according to the priority order of the backup controllers, and the controller is set as a backup controller.

5. The method of claim 1, wherein, The method further comprises: In the case that the main controller does not send any message to the battery management system and the controller can receive all the feedback information of the battery management system, In the case that the main controller sends an instruction to nominate the controller as a main controller, the controller is set as a main controller; 6. The method of claim 1, wherein, In the case that the main controller does not send any nomination instruction and the priority of the controller is the highest among the backup controllers, the controller is set as a main controller. The method further comprises: The up high voltage module is configured to set the instruction of the controller to the battery management system as a relay opening instruction after receiving an up high voltage instruction from the flight control system, and send a relay diagnosis instruction and a relay closing instruction to the battery management system in sequence in the case that the instruction of the controller to the battery management system is consistent with the instruction of a backup controller in the whole machine controller to the battery management system; The normal down high voltage module is configured to set the instruction of the controller to the battery management system as a relay opening instruction after receiving a down high voltage instruction from the flight control system, and send a relay opening instruction to the battery management system in the case that the motor speed is lower than the idle speed and the instruction of the controller to the battery management system is consistent with the instruction of the backup controller to the battery management system; 7. An energy control device for a main controller in an overall system controller, characterized by comprising: ​ ​ ​ An abnormal high-voltage module, configured to set the instruction of the controller to the battery management system as a relay disconnection instruction after receiving a signal of an emergency fault from the battery management system, and send the relay disconnection instruction to the battery management system in the case that the instruction of the controller to the battery management system is consistent with the instruction of the backup controller to the battery management system. The number of the backup controllers is two.

8. An electronic device, comprising: Comprise: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the method of any one of claims 1 to 6 when executing the instructions stored in the memory.

Images