Aircraft electric or hybrid propulsion architecture

Abstract

An aircraft electric or hybrid propulsion architecture is disclosed, comprising at least two propulsion lines, each propulsion line comprising at least one motor (motor 1, motor 2) powered by at least two energy sources (energy source 1, energy source 2, energy source 3, energy source 4) of the propulsion architecture via at least two power supply paths, each energy supply path comprises at least one energy inverter and one electrical protection device which supplies a DC voltage to HVDC buses (HVDC bus 1, HVDC bus 2), each HVDC bus distributing the DC voltage to at least one electric machine via at least one energy inverter and one electrical protection device, the propulsion architecture includes energy supply paths that are at least partially distinct and preferably fully distinct.

Description

Technical Field

[0001] The present invention relates to the field of electric or hybrid propulsion architectures for aircraft. More particularly, the present invention relates to a propulsion architecture that tolerates random failures and is robust to systematic failures. Background Art

[0002] The propulsion system architectures of fixed-wing or rotary-wing aircraft generally tolerate a single random failure, but do not tolerate systematic failures, especially for certain critical events that result in the loss of the aircraft (due to the loss of integrity of the propulsion system control or the loss of the propulsion system itself). This is especially true for VTOL (vertical takeoff and landing) type aircraft used for urban mobility purposes, whose propulsion function directly contributes to the takeoff function, so the expected safety level of avoiding tragic losses and human disasters is more important than the safety level required for traditional aircraft with a lower likelihood of crashing in urban areas.

[0003] To be independent of the loss of control integrity, it is known to make the control equipment redundant so that, after the first random failure is confirmed, the control function is still ensured by redundancy. To be independent of the loss of the propulsion system, it is known to keep the minimum propulsion resources running so that a safe landing can be performed, that is, to ensure that the trajectory of the aircraft has the necessary safety margin.

[0004] These solutions are acceptable for traditional aircraft with heat engines, but are no longer acceptable for electric or hybrid propulsion line architectures that must provide better performance in terms of random and systematic failures.

[0005] In addition, climate change is a major concern for many legislative and regulatory bodies around the world. Specifically, various countries have taken, are taking, or will take various carbon emission restriction measures. In particular, an ambitious standard applies to both new aircraft and those currently in circulation, requiring the implementation of technical solutions to make them compliant with current regulations. For several years, civil aviation has been committed to contributing to the fight against climate change.

[0006] Technical research work has significantly improved the environmental performance of aircraft. The applicant is considering factors that affect all design and development stages to obtain aviation components and products with lower energy consumption, more environmentally respectful, and with a moderate environmental impact during integration and use in civil aviation, with the aim of improving the energy efficiency of aircraft.

[0007] Therefore, the applicant has been committed to reducing its impact on the climate by using beneficial methods and developing manufacturing processes, and keeping greenhouse gas emissions at an absolute minimum to reduce the environmental footprint of its business activities.

[0008] This ongoing research and development work simultaneously involves new-generation aircraft engines, the lightweighting of aircraft, particularly through the use of materials and lighter on-board equipment, the development of electric technologies for providing thrust, and aviation biofuels, which are an indispensable partner in technological progress.

[0009] Therefore, the present invention is the result of a technical research aimed at significantly improving aircraft performance and contributing to reducing its environmental impact. Summary of the Invention

[0010] Regarding the above, the main object of the present invention is to provide an electric or hybrid propulsion and / or lift architecture that includes at least two propulsion lines and provides a maximum margin in terms of power and the probability of not losing the propulsion function in normal mode and single or multiple fault states.

[0011] These objects have been achieved by an aircraft electric or hybrid propulsion architecture that includes at least two propulsion lines, each propulsion line including at least one electric motor, the at least one electric motor being powered from at least two energy sources of the propulsion architecture through at least two power supply paths, each power supply path including at least one energy inverter and an electrical protection device, the electrical protection device delivering a DC voltage to an HVDC bus, each HVDC bus distributing the DC voltage to at least one electric motor through at least one of the energy inverters and one of the electrical protection devices, the propulsion architecture being characterized in that the power supply paths are at least partially different and preferably completely different.

[0012] Therefore, through this diversity of the power supply paths, an architecture that is tolerant to random faults and robust to systematic faults is obtained. Thus, a propulsion system can be obtained that can meet the requirements of a critical system, provide the power required for flight control at a very high safety level, and minimize the vulnerability and threat of potential faults to an acceptable level.

[0013] In the present invention, thus there is diversity or difference in all elements of the propulsion architecture, and the independence between potentially dangerous faults can be maintained.

[0014] Preferably, the energy source, energy inverter, electrical protection device, and HVDC bus in one power supply path are each different from the energy source, energy inverter, electrical protection device, and HVDC bus in at least one other power supply path.

[0015] Advantageously, the electric motors in at least two propulsion lines are different.

[0016] The architecture may also include an electrical bus protection device provided between two different HVDC buses.

[0017] Preferably, the electrical bus protection device comprises a series assembly of a controlled basic electrical protection device (preferably including a contactor) and an uncontrolled basic electrical protection device (preferably including a circuit breaker).

[0018] Applied to a ring energy distribution network having three HVDC buses, the architecture includes at least one HVDC bus that is partially or completely different from the other two.

[0019] Applied to a ring energy distribution network having four HVDC buses, the architecture includes at least one HVDC bus that is partially or completely different from the other three.

[0020] Preferably, two adjacent HVDC buses of the energy distribution network are connected to each other by a series assembly of two electrical bus protection devices, which two electrical bus protection devices include two different basic electrical protection devices, preferably one controlled basic electrical protection device and one uncontrolled basic electrical protection device.

[0021] The present invention also relates to an electric or hybrid aircraft comprising an electric or hybrid propulsion architecture as described above. Description of the Drawings

[0022] With reference to the drawings, other features and advantages of the present invention will become apparent from the description given below, which shows exemplary embodiments of the present invention without any limitation, wherein:

[0023] Figure 1 Shows a first example of a propulsion architecture according to the present invention,

[0024] Figure 2 Shows a second example of a propulsion architecture according to the present invention,

[0025] Figure 3 Shows a first example of a power distribution network applicable to Figure 1 and 2 either one of the architectures,

[0026] Figure 4 Shows a second example of a power distribution network applicable to Figure 1 and 2 either one of the architectures,

[0027] Figure 5 Shows a third example of a propulsion architecture according to the present invention, and

[0028] Figure 6 Shows a fourth example of a propulsion architecture according to the present invention. Detailed Description

[0029] In the remainder of this specification, all elements of the architecture are considered to be in an active operating state, capable of contributing to compensating for systematic and random failures so as to maintain the airworthiness of the aircraft, enabling it to land safely using one motor (a single propulsion unit), i.e., providing the emergency energy level required to compensate for the loss of other propulsion units.

[0030] In order for each motor (or group of motors, referred to hereinafter in the remainder of this specification as groups 1 and 2) to be able to operate independently of one another (if there are two motors (or if there are more than two motors, all other motors)), the power-consuming items of these motors should become independent, and the energy sources powering them should also be independent.

[0031] It may be recalled that the term "propulsion system" refers to the functions and components that can generate and regulate the rotational speed and / or torque on each drive shaft of each motor. The power generated on multiple output shafts is subject to the requirements made by the flight control system of the aircraft.

[0032] Several propulsion system architectures will be described hereinafter, and for each architecture, an explanation will be given of how to ensure this independence to tolerate random single or systematic failures. This will be achieved by using diversity (or dissimilarity), which consists of providing as many differences as possible between the hardware or software characteristics of the objects that are desired to be independent. Thus, the more different characteristics there are between the same objects, the lower the probability that these objects will fail due to a common cause.

[0033] In the remainder of this specification, when the elements or energy supply paths of the propulsion architecture meet this diversity criterion, especially when their hardware or software characteristics are different, they are said to be "dissimilar".

[0034] Specifically, the fact that objects are very similar or even identical creates dependencies between these objects, i.e., they are no longer statistically independent, and the failure of one of these objects is statistically correlated with the failure of another of these objects. Such dependencies may be due to intrinsic functional or physical characteristics (intentionally or unintentionally), which are vulnerabilities such as, by way of example: behavior, materials, geometry, etc., or intrinsic or extrinsic characteristics of the objects (intentionally or unintentionally), which are the result of the interaction between the objects or the behavior in response to a given situation.

[0035] It can be considered that there are two subsets of causes that make faults interdependent. The first subset involves cascading faults, i.e., faults where there is a physical or logical coupling between non-redundant objects. First is the primary fault of the first object, and then through propagation, the secondary fault of the second object, etc., until the propagation stops at the last element where a fault occurs, or at an object that is more robust to the fault than its previous element. The second subset involves common-cause faults, which can reveal the dependencies of multiple objects within the same time interval (such as a flight or a mission), and which may be the result of the coupling mechanism of redundant objects, or may be the result of a common-cause initiator at a certain moment (e.g., a morning with higher-than-usual humidity, higher-than-usual vibration, etc.). The common cause may be random in nature, as the initiator may occur randomly over time, thus creating conditions for faults to occur in several objects during flight. However, when the initiator (pressure, specific requirements) appears, due to the lack of robustness of the objects under equivalent conditions that cause the faults of each object, the impact of the faults is the same.

[0036] Therefore, the present invention describes an architecture that tolerates common causes of potentially critical systematic faults in a propulsion system, and by reducing common-cause initiators and coupling mechanisms, this architecture avoids these common causes that lead to concerning events (loss of integrity and loss of availability described in the introduction) in the propulsion system.

[0037] Figure 1 A first example of a propulsion system architecture according to the present invention is shown, which includes at least two propulsion lines, and in each propulsion line there is at least: an energy source, a first element for inverting energy, an element for distributing the inverted energy, a second element for inverting the distributed energy, an element for converting electrical energy into mechanical energy for driving a propeller (motor), an electrical protection device, and one or more control systems (not shown) for different elements in the line.

[0038] This is a propulsion architecture with two independent propulsion groups (Group 1 # Group 2) (the symbol # indicates this independence), and the motors of Group 1 do not have the same origin as the motors of Group 2 (e.g., different suppliers) (so these two motors are different), and are organized by two equally independent HVDC (High-Voltage Direct Current) buses (HVDC Bus 1 # HVDC Bus 2). For such buses that are technically simple copper / aluminum bars, this independence will manifest as a characteristic that can prevent common causes of different materials, forms, or suppliers.

[0039] To improve the availability of each HVDC bus, each HVDC bus is advantageously powered by multiple energy sources along multiple functional power supply lines (or energy supply paths). In a first configuration, there are two energy sources, one of which is shared by two functional power supply lines. The shared energy source 2 can be, for example, a non-rechargeable thermal battery, or a rechargeable element such as a fuel cell, or a supercapacitor as shown in the figure, or a heat engine equipped with two alternators or a dual-channel (also known as a double-star) alternator that powers an HVAC bus (not shown), while energy sources 1 and 3 can be batteries.

[0040] The fact of having multiple functional power supply lines makes it possible to tolerate single random failures that cause the loss of the bus energy source and thus the loss of the entire bus (in this case, each functional line must be able to provide the maximum power required for true redundancy), but it does not mitigate systematic failures due to the similarity of these redundant functional power supply lines in terms of definition / design, manufacturing, installation, use, and maintenance / repair.

[0041] Furthermore, according to the present invention, in order for this propulsion architecture to tolerate systematic failures and meet the above-mentioned HVDC bus 1#HVDC bus 2 independence conditions, these two power supply lines also need to be at least partially different, and preferably completely different.

[0042] This difference is illustrated by the solid or dashed outlines of the units in question, with the same outline corresponding to similar objects. Thus, energy source 1 is similar to energy source 3, and energy source 2 is different from energy sources 1 and 3. The same similarity and difference exist in the inverters and electrical protection devices in each propulsion line.

[0043] These electrical protection devices serve to prevent certain electrical faults: short circuits between wires, between phases, or between phase and ground. These electrical protection devices are called: fuses, thermal fuses, circuit breakers, thermal circuit breakers, etc. Except for fuses, these components are fully or partially controlled and rely on another element that will detect these short-circuit faults. In most cases, these electrical protection devices combine an element that provides detection and another element that controls the element used to disconnect the electrical fault. More generally, an electrical protection device is a combination of two series switches that combines the dual properties of an active element and a passive element. Such an electrical protection device is used to protect the propulsion line from component failures in the electrical path in order to locally suppress electrical faults and can keep other paths and electrical components in a nominal operating state and thus make them independent of the electrical fault and the affected one or more paths.

[0044] Therefore, for electrical faults from an energy source that can be AC or DC, isolating them from the power-consuming item(s) is sought. For electrical faults from power distribution components (HVDC or HVAC busbars), isolating them from both the power-consuming item(s) and the energy source is sought to avoid propagation to other electrical paths. For electrical faults from energy conversion components (AC / DC inverters, DC / AC inverters, etc.), isolating them from the energy source, power distribution components, and downstream power-consuming item(s) is sought.

[0045] Any electrical fault of the short-circuit type must be controllable by isolating other elements of the circuit from the effects of such a fault. Therefore, each electrical protection device must be independent of the cause it is intended to cover, i.e., any cause of the fault that results in a short circuit must be independent of the electrical protection device that prevents the short circuit.

[0046] Note that these electrical protection devices are also capable of mitigating risks other than the short-circuit risk in the same way, such as overvoltage, overheating, or thermal runaway of the energy source (battery), and these risks must also be controlled in an electric or hybrid propulsion system.

[0047] An electrical bus protection device of the "cross-contact" type is provided between two HVDC buses (HVDC bus 1, HVDC bus 2). This electrical bus protection device consists of a series assembly of two basic electrical protection devices: one is controlled, such as a contactor (e.g., controlled to open due to overcurrent), and the other is uncontrolled, such as a circuit breaker, fuse, or high-temperature switch. These two protection devices are different in nature, and each protection device opens under very specific conditions, being redundant or complementary to each other.

[0048] As required, this electrical bus protection device can be installed or not installed. If installed, the contactor generally remains open unless in the event of a fault, and the circuit breaker generally remains closed in the nominal position (in the nominal scenario, the cross-contact must be open to maintain the independence of the two channels). During very specific operating phases on the ground or in flight, the contactor (controlled element) of the electrical protection device can be closed, for example, to charge one energy source with another energy source or in the event of a fault. During certain faults, it can be particularly advantageous to restore other paths and distribute power across a certain number of paths instead of using the non-faulty power supply path to its maximum performance, which is doubly beneficial because it avoids operating certain paths at maximum power, which reduces the risk of failure, and thus certain paths can be kept redundant, and the system can therefore be maintained in a state more tolerant of faults.

[0049] From a safety perspective, the dependency between two HVDC buses is acceptable only if it is known how to isolate one HVDC bus from the other again when a fault occurs on one of the HVDC buses. This embodiment can lead to the implementation of several electrical components to ensure that the two buses can be made independent again by disconnecting the dependent connection in the event of a short circuit, for example, in one of the two buses.

[0050] It should be clearly pointed out that there are several possible sharing combinations depending on whether the energy of the bus is simplex, duplex or otherwise. For example, in a variant architecture, it can be envisaged that HDVC bus 1 is powered only in simplex form by energy 2, i.e., without energy 1, energy 1 will not be installed. In this case, there are therefore only two real energies, energy 2 and energy 3, i.e., the second-order minimum cut set of the loss of energy availability, but compared with the third-order minimum cut set related to the loss of source availability in the Figure 1 architecture, there is a significant saving in the mass balance. The concept of the nth-order minimum cut set must be understood as the number n of necessary conditions to reach the loss of the aircraft within the meaning of the fault tree related to the propulsion line.

[0051] To best maintain the principle of independence between the two buses, i.e., HVDC bus 1 # HVDC bus 2, it should be stipulated that at least one power supply path of HDVC bus 1 is different from at least one power supply path of HVDC bus 2, which can be expressed as follows:

[0052] · [Path 1 or Path 2.1] # [Path 2.2 or Path 3].

[0053] Or for example:

[0054] ·· [Energy 1 + Protection device 1 + Inverter 1 + HVDC bus 1] # [Energy 3 + Protection device 3 + Inverter 3 + HVDC bus 2], [Energy 2 # [HVDC bus 1 or HVDC bus 2]], which allows: Energy 2.1 = Energy 2.2, Protection device 2.1 = Protection device 2.2 = [Protection device 1 or Protection device 3 or neither], Inverter 2.1 = Inverter 2.2 = [Inverter 1 or Inverter 3 or neither],

[0055] · [Energy 2.1 + Protection device 2.1 + Inverter 2.1 + HVDC bus 1] # [Energy 2.2 + Protection device 2.2 + Inverter 2.2 + HVDC bus 2], [Energy 2 # [HVDC bus 1 or HVDC bus 2], Energy 2 # [Energy 1 or Energy 3], allowing: Protection device 1 = Protection device 3 = [Protection device 2.1 or Protection device 2.2 or neither], Inverter 1 = Inverter 3 = [Inverter 2.1 or Inverter 2.2 or neither],

[0056] ··[Energy 1 + Protection device 1 + Inverter 1 + HVDC bus 1]#[Energy 2 + Energy 2.2 + Protection device 2.2 + Inverter 2.2 + HVDC bus 2], [Energy 2#[HVDC bus 1 or HVDC bus 2]], which allows: Energy 1 = Energy 3, Protection device 1 = Protection device 3 = [Protection 2.1 or not], Inverter 1 = Inverter 3 = [Inverter 2.1 or not],

[0057] ··[Energy 1 + Protection device 1 + Inverter 1 + HVDC bus 1]#[Energy 2 + Energy 2.i + Protection device 2.i + Inverter 2.i + HVDC bus 2], [Energy 2#[HVDC bus 1 or HVDC bus 2]], which allows: Energy 1 = Energy 3, Protection device 1 = Protection device 3, Inverter 1 = Inverter 3,

[0058] Of course, it is crucial that path 2.1 is electrically independent of path 2.2 and that a fault at the common point "Energy 2" does not propagate, resulting in the loss of HVDC bus 1 and HVDC bus 2. To achieve this, therefore, it is necessary that: Energy 2#[HVDC bus 1 or HVDC bus 2].

[0059] This independence is found in motors that are different from each other and also have different wirings. Thus, motor 1 is powered by HVDC bus 1 and HVDC bus 2 through different inverters and electrical protection devices. More precisely, motor 1 is powered from HVDC bus 1 via path 1.1 through electrical protection device 1 and inverter 1.1, and from HVDC bus 2 via path 2.1 through electrical protection device 2 and inverter 2.1, it being understood that protection device 1 is different from protection device 2 and inverter 1.1 is different from inverter 2.1. Similarly, motor 2 is powered from HVDC bus 1 via path 2.2 through electrical protection device 1 and inverter 1.2, and from HVDC bus 2 via path 2.1 through electrical protection device 2 and inverter 2.1, it being understood that protection device 1 is different from protection device 2 and inverter 2.1 is different from inverter 2.2.

[0060] In Figure 2 Energy 2.1 and 2.2 no longer have a common source and are thus different and the routing of the loads is different. Thus, motor 1 is exclusively powered from HVDC bus 1 by two redundant paths, one 1.1 through electrical protection device 1 and inverter 1.1 and the other 1.2 through protection device 1 and inverter 1.2, and motor 2 is also powered from HVDC bus 2 by two redundant paths, one 2.1 through protection device 2 and inverter 2.1 and the other 2.2 through protection device 2 and inverter 2.2.

[0061] Figure 3Shows different examples of powering HVDC bus 1 and HVDC bus 2 with four different energy sources (without load routing). This architecture is very different from the previous one because there are two shared energy sources on each HVDC bus. But there are also two additional HVDC buses. This advantageously enables load routing as shown in Figure 1 and Figure 2 to eliminate the second-order fault minimal cut sets that exist when there are only two buses.

[0062] To best maintain the principle of independence between the two buses: HVDC bus 1 # HVDC bus 4, it should be stipulated that at least one power supply path of HVDC bus 1 is partially or completely different from at least one power supply path of HVDC bus 4, in the following form:

[0063] · [Path 1 or Path 2] # [Path 3 or Path 4].

[0064] Therefore, for example, among several possible dissimilarity distributions across this architecture, there is at least the following minimum selection:

[0065] · [Energy 1 + Protection device 1 + Inverter 1 + HVDC bus 1] # [Energy 4 + Protection device 4 + Inverter 4 + HVDC bus 4], [Energy 2 # [HVDC bus 1 or HVDC bus 4]], [Energy 3 # [HVDC bus 1 or HVDC bus 4]], which allows: Energy 1 = Energy 2, Protection device 1 = Protection device 2, HVDC bus 1 = HVDC bus 2, Inverter 1 = Inverter 2, Energy 3 = Energy 4, Protection device 3 = Protection device 4, Inverter 3 = Inverter 4, HVDC bus 3 = HVDC bus 4.

[0066] Another example of a similarly suitable distribution exploits the dissimilarity that may exist between battery-based energy sources 2 and 3 and energy sources 1 and 4 that may be different from the battery according to the scenario.

[0067] In the above two configurations, the purpose of adding electrical bus protection devices (Protection device 5 and Protection device 6) between buses HVDC1 and HVDC4 is the same as in the first configuration. Cross-switch contactors can be used as redundancy for buses HVDC2 and HVDC3 to enable bus HVDC1 to be connected to bus HVDC 4.

[0068] Figure 4 The architecture of... replicates the above principle but enables a reduction in the number of available energy sources. In this configuration, the loss of energy is a third-order minimal cut set. If the requirements and reliability / availability of the energy allow, the number of energy sources can be further reduced, for example, removing Energy 2 or Energy 3. In this case, the loss of energy will be a second-order minimal cut set, which is not prohibitive in itself.

[0069] Here, in order to best maintain the independence principle between the two busbars: HVDC busbar 1 # HVDC busbar 4, it should be stipulated that at least one power supply path of HVDC busbar 1 is partially or completely different from at least one power supply path of HVDC busbar 4, in the following form:

[0070] ··[Path 1.1 or Path 2 or Path 3] # [Path 1.2 or Path 3 or Path 2].

[0071] There are several possible distributions of the dissimilarity in this architecture, including the following, which minimizes the number of dissimilar components:

[0072] ··[Energy 1 + Energy 1.i + Protection device 1.i + Inverter 1.i + HVDC busbar 1] # [Energy 2 / 3 + Protection device

[0073] 2 / 3 + Inverter 2 / 3 + HVDC busbar 4], [Energy 2 # [HVDC busbar 1 or HVDC busbar 4]], [Energy 3 # [HVDC busbar 1 or HVDC busbar 4]], which allows: Energy 2 = Energy 3, Protection device 2 = Protection device 3, HVDC busbar 1 = HVDC busbar 2, Inverter 2 = Inverter 3, Energy 1.1 = Energy 1.2, Protection device 1.1 = Protection device 1.2, Inverter 1.1 = Inverter 1.2, HVDC busbar 3 = HVDC busbar 4.

[0074] Of course, it is crucial that Path 1.1 is electrically independent of Path 1.2, and the failure of the common point of the shared energy does not spread, so as to avoid causing the loss of HVDC busbar 1 and HVDC busbar 4. For this reason, therefore, it is necessary that: Energy 1 # [HVDC busbar 1 or HVDC busbar 4].

[0075] As mentioned before, the benefits of adding an electrical bus protection device between busbars HVDC1 and HVDC4 are the same as the previous architecture. Cross contactors can be used as redundancy for HVDC busbar 2 and HVDC busbar 3 to enable HVDC busbar 1 to be connected to HVDC busbar 4.

[0076] Figure 5The architecture shown depicts a ring network with three different energy sources. In such a ring network architecture, the loads (the motors driving the propellers) are not directly connected to the HVDC bus, but rather through a so-called reconfiguration module, which is set at the intersection of two adjacent HVDC buses in the ring and consists of two electrical bus protection devices. Each of these two electrical bus protection devices is constituted by a series assembly of two basic electrical protection devices (on the one hand, protection device a and protection device b, and on the other hand, protection device c and protection device d), and these two protection devices are different in nature: one is controlled, such as a contactor, and the other is uncontrolled, such as a circuit breaker. As shown, these electrical bus protection devices are not necessarily identical, and the dissimilarity of the shown modules can be organized in different ways.

[0077] On such a ring network with three energy sources, there are three load connection points (at the connection points between two electrical bus protection devices), while on a ring network with four energy sources as shown Figure 6 there are four energy connection points.

[0078] Although in all previous configurations, there are several electrical networks (2, 3, 4, …) that are electrically independent HVDC buses, the ring network is an example of an implementation where all energy sources and loads are connected to the same network. Such a network is like a spider web and has significant advantages in tolerating errors of different participants in the network.

[0079] To comply with the independence principle guiding the present invention, the dysfunctional behavior of objects such as the network, energy sources, inverters, buses, or loads should not impair the operation of other objects, regardless of the fault situation, that is, whether these objects are autonomous from the perspective of their operation. In other words, at least two families of power supply paths must be independent (including systematic faults), that is, there must always be at least two families of energy sources, inverters, buses, and loads that must be independent.

[0080] Due to the need for two independent propulsion groups (Group 1 # Group 2), this requires at least one network independent of the other, that is, HVDC bus i # other HVDC buses. Therefore, if it is necessary to achieve third-order independence (Group 1 # Group 2 # Group 3) in the architecture, there must be at least two paths that are partially or completely different from each other and from other path parts, that is, HVDC bus i # HVDC bus j # other HVDC buses. Similarly, if n-order independence is required, there must be at least n - 1 paths that are partially or completely different from each other and from these other path parts.

[0081] Thus, in a ring network configuration with three buses, under the second-order independence requirement (Group 1 # Group 2), it is recommended that at least one bus be partially or fully different from the other two buses, and in an architecture with four buses, there should be at least one bus that is partially or fully different from the other three buses. As in the previous architectures, there are several ways to distribute the dissimilarity. In particular, when the number of buses is even, as Figure 6 shown, a uniform distribution of dissimilarity is a solution that has advantages in terms of production, inventory, experience feedback, etc. from an industrial perspective.

[0082] However, note that for all examples of the propulsion architectures described in the present invention, there may be other reasons for the distribution choices, such as based on: the reliability of diverse technical solutions, the aircraft and its ability to install wiring that will not be damaged by common failure causes in the areas of the aircraft through which the wiring passes or other threats (such as high-energy debris, for example), which would undermine the expected independence.

[0083] Several different examples of generators, inverters, motors, and electrical protection devices will now be described. These examples are illustrative only and do not limit the present invention.

[0084] For a power generation propulsion system, at least two different voltage generators can be connected in parallel: one generator generates electricity using a rotating machine, and the other generates electricity electrochemically.

[0085] For the inverters present in the propulsion system, this dissimilarity can be hardware-based or software-based. For example, one inverter may have a digital control architecture, while the other has an analog control architecture. This can especially reduce its vulnerability to cyberattacks (which can be introduced on a digital network but not on an analog network), as well as lightning strikes (lightning strikes can cause a more sensitive digital network to fail, so an analog control network can be used to maintain the conversion function).

[0086] Regarding the motors present in the propulsion system, different motor topologies can be used. For example, one motor can be a permanent magnet synchronous motor, and the other can be an asynchronous motor. This can especially limit the problems related to the nature of the materials used in the magnets.

[0087] Finally, for the protection system, these can be remotely controlled or triggered autonomously. Protection devices of the electromechanical type (circuit breakers, fuses, or thermal fuses) or electronic type (solid-state energy controllers or SSPCs) can also be used.

Claims

1. An electric or hybrid propulsion architecture for an aircraft, comprising at least two propulsion lines, each propulsion line comprising at least one electric machine (Electric Machine 1, Electric Machine 2), said at least one electric machine being powered from at least two energy sources (Energy Source 1, Energy Source 2, Energy Source 3, Energy Source 4) of the propulsion architecture through at least two power supply paths, each power supply path comprising at least one energy inverter (Inverter 1, Inverter 2) and an electrical protection device (Protection Device 1, Protection Device 2), said electrical protection device delivering a DC voltage to an HVDC bus (HVDC Bus 1, HVDC Bus 2, HVDC Bus 3, HVDC Bus 4), and each HVDC bus distributing said DC voltage to at least one electric machine (Electric Machine 1, Electric Machine 2) through at least one of said energy inverters and one of said electrical protection devices. The propulsion architecture is characterized in that the energy source (Energy Source 1), energy inverter (Inverter 1), electrical protection device (Protection Device 1) and HVDC bus (HVDC Bus 1) in one power supply path are each different from the energy source (Energy Source 4), energy inverter (Inverter 4), electrical protection device (Protection Device 4) and HVDC bus (HVDC Bus 4) in at least one other power supply path.

2. The architecture according to claim 1, wherein the electric machines (Electric Machine 1, Electric Machine 2) in said at least two propulsion lines are different.

3. The architecture according to any one of claims 1 or 2, further comprising an electrical bus protection device (Protection Devices 5 - Protection Devices 6) arranged between two different HVDC buses.

4. The architecture according to claim 3, wherein said electrical bus protection device comprises a series assembly of a controlled basic electrical protection device preferably comprising a contactor and an uncontrolled basic electrical protection device preferably comprising a circuit breaker.

5. The architecture according to any one of claims 1 to 4, configured to be applied to a ring-shaped energy distribution network having three HVDC buses, wherein at least one HVDC bus (HVDC Bus 3) is partially or completely different from the other two (HVDC Buses 1 - HVDC Bus 2).

6. The architecture according to any one of claims 1 to 4, configured to be applied to a ring-shaped energy distribution network having four HVDC buses, wherein at least one HVDC bus (HVDC Buses 3 - HVDC Bus 4) is partially or completely different from the other three (HVDC Buses 1 - HVDC Bus 2).

7. The architecture according to claim 5 or claim 6, wherein two adjacent HVDC buses in said energy distribution network are connected to each other through a series assembly of two electrical bus protection devices (a, b; c, d).

8. The architecture according to claim 7, wherein each of said two electrical bus protection devices (a, b; c, d) comprises two different basic electrical protection devices, preferably one controlled basic electrical protection device and one uncontrolled basic electrical protection device.

9. An electric or hybrid aircraft, comprising an electric or hybrid propulsion architecture as claimed in any one of claims 1 to 8.

Images