Full-link fault isolation control method and device for eVTOL low-voltage distribution box

Abstract

The application discloses a kind of eVTOL low-voltage distribution box's whole link fault isolation control method and device, its method includes: independent overvoltage protection circuit in protection circuit is monitored and handled to the voltage input, obtains monitoring voltage data;The current direction of input end is monitored by the independent ideal diode in the protection circuit, and monitoring current direction is obtained;The protection circuit carries out fault isolation control processing to external power supply and low-voltage power supply according to monitoring voltage data and monitoring current direction;Based on multistage isolation redundant architecture, the whole link fault of power supply in the eVTOL low-voltage distribution box is carried out fault isolation control processing.In the embodiment of the application, fast response is realized on the hardware level, and through whole link isolation redundant design, the fault is accurately limited in local area, to prevent fault diffusion, improve the reliability of system;Integrating positive and negative reverse connection protection, anti-static and anti-surge, can effectively resist various abnormal inputs.

Description

Technical Field

[0001] This invention relates to the field of unmanned aerial vehicle (UAV) technology, and in particular to a method and apparatus for end-to-end fault isolation control of an eVTOL low-voltage power distribution box. Background Technology

[0002] As an emerging urban air mobility solution, electric vertical takeoff and landing (eVTOL) aircraft face more stringent technical requirements for their power distribution systems than traditional aircraft. Existing eVTOL low-voltage power distribution systems mainly rely on MCU-based protection logic. For overvoltage / overcurrent protection, certain thresholds are set, and when the voltage or current exceeds the threshold, the MCU issues a command to cut off the power supply or take corresponding protective measures. For fault isolation, most systems adopt a single-layer protection mechanism, usually setting up protection devices at the bus level, and performing protection operations on the entire bus when a fault occurs. For reverse current control, software logic is mainly relied upon. By detecting the current direction, when reverse current is detected, the software issues a control signal to prevent the reverse current.

[0003] The main reason for the shortcomings of existing technologies is that traditional solutions rely too heavily on software control, lack rapid hardware-level protection mechanisms, and have insufficient protection layer design. The shortcomings are listed below:

[0004] a) Slow response speed: Overvoltage / overcurrent protection has a long response time, with a typical overvoltage cut-off time of more than 500μs. This is because the protection logic based on MCU control needs to go through multiple steps such as data acquisition, processing, judgment and command issuance, resulting in a large delay. It cannot respond to rapidly changing fault conditions in a timely manner and is difficult to meet the real-time requirements of aviation grade.

[0005] b) Poor fault isolation capability: Single-level protection mechanisms cannot accurately isolate faults, and once a fault occurs, it can easily spread to the entire system; for example, in bus-level protection, a fault in one load may affect the operation of other normal loads, reducing the reliability and stability of the system.

[0006] c) Lack of comprehensive protection: There is a lack of effective protection measures against abnormal situations such as reverse power connection, static electricity, and surges; in actual flight, these abnormal situations may occur at any time, and if they cannot be effectively protected, they will seriously threaten the flight safety of eVTOL;

[0007] d) Unreliable reverse current control: Relying on software logic to control reverse current, due to the time delay in software execution, it cannot react quickly when reverse current occurs, which can easily lead to power supply mutual charging, oscillation, and device damage caused by reverse current. Summary of the Invention

[0008] The purpose of this invention is to overcome the shortcomings of the prior art. This invention provides a full-link fault isolation control method and device for eVTOL low-voltage distribution boxes. It achieves rapid response at the hardware level and precisely limits the fault to a local area through full-link isolation redundancy design, preventing the fault from spreading and improving the reliability of the system. It integrates positive and negative reverse connection protection, anti-static and surge protection, which can effectively resist various abnormal inputs.

[0009] To address the aforementioned technical problems, this invention provides a full-link fault isolation control method for eVTOL low-voltage distribution boxes. Applied to eVTOL low-voltage distribution boxes, the method includes a multi-level isolation redundancy architecture within the eVTOL low-voltage distribution box. A protection circuit is provided at the input of the multi-level isolation redundancy architecture. The input of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. The method includes:

[0010] The independent overvoltage protection circuit in the protection circuit monitors and processes the input voltage to obtain monitoring voltage data.

[0011] The independent ideal diode in the protection circuit monitors the current direction at the input terminal to obtain the monitored current direction;

[0012] The protection circuit performs fault isolation control on the external power supply and low-voltage power supply based on the monitored voltage data and the monitored current direction.

[0013] Based on a multi-level isolation and redundancy architecture, fault isolation and control are performed on the entire power supply link within the eVTOL low-voltage distribution box.

[0014] The multi-level isolation redundancy architecture includes, in sequence, a multi-input power supply independent isolation module, a dual-bus independent isolation module, a power supply merging fault isolation module, and an output circuit single-load isolation module.

[0015] The multi-input power supply-independent isolation module is used to independently isolate input power supply faults. The multi-input power supply-independent isolation module includes an overvoltage protection circuit and an ideal diode circuit. The overvoltage protection circuit includes an overvoltage protection controller chip and an N-channel metal-oxide-semiconductor field-effect transistor. The ideal diode circuit includes an ideal diode controller chip and an N-channel metal-oxide-semiconductor field-effect transistor.

[0016] The dual busbar independent isolation module is used to independently isolate busbar faults. The dual busbar independent isolation module includes a manual switch, a DC-DC step-down voltage regulator circuit, a relay, an overvoltage protection circuit, and an ideal diode circuit.

[0017] The power merging fault isolation module is used to monitor the current direction and perform fault isolation based on the current direction. The power merging fault isolation module includes a DC-DC buck regulator circuit and an ideal diode circuit.

[0018] The output circuit single load isolation module is used for fault isolation of the output circuit load;

[0019] The two sets of buses in the dual busbar independent isolation module are isolated from each other. When either set of buses fails, it does not affect the other set of buses from independently supplying power to the eVTOL low-voltage distribution box.

[0020] Each of the two busbars is connected in series with a contactor, and the contactor is controlled to be closed or opened by the main power manual switch outside the eVTOL low-voltage distribution box; wherein the main power manual switch has 4 channels, and is divided into groups of 2 channels, with each group controlling one contactor.

[0021] Optionally, the protection circuit performs fault isolation control processing on the external power supply and low-voltage power supply based on the monitored voltage data and the monitored current direction, including:

[0022] When the overvoltage protection circuit in the protection circuit confirms that the monitored voltage data is greater than the set protection voltage, it performs hardware-level rapid disconnection of the abnormal power supply to achieve fault isolation and control processing of the abnormal power supply.

[0023] When the ideal diode in the protection circuit confirms that the direction of the monitored current is reverse, the ideal diode blocks the reverse current, thereby achieving fault isolation and control of the abnormal power supply.

[0024] Optionally, when the main power manual switch is closed, it triggers the DC-DC circuits corresponding to the two sets of busbars in the eVTOL low-voltage distribution box to start, supplying power to the coil magnetic contactor inside the corresponding contactor, so that the physical contacts of the coil magnetic contactor are closed; when the main power manual switch is open, the physical contacts of the coil magnetic contactor inside the corresponding contactor are open; wherein the main power manual switch and the contactor are both designed with dual redundancy, and the power supply of the contactor is two sets of independent and series-connected step-down voltage regulator modules and overvoltage protection modules.

[0025] Optionally, the input terminal of the power merging fault isolation module is connected to the output terminal of the dual-bus independent isolation module. The power merging fault isolation module is configured with a corresponding number of output loads according to the number of avionics devices. Each output load corresponds to one avionics device. Each output load configured in the power merging fault isolation module is an ideal diode and a step-down module connected in series.

[0026] Optionally, the output circuit single load isolation module consists of a fuse connected in series with each output load, the power of which matches the output load. When the current of the output load exceeds a preset value, the fuse connected in series will blow, thereby disconnecting the fault circuit corresponding to the output circuit single load isolation module.

[0027] In addition, this invention also provides a full-link fault isolation control device for an eVTOL low-voltage distribution box, applied to the eVTOL low-voltage distribution box. A multi-level isolation redundancy architecture is provided within the eVTOL low-voltage distribution box, and a protection circuit is provided at the input terminal of the multi-level isolation redundancy architecture. The input terminal of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. The device includes:

[0028] First monitoring module: used by the independent overvoltage protection circuit in the protection circuit to monitor and process the input voltage and obtain monitoring voltage data;

[0029] The second monitoring module is used to monitor the direction of the current at the input terminal using an independent ideal diode in the protection circuit, thereby obtaining the direction of the monitored current.

[0030] First fault isolation control module: used by the protection circuit to perform fault isolation control processing on the external power supply and low-voltage power supply according to the monitored voltage data and the monitored current direction;

[0031] The second fault isolation control module is used to perform fault isolation control processing on the entire power supply link faults in the eVTOL low-voltage distribution box based on a multi-level isolation redundancy architecture.

[0032] Optionally, the multi-level isolation redundancy architecture includes, in sequence, a multi-input power supply independent isolation module, a dual-bus independent isolation module, a power supply merging fault isolation module, and an output circuit single-load isolation module.

[0033] In this invention, a multi-level isolation redundancy architecture is set up in the eVTOL low-voltage distribution box, and a protection circuit is set at the input end of the multi-level isolation redundancy architecture. The input end of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. This achieves fast response at the hardware level, and through the full-link isolation redundancy design, the fault is precisely limited to a local area, preventing the fault from spreading and improving the reliability of the system. The integrated positive and negative reverse connection protection, anti-static and surge protection can effectively resist various abnormal inputs. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating the end-to-end fault isolation control method for the eVTOL low-voltage distribution box in an embodiment of the present invention.

[0036] Figure 2 This is a schematic diagram of the structural composition of the end-to-end fault isolation control device for the eVTOL low-voltage distribution box in an embodiment of the present invention;

[0037] Figure 3 This is a structural composition view of the circuit corresponding to the eVTOL low-voltage distribution box in an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram of the structure of the overvoltage protection circuit in the protection circuit of this invention embodiment;

[0039] Figure 5 This is a schematic diagram of the structure of an ideal diode circuit in the protection circuit of this invention embodiment;

[0040] Figure 6 This is a schematic diagram of the structural composition of the dual-bus independent isolation module in an embodiment of the present invention;

[0041] Figure 7 This is a schematic diagram of the structural composition of the power merging fault isolation module in an embodiment of the present invention;

[0042] Figure 8 This is a schematic diagram of the structural composition of the single-load isolation module for the output circuit in an embodiment of the present invention;

[0043] Figure 9 This is a schematic diagram of the structure of the multi-input power supply-independent isolation module in an embodiment of the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Example 1, please refer to Figure 1 , Figure 1 This is a flowchart illustrating the end-to-end fault isolation control method for the eVTOL low-voltage distribution box in an embodiment of the present invention.

[0046] like Figure 1 As shown, a full-link fault isolation control method for an eVTOL low-voltage distribution box is applied to the eVTOL low-voltage distribution box. A multi-level isolation redundancy architecture is set in the eVTOL low-voltage distribution box, and a protection circuit is set at the input end of the multi-level isolation redundancy architecture. The input end of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture.

[0047] For details, please refer to Figure 3 , Figure 4 and Figure 5 ,in, Figure 3 A structural view of the circuit corresponding to the eVTOL low-voltage distribution box; Figure 4 A schematic diagram of the structure of an overvoltage protection circuit in a protection circuit; Figure 5 A schematic diagram of the structure of an ideal diode circuit in a protection circuit; Figure 3For example, the eVTOL low-voltage distribution box has five power supplies: one high-voltage power supply for the power battery, one external power supply, and three low-voltage power supplies for the low-voltage battery. The high-voltage and external power supplies both need to pass through the overvoltage protection circuit in the protection circuit before being connected to the ideal diode circuit. The low-voltage power supply is directly connected to the ideal diode circuit in the protection circuit. Therefore, the protection circuit has two overvoltage protection circuits and five ideal diode circuits. In this embodiment, the five ideal diode circuits are divided into two paths: three ideal diode circuits are connected in parallel as one path, and the other two are connected in parallel as the other path. These are then connected to a multi-level isolation redundancy architecture. This allows each external power supply to sequentially pass through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture, and each low-voltage power supply to pass through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture.

[0048] The high-voltage power supply and external power supply are significantly higher than the power supply voltage required by the eVTOL low-voltage distribution box. For example, the high-voltage power supply is 800V, therefore a high-voltage to low-voltage DC-DC converter is needed. By configuring the overvoltage protection circuit threshold, i.e., setting the threshold to 60V, when an abnormal power supply overvoltage occurs, it can automatically disconnect within 2μs to prevent the multi-level isolation redundancy architecture (bus voltage surge damage to the downstream DC-DC module and airborne equipment) from being impacted. At the same time, it integrates positive and negative reverse connection protection (-100V withstand voltage), as well as anti-static (±15kV air discharge) and surge protection (58V / 3000W) devices, comprehensively resisting damage to the system from abnormal inputs (see details). Figure 4 ).

[0049] The overvoltage protection circuit works by controlling the gate voltage of a pair of external N-channel MOSFETs to ensure the output remains within a safe operating range. This is achieved through a 100V overvoltage, undervoltage, and reverse connection protection controller (such as the ADI LTC4367). It uses two comparator inputs and an external resistor divider to set the overvoltage (OV) and undervoltage (UV) setpoints. The fault output indicates that the GATE pin will be pulled low when the device input voltage exceeds the UV (VUV: 0.5V) and OV (VOV: 0.5V) setpoints. Overvoltage protection is up to 100V, and the overvoltage protection voltage can be set (e.g., 60V) by adjusting the values ​​of R1~R3 ​​as needed.

[0050] The working principle of an ideal diode (see details) Figure 5When powered on, the load current initially flows through the main diode of the MOSFET, and the resulting forward high voltage is detected and captured by the IN and OUT pins of the power electronic switch chip, which simultaneously drives its GATE pin to reduce the forward high voltage of the MOSFET to 25mV. When the MOSFET is fully turned on, the load current increases so that its forward voltage drop is greater than 25mV, then the forward voltage is equal to RDS(ON)•ILOAD. Generally, a few mΩ internal resistance is selected when choosing a MOSFET.

[0051] If the load current decreases and the forward voltage drop drops below 25mV, the power electronic switch chip MOSFET will apply a slight pull-down to the GATE pin to keep the MOSFET forward voltage drop at 25mV. If the load current reverses and the voltage difference between the input IN and the output OUT is smaller than -25mV, the power electronic switch chip will pull the MOSFET's GATE low through a stronger pull-down to turn off the MOSFET and prevent current backflow.

[0052] In the event of a power supply failure, such as a sudden short circuit in a fully loaded power supply, a reverse current temporarily flows through the MOSFET. This current originates from any load capacitor or other power source. In this situation, the power electronic switching chip will respond quickly and turn off the MOSFET within approximately 500ns, thereby minimizing the interference of the faulty power supply on the output bus.

[0053] The method includes:

[0054] S101: The independent overvoltage protection circuit in the protection circuit monitors and processes the input voltage to obtain monitoring voltage data;

[0055] In the specific implementation of this invention, the input voltage is monitored and processed through an independent overvoltage protection circuit in the protection circuit, thereby obtaining the monitoring voltage data.

[0056] S102: The independent ideal diode in the protection circuit monitors the current direction at the input terminal to obtain the monitored current direction;

[0057] In the specific implementation of this invention, the direction of the current at the input terminal is monitored by an independent ideal diode in the protection circuit, thereby obtaining the direction of the monitored current.

[0058] S103: The protection circuit performs fault isolation control processing on the external power supply and low-voltage power supply based on the monitored voltage data and the monitored current direction.

[0059] In the specific implementation of this invention, the protection circuit can perform fault isolation control processing on the external power supply and low-voltage power supply according to the monitored voltage data and the monitored current direction, thereby realizing hardware-level overvoltage protection. It can cut off the abnormal power supply within 2μs, and the ideal diode can turn off the reverse current within 0.5μs. These hardware-level fast response mechanisms avoid the delay of traditional MCU control, realize the fast response of overvoltage / overcurrent protection, and meet the aerospace-grade real-time requirements.

[0060] S104: Based on a multi-level isolation and redundancy architecture, fault isolation and control are performed on the entire power supply link within the eVTOL low-voltage distribution box.

[0061] In the specific implementation of this invention, the multi-level isolation redundancy architecture sequentially includes a dual-bus independent isolation module, a power supply merging fault isolation module, and an output circuit single-load isolation module;

[0062] The multi-input power supply-independent isolation module is used to independently isolate input power supply faults. The multi-input power supply-independent isolation module includes an overvoltage protection circuit and an ideal diode circuit. The overvoltage protection circuit includes an overvoltage protection controller chip and an N-channel metal-oxide-semiconductor field-effect transistor. The ideal diode circuit includes an ideal diode controller chip and an N-channel metal-oxide-semiconductor field-effect transistor.

[0063] The dual busbar independent isolation module is used to independently isolate busbar faults. The dual busbar independent isolation module includes a manual switch, a DC-DC step-down voltage regulator circuit, a relay, an overvoltage protection circuit, and an ideal diode circuit.

[0064] The power merging fault isolation module is used to monitor the current direction and perform fault isolation based on the current direction. The power merging fault isolation module includes a DC-DC buck regulator circuit and an ideal diode circuit.

[0065] The output circuit single load isolation module is used to isolate faults in the output circuit load.

[0066] Furthermore, the two sets of busbars in the dual-busbar independent isolation module are mutually isolated, so that if either set of busbars fails, the other set of busbars will not affect the normal power supply of the eVTOL low-voltage distribution box.

[0067] Furthermore, each of the two sets of busbars is connected in series with a contactor, and the contactor is controlled to be closed or opened by the main power manual switch outside the eVTOL low-voltage distribution box; wherein the main power manual switch has 4 channels, and is divided into groups of 2 channels, with each group controlling one contactor.

[0068] Furthermore, when the main power manual switch is closed, it triggers the DC-DC circuits corresponding to the two busbars in the eVTOL low-voltage distribution box to start, supplying power to the coil magnetic contactor inside the corresponding contactor, so that the physical contacts of the coil magnetic contactor are closed; when the main power manual switch is open, the physical contacts of the coil magnetic contactor inside the corresponding contactor are open; wherein the main power manual switch and the contactor are both designed with dual redundancy, and the power supply of the contactor is two sets of independent and series-connected step-down voltage regulator modules and overvoltage protection modules.

[0069] Furthermore, the input terminal of the power merging fault isolation module is connected to the output terminal of the dual-bus independent isolation module. Within the power merging fault isolation module, a corresponding number of output loads are set according to the number of avionics devices. Each output load corresponds to one avionics device. Each output load within the power merging fault isolation module consists of an ideal diode and a step-down module connected in series.

[0070] Furthermore, the output circuit single load isolation module connects each output load in series with a fuse whose power matches that of the output load. When the current of the output load exceeds a preset value, the fuse connected in series will blow, thereby disconnecting the fault circuit corresponding to the output circuit single load isolation module.

[0071] For details, please refer to Figure 6 , Figure 7 , Figure 8 and Figure 9 The multi-level isolation redundancy architecture includes, in sequence, a multi-input power supply independent isolation module, a dual-bus independent isolation module, a power supply merging fault isolation module, and an output circuit single-load isolation module.

[0072] Figure 6 A schematic diagram of the structural composition of a dual-bus independent isolation module; Figure 7 This is a schematic diagram of the structural composition of the power merging fault isolation module; Figure 8 This is a schematic diagram of the structural composition of a single-load isolation module for the output circuit. Figure 9 This is a schematic diagram of the structure of a multi-input power supply - independent isolation module.

[0073] In this way, a complete isolation link of "detection-cutoff-isolation" is formed by multiple input power supply independent isolation modules, dual bus independent isolation modules, power supply merging fault isolation modules, and output circuit single load isolation modules, ensuring that the fault is accurately limited to a local area.

[0074] The working principle of the dual busbar input independent isolation module is as follows: the two busbars are mutually isolated, and a fault in either busbar does not affect the other busbar's independent power supply to the system. Two 100A contactors (one connected in series on each busbar) are simultaneously controlled by a "main power manual switch" (a mechanical hardware switch, four in total, with two switches combined into one group, each group controlling two contactors) located outside the low-voltage distribution box. (See details...) Figure 6 ).

[0075] For details on the control logic of the contactor, please refer to [link / reference]. Figure 6 The contactor coil power supply (e.g., 24VDC) is as follows: closing the "main power manual switch" outside the low-voltage distribution box triggers the corresponding DC-DC circuit inside the distribution box, providing power to the contactor's internal coil (e.g., 24VDC). The contactor's physical contacts are magnetically attracted, closing the contacts. Disconnecting the "main power manual switch" outside the low-voltage distribution box disconnects the contactor. Both the manual switch and the main contactor employ a dual-redundant independent design. The power supply (e.g., 24VDC) for the two contactor control coils each has two independent step-down and voltage-regulating modules, and an overvoltage protection barrier is added to each input channel to prevent external high voltage from burning out the contactor coil. When one set of manual switches fails, the other set can independently control the corresponding bus relay, ensuring at least one of the two busbars is powered normally.

[0076] The aforementioned contactor redundancy design ensures that the failure of any single point within the contactor control system of the low-voltage distribution box will not affect the normal power supply of all low-voltage equipment in the aircraft. The main parameters of the selected contactors are as follows: Maximum Switching Voltage: 750 Vd.c., Maximum Breaking Current: 1500A 750Vd.c., Contact Rating: 200 A (60 mm² cable). From the perspective of the "busbar level," the two sets of buses are independent and have no overlap, and there is no capacitive coupling between them. From the perspective of the "output terminal level," the two sets of buses are stepped down to the appropriate voltage by their respective independent DC-DC step-down units, and then combined into the same output voltage (such as 28V, 24V, 12V, or 5V) through ideal diodes. From this perspective, it can be said that the buses have a certain degree of indirect overlap, but this will not adversely affect the independence of the two sets of buses.

[0077] refer to Figure 7The input terminal of the power merging fault isolation module is connected to the output terminal of the dual-bus independent isolation module. The number of output loads corresponding to the number of avionics equipment is set in the power merging fault isolation module. Each output load corresponds to one avionics equipment. Each output load set in the power merging fault isolation module is an ideal diode and a step-down module connected in series.

[0078] refer to Figure 8 The single-load isolation module for the output circuit connects a fuse in series with the power of the output load for each output load. When the current of the output load exceeds the preset value, the fuse in series will blow. The fuse blowing time can be within 50ms, so the fault circuit corresponding to the single-load isolation module for the output circuit can be quickly disconnected.

[0079] refer to Figure 9 The multi-input power supply-independent isolation module is used to independently isolate input power supply faults. The multi-input power supply-independent isolation module includes an overvoltage protection circuit and an ideal diode circuit. The overvoltage protection circuit includes an overvoltage protection controller chip and an N-channel metal-oxide-semiconductor field-effect transistor (MOSFET). The ideal diode circuit includes an ideal diode controller chip and an N-channel metal-oxide-semiconductor field-effect transistor.

[0080] The overvoltage protection controller chip can be the LTC4367HMS8, and the N-channel metal-oxide-semiconductor field-effect transistor (MOSFET) can be the IPT015N10N5. The LTC4367HMS8 chip protects applications where the power supply input voltage may be too high. It ensures the output remains within a safe operating range by controlling the gate voltage of a pair of external N-channel MOSFETs. The LTC4367HMS8 chip can withstand voltages from -40V to 100V, operates from 2.5V to 60V, and consumes only 70µA during normal operation. The comparator input allows the overvoltage setpoint to be configured using an external resistor divider. A shutdown pin provides external control for enabling and disabling the MOSFETs and placing the device in a low-current shutdown state. A fault output indicates that the GATE pin is pulled low when the device is in a shutdown state or the input voltage exceeds the UV setpoint. Its performance specifications include a wide operating voltage range of 2.5V to 60V, overvoltage protection up to 100V, blocking of 50Hz and 60Hz AC power, a fault recovery time of 32ms, no input capacitor or transient voltage suppressor required for most applications, adjustable overvoltage threshold, control of back-to-back N-channel MOSFETs, low operating current of 70µA, low shutdown current of 5µA, and availability in 8-pin MSOP and 3mm x 3mm DFN packages.

[0081] The IPT015N10N5 metal-oxide-semiconductor field-effect transistor (MOSFET) is an advanced N-channel enhancement-mode power MOSFET designed for high-efficiency power conversion applications. It features low conduction losses, high switching speed, and excellent thermal performance, making it suitable for various low- and medium-voltage power electronics scenarios. It achieves extremely low on-resistance, effectively reducing conduction losses and improving system energy efficiency, making it particularly suitable for high-current applications. It has a short switching time (small turn-on / turn-off delay), supports high-frequency operating modes, reduces switching losses, and is suitable for circuits requiring high-frequency conversion (such as DC-DC converters and inverters). Its compact package (TO-220) provides good heat dissipation, facilitating system thermal management and supporting high power density designs. The ideal diode controller chip can be the LTC4367HMS8, and the N-channel MOSFET can be the IPT015N10N5.

[0082] The dual-bus independent isolation module includes a toggle switch, a DC-DC buck regulator circuit, relays, overvoltage protection circuitry, and an ideal diode circuit. The DC-DC buck regulator circuit includes a buck regulator chip, which can be the TPS54560. The TPS54560 is a 60 V, 5 A buck regulator with integrated high-side MOSFETs. This device can withstand load drop pulses up to 65 V compliant with ISO 7637 standards. Current-mode control provides simple external compensation and flexible component selection. Low-ripple pulse-skip mode reduces the no-load supply current to 146 μA. When the enable pin is pulled low, the shutdown current can be reduced to 2 μA. Undervoltage lockout is internally set at 4.3 V, but this value can be increased via the enable pin. The output voltage startup ramp is internally controlled for controlled startup and overshoot elimination. A wide switching frequency range optimizes efficiency or external component size. Output current is current-limited cycle-by-cycle. Frequency foldback and thermal shutdown protect internal and external components from overload. The TPS54560 is housed in an 8-pin thermally enhanced HSOIC PowerPAD package. The relay coil is powered by a corresponding DC-DC circuit, and overvoltage protection monitors the coil voltage, cutting off power within 2μs if it exceeds 30V to prevent contactor sticking.

[0083] The power supply merging fault isolation module includes a DC-DC buck regulator circuit and an ideal diode circuit. Each DC-DC buck regulator circuit is powered by its corresponding bus and operates independently. The voltages are then combined into a single output voltage by the ideal diode circuit to power the external load. If any bus in the power supply merging fault isolation module fails and loses voltage, or if any DC-DC buck regulator circuit malfunctions, it will be powered by another normal bus or another normally operating DC-DC buck regulator circuit. Simultaneously, due to the "reverse current blocking" characteristic of the ideal diode, the faulty bus or faulty DC-DC buck regulator circuit will not interfere with the normal bus or DC-DC buck regulator circuit, thus achieving fault isolation and ensuring that the power supply to the output load is unaffected. The DC-DC buck regulator circuit merges with the corresponding avionics load, and the ideal diode monitors the output current direction; reverse current is blocked within 0.5μs, achieving fault module isolation.

[0084] The output circuit single load isolation module is used to isolate the output circuit load from faults. Its core component includes a one-time surface mount fuse.

[0085] Each output voltage is connected in series with a one-time surface mount fuse to supply power to external avionics equipment. If any output voltage in the single load isolation module fails, such as due to a high current or short circuit to ground, the one-time surface mount fuse on the power supply channel will blow in a short time, disconnecting the faulty device from the power supply channel, thus playing a role in fault isolation and ensuring that the faulty device will not affect its power supply channel in reverse.

[0086] This disposable surface mount fuse can be made from the NANO2 Slo-Blo series fuse, a miniaturized time-delay fuse designed for electronic systems that require both overload protection and short-time pulse tolerance. With its compact size, precise protection features, and wide applicability, it has become a reliable overcurrent protection solution for various circuits.

[0087] Its core functional features are as follows: Time-delay protection: It possesses a precise time-delay fuse curve, capable of withstanding short-term pulse currents (such as instantaneous overcurrents during circuit startup or normal operation, including motor starting and capacitor charging), preventing false triggering of protection. Simultaneously, it rapidly fuses under sustained overload conditions, effectively protecting downstream components from damage. Miniaturized design: Adopting the NANO2 package standard, its compact size (typically surface mount) saves PCB space, adapting to high-density circuit designs and meeting the needs of consumer electronics, industrial control, and automotive electronics for miniaturized components. Wide current and voltage range: Covering a variety of rated currents (typically from hundreds of mA to several A) and voltage specifications (suitable for DC and AC scenarios), it can flexibly match the protection requirements of circuits with different power levels. High reliability and safety: Compliant with international safety standards (such as UL, IEC, etc.), it has stable fusing characteristics and strong breaking capacity, capable of rapidly disconnecting the circuit under fault current, cutting off the connection between the power supply and the load, and reducing the risk of fire and equipment damage. Wide range of applications: Suitable for circuits that need to withstand transient pulses, such as power adapters, motor drive modules, LED lighting systems, portable electronic devices, etc., providing overcurrent protection that "precisely responds and avoids malfunctions".

[0088] The following are examples of fault scenarios for end-to-end fault isolation:

[0089] Fault Scenario 1: Power Supply 1 Overvoltage (65V)

[0090] If an overvoltage occurs in "Input Power Supply 1" (e.g., 65V, exceeding the pre-set threshold of 60V for the overvoltage protection circuit), the "coordinated workflow of the multi-level isolation module" is as follows: a) The "LTC4367" in the overvoltage protection module of the protection circuit cuts off "Input Power Supply 1" within 2μs; b) Other input power supplies in bus 1 continue to supply power, the power supply of bus 1 is not affected, and bus 2 supplies power normally at the same time; c) The DC-DC converter in the power merging fault isolation module is normal, and the ideal diode remains conducting; d) The single-load isolation module of the output circuit has no overcurrent, and the one-time fuse does not blow; e) Ultimately, only the "Input Power Supply 1" circuit fails, without affecting other power supply links, and all avionics equipment such as flight control and servos are powered normally.

[0091] Fault Scenario 2: Power supply 2 experiences a short circuit to ground.

[0092] If a short-circuit fault to ground occurs in "Input Power Supply 2", the "coordinated workflow of the multi-level isolation module" is as follows: a) The "LTC4357HMS8#PBF" in the ideal diode circuit cuts off the reverse current path of "Input Power Supply 2" within 2μs; b) Other input power supplies in bus 2 continue to supply power, the power supply of bus 2 is not affected, and bus 1 is supplied normally at the same time; c) The DC-DC converter in the power merging fault isolation module is normal, and the ideal diode remains conducting; d) There is no overcurrent in the single-load isolation module of the output circuit, and the one-time fuse does not blow; e) In the end, only the "Input Power Supply 2" circuit fails, which does not affect other power supply links, and all avionics equipment such as flight control and servos are supplied normally.

[0093] Fault Scenario 3: Fault in channels 1 and 3 of the 4-channel manual toggle switch (cannot be closed)

[0094] If the first and third channels of the "4-way manual switch" fail, the "cooperative workflow of the multi-level isolation module" is as follows: a) If the first and third channels of the "4-way manual switch" fail, the remaining second and fourth channels can still continuously supply power to the DC-DC step-down circuit of the coils of relays 1 and 2; b) The coils of relays 1 and 2 can both receive a continuous 24V power supply, thus maintaining closed conduction, and the power supply to buses 1 and 2 is not affected; c) The DC-DC converter in the power merging fault isolation module is normal, and the ideal diode remains conducting; d) There is no overcurrent in the single-load isolation module of the output circuit, and the one-time fuse does not blow; e) Ultimately, only the first and third channels of the "4-way manual switch" fail, without affecting other power supply links, and all avionics equipment such as flight control and servos are powered normally.

[0095] Fault Scenario 4: Fault in "DC-DC1" of "Power Combination - Fault Isolation Module" (no 28V, output is 0V)

[0096] If the output of "DC-DC1" of the "Power Combining-Fault Isolation Module" is 0V, the "cooperative workflow of the multi-level isolation module" is as follows: a) The output of "DC-DC1" of the "Power Combining-Fault Isolation Module" is 0V, while DC-DC3 continuously outputs 28V. Due to the merging effect of the "ideal diodes" on the channel, DC-DC3 can independently assume the responsibility of 100% power supply to avionics equipment 1, without affecting the normal power supply of avionics equipment 1 by the low-voltage power distribution box; b) In the end, only the "DC-DC1" of the "Power Combining-Fault Isolation Module" fails, without affecting other power supply links, and all avionics equipment such as flight control and servos are powered normally.

[0097] The table below shows the test data for end-to-end fault isolation:

[0098]

[0099] In this embodiment of the invention, a multi-level isolation redundancy architecture is set in the eVTOL low-voltage distribution box, and a protection circuit is set at the input end of the multi-level isolation redundancy architecture. The input end of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. This achieves fast response at the hardware level, and through the full-link isolation redundancy design, the fault is precisely limited to a local area, preventing the fault from spreading and improving the reliability of the system. The integrated positive and negative reverse connection protection, anti-static and surge protection can effectively resist various abnormal inputs.

[0100] Example 2, please refer to Figure 2 , Figure 2 This is a schematic diagram of the structural composition of the full-link fault isolation control device for the eVTOL low-voltage distribution box in an embodiment of the present invention.

[0101] like Figure 2 As shown, a full-link fault isolation control device for an eVTOL low-voltage distribution box is applied to the eVTOL low-voltage distribution box. A multi-level isolation redundancy architecture is set within the eVTOL low-voltage distribution box, and a protection circuit is set at the input terminal of the multi-level isolation redundancy architecture. The input terminal of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. The device includes:

[0102] First monitoring module 201: Used by the independent overvoltage protection circuit in the protection circuit to monitor and process the input voltage and obtain monitoring voltage data;

[0103] The second monitoring module 202 is used to monitor the direction of the input current by an independent ideal diode in the protection circuit, and to obtain the direction of the monitored current.

[0104] First fault isolation control module 203: used by the protection circuit to perform fault isolation control processing on the external power supply and low voltage power supply according to the monitored voltage data and the monitored current direction;

[0105] The second fault isolation control module 204 is used to perform fault isolation control processing on the entire power supply link fault in the eVTOL low-voltage distribution box based on a multi-level isolation redundancy architecture.

[0106] In the specific implementation of this invention, the specific implementation of the device item can be referred to the implementation of the method item above, and will not be repeated here.

[0107] In this embodiment of the invention, a multi-level isolation redundancy architecture is set in the eVTOL low-voltage distribution box, and a protection circuit is set at the input end of the multi-level isolation redundancy architecture. The input end of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. This achieves fast response at the hardware level, and through the full-link isolation redundancy design, the fault is precisely limited to a local area, preventing the fault from spreading and improving the reliability of the system. The integrated positive and negative reverse connection protection, anti-static and surge protection can effectively resist various abnormal inputs.

[0108] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0109] Furthermore, the above provides a detailed description of the full-link fault isolation control method and device for an eVTOL low-voltage distribution box provided by the embodiments of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for end-to-end fault isolation control of an eVTOL low-voltage distribution box, characterized in that, The method is applied to an eVTOL low-voltage distribution box, which contains a multi-level isolation redundancy architecture. A protection circuit is provided at the input of the multi-level isolation redundancy architecture. The input of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. The method includes: The independent overvoltage protection circuit in the protection circuit monitors and processes the input voltage to obtain monitoring voltage data. The independent ideal diode in the protection circuit monitors the current direction at the input terminal to obtain the monitored current direction; The protection circuit performs fault isolation control on the external power supply and low-voltage power supply based on the monitored voltage data and the monitored current direction. Based on a multi-level isolation and redundancy architecture, fault isolation and control are performed on the entire power supply link within the eVTOL low-voltage distribution box. The multi-level isolation redundancy architecture includes, in sequence, a multi-input power supply independent isolation module, a dual-bus independent isolation module, a power supply merging fault isolation module, and an output circuit single-load isolation module. The input terminal of the power supply merging fault isolation module is connected to the output terminal of the dual-bus independent isolation module. The number of output loads in the power supply merging fault isolation module is set according to the number of avionics equipment. The multi-input power supply-independent isolation module is used to independently isolate input power supply faults; The dual busbar independent isolation module is used to independently isolate busbar faults; The power merging fault isolation module is used to monitor the current direction and perform fault isolation based on the current direction; The output circuit single load isolation module is used for fault isolation of the output circuit load; The two sets of buses in the dual busbar independent isolation module are isolated from each other. When either set of buses fails, it does not affect the other set of buses from independently supplying power to the eVTOL low-voltage distribution box. Each of the two busbars is connected in series with a contactor, and the contactor is controlled to be closed or opened by the main power manual switch outside the eVTOL low-voltage distribution box; wherein the main power manual switch has 4 channels, and is divided into groups of 2 channels, with each group controlling one contactor.

2. The end-to-end fault isolation and control method according to claim 1, characterized in that, The protection circuit performs fault isolation control processing on the external power supply and low-voltage power supply based on the monitored voltage data and the monitored current direction, including: When the overvoltage protection circuit in the protection circuit confirms that the monitored voltage data is greater than the set protection voltage, it performs hardware-level rapid disconnection of the abnormal power supply to achieve fault isolation and control processing of the abnormal power supply. When the ideal diode in the protection circuit confirms that the direction of the monitored current is reverse, the ideal diode blocks the reverse current, thereby achieving fault isolation and control of the abnormal power supply.

3. The end-to-end fault isolation and control method according to claim 1, characterized in that, When the main power manual switch is closed, it triggers the DC-DC circuits corresponding to the two busbars in the eVTOL low-voltage distribution box to start, supplying power to the coil magnetic contactor inside the corresponding contactor, so that the physical contacts of the coil magnetic contactor are closed; when the main power manual switch is opened, the physical contacts of the coil magnetic contactor inside the corresponding contactor are opened; wherein the main power manual switch and the contactor are both designed with dual redundancy, and the power supply of the contactor is two sets of independent and series-connected step-down voltage regulator modules and overvoltage protection modules.

4. The end-to-end fault isolation and control method according to claim 1, characterized in that, Each output load corresponds to an avionics device, wherein each output load in the power merging fault isolation module is an ideal diode and a step-down module connected in series.

5. The end-to-end fault isolation and control method according to claim 1, characterized in that, The output circuit single load isolation module consists of a fuse connected in series with each output load, the power of which matches the output load. When the current of the output load exceeds a preset value, the fuse connected in series will blow, thereby disconnecting the fault circuit corresponding to the output circuit single load isolation module.

6. A full-link fault isolation control device for an eVTOL low-voltage distribution box, characterized in that, This device is applied to an eVTOL low-voltage distribution box. A multi-level isolation redundancy architecture is provided within the eVTOL low-voltage distribution box, and a protection circuit is provided at the input terminal of the multi-level isolation redundancy architecture. The input terminal of the protection circuit is connected to at least one external power supply and at least one low-voltage power supply. Each external power supply passes through an independent overvoltage protection circuit and an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. Each low-voltage power supply passes through an independent ideal diode in the protection circuit before being connected to the multi-level isolation redundancy architecture. The device includes: First monitoring module: used by the independent overvoltage protection circuit in the protection circuit to monitor and process the input voltage and obtain monitoring voltage data; The second monitoring module is used to monitor the direction of the current at the input terminal using an independent ideal diode in the protection circuit, thereby obtaining the direction of the monitored current. First fault isolation control module: used by the protection circuit to perform fault isolation control processing on the external power supply and low-voltage power supply according to the monitored voltage data and the monitored current direction; The second fault isolation control module is used to perform fault isolation control processing on the entire power supply link faults in the eVTOL low-voltage distribution box based on a multi-level isolation redundancy architecture. The multi-level isolation redundancy architecture includes, in sequence, a multi-input power supply independent isolation module, a dual-bus independent isolation module, a power supply merging fault isolation module, and an output circuit single-load isolation module. The input terminal of the power supply merging fault isolation module is connected to the output terminal of the dual-bus independent isolation module. The number of output loads in the power supply merging fault isolation module is set according to the number of avionics equipment. The multi-input power supply-independent isolation module is used to independently isolate input power supply faults; The dual busbar independent isolation module is used to independently isolate busbar faults; The power merging fault isolation module is used to monitor the current direction and perform fault isolation based on the current direction; The output circuit single load isolation module is used for fault isolation of the output circuit load; The two sets of buses in the dual busbar independent isolation module are isolated from each other. When either set of buses fails, it does not affect the other set of buses from independently supplying power to the eVTOL low-voltage distribution box. Each of the two busbars is connected in series with a contactor, and the contactor is controlled to be closed or opened by the main power manual switch outside the eVTOL low-voltage distribution box; wherein the main power manual switch has 4 channels, and is divided into groups of 2 channels, with each group controlling one contactor.

Images