Redundant high voltage distribution box for electric vertical take-off and landing aircraft and control method thereof

Abstract

The application relates to a redundant high-voltage distribution box for an electric vertical take-off and landing aircraft and a control method thereof. The distribution box comprises a central controller and first and second high-voltage distribution branches which are independent of each other; each branch is sequentially provided with a Hall current sensor, a positive fuse, an input-side high-voltage node, a main contactor and an output-side high-voltage node along the output direction of the corresponding battery pack, a pre-charging contactor and a pre-charging resistor are connected in series to form a pre-charging circuit which is parallel to the main contactor, and the output-side high-voltage node is connected to a plurality of load output ends through a plurality of load fuses. The central controller centrally monitors the two branches and performs fault identification and branch isolation when overcurrent, short circuit or contactor abnormality occurs in any branch, and the power supply is maintained by the other branch. The application combines independent configuration and centralized control of the double high-voltage power paths, avoids the loss of power of all high-voltage loads caused by the failure of a single branch, and improves the power supply continuity, fault isolation capability, operation reliability and flight safety.

Description

Technical Field

[0001] This invention relates to the field of electric vertical takeoff and landing (EVTOL) aircraft, and in particular to a redundant high-voltage power distribution box and its control method for EVTOL aircraft. Background Technology

[0002] With the rapid development of urban air mobility, electric vertical takeoff and landing (eVTOL) aircraft are placing higher demands on their high-voltage power distribution systems. To reduce the weight and power loss of wiring harnesses caused by high current, eVTOL aircraft generally adopt 400V to 800V high-voltage DC platforms, with some models even evolving towards 1000V high-voltage architectures. Simultaneously, manned flight scenarios require power distribution systems to possess multiple fault protection capabilities; any single point of failure must not lead to system malfunction or endanger crew safety. Furthermore, eVTOLs are weight-sensitive; every additional kilogram of weight directly reduces range and payload capacity. Therefore, the power distribution system faces the challenge of high integration while maintaining full functionality. In terms of intelligent management, the power distribution system also needs to monitor the electrical status of each branch in real time, achieving fault self-diagnosis, self-isolation, and information reporting to support rapid fault location by ground maintenance personnel.

[0003] In existing technologies, eVTOL high-voltage power distribution mostly employs discrete relay solutions and traditional fuse solutions. These solutions suffer from drawbacks such as large size, decentralized control, slow fault response, and lack of intelligent diagnostics. Especially when the battery pack is the sole energy source, the redundancy design of existing power distribution paths is insufficient to meet flight safety requirements. Summary of the Invention

[0004] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a redundant high-voltage power distribution box and its control method for electric vertical take-off and landing aircraft. By adopting a redundant high-voltage power distribution box architecture, the continuous safe operation of the electric vertical take-off and landing aircraft under single-point failure conditions is realized, which significantly improves the reliability and safety of the aircraft's electrical system.

[0005] To achieve the above objectives, the present invention adopts the following technical solution.

[0006] In a first aspect, the present invention provides a redundant high-voltage power distribution box for an electric vertical takeoff and landing aircraft, which adopts the following technical solution: Central controller; In the first high-voltage distribution branch, a first Hall current sensor and a first active fuse are sequentially arranged along the output direction of the first battery pack. The output terminal of the first active fuse forms a first input-side high-voltage node. A first main contactor is connected between the first input-side high-voltage node and the first output-side high-voltage node. A first pre-charge contactor and a first pre-charge resistor are connected in series to form a first pre-charge circuit. The first pre-charge circuit is connected in parallel with the first main contactor. The first output-side high-voltage node is connected to multiple load output terminals via multiple load fuses. The second high-voltage distribution branch is provided with a second Hall current sensor and a second active fuse in sequence along the output direction of the second battery pack. The output terminal of the second active fuse forms a second input-side high-voltage node. A second main contactor is connected between the second input-side high-voltage node and the second output-side high-voltage node. A second pre-charge contactor and a second pre-charge resistor are connected in series to form a second pre-charge circuit. The second pre-charge circuit is connected in parallel with the second main contactor. The second output-side high-voltage node is connected to multiple load output terminals through multiple load fuses. The first high-voltage power distribution branch and the second high-voltage power distribution branch are independent of each other in the high-voltage power path, and share the central controller for centralized control.

[0007] Furthermore, in the aforementioned redundant high-voltage distribution box, the central controller includes: The high-voltage sampling module is used to collect the node voltages of the first input-side high-voltage node, the first output-side high-voltage node, the second input-side high-voltage node, the second output-side high-voltage node, and the load side of each load fuse; A low-voltage sampling module is used to acquire the output signals of the first Hall current sensor and the second Hall current sensor; and An active fuse driver module is used to drive the first active fuse and the second active fuse respectively.

[0008] Furthermore, in the aforementioned redundant high-voltage distribution box, the central controller also includes: A first relay control module is used to control the first main contactor and the first precharge contactor; and The second relay control module is used to control the second main contactor and the second precharge contactor.

[0009] Furthermore, in the aforementioned redundant high-voltage distribution box, the central controller also includes: Flash storage modules are used to store operational and fault data; and The CAN communication module is used to communicate with the battery management system or the overall controller.

[0010] Furthermore, in the aforementioned redundant high-voltage distribution box, the first output-side high-voltage node is connected to the first load, the second load, and the third load via the first load fuse, the second load fuse, and the third load fuse, respectively, and a corresponding high-voltage sampling node is formed on the load side of each load fuse; the second output-side high-voltage node is connected to the fourth load, the fifth load, and the sixth load via the fourth load fuse, the fifth load fuse, and the sixth load fuse, respectively, and a corresponding high-voltage sampling node is formed on the load side of each load fuse.

[0011] Secondly, the control method provided by the present invention adopts the following technical solution: A control method for a redundant high-voltage distribution box as described in any one of the first aspects above, comprising: During system initialization, the central controller completes the low-voltage circuit initialization test, keeps all main contactors and pre-charge contactors in the open state, and keeps the trigger output of each active fuse in the disabled state. High-voltage node status confirmation: Before closing the pre-charge contactor, collect the input side, output side and load side node voltages of each branch to determine whether the battery pack is connected and whether there is contactor sticking or reverse high voltage on the load side. Pre-charge control is implemented for the first high-voltage distribution branch and the second high-voltage distribution branch, respectively. During pre-charge, the corresponding main contactor is kept open while the corresponding pre-charge contactor is closed, allowing the battery pack to be current-limited charged to the output high-voltage node and the input capacitor of the load via the pre-charge resistor; and When the main contactor is closed, and the output voltage reaches a preset ratio of the input voltage and the pre-charge current decays to below a preset threshold, the corresponding main contactor is closed and the corresponding pre-charge contactor is opened.

[0012] Furthermore, the above control methods also include: During the pre-charging process, the central controller calculates the equivalent loop resistance based on the input voltage, output voltage, and branch current. The accumulated charge is obtained by integrating the pre-charge current over time, and the equivalent load capacitance is calculated based on the output voltage increment; and Based on the equivalent loop resistance and the equivalent load capacitance, a predicted voltage rise curve and a predicted current decay curve are generated, and the residual between the measured curve and the predicted curve is used as the pre-charge state criterion.

[0013] Furthermore, the above control methods also include: operation monitoring and fault diagnosis. Collect the input and output voltages of each branch, and monitor the voltage difference and voltage drops exceeding the preset range; Collect the voltage on the load side of each load fuse and compare it with the corresponding output side voltage to identify whether the load fuse is blown or there is a fault in the output line; and The output of each Hall current sensor is collected to monitor the overcurrent and current change rate of each branch when they exceed the preset threshold.

[0014] Furthermore, the above control method also includes: graded protection. When a pre-charge timeout, contactor malfunction, or overcurrent exceeding the first overcurrent threshold is detected, the main contactor and pre-charge contactor of the corresponding branch are disconnected; and When the branch current exceeds the second overcurrent threshold, or when the branch current rise rate exceeds the preset rise rate threshold and the input or output voltage drops abnormally, the corresponding active fuse is triggered and the corresponding main contactor and precharge contactor are disconnected, wherein the second overcurrent threshold is greater than the first overcurrent threshold.

[0015] Furthermore, the above control method also includes: for cases where short-circuit characteristics are detected but the instantaneous disconnection threshold is not reached: First, a disconnect command is sent to the corresponding main contactor and the isolation confirmation time window is activated; If the branch current decays to a preset safe current threshold and a preset disconnection voltage difference is formed between the input and output sides within the time window, the contactor is deemed to have successfully isolated the circuit, and the active fuse is not triggered; and If the branch current does not decay or the input / output nodes remain conductive, the corresponding active fuse will be triggered.

[0016] In summary, compared with the prior art, the present invention has at least one of the following beneficial technical effects: The redundant high-voltage power distribution box of this invention sets up two independent high-voltage power distribution branches on the high-voltage power path, so that when one branch fails, the other branch can still operate independently, thereby ensuring the continuous power supply capability of the electric vertical takeoff and landing (EVTOL) aircraft and meeting aviation-grade safety redundancy requirements. Simultaneously, the two branches share a central controller for centralized control, simplifying the system architecture and reducing overall weight and cost while achieving redundant power distribution. The configuration of Hall current sensors and active fuses in each branch enables real-time monitoring of branch current and rapid fault disconnection. The parallel design of the main contactor and pre-charge circuit ensures safe pre-charging of the load capacitor when the system is powered on, avoiding damage to the contactor and battery pack from high-current surges, thus comprehensively improving the reliability, safety, and fault tolerance of the EVTOL aircraft's electrical system. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A schematic diagram of the electrical structure of a redundant high-voltage power distribution box for an electric vertical takeoff and landing aircraft according to an embodiment of the present disclosure is shown.

[0019] Figure 2 A flowchart of a control method for a redundant high-voltage distribution box according to an embodiment of the present disclosure is shown.

[0020] Figure 3 A flowchart of precharge prediction and state criterion in a precharge control method according to an embodiment of the present disclosure is shown.

[0021] Figure 4 A flowchart of an operation monitoring and graded protection method according to an embodiment of the present disclosure is shown. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Furthermore, it should be understood that the specific embodiments described herein are only for illustration and explanation of this application and are not intended to limit this application.

[0023] It should be noted that the order of description of the following embodiments is not intended to limit the preferred order of the embodiments of this application. Furthermore, the descriptions of each embodiment in the following embodiments have their own emphasis; for parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0024] The method steps described in this embodiment of the invention can be executed in the order described in the specific implementation, or the execution order of each step can be adjusted according to actual needs, provided that the technical problem can be solved. These are not listed one by one here.

[0025] The present invention will be further described in detail below with reference to the accompanying drawings.

[0026] Reference Figure 1 An embodiment of the present invention provides a redundant high-voltage power distribution box for an electric vertical take-off and landing aircraft, comprising a central controller, a first high-voltage power distribution branch, and a second high-voltage power distribution branch.

[0027] The first and second high-voltage power distribution branches are independent of each other in the high-voltage power path. The first high-voltage power distribution branch is connected to the first battery pack BAT1 and its corresponding load group, and the second high-voltage power distribution branch is connected to the second battery pack BAT2 and its corresponding load group. Each of the two high-voltage power distribution branches is equipped with its own main contactor, pre-charge contactor, pre-charge resistor, and active fuse, enabling each branch to perform pre-charge, power-on, and fault disconnection operations independently. In some embodiments, when one branch fails, the other branch can still operate independently, thereby ensuring the continuous power supply capability of the electric vertical takeoff and landing aircraft.

[0028] The central controller includes an MCU and multiple functional modules connected to the MCU. The first and second high-voltage distribution branches share the central controller for centralized control. The central controller centrally controls and monitors the pre-charging, power-on, node voltage, current, contactors, and active fuses of both branches. In some implementations, by configuring the two high-voltage power branches independently while sharing the central controller, the redundant high-voltage distribution box simplifies the system architecture while achieving redundant power distribution.

[0029] As described above, the redundant high-voltage distribution box includes a first high-voltage distribution branch and a second high-voltage distribution branch that are independent of each other on the high-voltage power path. See below for reference. Figure 1 The specific structure of the two high-voltage power distribution branches is described in detail.

[0030] A first Hall current sensor (Hall) and a first active fuse (SQ1) are sequentially installed along the output direction of the first battery pack (BAT1) in the first high-voltage distribution branch. The first Hall current sensor (Hall) is used to detect the current flowing through the first high-voltage distribution branch. The output terminal of the first active fuse (SQ1) forms the first input-side high-voltage node HVX1. A first main contactor (K1) is connected between the first input-side high-voltage node HVX1 and the first output-side high-voltage node HVX2. A first pre-charge contactor (K2) and a first pre-charge resistor (R1) are connected in series to form a first pre-charge circuit, which is connected in parallel with the first main contactor (K1). In some embodiments, the first pre-charge circuit is used to perform current-limited charging of the load-side capacitor when the system is powered on to avoid large current surges. The first output-side high-voltage node HVX2 is connected to the first load LoadX1, the second load LoadX2, and the third load LoadX3 via the first load fuse (F1), the second load fuse (F2), and the third load fuse (F3), respectively. A first high-voltage sampling node HV_LoadX1 is formed on the load side of the first load fuse F1, a second high-voltage sampling node HV_LoadX2 is formed on the load side of the second load fuse F2, and a third high-voltage sampling node HV_LoadX3 is formed on the load side of the third load fuse F3.

[0031] The structure of the second high-voltage distribution branch is symmetrical to that of the first high-voltage distribution branch. Along the output direction of the second battery pack BAT2, the second high-voltage distribution branch sequentially includes a second Hall current sensor (Hall) and a second active fuse (SQ2). The second Hall current sensor (Hall) is used to detect the current flowing through the second high-voltage distribution branch. The output terminal of the second active fuse (SQ2) forms the second input-side high-voltage node HVY1. The second main contactor (K3) is connected between the second input-side high-voltage node HVY1 and the second output-side high-voltage node HVY2. The second pre-charge contactor (K4) and the second pre-charge resistor (R2) are connected in series to form a second pre-charge circuit, which is connected in parallel with the second main contactor (K3). The second output-side high-voltage node HVY2 is connected to the fourth load (LoadY1), fifth load (LoadY2), and sixth load (LoadY3) via the fourth load fuse (F4), fifth load fuse (F5), and sixth load fuse (F6), respectively. A fourth high-voltage sampling node HV_LoadY1 is formed on the load side of the fourth load fuse F4, a fifth high-voltage sampling node HV_LoadY2 is formed on the load side of the fifth load fuse F5, and a sixth high-voltage sampling node HV_LoadY3 is formed on the load side of the sixth load fuse F6.

[0032] In some implementations, the high-voltage sampling nodes on the load side of each load fuse are used to monitor the voltage status of the corresponding load branch, so that the central controller can identify whether the load fuse has blown or the output line is faulty. In some implementations, the first high-voltage distribution branch and the second high-voltage distribution branch each independently supply power to the corresponding load group, and when one branch fails, the other branch can still operate independently.

[0033] Reference Figure 1 The internal module structure of the central controller includes a power processing module, a high-voltage sampling module, a low-voltage sampling module, an active fuse drive module, a first relay control module, a second relay control module, a FLASH storage module, and a CAN communication module.

[0034] The power supply module provides operating power to the MCU and various functional modules after the central controller is connected to an external low-voltage power supply. In some implementations, the power supply module performs voltage regulation and filtering on the external low-voltage power supply to ensure the power supply stability of the MCU and various functional modules.

[0035] The high-voltage sampling module is used to collect the node voltages of the first input-side high-voltage node HVX1, the first output-side high-voltage node HVX2, the second input-side high-voltage node HVY1, the second output-side high-voltage node HVY2, and the load-side node voltages of each load fuse. In some embodiments, the high-voltage sampling module collects the voltages of the first high-voltage sampling node HV_LoadX1, the second high-voltage sampling node HV_LoadX2, the third high-voltage sampling node HV_LoadX3, the fourth high-voltage sampling node HV_LoadY1, the fifth high-voltage sampling node HV_LoadY2, and the sixth high-voltage sampling node HV_LoadY3. By collecting the node voltages of each input-side, output-side, and load-side node, the central controller can monitor the input voltage, output voltage, voltage difference, and abnormal voltage drops of the two branches, and identify load fuse blowouts or output line faults.

[0036] The low-voltage sampling module is used to acquire the output signals of the first Hall current sensor (Hall) and the second Hall current sensor (Hall). In some embodiments, the low-voltage sampling module also acquires low-voltage signals from within the central controller. By acquiring the output signals of the Hall current sensors, the central controller can monitor the current, overcurrent, and rate of change of current in each branch.

[0037] The active fuse drive module is used to drive the first active fuse SQ1 and the second active fuse SQ2 respectively. In some embodiments, when the branch current exceeds a preset severe overcurrent threshold, or when the branch simultaneously exhibits short-circuit characteristics such as a rapid current rise and an abnormal voltage drop on the input or output side, the central controller triggers the corresponding active fuse through the active fuse drive module to achieve rapid disconnection of the severe fault.

[0038] The first relay control module controls the first main contactor K1 and the first precharge contactor K2. The second relay control module controls the second main contactor K3 and the second precharge contactor K4. In some embodiments, the central controller issues closing or opening commands to each main contactor and precharge contactor through the first and second relay control modules, respectively, to achieve independent precharge, power-on, and fault disconnection control of the two high-voltage power distribution branches.

[0039] The FLASH storage module is used to store operational and fault data. In some implementations, the FLASH storage module uses a circular cache method to continuously store the state vector before the fault occurs, and continues to store data for a preset time after the fault is triggered, to form a fault event record containing pre-fault data, post-fault data, identification parameters, flight phases, and the sequence of protection actions. In some implementations, the FLASH storage module also stores the equivalent loop resistance, equivalent load capacitance, pre-charge time, and trajectory residual reference formed during normal pre-charge of each branch, for parameter normalization processing and health reference updates in subsequent pre-charge processes.

[0040] The CAN communication module is used to communicate with the battery management system or the overall controller. In some implementations, the central controller receives flight phase, branch allowable power, and load priority information via the CAN communication module, and sends contactor control status, branch current, voltage of each high-voltage node, and fault codes. In some implementations, when the system self-test fails, the central controller reports fault information via the CAN communication module.

[0041] Based on the aforementioned redundant high-voltage distribution box, this embodiment of the invention also provides a control method.

[0042] Figure 2 A flowchart of a control method 200 for a redundant high-voltage switchgear box according to an embodiment of the present disclosure is shown. Figure 2 As shown, the control method 200 includes a system initialization step 202, a high-voltage node status confirmation step 204, a pre-charge control step 206, a pre-charge completion determination step 208, a main contactor closing step 210, and a continued pre-charge step 212.

[0043] In step 202, the central controller completes the low-voltage circuit initialization test and keeps all main contactors and pre-charge contactors in the open state, and keeps the trigger outputs of all active fuses in the disabled state. In some embodiments, after the central controller is connected to an external low-voltage power supply, the power processing module provides operating power to the MCU and various functional modules. After the MCU completes initialization, it performs a low-voltage self-test, including checking whether the low-voltage power supply and low-voltage sampling signal are within the preset valid range, checking the read and write functions of the FLASH storage module, and checking whether the CAN communication module can transmit and receive normally. In some embodiments, the zero-point or bias calibration of the high-voltage sampling channel and the first Hall current sensor Hall and the second Hall current sensor Hall is completed during system initialization. In some embodiments, the central controller reads the equivalent loop resistance, equivalent load capacitance, pre-charge time, and trajectory residual reference formed by the most recent normal pre-charges of the corresponding branch from the FLASH storage module, and normalizes the reference parameters according to the current input voltage. When the self-test fails, the central controller prohibits the pre-charge and power-on operations of the corresponding high-voltage branch and reports fault information through the CAN communication module.

[0044] Step 204 is the high-voltage node status confirmation. Before closing the pre-charge contactor, the central controller collects the input-side, output-side, and load-side node voltages of each branch through the high-voltage sampling module to determine whether the battery pack is connected and whether there is contactor sticking or reverse high voltage on the load side. In some embodiments, since the first input-side high-voltage node HVX1 and the second input-side high-voltage node HVY1 are located after the first active fuse SQ1 and the second active fuse SQ2, respectively, and before the main contactor and the pre-charge contactor, when the corresponding battery pack is connected and the active fuse is conducting, the first input-side high-voltage node HVX1 and the second input-side high-voltage node HVY1 reflect the output voltages of the first battery pack BAT1 and the second battery pack BAT2, respectively. In some embodiments, when the first main contactor K1, the first pre-charge contactor K2, the second main contactor K3, and the second pre-charge contactor K4 are all open and there is no external reverse power supply, the first output-side high-voltage node HVX2, the second output-side high-voltage node HVY2, and the high-voltage sampling nodes on the load side of each load fuse are in a low-voltage state. The central controller determines whether the battery pack is connected, whether the active fuse circuit is abnormal, and whether there is contactor sticking or reverse high voltage on the load side when the contactor is open, based on the above node voltages. In some implementations, if the node status of a certain path does not meet the preset conditions, precharging of that path is prohibited; another branch, when its own status is normal and the system does not require overall power-down, independently enters the subsequent control steps.

[0045] In step 206, the central controller performs pre-charge control on the first and second high-voltage distribution branches respectively. During pre-charge, the corresponding main contactor is kept open and the corresponding pre-charge contactor is closed, allowing the battery pack to be charged to the high-voltage node on the output side and the input capacitor of the load through the pre-charge resistor with current limitation. The detailed process of the pre-charge control is described in the following section on pre-charge control and prediction criteria, and will not be repeated here.

[0046] Step 208 is the pre-charge completion determination. The central controller determines whether the output voltage has reached a preset ratio of the input voltage and whether the pre-charge current has decreased to below a preset threshold. In some embodiments, the preset ratio is 98%, and the specific value is determined based on the battery voltage, load capacitance, and contactor parameters. If the determination result of step 208 is yes, then step 210 is executed; if the determination result is no, then step 212 is executed.

[0047] In step 210, when the output voltage reaches a preset ratio of the input voltage and the pre-charge current decays to below a preset threshold, the central controller closes the corresponding main contactor and opens the corresponding pre-charge contactor to complete the pre-charge. The detailed process of the main contactor closing control is described in the following section on main contactor closing control, and will not be repeated here.

[0048] In step 212, if the output voltage does not reach the preset ratio of the input voltage or the pre-charge current does not decay to below the preset threshold, the central controller maintains the pre-charge contactor closed and continues current-limited charging and monitoring until the pre-charge completion condition is met or a pre-charge abnormality is detected.

[0049] The pre-charge control step 206 in the above control method 200 involves the specific process of pre-charge prediction and state criterion. Figure 3 A flowchart of a precharge control method 300 according to an embodiment of the present disclosure is shown. As described above, during precharge, the corresponding main contactor is kept open and the corresponding precharge contactor is closed, so that the battery pack is current-limited charged to the high-voltage node on the output side and the input capacitor of the load through the precharge resistor.

[0050] In step 302, during the pre-charging process, the central controller collects the input-side voltage, output-side voltage, and branch current in real time according to a preset sampling period. For the first high-voltage distribution branch, the central controller collects the voltage of the first input-side high-voltage node HVX1 as the input-side voltage U. in The voltage of the first output-side high-voltage node HVX2 is collected as the output-side voltage U. out The central controller acquires the branch current I by sampling the output signal of the first Hall current sensor Hall through a low-voltage sampling module. For the second high-voltage distribution branch, the central controller acquires the voltage of the second input-side high-voltage node HVY1 as the input-side voltage, acquires the voltage of the second output-side high-voltage node HVY2 as the output-side voltage, and acquires the output signal of the second Hall current sensor Hall to obtain the branch current.

[0051] Step 304 calculates the equivalent loop resistance based on the input voltage, output voltage, and branch current. When the current is within the effective identification range, the central controller calculates the equivalent loop resistance R according to the following formula. eq : ; Among them U in U is the input-side voltage. out I is the output voltage, and I is the branch current.

[0052] Step 306 integrates the pre-charge current over time to obtain the accumulated charge, and calculates the equivalent load capacitance based on the output voltage increment. The central controller integrates the pre-charge current over time to obtain the accumulated charge Q: ; Where I k Let Δt be the current value in the kth sampling period, and Δt be the sampling period.

[0053] The central controller calculates the equivalent load capacitance C based on the accumulated charge and the output voltage increment. eq : ; Where U0 is the initial value of the output side voltage when pre-charging begins.

[0054] In step 308, the central controller determines the equivalent loop resistance R. eq and equivalent load capacitance C eq A predicted voltage rise curve and a predicted current decay curve are generated. These curves reflect the expected trajectory of the precharge process under the current equivalent loop parameters.

[0055] Step 310 calculates the residual between the measured curve and the predicted curve, and uses the residual as the pre-charge state criterion. The central controller compares the measured voltage rise trajectory and current decay trajectory with the predicted trajectory, and calculates the deviation between the two as the residual.

[0056] In step 312, the central controller determines whether the residual is within a preset range. If the residual is within the preset range, step 314 is executed to determine that the pre-charge is normal and the main process continues. If the residual exceeds the preset range, step 316 is executed to determine that the pre-charge is abnormal and triggers the corresponding protection.

[0057] In some implementations, the central controller uses sliding window, median filtering, or recursive estimation methods during the pre-charging process to suppress contactor action transients and sampling noise, thereby improving the identification accuracy of equivalent loop resistance and equivalent load capacitance.

[0058] In some implementations, the central controller performs pre-charge anomaly diagnosis based on the variation characteristics of the equivalent loop resistance and equivalent load capacitance. When the equivalent loop resistance R... eq When the voltage continues to increase and the rate of increase of the output voltage is lower than the predicted range, the central controller determines that there is high resistance degradation in the pre-charge resistor, contactor contacts, or connection parts. When the equivalent load capacitance C... eq When the current is significantly lower than the historical baseline, the central controller determines that the load is not connected, the load fuse is open, or the load input capacitor is abnormal. When the precharge current is consistently higher than the predicted value and the output voltage rises slowly, the central controller determines that there is a risk of leakage or short circuit on the load side.

[0059] In some implementations, the central controller determines that pre-charging is complete when the output voltage reaches a preset proportion of the input voltage and the pre-charge current decays to below a preset threshold. The preset proportion is, for example, 98%, and the specific value is determined based on the battery voltage, load capacitance, and contactor parameters.

[0060] The aforementioned pre-charge control method 300 describes the online identification of the equivalent loop resistance and equivalent load capacitance during the pre-charge process, as well as the generation of pre-charge state criteria. After the pre-charge process meets the completion conditions, the central controller executes the main contactor closing control to complete the system power-on.

[0061] As described above, when the output voltage reaches a preset ratio of the input voltage and the pre-charge current decays to below a preset threshold, the central controller closes the corresponding main contactor and opens the corresponding pre-charge contactor. In some embodiments, the preset ratio is 98%, and the specific value is determined based on the battery voltage, load capacitance, and contactor parameters.

[0062] In addition to voltage ratio and pre-charge current conditions, the central controller also uses the online-identified equivalent load capacitance C. eq The expected charge transfer amount Q is calculated based on the voltage difference ΔU before the main contactor closes. close And the expected impact energy E close The expected charge transfer amount Q close Calculate using the following formula: .

[0063] Expected impact energy E close Calculate using the following formula: ; Where C eq For online identification of the equivalent load capacitance, ΔU is the voltage difference between the input side voltage and the output side voltage before the main contactor is closed.

[0064] In some implementations, the central controller, based on the voltage ratio and pre-charge current conditions, further determines the expected charge transfer amount Q. close And the expected impact energy E close Whether the values ​​are below the corresponding allowable thresholds for the main contactor and busbar. In some implementations, the central controller also determines whether the measured trajectory residual is continuously within the allowable envelope. The central controller only allows the main contactor to close when the expected charge transfer and expected impact energy are below the corresponding allowable thresholds, and the measured trajectory residual is continuously within the allowable envelope.

[0065] Through the above control method, the pre-charge completion threshold can be adaptively adjusted according to the actual load capacitance, input voltage, and circuit aging state, rather than relying solely on a fixed voltage ratio. In some implementations, when the equivalent load capacitance is large, the central controller requires a lower voltage difference to limit the amount of charge transfer and impact energy during closure; when the equivalent load capacitance is small, the central controller allows the main contactor to close under a larger voltage difference. In some implementations, when circuit aging leads to an increase in equivalent circuit resistance, the central controller adjusts the pre-charge completion judgment conditions based on the residual change between the measured trajectory and the predicted trajectory.

[0066] For the first high-voltage distribution branch, when the voltage of the first output-side high-voltage node HVX2 reaches a preset proportion of the voltage of the first input-side high-voltage node HVX1, and the pre-charging current of the first branch decays to below a preset threshold, and the expected charge transfer amount and expected impact energy are respectively lower than the corresponding allowable thresholds, the central controller closes the first main contactor K1 and opens the first pre-charging contactor K2 after a preset delay. For the second high-voltage distribution branch, when the voltage of the second output-side high-voltage node HVY2 reaches a preset proportion of the voltage of the second input-side high-voltage node HVY1, and the pre-charging current of the second branch decays to below a preset threshold, and the expected charge transfer amount and expected impact energy are respectively lower than the corresponding allowable thresholds, the central controller closes the second main contactor K3 and opens the second pre-charging contactor K4 after a preset delay.

[0067] The central controller performs contactor action verification during contactor control. Based on control commands, changes in node voltage and branch current before and after contactor action, the central controller determines whether the main contactor has failed to close or open as instructed. In some implementations, if the voltage difference between the input and output sides does not decrease to below a preset threshold within a preset time after the central controller issues a closing command to the main contactor, or if the branch current does not form the expected conducting current, the central controller determines that the main contactor has failed to close as instructed. In some implementations, if the voltage difference between the input and output sides does not form within a preset time after the central controller issues an opening command to the main contactor, or if the branch current does not decay to below a preset safe current threshold, the central controller determines that the main contactor has failed to open as instructed.

[0068] In some implementations, when the central controller detects an abnormal operation of the main contactor, it stops the power-on process of the corresponding branch and reports the fault information via the CAN communication module. After each branch has been powered on, the central controller reports the pre-charge completion status and contactor status of the corresponding branch via the CAN communication module.

[0069] The aforementioned pre-charge control method 300 and main contactor closing control describe the pre-charge status monitoring and contactor control during the system power-on process. After the main contactor closes, the central controller enters the operation monitoring and fault diagnosis phase. Figure 4 A flowchart of a graded protection method 400 according to an embodiment of the present disclosure is shown. The graded protection method 400 includes an operation monitoring and fault diagnosis step 402.

[0070] In step 402, the central controller collects the input and output voltages of each branch at a preset cycle, monitoring the voltage difference and voltage drops exceeding a preset range. For the first high-voltage distribution branch, the central controller collects the voltage of the first input-side high-voltage node HVX1 as the input-side voltage U. inThe voltage of the first output-side high-voltage node HVX2 is collected as the output-side voltage U. out For the second high-voltage distribution branch, the central controller collects the voltage of the second input-side high-voltage node HVY1 as the input-side voltage and collects the voltage of the second output-side high-voltage node HVY2 as the output-side voltage.

[0071] The central controller collects the voltage on the load side of each load fuse and compares it with the corresponding output side voltage to identify whether the load fuse is blown or there is a fault in the output line. For the first high-voltage distribution branch, the central controller collects the voltages of the first high-voltage sampling node HV_LoadX1, the second high-voltage sampling node HV_LoadX2, and the third high-voltage sampling node HV_LoadX3, and compares them with the voltage of the first output side high-voltage node HVX2. For the second high-voltage distribution branch, the central controller collects the voltages of the fourth high-voltage sampling node HV_LoadY1, the fifth high-voltage sampling node HV_LoadY2, and the sixth high-voltage sampling node HV_LoadY3, and compares them with the voltage of the second output side high-voltage node HVY2.

[0072] The central controller collects the outputs of each Hall current sensor to monitor overcurrent and current change rate exceeding preset thresholds in each branch. The central controller also collects the output signals of the first and second Hall current sensors via a low-voltage sampling module to obtain the branch current and current change rate of the first and second high-voltage distribution branches.

[0073] The central controller establishes node topology state vectors for the first and second high-voltage distribution branches respectively. Each node topology state vector includes at least the input voltage, output voltage, three load-side voltages, branch current, current rate of change, output voltage rate of change, and control commands for the main contactor and pre-charge contactor. For the first high-voltage distribution branch, the node topology state vector includes the voltage of the first input-side high-voltage node HVX1, the voltage of the first output-side high-voltage node HVX2, the voltages from the first high-voltage sampling node HV_LoadX1 to the third high-voltage sampling node HV_LoadX3, the branch current and current rate of change detected by the first Hall current sensor Hall, the voltage rate of change of the first output-side high-voltage node HVX2, and control commands for the first main contactor K1 and the first pre-charge contactor K2. For the second high-voltage distribution branch, the node topology state vector includes the voltage of the second input-side high-voltage node HVY1, the voltage of the second output-side high-voltage node HVY2, the voltages of the fourth high-voltage sampling node HV_LoadY1 to the sixth high-voltage sampling node HV_LoadY3, the branch current and current change rate detected by the second Hall current sensor Hall, the voltage change rate of the second output-side high-voltage node HVY2, and the control commands of the second main contactor K3 and the second precharge contactor K4.

[0074] The central controller calculates the pressure difference ΔU in the main path. m and the equivalent voltage difference ΔU across each load fuse Li The pressure difference ΔU in the main passage m Calculate using the following formula: .

[0075] The equivalent voltage difference ΔU across each load fuse Li Calculate using the following formula: ; Among them U in U is the input-side voltage. out For the output voltage, U load_i Let be the voltage on the load side of the i-th load fuse.

[0076] The central controller generates fault characteristic combinations based on the differential pressure, current, and their temporal relationships to distinguish between pre-charge circuit abnormalities, main contactor malfunction or sticking, single load fuse blowout, reverse power supply to the load side, branch short circuits, and high-resistance connection faults. In some implementations, when a certain equivalent differential pressure ΔU Li If the voltage difference continuously exceeds the threshold, while other equivalent differential voltages in the same group remain normal and the total branch current matches the disconnection of the load, the central controller will determine that the corresponding load fuse has blown or the output line is open. In some implementations, the main circuit voltage difference ΔU is determined after the main contactor closing command is issued. m If the voltage difference remains high and no branch current has formed, the central controller is positioned as either the main contactor failing to operate or the main circuit having high resistance. In some implementations, the main circuit voltage difference ΔU is determined after the main contactor disconnect command is issued. m When the current is still close to zero and a continuous current exists, the central controller identifies the main contactor as stuck. In some implementations, when multiple load-side nodes simultaneously drop and are accompanied by a rapid rise in branch current, the central controller identifies the branch-level short circuit.

[0077] The central controller generates fault fingerprints based on the node topology state vectors. Fault fingerprints must remain consistent within a preset number of consecutive samples, or meet the cross-confirmation condition of voltage and current evidence, before entering the corresponding protection state. In some implementations, voltage evidence includes a rapid drop in input or output voltage in the direction of the short circuit, and current evidence includes branch current or current change rate exceeding a corresponding threshold. Through the cross-confirmation mechanism of fault fingerprints, the central controller can avoid misjudgments caused by single-sample noise or transient interference, improving the accuracy of fault diagnosis.

[0078] The above-described operation monitoring and fault diagnosis step 402 describes the central controller's acquisition and identification of voltage, current, and fault characteristics at each branch node. After confirming the fault characteristics, the central controller performs graded protection according to the fault type and severity. (Refer to...) Figure 4 The graded protection method 400 includes an instantaneous disconnection determination step 406, an instantaneous disconnection execution step 408, a first-level protection determination step 410, a first-level protection execution step 412, a short-circuit characteristic determination step 414, an isolation command issuance step 416, an isolation confirmation determination step 418, an isolation success determination step 420, an active fuse triggering step 422, and a normal operation maintenance step 424.

[0079] In step 406, the central controller determines whether the instantaneous disconnection condition is met. The instantaneous disconnection condition includes the branch current exceeding a second overcurrent threshold, or the branch simultaneously experiencing a current rise rate exceeding a preset rise rate threshold and an abnormal voltage drop on the input or output side. In some embodiments, when the first Hall current sensor detects that the current in the first high-voltage distribution branch exceeds the second overcurrent threshold, the central controller determines that the first high-voltage distribution branch meets the instantaneous disconnection condition. In some embodiments, when the first high-voltage distribution branch simultaneously experiences a current rise rate exceeding a preset rise rate threshold and an abnormal voltage drop at the first input high-voltage node HVX1 or the first output high-voltage node HVX2, the central controller determines that the first high-voltage distribution branch meets the instantaneous disconnection condition. The instantaneous disconnection condition determination for the second high-voltage distribution branch is symmetrical to that for the first high-voltage distribution branch.

[0080] When the determination result of step 406 is that the instantaneous disconnection condition is met, step 408 is executed. The central controller triggers the corresponding active fuse through the active fuse drive module and disconnects the corresponding main contactor and precharge contactor. For the first high-voltage distribution branch, the central controller triggers the first active fuse SQ1 and issues a control command to disconnect the first main contactor K1 and the first precharge contactor K2. For the second high-voltage distribution branch, the central controller triggers the second active fuse SQ2 and issues a control command to disconnect the second main contactor K3 and the second precharge contactor K4. After the active fuse is triggered, the central controller latches the corresponding fault, prevents the branch from being powered on again, and records the triggering reason through the FLASH storage module.

[0081] If the determination result of step 406 is that the instantaneous disconnection condition is not met, step 410 is executed. Step 410 determines whether the first-level protection condition is met. The first-level protection condition includes detecting pre-charge timeout, abnormal contactor operation, or an overcurrent value exceeding the first overcurrent threshold. In some embodiments, pre-charge timeout refers to the pre-charge process lasting longer than a preset pre-charge time limit while the output voltage still has not reached the preset ratio. In some embodiments, abnormal contactor operation refers to the main contactor or pre-charge contactor failing to close or open according to the control command. The contactor operation verification refers to the main contactor closing control section described above, and will not be repeated here. The second overcurrent threshold is greater than the first overcurrent threshold, so that the overcurrent level corresponding to the first-level protection condition is lower than the overcurrent level corresponding to the instantaneous disconnection condition.

[0082] If the determination result of step 410 is that the first-level protection condition is met, step 412 is executed. The central controller disconnects the main contactor and pre-charge contactor of the corresponding branch. For the first high-voltage distribution branch, the central controller issues a control command to disconnect the first main contactor K1 and the first pre-charge contactor K2. For the second high-voltage distribution branch, the central controller issues a control command to disconnect the second main contactor K3 and the second pre-charge contactor K4. In step 412, the central controller does not trigger the active fuse, so that the branch is ready to be powered on after the fault is cleared.

[0083] If the determination result of step 410 is that the first-level protection condition is not met, step 414 is executed. Step 414 determines whether a short-circuit characteristic is detected but the instantaneous tripping threshold is not reached. In some embodiments, the short-circuit characteristic includes the branch current or current change rate exceeding the corresponding threshold but below the instantaneous tripping threshold, or the input or output voltage experiencing a rapid drop in the same direction as the short circuit but the drop amplitude or speed does not reach the instantaneous tripping condition.

[0084] If the determination result of step 414 is that a short circuit characteristic is detected but the instantaneous disconnection threshold is not reached, step 416 is executed. The central controller issues a disconnect command to the corresponding main contactor and initiates the isolation confirmation time window. In some embodiments, the isolation confirmation time window is a preset time interval used to determine whether the main contactor can effectively isolate the fault.

[0085] Step 418 determines whether the branch current has decayed to a preset safe current threshold and whether a preset disconnection voltage difference has formed between the input and output sides within the isolation confirmation time window. In some implementations, the preset disconnection voltage difference refers to the voltage difference between the input voltage and the output voltage after the main contactor is disconnected reaching a preset threshold, indicating that the main contactor has been effectively disconnected.

[0086] When the determination result of step 418 is that the branch current decays to a preset safe current threshold and a preset disconnection voltage difference is formed between the input side and the output side, step 420 is executed. The central controller determines that the contactor isolation is successful and does not trigger the active fuse. In some embodiments, after the contactor isolation is successful, the central controller reports the fault information through the CAN communication module and keeps the branch in the open state to wait for the fault to be cleared.

[0087] If the determination result of step 418 is that the branch current has not decayed to the preset safe current threshold or the preset disconnection voltage difference has not been formed between the input and output sides, step 422 is executed. The central controller determines that the contactor cannot effectively isolate the fault and triggers the corresponding active fuse. In some embodiments, when the branch current has not decayed or the input and output nodes are still conducting, the central controller determines that the main contactor is stuck or the fault current continues to flow, and triggers the corresponding active fuse to achieve rapid fault disconnection.

[0088] If the determination result of step 414 is that no short circuit characteristics are detected, proceed to step 424. The central controller maintains normal operation and continues monitoring.

[0089] In some implementations, the central controller employs a tiered confirmation triggering mechanism for active fuses. When the fault intensity is below the instantaneous tripping threshold but meets the suspected short-circuit conditions, the central controller confirms the fault by combining at least two of the following three types of evidence: the branch current or rate of change of current exceeds the corresponding threshold; the input or output voltage experiences a rapid drop in the direction consistent with the short circuit; and the branch current fails to decay within the isolation confirmation time window after the main contactor receives the disconnect command. Through this tiered confirmation triggering mechanism, the central controller can avoid false triggering due to a single piece of evidence, thus improving the accuracy of active fuse triggering.

[0090] In some implementations, the central controller predicts fault energy based on the rate of change of current and the rate of voltage sag. When the predicted fault energy will exceed a safety limit before the contactor completes disconnection, the central controller triggers the corresponding active fuse. In some implementations, the central controller calculates the growth trend of the fault energy based on the rate of change of current dI / dt and the rate of voltage sag dU / dt, and compares it with the contactor's disconnection time. When the rate of increase of the fault energy exceeds the contactor's safe disconnection capability, the central controller directly triggers the active fuse without waiting for the isolation confirmation time window to end.

[0091] Through the aforementioned hierarchical protection mechanism, the central controller can select different protection strategies based on the fault type and severity. For general faults, the central controller handles the issue by disconnecting the contactor, ensuring that the branch circuit is ready to be powered back on after the fault is cleared. For severe short circuits or faults that the contactor cannot isolate, the central controller triggers an active fuse for rapid disconnection. In some implementations, the active fuse serves as an irreversible downstream protection when the contactor cannot reliably isolate a severe fault, rather than triggering it uniformly for all overcurrent faults.

[0092] The aforementioned graded protection method 400 describes the protection strategy executed by the central controller based on the fault type and severity. In addition to graded protection, the central controller also performs load degradation control based on flight phase and load priority, and records fault events and updates health baselines via the Flash storage module.

[0093] The central controller receives flight phase, branch allowable power, and load priority information via the CAN communication module. For general overloads that do not meet the instantaneous disconnection condition, the central controller sends a load degradation request for the corresponding branch to the aircraft's overall controller and monitors the branch current within the degradation response time window. In some implementations, the central controller uses the branch current decrease as closed-loop feedback to determine whether load degradation is effective. If the branch current recovers to the allowable range within the degradation response time window, the central controller maintains the branch in degraded operation; if the branch current does not recover to the allowable range, the central controller disconnects the corresponding main contactor. In some implementations, the load degradation control is applicable to overloads that can be delayed and does not reduce the response speed of severe short-circuit protection.

[0094] The central controller adjusts the load degrading strategy according to the flight phase. During critical phases such as takeoff and landing, the central controller prioritizes retaining pre-marked critical loads. During ground or non-critical flight phases, the central controller employs a shorter load degrading response time. In some implementations, the central controller receives current flight phase information from the aircraft's overall controller via a CAN communication module and selects the corresponding load degrading response time and load priority configuration based on the flight phase.

[0095] Under the conditions that the shared central controller and low-voltage power supply are still normal, the other branch is not faulty, and the aircraft's overall control strategy allows for continued power supply, when only a single high-voltage branch fails, the central controller maintains power supply from the other branch to its corresponding load group. In some embodiments, when the first high-voltage distribution branch fails while the second high-voltage distribution branch is normal, the central controller performs corresponding protection actions on the first high-voltage distribution branch, while maintaining power supply from the second high-voltage distribution branch to the fourth load LoadY1, the fifth load LoadY2, and the sixth load LoadY3. In some embodiments, when the second high-voltage distribution branch fails while the first high-voltage distribution branch is normal, the central controller performs corresponding protection actions on the second high-voltage distribution branch, while maintaining power supply from the first high-voltage distribution branch to the first load LoadX1, the second load LoadX2, and the third load LoadX3.

[0096] The Flash storage module continuously saves the state vector before the fault occurs using a circular caching method. In some implementations, the Flash storage module saves the node topology state vector within a preset time window before the fault. When a pre-charge anomaly, contactor anomaly, fuse blown, load degradation, main contactor tripping, or active fuse triggering occurs, the Flash storage module freezes the pre-fault data and continues to save post-fault data for a preset time period to form a fault event record containing pre-fault data, post-fault data, identification parameters, flight phase, and protection action sequence. In some implementations, the fault event record also includes equivalent loop resistance, equivalent load capacitance, trajectory residual, node voltage difference, current and rate of change, contactor commands, fault fingerprint, and timestamps of each protection action.

[0097] For operating cycles that have completed pre-charging and have not experienced any faults, the central controller updates the health benchmark for the corresponding branch at a defined update rate. In some implementations, the health benchmark includes equivalent loop resistance, equivalent load capacitance, pre-charging time, and trajectory residual benchmarks. By defining the update rate, the central controller avoids contaminating subsequent judgment thresholds with single abnormal data. In some implementations, the central controller uses a weighted average or sliding window method to update the health benchmark, enabling the health benchmark to reflect the long-term state change trend of the branch while suppressing the impact of single measurement deviations on the health benchmark.

[0098] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a system including a processing module or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0099] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A redundant high-voltage power distribution box for an electric vertical takeoff and landing aircraft, characterized in that, include: Central controller; In the first high-voltage distribution branch, a first Hall current sensor and a first active fuse are sequentially arranged along the output direction of the first battery pack. The output terminal of the first active fuse forms a first input-side high-voltage node. A first main contactor is connected between the first input-side high-voltage node and the first output-side high-voltage node. A first pre-charge contactor and a first pre-charge resistor are connected in series to form a first pre-charge circuit. The first pre-charge circuit is connected in parallel with the first main contactor. The first output-side high-voltage node is connected to multiple load output terminals via multiple load fuses. The second high-voltage distribution branch is provided with a second Hall current sensor and a second active fuse in sequence along the output direction of the second battery pack. The output terminal of the second active fuse forms a second input-side high-voltage node. A second main contactor is connected between the second input-side high-voltage node and the second output-side high-voltage node. A second pre-charge contactor and a second pre-charge resistor are connected in series to form a second pre-charge circuit. The second pre-charge circuit is connected in parallel with the second main contactor. The second output-side high-voltage node is connected to multiple load output terminals through multiple load fuses. The first high-voltage power distribution branch and the second high-voltage power distribution branch are independent of each other in the high-voltage power path, and share the central controller for centralized control.

2. The redundant high-voltage distribution box according to claim 1, characterized in that, The central controller includes: The high-voltage sampling module is used to collect the node voltages of the first input-side high-voltage node, the first output-side high-voltage node, the second input-side high-voltage node, the second output-side high-voltage node, and the load side of each load fuse; A low-voltage sampling module is used to acquire the output signals of the first Hall current sensor and the second Hall current sensor; and An active fuse driver module is used to drive the first active fuse and the second active fuse respectively.

3. The redundant high-voltage distribution box according to claim 2, characterized in that, The central controller also includes: A first relay control module is used to control the first main contactor and the first precharge contactor; and The second relay control module is used to control the second main contactor and the second precharge contactor.

4. The redundant high-voltage distribution box according to claim 1, characterized in that, The central controller also includes: Flash storage modules are used to store operational and fault data; and The CAN communication module is used to communicate with the battery management system or the overall controller.

5. The redundant high-voltage distribution box according to claim 1, characterized in that, The first output-side high-voltage node is connected to the first load, the second load, and the third load via the first load fuse, the second load fuse, and the third load fuse, respectively, and forms a corresponding high-voltage sampling node on the load side of each load fuse; the second output-side high-voltage node is connected to the fourth load, the fifth load, and the sixth load via the fourth load fuse, the fifth load fuse, and the sixth load fuse, respectively, and forms a corresponding high-voltage sampling node on the load side of each load fuse.

6. A control method for a redundant high-voltage distribution box as described in any one of claims 1-5, characterized in that, include: During system initialization, the central controller completes the low-voltage circuit initialization test, keeps all main contactors and pre-charge contactors in the open state, and keeps the trigger output of each active fuse in the disabled state. High-voltage node status confirmation: Before closing the pre-charge contactor, collect the input side, output side and load side node voltages of each branch to determine whether the battery pack is connected and whether there is contactor sticking or reverse high voltage on the load side. Pre-charge control is performed on the first high-voltage distribution branch and the second high-voltage distribution branch respectively. During pre-charge, the corresponding main contactor is kept open and the corresponding pre-charge contactor is closed, so that the battery pack is current-limited charged to the high-voltage node on the output side and the input capacitor of the load through the pre-charge resistor. as well as When the main contactor is closed, and the output voltage reaches a preset ratio of the input voltage and the pre-charge current decays to below a preset threshold, the corresponding main contactor is closed and the corresponding pre-charge contactor is opened.

7. The control method according to claim 6, characterized in that, Also includes: During the pre-charging process, the central controller calculates the equivalent loop resistance based on the input voltage, output voltage, and branch current. The accumulated charge is obtained by integrating the pre-charge current over time, and the equivalent load capacitance is calculated based on the output voltage increment; and Based on the equivalent loop resistance and the equivalent load capacitance, a predicted voltage rise curve and a predicted current decay curve are generated, and the residual between the measured curve and the predicted curve is used as the pre-charge state criterion.

8. The control method according to claim 6, characterized in that, It also includes operation monitoring and fault diagnosis: Collect the input and output voltages of each branch, and monitor the voltage difference and voltage drops exceeding the preset range; Collect the voltage on the load side of each load fuse and compare it with the corresponding output side voltage to identify whether the load fuse is blown or the output line is faulty. as well as The output of each Hall current sensor is collected to monitor the overcurrent and current change rate of each branch when they exceed the preset threshold.

9. The control method according to claim 6, characterized in that, It also includes graded protection: When a precharge timeout, contactor malfunction, or overcurrent value exceeding the first overcurrent threshold is detected, disconnect the main contactor and precharge contactor of the corresponding branch. as well as When the branch current exceeds the second overcurrent threshold, or when the branch current rise rate exceeds the preset rise rate threshold and the input or output voltage drops abnormally, the corresponding active fuse is triggered and the corresponding main contactor and precharge contactor are disconnected, wherein the second overcurrent threshold is greater than the first overcurrent threshold.

10. The control method according to claim 9, characterized in that, For cases where short-circuit characteristics are detected but the instantaneous disconnection threshold is not reached: First, a disconnect command is sent to the corresponding main contactor and the isolation confirmation time window is activated; If the branch current decays to the preset safe current threshold within the time window and a preset disconnection voltage difference is formed between the input side and the output side, the contactor is determined to be successfully isolated and the active fuse is not triggered. as well as If the branch current does not decay or the input / output nodes remain conductive, the corresponding active fuse will be triggered.

Images