Intelligent high-voltage power supply and distribution equipment for electric aircraft and control method

Abstract

The application discloses an intelligent high-voltage power supply and distribution equipment for an electric airplane and a control method, and the equipment comprises a dissimilar dual-redundancy management and control computer, a high-voltage high-power solid-state circuit breaker, a high-voltage contactor, a plurality of groups of power battery electric energy input interfaces, positive and negative double high-voltage bus bars, a plurality of power distribution output interfaces, a power battery charging interface, a micro switch and a fuse redundant protection unit; the power battery electric energy input interfaces are connected to corresponding battery bus bars through independent high-voltage high-power solid-state circuit breakers; the positive and negative double high-voltage bus bars are physically isolated from each other, different battery positive bus bars are interconnected through high-voltage high-power solid-state circuit breakers, and negative bus bars are combined; power distribution output is powered through high-voltage high-power solid-state circuit breakers; the charging interface is connected through a high-voltage contactor; and except for the interconnected solid-state circuit breaker, the solid-state circuit breakers of the remaining input and output circuits are connected in series with fuses. The equipment can meet the strict requirements of eVTOL and other electric airplanes on a direct-current high-voltage power supply and distribution system, such as high safety, high reliability, fault tolerance and airworthiness.

Description

Technical Field

[0001] This invention belongs to the field of aviation electrical systems technology, and relates to an intelligent high-voltage power supply and distribution equipment and control method for electric aircraft. Background Technology

[0002] With the rapid development of electric aircraft technologies such as electric vertical takeoff and landing (EVTOL) aircraft, airborne high-voltage direct current (HVDC) power supply and distribution systems have become a key factor determining the overall safety, reliability, and range of the aircraft. Typical electric aircraft use multiple sets of high-voltage power batteries to provide power to airborne equipment such as propulsion motors, flight control systems, and avionics. The power supply and distribution system needs to complete the reception, distribution, protection, and reconfiguration of electrical energy under high voltage and high current conditions.

[0003] In existing technical solutions, electric aircraft high-voltage power supply and distribution systems generally use mechanical high-voltage contactors as the main circuit switching control devices, combined with conventional fuses and single-channel controllers to achieve basic power distribution functions. The electrical energy from multiple power batteries is connected to a single common busbar through contactors, and then distributed from the busbar to each electrical load through contactors. The fuses only serve as short-circuit backup protection.

[0004] However, in practical applications, the above solutions have significant shortcomings. The breaking time of mechanical contactors is typically tens to hundreds of milliseconds, insufficient for microsecond-level rapid disconnection of high-voltage DC short-circuit faults. Fault energy can easily dissipate rapidly during the breaking process, posing serious safety hazards. Hardware or software failures in a single-channel control unit can lead to the entire power distribution system going out of control, failing to meet the aviation industry's "fail-safe" and "fail-operation" airworthiness requirements. Furthermore, existing power supply topologies lack independent switching control and flexible interconnection mechanisms between multiple battery banks. If a battery or busbar fails, grid reconfiguration cannot be completed in a very short time, failing to guarantee uninterrupted power supply to critical loads. Simultaneously, traditional systems have low levels of intelligence in insulation monitoring, energy dispatch, integrated charging control, and cover plate safety interlocking, making them ill-suited for the energy management needs of multiple battery banks under complex flight conditions. Summary of the Invention

[0005] The purpose of this invention is to provide an intelligent high-voltage power supply and distribution device and control method for electric aircraft to solve the above-mentioned problems.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides an intelligent high-voltage power supply and distribution device for electric aircraft, comprising: a non-similar dual-redundant control computer, a high-voltage high-power solid-state circuit breaker, a high-voltage contactor, multiple sets of power battery power input interfaces, positive and negative dual high-voltage busbars, multiple power distribution output interfaces, a power battery charging interface, a micro switch, and a fuse redundancy protection unit; each of the multiple sets of power battery power input interfaces is connected to a corresponding battery busbar through an independent high-voltage high-power solid-state circuit breaker; the positive and negative dual high-voltage busbars are physically isolated positive and negative busbars, and different battery positive terminals are connected together. The battery busbars are interconnected via high-voltage, high-power solid-state circuit breakers, and the negative busbars are connected in a merged manner. Multiple power distribution output interfaces draw power from each battery busbar via high-voltage, high-power solid-state circuit breakers. The power battery charging interface connects the external charging interface and the internal power battery power supply interface via a high-voltage contactor. The fuse redundancy protection unit includes fuses; except for the high-voltage, high-power solid-state circuit breaker interconnecting the battery busbars, all other high-voltage, high-power solid-state circuit breakers in the power battery power input circuit and power distribution output circuit are connected in series with fuses. A microswitch is used to detect the closed state of the equipment cover.

[0007] Furthermore, the non-similar dual-redundant control computer includes a main control module and a backup control module. The main control module and the backup control module adopt different processor architectures, independent power supply circuits, independent sampling circuits and isolated communication buses, and their functions and external interfaces are the same. After the device is powered on, the main control module works and outputs, while the backup control module is in a hot backup state, executing logic but not outputting. Cross-verification and heartbeat monitoring are performed between the main and backup control modules.

[0008] Furthermore, both the main control module and the backup control module are equipped with insulation monitoring units to monitor the insulation resistance to ground of the positive and negative dual high-voltage busbars and each branch, and to issue early warnings when insulation is abnormal.

[0009] Furthermore, both the main control module and the backup control module are equipped with a smart grid management unit: based on the status of the power battery and the power supply status of the battery pack busbars, the unit automatically controls the operation of each solid-state circuit breaker to complete the disconnection of the power battery from the grid and the switching of the busbars, thereby dynamically adjusting the high-voltage grid configuration.

[0010] Furthermore, the non-similar dual-redundancy control computer is equipped with a safety monitoring unit: after the ground is powered on, it monitors the status of the micro switch. If it is in the closed state, it executes the power battery grid connection and load power distribution control logic; if it is in the open state, it reports a safety alarm and no longer executes the power battery grid connection and load power distribution control logic.

[0011] Furthermore, the high-voltage, high-power solid-state circuit breaker array receives control commands from the management computer via a CAN bus network, and is also designed with a switch signal interface to directly receive control from the management computer. It also uploads its own operating status, self-test information, and channel voltage and current parameters via the CAN bus.

[0012] Furthermore, the high-voltage, high-power solid-state circuit breaker is a SiC-based solid-state circuit breaker with bidirectional conduction function and a breaking time of less than 5μs.

[0013] Furthermore, the positive terminal of each power battery power supply interface is connected to the positive terminal of the charging interface through a high-voltage contactor, and the negative terminals of all power battery power supply interfaces are combined and then connected to the negative terminal of the charging interface through a high-voltage contactor.

[0014] Furthermore, the device can be cascaded into two units to distribute multiple sets of power batteries to the two devices, providing redundant power distribution for the airborne load.

[0015] Secondly, the present invention provides a control method for intelligent high-voltage power supply and distribution equipment for electric aircraft, comprising the following steps: After power-on, the non-similar dual-redundancy control computer acquires the state of the micro switch; If the micro switch is closed, the control computer executes the power battery grid connection and load power distribution control logic; If the microswitch is in the open state, the control computer will report a safety alarm and will not execute the power battery grid connection and load power distribution control logic.

[0016] Compared with the prior art, the present invention has the following technical effects: This invention employs a dissimilar dual-redundant control computer to control the power supply and distribution system using a hardware and software dissimilar redundancy architecture. This eliminates the risk of single-point failure, allowing the backup control module to seamlessly take over when the main control module fails, thus achieving high system-level reliability and fault tolerance. By replacing traditional mechanical contactors with high-voltage, high-power solid-state circuit breakers in each power battery input circuit and power distribution output circuit, the fault breaking time can be compressed to the microsecond level, rapidly cutting off the fault current, preventing the spread of fault energy, and improving system safety. By constructing physically isolated positive and negative busbars and interconnecting the positive busbars of different batteries via high-voltage, high-power solid-state circuit breakers, the interconnected solid-state circuit breakers can be quickly closed in the event of a battery or busbar failure, changing the power supply topology, completing rapid grid reconfiguration, and ensuring uninterrupted power supply to critical loads. Furthermore, by connecting the fuses in series with other high-voltage, high-power solid-state circuit breakers (excluding the interconnected circuit breakers) through a fuse redundancy protection unit, a dual protection mechanism of electronic rapid protection plus physical ultimate protection is formed. In extreme cases where the solid-state circuit breaker fails due to breakdown, the fuses safely disconnect the circuit, covering all typical failure modes and improving safety margins. By detecting the closure status of the equipment cover through a microswitch and linking it with a control computer, the system can identify the abnormal state of an unclosed cover during ground operations and prevent the power battery from connecting to the grid, thus avoiding the risk of electric shock and arcing. This invention is applicable to electric aircraft such as electric vertical takeoff and landing aircraft operating in DC 540V to 1000V high-voltage power supply scenarios, meeting stringent requirements for high safety, high reliability, fault tolerance, and airworthiness. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall architecture of the intelligent high-voltage power supply and distribution equipment according to an embodiment of the present invention; Figure 2 This is a block diagram of a dissimilar dual-redundancy control computer architecture according to an embodiment of the present invention; Figure 3 This is a topology diagram of dual protection for input and output branches using "solid-state circuit breaker + fuse" in an embodiment of the present invention. Figure 4 This is a topology diagram for multi-device cascading in an embodiment of the present invention. Detailed Implementation

[0018] The present invention will now be described in further detail with reference to the accompanying drawings: Example 1, see Figure 1 In one embodiment of the present invention, an intelligent high-voltage power supply and distribution device for electric aircraft is provided, which is used to realize the power access, rapid protection, intelligent distribution and grid reconfiguration of multiple high-voltage power batteries in electric aircraft such as electric vertical take-off and landing aircraft.

[0019] Specifically, the intelligent high-voltage power supply and distribution equipment for electric aircraft includes the following components: a non-similar dual-redundant control computer, a high-voltage high-power solid-state circuit breaker, a high-voltage contactor, multiple sets of power battery power input interfaces, positive and negative dual high-voltage busbars, multiple power distribution output interfaces, a power battery charging interface, and a micro switch and fuse redundancy protection unit.

[0020] See Figure 2The dissimilar dual-redundancy control computer consists of two computer modules with identical functions and external interfaces but completely independent internal implementation mechanisms, defined as the main control module and the backup control module. The main control module and the backup control module each use processors with different architectures as their control cores, and their power supply circuits, sampling circuits, and communication buses are all independently designed. The main components are selected from different models, achieving dissimilar redundancy from both hardware and software perspectives. After power-on, the main control module enters the working state by default, executing all control logic and outputting drive instructions. The backup control module runs the control logic synchronously but does not output externally, remaining in a hot backup state. The two modules continuously perform data cross-verification and heartbeat signal monitoring via a high-speed internal bus. Once the backup control module detects an anomaly in the main control module or a loss of heartbeat, it automatically switches to the working state, seamlessly taking over all control functions. The entire process does not cause power interruption.

[0021] The high-voltage, high-power solid-state circuit breakers are arrayed within the equipment, distributed across each power battery input branch, load distribution output branch, and interconnecting branch between the battery positive terminal busbars. Each high-voltage, high-power solid-state circuit breaker utilizes wide-bandgap semiconductor devices such as silicon carbide or insulated-gate bipolar transistors, possessing microsecond-level ultra-fast turn-off capability, bidirectional conduction, and comprehensive overload, short-circuit protection, and status self-checking functions. Its control interface features a dual-redundancy design, receiving action commands from the management computer via the controller area network bus, while also retaining a hard-wired switch signal interface. This allows the management computer to directly control the opening and closing of circuits via high and low levels, ensuring reliable protection actions even in the event of bus communication failure. Simultaneously, each high-voltage, high-power solid-state circuit breaker reports its operating status, self-check results, and real-time detected channel voltage and current parameters via the controller area network bus, enabling the management computer to accurately monitor the energy flow across the entire network.

[0022] The high-voltage contactor is used for high-voltage channels that are not routinely switched, specifically in the power battery charging circuit. Since the charging operation only takes place on the ground and the frequency of operation is extremely low, a mature and reliable high-voltage contactor is sufficient to meet the requirements. At the same time, its high physical isolation capability also increases the safety of the charging interface.

[0023] The multiple sets of power battery power input interfaces serve as the electrical connection interface between the equipment and external power battery packs. Each set of power battery power input interfaces independently corresponds to a battery bus bar and is connected through its own dedicated high-voltage, high-power solid-state circuit breaker. When a power battery pack experiences faults such as over-discharge, abnormal temperature, or internal short circuit, the control computer will immediately instruct the corresponding high-voltage, high-power solid-state circuit breaker to shut down, reliably disconnecting the battery pack from the high-voltage power grid and achieving fault isolation; when the fault is cleared or needs to be reconnected, it will be controlled to close and reconnect to the grid.

[0024] The positive and negative dual high-voltage busbars form the internal DC power distribution framework of the equipment, employing physically isolated positive and negative busbars. The positive busbars are divided into multiple independent sub-busbars according to the battery packs. Each sub-busbar is connected only to the positive terminal of a corresponding set of power batteries and the corresponding high-voltage, high-power solid-state circuit breaker for power distribution output. High-voltage, high-power solid-state circuit breakers are also connected between the positive busbars of different batteries. Under normal flight conditions, these interconnecting circuit breakers are in the open state, ensuring that each battery's power supply domain remains independent on the positive side. The negative terminals of all batteries are combined and connected to a common negative busbar, forming a unipolar isolated, multi-domain parallel topology.

[0025] The multiple power distribution output interfaces draw power from each battery busbar via high-voltage, high-power solid-state circuit breakers to provide power to critical airborne loads such as propulsion motors, environmental control systems, flight control systems, and avionics systems. Each power distribution output interface is connected in series with a high-voltage, high-power solid-state circuit breaker. The control computer can dynamically control the on / off state of these circuit breakers based on load priority, real-time power consumption, and the health status of the power supply, thereby enabling the connection and disconnection of loads.

[0026] The power battery charging interfaces are internally connected to the external charging socket and each power battery power supply interface via high-voltage contactors. Specifically, the positive terminal of each power battery power supply interface is connected to the positive terminal of the charging interface via an independent high-voltage contactor, while the negative terminals of all power battery power supply interfaces are first combined into one point and then connected to the negative terminal of the charging interface via a common high-voltage contactor. This contactor layout with grouped positive terminals and shared negative terminals allows the control computer to sequentially engage each battery channel during charging, enabling grouped sequential charging. Furthermore, a failure of any contactor can disconnect the common negative contactor to completely cut off the charging circuit.

[0027] The redundant fuse protection unit consists of several aerospace-grade high-voltage fuses, arranged as follows: except for the interconnecting high-voltage, high-power solid-state circuit breakers between battery busbars, all other high-voltage, high-power solid-state circuit breakers installed in the power battery input circuit and power distribution output circuit have a fuse connected in series in their current path. During normal operation, the load current is normally carried and interrupted by the high-voltage, high-power solid-state circuit breakers. In extreme cases, such as when a high-voltage, high-power solid-state circuit breaker fails to shut off due to lightning strikes or component aging, the fault current will continue to rise until the series-connected fuse melts within milliseconds, physically cutting off the branch and preventing the fault from escalating. This forms a dual safety mechanism of rapid electronic protection and ultimate physical protection.

[0028] The microswitch is installed at the joint of the equipment cover, and its contact state directly reflects the assembly status of the cover. When the equipment cover is correctly installed and locked, the microswitch is pressed and closed; when the cover is opened, loosened, or not fully installed, the internal spring of the microswitch resets, causing the contacts to open. The control computer can accurately determine the closure status of the equipment cover by reading the on / off state of the microswitch.

[0029] This invention, the intelligent high-voltage power supply and distribution equipment for electric aircraft, achieves end-to-end high-voltage control from battery access, bus distribution, load power distribution to charging management through the organic combination of the aforementioned components. During normal flight, each power battery independently supplies power to the busbars, and the interconnected solid-state circuit breakers remain open, allowing the system to independently adjust the power of each channel. When any battery or busbar experiences a short circuit or ground fault, the corresponding high-voltage, high-power solid-state circuit breaker shuts off within microseconds, while the interconnected solid-state circuit breakers close, isolating the fault domain and allowing other healthy batteries to continue supplying power to the load through interconnected branches. This completes rapid grid reconfiguration and ensures uninterrupted operation of critical components such as the propulsion motor and flight control system. The equipment is adaptable to a DC operating voltage range of 540V to 1000V, and the entire system meets the airworthiness design criteria for high safety, high reliability, and fault tolerance of airborne equipment.

[0030] The non-similar dual-redundant control computer includes a main control module and a backup control module. The main control module and the backup control module adopt different processor architectures, independent power supply circuits, independent sampling circuits and isolated communication buses, and their functions and external interfaces are the same. After the device is powered on, the main control module works and outputs, while the backup control module is in a hot backup state, executing logic but not outputting. Cross-verification and heartbeat monitoring are performed between the main and backup control modules.

[0031] For details, see Figure 2The main control module and the backup control module are physically two independent printed circuit board assemblies, installed in different slots, with power inputs drawn from isolated onboard power busbars. The main control module uses a high-performance digital signal processor, while the backup control module uses a general-purpose microcontroller based on a different instruction set. Their underlying firmware is developed by different software teams using different compilation environments to minimize the risk of common-cause failures. Each module is equipped with independent voltage and current sampling and conditioning circuits and analog-to-digital converters for redundant acquisition of voltage from the high-voltage busbar and current from each branch. Both the main control module and the backup control module have independent controller area network (CAN) bus interfaces and switch driver interfaces, connecting to various high-voltage, high-power solid-state circuit breakers. After power-on initialization, the main control module outputs control commands, while the backup control module, although also calculating control strategies in real time, has its output driver in a high-impedance state and does not apply control externally. The two modules continuously exchange critical status words and heartbeat counts via an isolated serial interface. If the backup module fails to receive a correct heartbeat from the master module within a predetermined time window or detects a status word verification error, it immediately sets the chip select signal, disables the master module's output enable, and simultaneously switches its own output driver from a high-impedance state to a normal driving state, issuing a takeover signal. This dissimilar dual-redundant control architecture effectively addresses risks such as random hardware failures of a single processor, single-point power supply failures, or software infinite loops, improving the reliability of the entire control computer by several levels compared to single-channel solutions. Furthermore, the switching time is extremely short, preventing any power interruption on the load side.

[0032] Both the main control module and the backup control module are equipped with insulation monitoring units to monitor the insulation resistance to ground of the positive and negative dual high-voltage busbars and each branch, and to issue early warnings when insulation is abnormal.

[0033] Specifically, the insulation monitoring unit is integrated into the main control module and backup control module of the control computer, and each operates independently. Each insulation monitoring unit introduces the positive and negative busbars into the measurement circuit through a high-resistance network, and continuously detects the insulation resistance values ​​of the positive and negative terminals to the chassis ground using the DC superposition AC injection method or the bridge balance method. At the same time, the insulation monitoring unit also sequentially selects each power battery input branch and power distribution output branch through polling, and measures the insulation status of each branch conductor to ground one by one. When the insulation resistance value of any positive or negative terminal to ground drops below the preset threshold, the control computer immediately generates an early warning message, reports it to the flight management system through the airborne bus, and can decide whether to shut down the high-voltage, high-power solid-state circuit breaker of the corresponding branch according to the severity.

[0034] Both the main control module and the backup control module are equipped with a power grid intelligent management and control unit: based on the status of the power battery and the power supply status of the battery pack busbars, the unit automatically controls the operation of each solid-state circuit breaker to complete the disconnection of the power battery from the grid and the switching of the busbars, thereby dynamically adjusting the high-voltage power grid configuration.

[0035] Specifically, the intelligent grid management unit (IGMU) is a strategy module implemented in the management computer software. Its inputs come from the individual cell voltage, state of charge (SOC), and temperature uploaded by each power battery management system, as well as the voltage and current of each battery busbar detected by the unit's sensors. The IGMU has multiple predefined grid configuration tables built-in, each configuration corresponding to a specific combination of high-voltage, high-power solid-state circuit breakers. During normal cruise, the IGMU employs a load balancing strategy, distributing the total load power among the battery groups according to the remaining charge ratio. When the SOC of a particular battery group is detected to be significantly lower than that of other groups, the IGMU instructs the disconnection of its corresponding high-voltage, high-power solid-state circuit breaker to actively disconnect it from the grid. Simultaneously, the corresponding interconnecting solid-state circuit breakers are closed, allowing other battery groups to continue supplying power to the load on that busbar, completing an online battery disconnection without affecting the load. During takeoff and high-power ramp-up phases, the IGMU closes some interconnecting solid-state circuit breakers, temporarily paralleling multiple battery groups to provide greater instantaneous power capability. When a short-circuit fault to ground is detected in a battery busbar, the intelligent power grid management unit immediately disconnects all input and output solid-state circuit breakers of the faulty busbar, completely isolating the fault domain, and reconstructs the power supply topology according to preset logic to ensure the power supply continuity of critical loads. This implementation integrates energy management and power grid reconstruction logic into a dual-redundant management computer, enabling the equipment to proactively adjust the high-voltage power grid structure based on the flight mission profile and real-time status. This not only ensures the survivability of the high-voltage system under fault conditions but also optimizes the energy utilization efficiency of multiple battery packs, extending flight range.

[0036] The non-similar dual-redundancy control computer is equipped with a safety monitoring unit: after the ground is powered on, it monitors the status of the micro switch. If it is in the closed state, it executes the power battery grid connection and load power distribution control logic; if it is in the open state, it reports a safety alarm and no longer executes the power battery grid connection and load power distribution control logic.

[0037] Specifically, the safety monitoring unit is a safety interlocking logic that operates independently of both the main control module and the backup control module of the management computer. After the equipment passes its initial power-on self-test on the ground, the safety monitoring unit immediately reads the electrical status of the microswitch. If the microswitch is closed, it indicates that the equipment cover has been reliably installed. The safety monitoring unit releases the interlock signal, allowing the management computer to respond to the power battery grid connection command and load power distribution command from the host computer, and the equipment enters its normal operating process. If the microswitch is open, it indicates that the cover may have been removed or not properly locked, posing a risk of exposed high-voltage conductors. This implementation utilizes a simple and reliable electromechanical switch and management software to form a hardware-software integrated anti-misdistribution safety mechanism. Without additional personnel intervention, it can automatically identify and reliably lock dangerous conditions under maintenance or detection equipment, greatly improving the safety of personnel performing ground maintenance operations.

[0038] The high-voltage, high-power solid-state circuit breaker array receives control commands from the management computer via the controller local area network bus. It is also designed with a switch signal interface to directly receive control from the management computer, and uploads its own working status, self-test information, and channel voltage and current parameters via the controller local area network bus.

[0039] Specifically, each high-voltage, high-power solid-state circuit breaker integrates a drive unit, power semiconductor chipset, current sensor, and microcontroller. Its external interfaces include a bidirectional controller area network (CLAN) bus terminal, two independent digital input terminals, and two status feedback output terminals. The CLAN bus terminal forms a redundant network with the main control module and backup control module of the management computer, transmitting circuit breaker opening and closing commands, protection parameter settings, and status frames returned from the circuit breaker. The status frames include the conduction status of the switching transistors, self-test results, over-temperature alarms, over-current alarms, and real-time measured channel voltage and current values. The digital signal interface runs completely parallel to the CLAN bus, with each of the two modules of the management computer directly controlling the circuit breaker's opening and closing by issuing high and low levels via hardwired connections. The power transistors are only turned on when the internal logic controller of the circuit breaker simultaneously receives both the bus closing command and the digital closing signal; when any one of the inputs issues a closing command or closing level, or when its own protection logic is triggered, it immediately and unconditionally shuts off. This dual-channel redundant control structure ensures that even in extreme cases where bus communication is subjected to strong electromagnetic interference or bus transceiver failure, the control computer can still forcibly shut down the faulty branch through hard-wired switching signals. Under normal conditions, the parallel operation of the dual channels improves the reliability of command transmission, achieving zero single point of failure in control.

[0040] The high-voltage, high-power solid-state circuit breaker is a solid-state circuit breaker based on silicon carbide or insulated-gate bipolar transistor devices, with bidirectional conduction function and a breaking time of less than five microseconds.

[0041] Specifically, the power circuit of each high-voltage, high-power solid-state circuit breaker uses a common-source series silicon carbide metal-oxide-semiconductor field-effect transistor or a reverse-resistance insulated-gate bipolar transistor to form a bidirectional switching unit, capable of bidirectional current carrying and breaking. Upon receiving a breaking command, the gate drive circuit removes the gate charge within nanoseconds, causing the power transistor to move from saturation conduction to the cutoff region. The entire turn-off process, from the arrival of the command to the current dropping to zero, is completed within five microseconds.

[0042] Each power battery power supply interface positive terminal is connected to the charging interface positive terminal through a high-voltage contactor, and all power battery power supply interface negative terminals are combined and then connected to the charging interface negative terminal through a high-voltage contactor.

[0043] Specifically, under ground charging conditions, the coils of the high-voltage contactors are driven by the auxiliary power supplied by the external charging pile or the onboard low-voltage power supply via a control computer. When the charging gun is inserted and the external charging interface's guidance signal is valid, the control computer first engages the high-voltage contactors of the common negative branch of all power battery power supply interfaces, establishing a negative path for the charging circuit. Then, according to the battery management system's charging strategy, it sequentially engages the high-voltage contactors of the corresponding battery pack's positive terminal, allowing the charging current to flow back to the charging pile through that contactor, the internal battery cells, and the common negative contactor. When a battery pack is fully charged, its positive contactor is disconnected before the next battery pack is connected, thus achieving orderly group charging. If any contactor experiences a sticking fault during charging, the control computer will disconnect the common negative contactor the instant the fault is detected. Even if the positive contactor is stuck and cannot be disconnected, the charging circuit can still be safely disconnected because the negative circuit is completely cut off, preventing overcharging and battery damage. This charging contactor configuration, with positive terminals grouped and negative terminals shared, achieves independent charging control and safe disconnection for all power battery packs with a minimum number of high-voltage contactors, balancing cost, weight, and safety requirements.

[0044] The device can be cascaded into two units to distribute multiple sets of power batteries to the two devices, providing redundant power distribution for the airborne load.

[0045] For details, see Figure 4When an electric aircraft has a large number of battery packs or extremely high requirements for power supply reliability, two identical sets of intelligent high-voltage power distribution equipment can be cascaded via an inter-aircraft communication bus and power cables. Multiple battery packs are connected to the respective battery power input interfaces of the two devices, either evenly or according to capacity. Each device supplies power to half of the propulsion motors and two backup flight control computers. The control computers of the two devices exchange information on the battery and load status under their respective jurisdictions via a cross-connected communication bus and jointly execute grid reconfiguration strategies. When one device loses power supply due to internal failure or battery depletion, the other device can provide cross-aircraft power to the critical loads it is responsible for by closing its reserved reconfiguration solid-state circuit breaker, ensuring that the aircraft still has a certain degree of controllability. This implementation extends the power distribution equipment from a single machine to a dual-machine redundant system, further eliminating the risk of single-point failure of the power distribution device itself at the system level, achieving a higher level of system fault tolerance, and meeting the high availability requirements of the power distribution system for large electric vertical takeoff and landing aircraft.

[0046] Example 2: This embodiment of the invention also provides a safety control method using the above-mentioned intelligent high-voltage power supply and distribution equipment for electric aircraft, comprising the following steps: After power-on, the non-similar dual-redundant control computer obtains the state of the micro switch; if the micro switch is in the closed state, the control computer executes the power battery grid connection and load power distribution control logic; if the micro switch is in the open state, the control computer reports a safety alarm and does not execute the power battery grid connection and load power distribution control logic.

[0047] See Figure 1 In practice, after the equipment is connected to the low-voltage control power supply, the main control module and backup control module of the non-similar dual-redundant management computer simultaneously initiate self-tests and run synchronously. During the first stage of program initialization, the safety monitoring unit reads the level signal of the microswitch through the general-purpose input / output port and stores this state as a global safety flag. Subsequently, before the management computer prepares to connect the power battery to the high-voltage grid or distribute power to the load, it checks this safety flag. If the flag is valid, indicating that the cover is closed, a series of grid connection operations are sequentially executed, including pre-charging and closing of the high-voltage, high-power solid-state circuit breaker, and then power is distributed to each load according to the energy management strategy. If the flag is invalid, the management computer immediately sends an alarm message to the onboard integrated display system via the communication bus and keeps all high-voltage, high-power solid-state circuit breakers and high-voltage contactors in the open state, refraining from executing external control commands. This method achieves effective personnel safety protection with extremely low hardware overhead. Furthermore, because the dual-redundant control computers independently accept the microswitch status, even if the reading circuit of one module fails, the other module can still output a lockout signal based on the correct status, ensuring single-fault safety of the safety function.

[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. An intelligent high-voltage power supply and distribution device for electric aircraft, characterized in that, include: The system includes a non-similar dual-redundant control computer, high-voltage high-power solid-state circuit breakers, high-voltage contactors, multiple sets of power battery power input interfaces, positive and negative dual high-voltage busbars, multiple power distribution output interfaces, a power battery charging interface, microswitches, and a fuse redundancy protection unit. Each of the multiple power battery power input interfaces is connected to its corresponding battery busbar via an independent high-voltage high-power solid-state circuit breaker. The positive and negative dual high-voltage busbars are physically isolated positive and negative busbars. Different battery positive busbars are interconnected via high-voltage high-power solid-state circuit breakers, while the negative busbars are connected in a single unit. The multiple power distribution output interfaces draw power from each battery busbar via high-voltage high-power solid-state circuit breakers. The power battery charging interface connects the external charging interface and the internal power battery power supply interface via a high-voltage contactor. The fuse redundancy protection unit includes fuses; except for the high-voltage high-power solid-state circuit breakers interconnecting the battery busbars, all other high-voltage high-power solid-state circuit breakers in the power battery power input and power distribution output circuits are connected in series with fuses. Microswitches are used to detect the closed state of the equipment cover.

2. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 1, characterized in that, The non-similar dual-redundant control computer includes a main control module and a backup control module. The main control module and the backup control module adopt different processor architectures, independent power supply circuits, independent sampling circuits and isolated communication buses, and their functions and external interfaces are the same. After the device is powered on, the main control module works and outputs, while the backup control module is in a hot backup state, executing logic but not outputting. Cross-verification and heartbeat monitoring are performed between the main and backup control modules.

3. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 2, characterized in that, Both the main control module and the backup control module are equipped with insulation monitoring units to monitor the insulation resistance to ground of the positive and negative dual high-voltage busbars and each branch, and to issue early warnings when insulation is abnormal.

4. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 2, characterized in that, Both the main control module and the backup control module are equipped with a power grid intelligent management and control unit: based on the status of the power battery and the power supply status of the battery pack busbars, the unit automatically controls the operation of each solid-state circuit breaker to complete the disconnection of the power battery from the grid and the switching of the busbars, thereby dynamically adjusting the high-voltage power grid configuration.

5. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 2, characterized in that, The non-similar dual-redundancy control computer is equipped with a safety monitoring unit: after the ground is powered on, it monitors the status of the micro switch. If it is in the closed state, it executes the power battery grid connection and load power distribution control logic; if it is in the open state, it reports a safety alarm and no longer executes the power battery grid connection and load power distribution control logic.

6. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 1, characterized in that, The high-voltage, high-power solid-state circuit breaker array receives control commands from the management computer via a CAN bus network. It is also designed with a switch signal interface to directly receive control from the management computer and uploads its own working status, self-test information, and channel voltage and current parameters via the CAN bus.

7. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 1, characterized in that, The high-voltage, high-power solid-state circuit breaker is a SiC-based solid-state circuit breaker with bidirectional conduction function and a breaking time of less than 10μs.

8. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 1, characterized in that, Each power battery power supply interface positive terminal is connected to the charging interface positive terminal through a high-voltage contactor, and all power battery power supply interface negative terminals are combined and then connected to the charging interface negative terminal through a high-voltage contactor.

9. The intelligent high-voltage power supply and distribution equipment for electric aircraft according to claim 1, characterized in that, The device can be cascaded into two units to distribute multiple sets of power batteries to the two devices, providing redundant power distribution for the airborne load.

10. A control method using the intelligent high-voltage power supply and distribution equipment for electric aircraft as described in claim 1, characterized in that, Includes the following steps: After power-on, the non-similar dual-redundancy control computer acquires the state of the micro switch; If the micro switch is closed, the control computer executes the power battery grid connection and load power distribution control logic; If the microswitch is in the open state, the control computer will report a safety alarm and will not execute the power battery grid connection and load power distribution control logic.

Images