Aircraft propulsion utilizing safety-critical energy management systems

Abstract

An energy management system (EMS) for an aircraft is provided. The aircraft may have one of a plurality of propulsion systems, such as a parallel hybrid electric propulsion system, a parallel turboelectric propulsion system, an electric propulsion system, a turboelectric propulsion system, and a turbohybrid electric propulsion system. The EMS includes redundant control paths for controlling safety-critical operations. Each redundant control path is configured to independently determine whether to electrically isolate a line replaceable unit (LRU) from a high-voltage direct current link (HVDC link) based on status information from the LRU. The isolation is based on the independent determination. The HVDC link is used for propulsion. The number of redundant control paths and components may depend on the type of propulsion system.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001]

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 63 / 389,599, filed July 15, 2022, which is incorporated herein by reference in its entirety. [Technical Field]

[0002]

[0002] The present disclosure relates to energy management systems for different aircraft propulsion architectures. [Background technology]

[0003]

[0003] Most known aircraft use prime movers such as jet engines for propulsion. However, recently, it has been proposed to use electric motor(s) to either provide thrust or to assist jet engines for propulsion. While the use of electric motors or hybrid power is common in ground vehicles such as cars and buses, their use in aircraft has not been successfully adopted. This is because many of the techniques used for ground vehicles do not translate directly to aircraft propulsion. This is also because the power requirements for aircraft propulsion are significantly higher than those of a car or bus and the flight duration.

[0004] Aircraft systems also require extensive testing to meet stringent safety requirements for certification, including testing of the system's hardware and software elements to ensure that the system has an extremely low probability of experiencing a catastrophic failure, a failure that could result in imminent loss of life and property. Summary of the Invention

[0005]

[0005] Therefore, an energy management system (EMS) for an aircraft is disclosed. The EMS can be connected to multiple line replaceable units (LRUs). The LRUs can be sink LRUs or source LRUs. The source LRU is a source of power for a high-voltage direct current link (HVDC link), and the sink LRU uses power from the HVDC link. The HVDC link can be used for propulsion. The EMS includes one or more communication interfaces. The communication interfaces can be configured to receive status information from each of the source LRU and the sink LRU. The status information can include information from respective sensors in each LRU and a determination that the information from each sensor is within a predetermined range. The communication interfaces can be used to send commands to the source LRU and the sink LRU. The EMS includes redundant control paths for controlling safety-critical operations. The redundant control paths are configured to independently determine whether to electrically isolate the LRUs from the HVDC link based on the status information from the LRUs. The isolation of the LRUs is based on the independent determination.

[0006] The number of redundant control paths and components may depend on the type of propulsion system. The aircraft may have one of several propulsion systems, such as a parallel hybrid electric propulsion system, a parallel turboelectric propulsion system, an electric propulsion system, a turboelectric propulsion system, and a turbohybrid electric propulsion system.

[0007] In aspects of the present disclosure, the EMS can be configured to achieve less than a threshold probability of catastrophic failure. For example, the threshold probability of catastrophic failure can be less than 10 -9 It could be.

[0008] In an aspect of the present invention, the redundant control paths may also independently determine whether to electrically connect the LRU to the HVDC link. [Brief explanation of the drawings]

[0009] [Figure 1]1 illustrates a system according to an aspect of the present disclosure. [Figure 2]

[0010] 1 illustrates an energy management system in a parallel turbo hybrid propulsion system according to an aspect of the present disclosure. [Figure 3]

[0011] 1 illustrates an energy management system in a parallel hybrid electric propulsion system according to an aspect of the present disclosure. [Figure 4]

[0012] 1 illustrates an energy management system according to an aspect of the present disclosure. [Figure 5]

[0013] 4 illustrates an exemplary distributed system control unit for the energy management system of FIGS. 2 and 3 according to an embodiment of the present disclosure. [Figure 6]

[0014] 1 illustrates a power conversion unit according to an aspect of the present disclosure. [Figure 7]

[0015] 6 illustrates a method of key-on time management for the distributed system control unit of FIG. 5 according to an embodiment of the present disclosure. [Figure 8]

[0016] 6 illustrates a method for in-flight management of line replaceable unit connections for the distributed system control unit of FIG. 5 according to an aspect of the present disclosure. [Figure 9]

[0017] 6 illustrates a method of in-flight management for the distributed system control unit of FIG. 5 in response to receiving commands from the cockpit according to an aspect of the present disclosure. [Figure 10]

[0018] 4 illustrates another system control unit, either federated or distributed, for the propulsion system of FIGS. 2 and 3 according to aspects of the present disclosure. [Figure 11]

[0019] 11 illustrates a method for in-flight management of line replaceable unit connections for the system control unit of FIG. 10 according to an aspect of the present disclosure. [Figure 12]

[0020] 1 illustrates an energy management system in an all-electric propulsion system according to an aspect of the present disclosure. [Figure 13]

[0021] 1 illustrates an energy management system in a turboelectric propulsion system according to an aspect of the present disclosure. [Figure 14]

[0022] 1 illustrates an energy management system in a turbo-hybrid electric propulsion system according to an aspect of the present disclosure. [Figure 15]

[0023] 15 illustrates an exemplary federated or distributed system control unit for the propulsion system of FIGS. 12-14, according to an embodiment of the present disclosure. [Figure 16]

[0024] 16 illustrates a method of key-on time management according to an embodiment of the present disclosure for the system control unit of FIG. 15. [Figure 17] 16 illustrates a method of key-on time management according to an embodiment of the present disclosure for the system control unit of FIG. 15. [Figure 18] 16 illustrates a method of key-on time management according to an embodiment of the present disclosure for the system control unit of FIG. 15. [Figure 19]

[0025] 16 illustrates a method for in-flight management of line replaceable unit connections for the system control unit of FIG. 15 according to an aspect of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0010]

[0026] Aspects of the present disclosure provide an energy management system(s) (EMS) 10 that enables an aircraft's propulsion system to have a catastrophic failure probability rate below a predetermined threshold. The predetermined threshold may be a threshold required for the aircraft to meet certification. In some aspects, the predetermined threshold is less than 10 -9 In some aspects, the EMS 10 achieves this by using redundant control paths. The number of redundant control paths, the functionality achieved by the redundant control paths, and the control may be based on the type of propulsion architecture for the aircraft. The aircraft may be a conventional take-off and landing (CTOL) or vertical take-off and landing (VTOL) aircraft.

[0011]

[0027] The EMS 10 may be connected to a source line replaceable unit (source LRU 20) and a sink line replaceable unit (sink LRU 25). The type of source LRU 20 may depend on the propulsion architecture for the aircraft. For example, the source LRU 20 may be an energy storage system (ESS) 20A, such as in a parallel turbo-hybrid propulsion system 100A (as illustrated in FIG. 2), a parallel hybrid-electric propulsion system 100B (as illustrated in FIG. 3), an all-electric propulsion system 100C (as illustrated in FIG. 12), and a turbo-hybrid-electric propulsion system 100E (as illustrated in FIG. 14).

[0012]

[0028] The ESS 20A may include a control unit 200, an energy storage device 205, a thermal management unit, and a bus tie contactor / circuit breaker 215 (also referred to as a contactor 215). The control unit 200 may include a combination of a microprocessor, a field programmable gate array (FPGA), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a multi-chip module (MCM), or discrete logic (individually or collectively referred to herein as a "processor"). For example, the processor may include both a microprocessor and an FPGA. The microprocessor may include software for performing the functions described herein. The microprocessor may also include memory. Alternatively, the memory may be separate. The memory may include random access memory (RAM), read-only memory (ROM), flash memory, etc. The control unit 200 may further include one or more interfaces, such as an analog interface and a COM bus interface. The control unit 200 may further include other network interfaces, such as Ethernet, serial interfaces such as ARINC 429, 422, 485 interfaces, or wireless interfaces. The interfaces may receive a key-on signal from the cockpit / flight deck 40. The interfaces may also be used to receive commands from the EMS 10, such as pre-charge commands, commands to open or close contactors or circuit breakers 215, and commands to power the high-voltage DC link (HVDC 225A). A processor in the ESS 20A is configured to determine status information from one or more sensors in the ESS 20A. The status information for the ESS may include voltage, overvoltage, undervoltage, current, overcurrent, undercurrent, ground voltage, state of charge (SOC), delta SOC, temperature, and other characteristics of the ESS. The processor may determine whether each characteristic is within a predetermined range (the ranges may be stored in memory). The processor may also be configured to send status information to the EMS 10 at key-on and periodically during flight. The processor in the ESS 20A may be configured to perform built-in tests.

[0013]

[0029] The processor may also be configured to respond to commands from the EMS 10, such as opening and closing contactors / circuit breakers 215 as needed, precharging lines, providing power, etc. The processor may also provide local bias power for the BIT.

[0014]

[0030] The energy storage device ESD 205 supplies DC power to the HVDC 225A via a direct current (DC) link 225 (and the EMS 10). The ESD may be a lithium-ion battery. The ESD 205 may also alternatively or additionally include an ultracapacitor, a lead-acid battery, and other energy storage media. The ultracapacitor may include an electric double-layer capacitor (EDLC), also known as a supercapacitor, supercapacitor, or electrochemical double-layer capacitor, which comprises an electrochemical capacitor with a relatively high energy density.

[0015]

[0031] The supplied power may be at a first voltage 225 (DC link 225), which may be the same as or different from the voltage of HVDC link 225A, depending on the propulsion architecture for the aircraft and the size and mission of the aircraft.

[0016]

[0032] In an embodiment of the present disclosure, the nominal voltage of the first voltage 225 is greater than 400 VDC. For example, the first voltage 225 can be 800 VDC.

[0017]

[0033] The thermal management unit 210 may control the temperature of the ESS 20A to maintain the environment within a preset thermal environment, such as within a range, to achieve safe and optimal thermal conditions. In embodiments of the present disclosure, the thermal management unit 210 may include a liquid cooling plate, a fan, and a pump to move liquid through pipes passing through the plate. The pipes may include one or more controllable valves to control the liquid passing through the pipes. These valves may be controlled via actuators. In embodiments of the present disclosure, a processor in the ESS 20A controls the actuators. In other embodiments, the thermal management unit 210 may have its own processing elements, including a microprocessor, an FPGA, and combinations thereof. Additionally, the ESS 20A may include other thermal cooling materials to maintain temperature.

[0018]

[0034] The bus tie contactor / circuit breaker 215 provides protection for the DC link 225, 225A, etc. The type of device in the circuit may depend on the DC link voltage and propulsion architecture. The contactor / circuit breaker 215 is designed for high voltage. High voltage, as used herein, means voltages greater than 50 VDC. The contactor may be thermal, electromechanical, or solid-state. In other embodiments, the contactor may be a combination thereof. The circuit breaker may be made from the above. In embodiments of the present disclosure, both bus tie contactors and circuit breakers may be used. However, in other embodiments, either may be used. In embodiments of the present disclosure, a processor in the ESS 20A may control the bus tie contactor / circuit breaker 215 based on commands from the EMS 10. In other embodiments, the bus tie contactor / circuit breaker 215 may have a dedicated processor, such as a microprocessor or FPGA, or a combination thereof.

[0019]

[0035] In other aspects, the source LRU 20 may also be a turbo-generator 20B, such as in a parallel turbo-hybrid propulsion system 100A (as illustrated in FIG. 2), a turbo-electric propulsion system 100D (as illustrated in FIG. 13), and a turbo-hybrid electric propulsion system 100E (as illustrated in FIG. 14). The turbo-generator 20B may include a prime mover, such as a turbo-engine 430, a generator 425, and a power conversion unit (PCU) 400. The turbo-engine 430 may receive fuel via a fuel line (not shown). The size and type of the turbo-engine 430 may depend on the size, propulsion architecture, and flight duration and use (mission) of the aircraft. Additionally, the size and type of the turbo-engine 430 may be based on the number of turbo-generators 20B. The generator 425 may be a permanent magnet generator, such as a surface permanent magnet generator or an interior permanent magnet generator. However, other types of generators may be used, such as wound field, induction, synchronous reluctance (SynR), axial flux machines, and switched reluctance generators. The type of generator used is not limited to the above, and other machines suitable for converting mechanical motion into electrical energy may be used. The generator 425 is connected to the output shaft 435 of the turbo-engine. The generator 425 may supply three-phase AC 440 to the power conversion unit 400.

[0020]

[0036] The PCU 400 may include a control unit 405, a power stage 410, input / output filtering 415, and a bus tie contactor / circuit breaker 215.

[0021]

[0037] The control unit 405 may include a processor as described above. For example, the processor may include a combination of a microprocessor and an FPGA. The microprocessor may include software for performing the functions described herein. The microprocessor may also include memory. Alternatively, the memory may be separate. The memory may include random access memory (RAM), read-only memory (ROM), flash memory, etc. The control unit 405 may further include one or more interfaces, such as an analog interface and a COM bus interface. The control unit 405 may further include other network interfaces, such as Ethernet, serial buses such as ARINC 429, 422, and 485 interfaces, or wireless interfaces. The interface may receive a key-on signal from the cockpit / flight deck 40. The interface may also be used to receive commands from the EMS 10, such as commands to open or close contactors or circuit breakers 215 and provide power to the high-voltage DC link 225A. The processor in the PCU 400 is configured to determine status information from one or more sensors in the PCU 400. The status information for the PCU may include voltage, overvoltage, undervoltage, current, overcurrent, undercurrent, ground voltage, state of charge (SOC), delta SOC, temperature, and other characteristics of the PCU. The processor may determine whether each characteristic is within a predetermined range (the ranges may be stored in memory). The processor may also be configured to send the status information to the EMS 10 at key-on and periodically during flight. The processor in the PCU also controls the generator 425 to provide power based on commands from the EMS 10 for propulsion. The manner in which the generator 425 is controlled may depend on the type of generator 425. For example, the control may be field-oriented control, space vector modulation, or deadbeat control.

[0022]

[0038] The power stage 410 may include circuitry (inverter) for converting AC power 440 received from the generator 425 into power for the DC link 225B. In embodiments of the present disclosure, the circuitry may include high-power semiconductor switching devices such as metal-oxide field-effect transistors (MOSFETs), insulated-gate bipolar transistors (IGBTs), high-electron-mobility transistors (HMETs), or thyristors. The semiconductors may include silicon, silicon carbide, gallium nitride, and / or other materials. In some embodiments, the switching devices may be configured in a single-level, two-level, or multi-level configuration.

[0023]

[0039] The power stage 410 may also include drive circuitry for biasing the switching elements.A processor in the turbo generator 20B may be configured to perform built-in tests.

[0024]

[0040] The power stage 410 may also include the reference sensors (voltage, current, temperature, etc.) mentioned above.

[0025]

[0041] Input / output filtering 415 is configured to filter the output of power stage 410 to improve power quality. Filtering 415 may comprise one or more capacitors C and inductors L for an LC filter. In other aspects, filtering 415 may include or alternatively have one or more diodes D.

[0026]

[0042] A similar bus tie contactor / circuit breaker 215 may be used in turbo generator 20B.

[0027]

[0043] The number of ESSs 20A and turbo-generators 20B may be based on the application, such as the size of the aircraft, and mission-dependent parameters, such as speed, flight length, maneuvers, and the like.

[0028]

[0044] The sink LRU 25 may be a parallel turbo propulsion unit 25A, such as in a parallel turbo hybrid propulsion system 100A (as illustrated in FIG. 2) or a parallel hybrid electric propulsion system 100B (as illustrated in FIG. 3). The parallel turbo propulsion unit 25A may include a turbo engine 430A, a motor 425A, a PCU 400A, a blending gearbox 505, and a propulsion fan 510. In the parallel turbo propulsion unit 25A, two mechanical shafts 435A (from the engine 430A) and 435B (from the motor 425A) are connected to the fan 510 via the blending gearbox 505. The blending gearbox 505 allows the speeds of the mechanical shafts 435A / 435B to be appropriately combined via gear ratios to achieve a speed for the fan 510.

[0029]

[0045] The motor 425A may be an electric machine similar to those described above, such as a permanent magnet, such as a surface permanent magnet or an internal permanent magnet. However, other types of electric machines may be used, such as wound field, induction, synchronous reluctance (SynR), axial flux machines, and switched reluctance. The type of motor used is not limited to the above, and other machines suitable for converting electrical energy (AC power 440A) into mechanical motion may be used.

[0030]

[0046] The PCU 400A in the parallel turbopropulsion unit 25A is similar to the PCU 400 in the turbo generator 20B in that it includes a control unit 405A, a power stage 410A, input / output filtering 415A, and a bus tie contactor / circuit breaker 425A. Because the HVDC link 225A can be more expensive than the DC links 225 and 225B, the bus tie contactor and circuit breaker 425A need to be designed for a higher rating.

[0031]

[0047] The control unit 405A may include a processor as described above. For example, the processor may be a combination of a microprocessor and an FPGA. The microprocessor may include software for performing the functions described herein. The microprocessor may also include memory. Alternatively, the memory may be separate. The memory may include random access memory (RAM), read-only memory (ROM), flash memory, etc. The control unit 405A may further include one or more interfaces, such as an analog interface and a COM bus interface. The control unit 405A may further include other network interfaces, such as Ethernet, serial, such as an ARINC 429, 422, or 485 interface, or wireless interfaces. The interface may receive a key-on signal from the cockpit / flight deck 40. The interface may also be used to receive commands from the EMS 10, such as commands to open or close a contactor or circuit breaker 425A and to provide mechanical power to the fan 510 using the HVDC link 225A. The processor in the PCU is configured to determine status information from one or more sensors in the PCU 400A. The status information for the PCU may include voltage, overvoltage, undervoltage, current, overcurrent, undercurrent, ground voltage, state of charge (SOC), delta SOC, temperature, and other characteristics of the PCU. The processor may determine whether each characteristic is within a set range. The processor may also be configured to send the status information to the EMS 10 at key-on and periodically during flight. The processor in the PCU also controls the motor 425A to provide mechanical power based on commands from the EMS 10 for propulsion. The manner in which the motor 425A is controlled may depend on the type of motor 425A. For example, the control may be field-oriented control, space vector modulation, or deadbeat control.

[0032]

[0048] The power stage 410A may include circuitry (inverter) that converts the received HVDC link 225A into AC power 440A for the motor 425A. The circuitry may be similar to that described above, but may be reversed.

[0033]

[0049] The sink LRU 25 may be an electric propulsion unit 25B, such as found in an all-electric propulsion system 100C (as illustrated in FIG. 12), a turboelectric propulsion system 100D (as illustrated in FIG. 13), and a turbo-hybrid electric propulsion system 100E (as illustrated in FIG. 14). The electric propulsion unit 25B is similar to the parallel turbopropulsion unit 25A, except that the turbo engine 430A (and shaft 435A) and the blending gearbox 505 are removed. The shaft 435B from the motor 425A may be directly connected to the fan 510 or indirectly connected through a gearbox (not shown).

[0034]

[0050] Again, the number of parallel turbopropulsion units 25A or electric propulsion units 25B may be based on the application, such as size of the aircraft, and mission-dependent parameters, such as speed, length of flight, maneuvers, etc.

[0035]

[0051] Use of the propulsion architecture described herein saves fuel costs per flight. For example, 30-70% less fuel may be used. Additionally, use of this architecture results in dramatic reductions in emissions, which enables new routes and markets that were not previously economically feasible. Additionally, the propulsion architecture allows airframers to maximize the efficiency of air travel by placing certain LRUs in more aerodynamically favorable locations within the system.

[0036]

[0052] For example, the use of a parallel turbo hybrid propulsion system 100A (as illustrated in FIG. 2) may be able to achieve an optimal fuel burn rate resulting in a net reduction in fuel consumption of 20-40%, even if the route is extended further than ESS 20A can handle. This is because the source includes both turbo-generator 20B and ESS 20A. Additionally, a net reduction in fuel consumption of 50-70% may be achieved due to the efficiency in controlling the combination of sources. Moreover, because there may be multiple parallel turbo propulsion units (distributed propulsion), power may be optimally provided from the cockpit 40 to achieve the desired performance. In the case of all-electric propulsion, a 100% fuel burn savings may be achieved.

[0037]

[0053] 4 illustrates an EMS 10 according to an embodiment of the present disclosure. The EMS 10 includes a system control unit (SCU) 300, a power conversion unit 305, a power distribution unit 310, and a bus tie contactor / circuit breaker 215.

[0038]

[0054] In an embodiment of the present disclosure, the EMS 10 may be implemented as a distributed control system. FIG. 5 illustrates an example of an SCU 300 with distributed control. In the SCU 300 illustrated in FIG. 5, there are two control paths, one of which is via the flight deck 40. In an embodiment of the present disclosure, the flight deck 40 includes a human-machine interface (HMI) 614. The HMI 614 may include a display, a means for receiving commands from a pilot or user, and a processor. The display may be a screen on a panel in the flight deck. The display may also be a head-up display or a head-mounted display. The display may display status information from the LRUs 20, 25. The status information may be transmitted directly from the LRUs 20, 25 to the HMI 614 via the COM bus interface 612B. Transmission / reception of status information is not limited to via the COM bus interface 612B. For example, the status information may be transferred via an analog interface. A pilot or user may use the means for receiving commands to instruct the LRU 20, 25 to open the contactor or breaker 215, 425A and disconnect it from the HVDC link 225A. For example, the pilot or user may view the status information and determine that a failure in the LRU is associated with a safety-critical issue and remove the LRU from the HVDC link 225A.

[0039]

[0055] In response to receiving this command, the processor in the HMI 614 relays a command to the appropriate LRU to open the contactor or breaker 215, 425A, disconnecting it from the HVDC link 225A.

[0040]

[0056] The means for receiving commands may be a touch panel, a push button, or a switch on the display.

[0041]

[0057] The second control path may include a processor 600, a COM bus interface 612A, and an analog interface 610. As shown, the second control path may also include a memory. In aspects of the present disclosure, the processor may be a combination of elements including software running on hardware, hardware in firmware, etc. As described above, the processor 600 may include a microprocessor, an FPGA, a DSP, an ASIC, an MCM, or analog circuitry. In aspects of the present disclosure, the processor may be a combination of a microprocessor and an FPGA. The memory 605 may include random access memory (RAM), read-only memory (ROM), flash memory, etc.

[0042]

[0058] The analog interface 610 may be configured to receive a key-on signal from the flight deck 40. The COM bus interface 612A may receive status information from the LRUs 20, 25. In other aspects, the status information may be received by the analog interface(s).

[0043]

[0059] FIG. 6 illustrates an example of a power conversion unit 305. The power conversion unit 305 may include multiple DC-DC converters 640A-640N. One of the converters may be used to convert a DC voltage (first voltage 225) to VDC for the HVDC link 225A. This converter may be a buck-boost converter. This may be used when the voltage from the HVDC link 225A is higher than the first voltage 225 provided by the ESS 20A. Another DC-DC converter (or the same) may be used to convert the voltage on the DC link 225B to the HVDC link 225A. In an embodiment of the present disclosure, the voltage 225B is the same as the voltage 225B.

[0044]

[0060] In other aspects, different DC-DC converters may be used to provide local bias voltages for hardware, such as for the processor, and to bias the switches. The source of the bias voltage may be in the cockpit or may be a low-voltage DC battery. In aspects of the present disclosure, a DC-DC converter in the EMS 10 may provide a local bias voltage to the hardware in the LRUs 20, 25 at key-on. In other aspects, each LRU has its own DC-DC converter to provide a local bias voltage.

[0045]

[0061] In other aspects, the EMS 10 may include a DC-DC converter for providing DC power to accessories, which may include lighting and radios.

[0046]

[0062] In other aspects, the power conversion unit 305 may include DC-AC converters 642A-642N (e.g., inverters). These inverters may be used to provide AC power to AC accessories. AC accessories are typically motor-driven. Thus, the EMS 10 may be coupled to the motors for the associated accessories. For example, AC accessories may include air compressors and air conditioning compressors. As used herein, the phrase "AC accessory" also refers to the subsystems required for the accessory to function.

[0047]

[0063] Power distribution unit 310 may include a plurality of connection terminals and cabling configured to receive connector cables for electrically connecting LRUs 20, 25 to EMS 10. Power distribution units 310 may be distributed throughout the aircraft and separated as needed to route cables from one LRU to another through EMS 10.

[0048]

[0064] 5 provides redundant control paths, the redundant control paths may not be used for each control instance. For example, in an embodiment of the present disclosure, when a key-on is received, both control paths may not be used to determine whether to connect an LRU to HVDC link 225A.

[0049]

[0065] FIG. 7 illustrates a method for responding to a key-on signal from the cockpit 40 according to an aspect of the present disclosure for the architecture illustrated in FIGS.

[0050]

[0066] At S1, each LRU 20, 25 and EMS 10 receives a key-on signal from the flight deck 40. The key-on signal may be transmitted via analog interface(s). The key-on signal may be received along with DC power to bias certain circuitry necessary to perform built-in test (BIT) and communicate with the EMS 10, or vice versa.

[0051]

[0067] At S3, each LRU 20, 25 executes its respective BIT. In the BIT, sensors in the LRU 20, 25 report sensed / detected values to their respective processors. In an embodiment of the present disclosure, each processor in the control units 200 and 400A (and 400, depending on the architecture) determines whether the sensed values are within a predetermined range. The predetermined range for each sensed parameter may be stored in the respective memory in each LRU 20, 25. When the sensed parameter is outside the predetermined range, the LRU 20, 25 adds a fault determination to the status information (e.g., fault = yes). The status information may include the fault determination and the raw sensed value from the sensor(s). In other embodiments, the processor in the control units 200 and 400A (and 400, depending on the architecture) may calculate additional information based on the sensed values and add the calculated additional information to the status information. At S5, each LRU 20, 25 transmits the status information to the EMS 10 (SCU 300) via the COM bus interface. At S7, processor 600 (in SCU 300) receives a report containing status information from each LRU 20, 25. For each LRU 20, 25, processor 600 determines from the status information whether the LRU 20, 25 is ready (e.g., to either receive or generate power) at S9. In an aspect of the present disclosure, if the processor in the control unit of the LRU determines that a fault exists, processor 600 determines that the LRU is not ready to receive or supply power at S9 (N at S9), does not issue a command to close contactor 215 / 425A, and generates a report indicating the fault and logs the report in memory at S11.

[0052]

[0068] On the other hand, when there is no fault in the sink LRU 25, the processor 600 issues a command to the sink LRU 25 to close the contactor 425A to the HVDC link 225A in S13. Also, when there is no fault in the source LRU 20 and the source LRU 20 is an LRU that needs to be precharged, such as the ESS 20A, the processor 600 may issue a command to the ESS 20A to precharge in S15. When a source LRU 20, such as the turbo generator 20B (if included in the architecture), does not need to be precharged, the processor 600 may issue a command to the turbo generator 20B to close the contactor 215 that electrically connects the turbo generator 20B to the HVDC link 225A (via the EMS 10). The EMS may also close its contactor 215 / 425A. The above commands may be issued via the COM bus interface 612A.

[0053]

[0069] At S17, the sink LRU 25 receives the command and the processor in the control unit 405A causes the contactor 425A to close to connect the LRU 25 to the HVDC link 225A.

[0054]

[0070] At S19A, turbo generator 20B (if included in the architecture) receives the command and the processor in control unit 405 causes contactor 215 to close, connecting LRU 25 to HVDC link 225A (via EMS 10).

[0055]

[0071] In S19, the ESS 20A receives a command to precharge. In an embodiment of the present disclosure, the ESS 20A has precharge circuitry. This precharge circuitry may include a contactor in parallel with an inrush resistor. In response to receiving the command, a processor in the control unit 200 closes the contactor. In this embodiment, sensors on both sides of the contactor measure current / voltage. The sensed values may be used to determine whether the DC link 225 is sufficiently precharged.

[0056]

[0072] In S21, the processor 600 determines whether the ESS 20A has closed its precharge contactor. In an embodiment of the present disclosure, voltage and current sensors may be used for this determination. In an embodiment of the present disclosure, the processor in the control unit 200 may report sensed values to the processor 600. If the processor 600 determines that the precharge contactor is not closed (remains open) (N in S21), the ESS 20A is not connected to the HVDC link 225A, and a report indicating a fault is logged in S11. Once the precharge contactor is closed, the processor 600 waits to command the ESS 20A to close the main contactor 215 until the precharge reaches a predetermined condition. In an embodiment of the present disclosure, the predetermined condition may be a steady-state voltage, e.g., an equilibrium voltage. In other embodiments, the predetermined condition may be current-based.

[0057]

[0073] At S23, processor 600 may use the sensed values to determine whether predetermined conditions are met. If the precharge is sufficient (Y at S23), processor 600 issues a command to a processor in control unit 200 (at S25) to open the precharge contactor and close main contactor 215. If the precharge is not sufficient (and after a preset period of time has elapsed), processor 600 leaves main contactor 215 open and generates a report indicating a fault at S11.

[0058]

[0074] At S27, the processor in the control unit 200 receives the command to open the precharge contactor and close the main contactor 215. If the main contactor 215 is not closed, the processor 600 generates a report at S11 indicating a fault. The report may include a timestamp.

[0059]

[0075] FIG. 8 illustrates an example of redundant control of the connection status of the LRUs 20, 25 during operation while the aircraft is in flight.

[0060]

[0076] At S100, each control path receives a report from each LRU 20, 25. The reports are received periodically. The reports include sensed values from the sensors and a fault determination by the respective processor, e.g., a sensed value outside a predetermined range. The report(s) are received by processor 600 and HMI 614 via respective COM bus interfaces 612A, 612B.

[0061]

[0077] In S102, status information (decisions and raw sensed data) may be displayed on the HMI display. In S104, each control path independently confirms / determines whether the LRU 20, 25 has a fault. For example, the processor 600 determines whether the report indicates a fault has been determined; additionally, the processor 600 may also compare the sensed value with a predetermined range for the parameter (the predetermined range may also be stored in memory in the EMS 10). Additionally, a pilot viewing the HMI display may recognize the fault determination. In aspects of the present disclosure, the display may use a different color or indication for sensed values outside the predetermined range. When there is no fault (N in S104), the control path returns to S100. In contrast, when there is a fault (Y in S104), each control path independently determines in S106 whether the fault may cause or has caused a safety-critical issue. A safety-critical issue is a potential imminent danger to human life and health. The processor 600 may determine a safety-critical issue based on the magnitude of the out-of-range value or combination of values. The processor 600 may have a look-up table that defines the safety-critical issue based on the sensed outputs. The pilot may also view the sensed values on the display and determine that a fault is causing or will cause a safety-critical issue. If any control path determines that the LRU 20, 25 has a safety-critical issue (Y in S108), the LRU may be isolated from the HVDC link 225A. For example, either or both of the HMI 614 and / or the processor 600 may issue a command to the LRU 20, 25 to open the contactor 215 / 425A in S110. The command may be transmitted via the respective COM buses 612A, 612B.

[0062]

[0078] If the fault does not cause a safety-critical issue (N in S108), the processor 600 generates and logs a report indicating the fault condition in S112.

[0063]

[0079] In aspects of the present disclosure, safety-criticality may also be determined by examining aircraft performance such as changes in trajectory, speed, altitude, and the like.

[0064]

[0080] In S114, the processor 600 (and HMI 614) monitors and determines whether the safety-critical faulted LRU has been isolated from the HVDC link 225A by utilizing appropriate sensors to verify that the contactors / circuit breakers are open. If it is determined that the safety-critical faulted LRU has been isolated (Y in S114), the processor 600 continues to control the remaining LRUs based on propulsion commands from the cockpit 40 in S118.

[0065]

[0081] If it is determined that the safety-critical faulty LRU cannot be isolated (contactor 215 / 425A is not open), processor 600 may issue a command for an emergency landing to cockpit 40 via COM bus 612A in S116. Processor 600 may also generate a report with the event in S116.

[0066]

[0082] FIG. 9 illustrates an example of a method for responding to thrust commands from the cockpit 40 according to an embodiment of the present disclosure.

[0067]

[0083] In S200, processor 600 may receive a propulsion command from flight deck 40. The propulsion command may be a power command, a torque command, or a speed command. The command may include a vector, such as a direction. In S202, processor 600 may determine whether any LRUs 20, 25 have been isolated due to a fault. This is because EMS 10 may control the LRUs to account for the isolated LRUs, e.g., in S204B, adjust the "normal command" as needed to maintain desired performance while achieving minimum aerodynamic integrity.

[0068]

[0084] When no LRUs 20, 25 are isolated, e.g., fully connected, LRUs, the processor 600 executes architecture and aircraft-based control logic to determine the appropriate control commands to issue to each LRU 20, 25 in S204A. The control commands may also be speed, torque, or power commands as needed to achieve minimum aerodynamic integrity. In aspects of the present disclosure, the control commands may be different for the parallel turbohybrid propulsion system 100A or the parallel hybrid propulsion system 100B. The particular control logic may also be aircraft-specific and customized by the aircraft manufacturer.

[0069]

[0085] When there are isolated LRUs 20, 25, the processor 600 executes architecture and aircraft-based control logic to determine the appropriate control commands to issue to each LRU 20, 25, in S204B, while augmenting power / propulsion from the remaining LRUs as needed.

[0070]

[0086] The amount of augmentation and which LRUs are augmented may also be architecture and aircraft specific to achieve the desired propulsion commanded from the flight deck 40.

[0071]

[0087] In S206, the processor 600 issues the determined command (in either S204A or S204B) to the LRUs 20, 25 connected to the HVDC link 225A.

[0072]

[0088] 10 illustrates another SCU 300A for an EMS 10 according to an embodiment of the present disclosure. In SCU 300A, the HMI is not shown, and the redundant control path includes a primary control path and a return control path. In an embodiment of the present disclosure, control via an HMI as described above may also be included.

[0073]

[0089] In SCU 300A, each control path may include a processor 600, a memory 605, an analog interface, and a COM bus interface 612A. In an embodiment of the present disclosure, the primary control path further includes a truth model. The truth model may be stored in memory 605 and executed by processor 600. The truth model is a mapping of sensor outputs to valid fault / non-fault decisions. In another embodiment of the present disclosure, the truth model may alternatively be executed in processor 600 in the return path. In another embodiment of the present disclosure, the truth model may be executed in the primary and return control paths. In yet another embodiment of the present disclosure, the truth model may be executed solely in a separate, independent processor (not shown in FIG. 10 ). The primary control path is configured to take commands from the cockpit 40, issue commands to the LRUs 20, 25, receive status information from the LRUs 20, 25, and control the LRUs based thereon. The return control path is configured to receive commands from the cockpit 40 but not issue commands to the LRUs 20, 25 unless the primary control path fails. The return control path is also configured to receive reports from the LRUs and determine if a safety-critical failure has occurred but not issue commands to isolate the LRUs unless the primary control path fails.

[0074]

[0090] Each processor 600 may communicate with each of the other processor(s) 600.

[0075]

[0091] Again, the redundant control path may not be used at key-on, however, in other aspects the redundant control path may be used.

[0076]

[0092] 11 illustrates another example of redundant control of the connection status of LRUs 20, 25 during operation while the aircraft is in flight. At S100, each processor 600 receives status information from the LRUs 20, 25 (each LRU). Reports are received periodically.

[0077]

[0093] At S106A, each processor 600 independently determines whether there is a fault, and if there is a fault, the processor 600 independently determines whether the fault has caused or is likely to cause a safety-critical problem.

[0078]

[0094] Each independent decision is sent to another control path (another processor) in S1100.

[0079]

[0095] The processor 600 determines whether there is agreement. If the control paths agree that there is a safety-critical problem with the LRU (Y in S108A), the processor 600 for the primary control path issues a command to the faulty safety-critical LRU to open the contactor 215 / 425A to isolate it from the HVDC link 225A in S110.

[0080]

[0096] If there is a disagreement and one of the control paths determines that there is a safety-critical issue in one of the LRUs (N in S108A but Y in S1102), then in S1104 a truth model is run against the status information to independently verify which of the safety-critical issue decisions is valid.

[0081]

[0097] The truth model examines the raw sensor values and determines whether the LRU has a safety-critical issue based on the sensor values. In other aspects of the present disclosure, the voting engine may be executed by one or both of the processors 600. The voting engine may be executed by an external processor.

[0082]

[0098] If the truth model determines that the LRU has a safety-critical problem (a valid safety-critical decision) (Y at S1106), the processor 600 for the primary control path issues a command to the faulty safety-critical LRU to open the contactor 215 / 425A and isolate it from the HVDC link 225A at S110.

[0083]

[0099] If the truth model determines that the LRU does not have a safety-critical issue (invalid safety-critical decision) (N at S1106), the processor 600 (in the primary control path) generates a report of the event at S112 and logs the event in memory 605. In aspects of the present disclosure, the log indicates that there was a disagreement.

[0084]

[0100] If there is agreement that there is a fault but no safety-critical issue (N in S1102), the processor 600 (in the primary control path) generates a report of the event in S112 and logs the event in memory 605. If the control path does not confirm that the first instance is faulty, the process returns to S100.

[0085]

[0101] At S114, each processor 600 monitors and determines whether the faulty safety-critical LRU is isolated from the HVDC link 225A by utilizing an appropriate sensor to verify that the contactor / circuit breaker is open. If the faulty safety-critical LRU is determined to be isolated (Y at S114), the processor 600 (in the primary control path) continues to control the remaining LRUs based on propulsion commands from the cockpit 40 at S118.

[0086]

[0102] At S1, each sink LRU 25 and EMS 10 receives a key-on signal from the cockpit 40. At S3, each sink LRU 25 executes its respective BIT. In the BIT, sensors within the LRU 25 report sensed / detected values to their respective processors. The control unit 405A determines the results of the BIT and sends status information to each processor 600 in the redundant control path.

[0087]

[0103] At S1, each sink LRU 25 and EMS 10 receives a key-on signal from the cockpit 40. At S3, each sink LRU 25 executes its respective BIT. In the BIT, sensors within the LRU 25 report sensed / detected values to their respective processors. The control unit 405A determines the results of the BIT and sends status information to each processor 600 in the redundant control path.

[0088]

[0104] At S7, each processor 600 in the redundant control path receives the status information. At S9A, each processor 600 in the redundant control path independently determines whether the sink LRU 25 is ready to receive power. This determination may be based on the status information (and the determination by each LRU). Once the determination / verification is performed in each processor 600, each processor 600 transmits its independent determination to the other processor 600 at S1100.

[0089]

[0105] If there is agreement among all of the processors 600 in each control path that there is a fault (safety-critical fault), for example, that they are not ready to receive power (Y in S108A), the processor 600 in the primary control path generates a report indicating the fault and logs the report in memory in S11.

[0090]

[0106] When there is disagreement between the redundant control paths (N in S108A and Y in S1102), the processors 600 in the primary control path may execute a truth model in S1104 to independently determine whether the initial decision of each processor 600 is valid. As described above, the truth model may be in the return control path and / or in an external processor. As above, the truth model examines sensor values to determine / confirm whether the sink LRU has a safety-critical fault (e.g., is ready to receive power).

[0091]

[0107] In S1104, the truth model is executed by the processor 600 (or an external processor) to determine whether there is a fault (safety-critical issue).

[0092]

[0108] If the truth model determines that the safety-critical decision is invalid (inaccurate) (N at S1106) or there is agreement that there is no safety-critical issue (N at S1102), the processor 600 in the primary control path issues a command to the sink LRU 25 in S13 to close its contactor 425A and connect it to the HVDC link 225A.

[0093]

[0109] If the truth model determines (Y in S1106) that there is a safety-critical problem (the safety-critical decision is valid), the processor 600 in the primary control path generates a report indicating the fault and logs the report in memory in S11. The processor 600 in the primary control path also does not issue a command to the sink LRU 25 to connect to the HVDC link 225A.

[0094]

[0110] The processors 600 in the redundant control path perform a similar process for the source LRU 20. However, in S9B, each processor 600 determines whether the source LRU 20 is ready to provide power.

[0095]

[0111] When there is agreement that there is a safety-critical problem in the source LRU 20, the source LRU 20 is not connected to the HVDC link 225A (at S11) and a report indicating a fault is generated.

[0096]

[0112] If the truth model determines that the safety-critical decision is invalid (inaccurate) (N in S1106) or there is agreement that there is no safety-critical issue (N in S1102), the processor 600 in the primary control path issues a command to the source LRU 25 to precharge or close the main contactor 215 in the turbo generator 20B (if precharging is required) in S15. For example, the ESS 20A may need to be precharged. Therefore, in S15, the processor 600 in the primary control path issues a command to the ESS 20A to close the contactor to precharge.

[0097]

[0113] In aspects of the present disclosure, S21 and S23 of Figure 17 may be executed by processor 600 in the primary control path. In other aspects of the present disclosure, S21 and S23 may be executed redundantly in each control path, and in the event of disagreement, the truth model may be executed.

[0098]

[0114] Again, instead of a truth model, a voting engine may be used.

[0099]

[0115] FIG. 18 illustrates an example of a method for determining whether to take off, according to an aspect of the present disclosure.

[0100]

[0116] In S1800, the processors 600 in each of the control paths may determine whether the LRUs 20, 25 are electrically isolated (disconnected) from the HVDC link 225A. If all LRUs are connected, the processors 600 in the primary path may confirm to the cockpit 40 that the aircraft may take off (e.g., normal takeoff) in S1806. If the processors 600 determine that the LRUs 20, 25 are isolated, e.g., faulty safety-critical LRUs that are not connected, each processor 600 determines in S1802 whether it is safe to take off without the isolated LRU. This determination may be architecture-specific and aircraft-specific. For example, this determination may be based on the number of remaining ESSs 20A, turbogenerators 20B, and electric propulsion units 25B. This determination may also be based on the size of the aircraft, the additional capacity initially provided, the length of the flight, and the mission.

[0101]

[0117] If it is determined that it is safe to take off (Y in S1802) (all processors in all control paths agree), the processor 600 in the primary path may confirm to the cockpit 40 that the aircraft may take off (e.g., a normal takeoff) in S1806. If all processors 600 (in all control paths) agree that it is not safe to take off, the processor 600 in the primary control path may issue a command to the cockpit 40 not to take off in S1804. In aspects of the present disclosure, when there is disagreement, a truth model may be executed.

[0102]

[0118] 19 illustrates another example of redundant control of the connection status of LRUs 20, 25 during operation while an aircraft is in flight. The difference between the example of FIG. 11 and the example of FIG. 19 is that before controlling the LRUs 20, 25 to isolate them, each processor 600 determines in S1900 whether it is safe to isolate the LRUs 20, 25 from the HVDC link 225A. If it is not safe, the processor 600 in the primary control path issues a command to have an emergency landing; if not, the process moves to S110.

[0103]

[0119] In a first aspect of the present disclosure, an EMS (for an aircraft) is configured to be connectable to multiple source line replaceable units (source LRUs) and multiple sink line replaceable units (sink LRUs). The source LRU is a source of power for a high-voltage DC link used for propulsion, and the sink LRU uses power from the high-voltage DC link for propulsion. The EMS includes a communication interface and redundant control paths for controlling safety-critical operations. The communication interface is configured to receive status information from each of the source LRUs and the sink LRUs. The status information includes information from respective sensors in the respective LRUs and a determination that the information from each sensor is within a predetermined range. The communication interface is configured to send commands to the source LRUs and the sink LRUs. The redundant control paths are configured to independently determine whether to electrically isolate the LRUs from the high-voltage DC link based on the status information from the LRUs. The isolation is based on the independent determination.

[0104]

[0120] Further in accordance with the first aspect, in a second aspect of the present disclosure, the EMS is configured to achieve less than a threshold probability of catastrophic failure.

[0105]

[0121] In accordance with the first or second aspect, in a third aspect of the present disclosure, an aircraft has a parallel hybrid electric propulsion system or a parallel turbo-hybrid electric propulsion system. The redundant control path includes a first processor in the first control path, and the first processor is configured to electrically isolate the LRU from the high-voltage DC link when status information from the LRU indicates that information from the sensor is outside a predetermined range for the sensor and the LRU determines that a condition is met. The redundant control path also includes a second control path, and the second control path includes a human-machine interface in the aircraft cockpit for displaying the status information and receiving a command to isolate the LRU. In response to the command, the LRU is electrically isolated from the high-voltage DC link.

[0106]

[0122] Further in accordance with the third aspect, in a fourth aspect of the present disclosure, each LRU and the first processor are configured to receive a key-on signal from the cockpit. In response to receiving the key-on signal, the processor in each LRU performs a built-in test for the LRU and transmits status information to the first processor via the communication interface. The first processor is configured to verify, based on its respective determination, that each sink LRU is ready to supply power, and in response to the verification that each sink LRU is ready to supply power, issue a command to electrically connect each sink LRU to the high-voltage DC link. The first processor is configured to verify, based on its respective determination, that each source LRU is ready to supply power, and in response to the verification that each source LRU is ready to supply power, issue a command to precharge the source LRU, and, when a preset precharge is reached, issue a command to electrically connect the source LRU to the high-voltage DC link.

[0107]

[0123] Further in accordance with the fourth aspect, in a fifth aspect of the present disclosure, when the first processor does not confirm that the sink LRU is ready to supply power or the source LRU is ready to supply power, the first processor is configured not to issue a command to the sink LRU or the source LRU to electrically connect to the high-voltage DC link.

[0108]

[0124] In accordance with the first or second aspect, in a sixth aspect of the present disclosure, an aircraft has a parallel hybrid electric propulsion system or a parallel turbo hybrid electric propulsion system. The redundant control paths include a primary control path and a return control path. Each control path includes a processor. Each processor is configured to receive status information, determine whether to isolate an LRU from the high-voltage DC link based on the status information, and transmit the determination to the other processor. When each processor determines, based on the status information, that a condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU. When there are different determinations, the processor in the primary control path, the processor in the return control path, or both, or a processor in another control path executes a truth model to determine which determination based on the status information is valid. When a determination that the condition is met is determined based on the truth model, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

[0109]

[0125] In addition to the sixth aspect, in a seventh aspect of the present disclosure, the return control path is configured to take over control of each LRU if the primary control path has a failure.

[0110]

[0126] In addition to any of the third to seventh aspects, in an eighth aspect of the present disclosure, the source LRU is an energy storage system, and the energy storage system (ESS) is configured to supply the first VDC.

[0111]

[0127] In addition to the eighth aspect, according to a ninth aspect of the present disclosure, the high voltage DC link is a second VDC, and the EMS further comprises conversion circuitry configured to convert the first VDC from the ESS to the second VDC.

[0112]

[0128] In addition to the ninth aspect, in a tenth aspect of the present disclosure, the second VDC is greater than the first VDC.

[0113]

[0129] In addition to any of the third to tenth aspects, in an eleventh aspect of the present disclosure, the source LRU includes a prime mover, a generator, and an inverter.

[0114]

[0130] In addition to any of the third to eleventh aspects, in a twelfth aspect of the present disclosure, the first processor is further configured to issue a command to each sink LRU based on a propulsion command from the cockpit.

[0115]

[0131] In addition to the twelfth aspect, in a thirteenth aspect of the present disclosure, the first processor is further configured to adjust a command to a sink LRU electrically connected to the high-voltage DC link when the sink LRU is electrically isolated from the high-voltage DC link.

[0116]

[0132] In addition to any of the third to thirteenth aspects, in a fourteenth aspect of the present disclosure, the first processor is further configured to determine whether an LRU commanded to be electrically isolated from the high-voltage DC link is electrically isolated from the high-voltage DC link, and in response to determining that the LRU is not electrically isolated, issue a command to land to the cockpit.

[0117]

[0133] In a fifteenth aspect of the present disclosure in addition to the first or second aspect, an aircraft has an electric propulsion system, a turbo-electric propulsion system, or a turbo-hybrid electric propulsion system. The redundant control paths include at least three control paths. The at least three control paths include a primary control path and at least two return control paths. Each control path includes a processor and a communication interface. Each LRU and each processor in the at least three control paths are configured to receive a key-on signal from the cockpit. In response to receiving the key-on signal, the processor in each LRU performs a built-in test for the LRU and transmits status information to each processor in the at least three control paths via the respective communication interface. Each processor in the at least three control paths is configured to independently confirm that each sink LRU is ready to supply power based on the respective status information and transmit confirmation, or lack thereof, to other processors in the other control paths, so that all control paths confirm that each sink LRU is ready to supply power, and the processor in the primary control path issues a command to electrically connect each sink LRU to the high-voltage DC link. When one control path does not confirm that the sink LRU is ready to power and another control path confirms that the sink is ready to power, the processor in the primary control path, or a processor in each control path, or an independent processor, executes a truth model to determine which confirmation output from each control path is valid. If the confirmation is determined to be valid based on the truth model, the processor in the primary control path issues a command to electrically connect the sink LRU to the high-voltage DC link.Each processor in the at least three control paths is configured to confirm that each source LRU is ready to supply power based on its respective status information, and when all control paths confirm that each source LRU is ready to supply power, the processor in the primary control path issues a command to each source LRU to precharge, and when a preset precharge is reached, issues a command to electrically connect each respective source LRU to the high-voltage DC link or to electrically connect each respective source LRU to the high-voltage DC link without precharge. When one control path does not confirm that the source LRU is ready to supply power and another control path confirms that the source LRU is ready to supply power, the processor in the primary control path, or a processor in each control path, or an independent processor, executes a truth model to determine which confirmation output from each control path is valid. If the confirmation is determined to be valid based on the truth model, the processor in the primary control path issues a command to electrically precharge the source LRUs, and when the preset precharge is reached, issues a command to electrically connect each source LRU to the high-voltage DC link, or to electrically connect the source LRU to the high-voltage DC link without precharge.

[0118]

[0134] In addition to the fifteenth aspect, in a sixteenth aspect of the present disclosure, each processor in the at least three control paths is configured to determine whether to electrically isolate an LRU based on status information received from the respective LRU.

[0119]

[0135] In addition to the sixteenth aspect, in a seventeenth aspect of the present disclosure, the processor in each control path is configured to receive status information via its respective communication interface, determine whether to isolate the LRU from the high-voltage DC link based on the status information, and transmit the determination to other processors in other control paths. When the processor in each control path determines that a condition is met based on the status information, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU. When there are different determinations, the processor in the primary control path, the processor in each return control path, or another processor executes a truth model to determine which determination based on the status information is valid. When the processor in the primary control path determines that the condition is met based on the truth model, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

[0120]

[0136] In addition to the seventeenth aspect, in an eighteenth aspect of the present disclosure, the cockpit includes a human-machine interface configured to receive an override, in response to which the electrically isolated LRU is commanded to reconnect to the high-voltage DC link.

[0121]

[0137] In addition to any of the fifteenth to eighteenth aspects, in a nineteenth aspect of the present disclosure, a processor in each of the at least three control paths is configured to receive propulsion commands from the cockpit and independently determine the commands, and a processor in the primary control path issues commands to each sink LRU.

[0122]

[0138] In addition to any of the fifteenth to nineteenth aspects, in a twentieth aspect of the present disclosure, the source LRU is an energy storage system, the energy storage system (ESS) is configured to supply the first VDC, and the EMS further comprises a conversion circuit configuration.

[0123]

[0139] In addition to the twentieth aspect, in a twenty-first aspect of the present disclosure, the conversion circuitry is a DC-DC converter. The DC-DC converter is configured to convert a first VDC to a second VDC. The second VDC is supplied as an accessory power source.

[0124]

[0140] In addition to the twentieth aspect, in a twenty-second aspect of the present disclosure, the conversion circuitry is a DC-AC converter. The DC-AC converter is configured to convert a first VDC into a first AC. The first AC is supplied as an accessory power source.

[0125]

[0141] In addition to any of the fifteenth to twenty-second aspects, in a twenty-third aspect of the present disclosure, the source LRU includes a turbo generator, and processors in each of the at least three control paths are configured to receive propulsion commands from the cockpit and independently determine the commands, and the processor in the primary control path issues commands to processors in each sink LRU and the turbo generator.

[0126]

[0142] In addition to any of the second to twenty-third aspects, in a twenty-fourth aspect of the present disclosure, the threshold probability of catastrophic failure is 10 -9 is.

[0127]

[0143] As described herein, embodiments of the present disclosure may include one or more electrical, pneumatic, hydraulic, or other similar secondary components and / or systems therein. The present disclosure is therefore intended, and will be understood, to include any necessary operating components thereof. For example, it will be understood that an electrical component includes any suitable necessary wiring, fuses, or the like for its normal operation. Similarly, any provided pneumatic system may include any secondary or peripheral components, such as air hoses, compressors, valves, meters, or the like. It will be further understood that any connections between various components not explicitly described herein may be made by any suitable means, including mechanical fasteners or more permanent attachment means such as welding or the like. Alternatively, where feasible and / or desirable, the various components of the present disclosure may be integrally formed as a single unit.

[0128]

[0144] Various inventive concepts may be embodied as one or more methods, examples of which are provided. The actions performed as part of the method may be ordered in any suitable manner. Thus, while shown as sequential actions in exemplary aspects of the disclosure, embodiments may be constructed in which actions are performed in an order different from that illustrated, which may include performing some actions simultaneously.

[0129]

[0145] While various inventive aspects have been described and illustrated herein, those skilled in the art will readily envision a wide variety of other means and / or structures for performing the functions and / or obtaining one or more of the results and / or advantages described herein, and each such variation and / or modification is deemed to be within the scope of the inventive aspects described herein. More generally, those skilled in the art will readily recognize that all parameters, dimensions, materials, and configurations described herein are intended to be illustrative, and that the actual parameters, dimensions, materials, and / or configurations will depend on the specific application or applications for which the inventive teachings are used. Those skilled in the art will recognize, or be able to ascertain using no more than routine experimentation, many equivalents to the specific inventive aspects described herein. Accordingly, the foregoing aspects are presented by way of example only, and it should be understood that, within the scope of the appended claims and their equivalents, inventive aspects may be practiced otherwise than as specifically described and claimed. The inventive aspects of the present disclosure are directed to each individual feature, system, article, material, kit, and / or method described herein. In addition, any combination of two or more such features, systems, articles, materials, kits, and / or methods is included within the inventive scope of the present disclosure, if such features, systems, articles, materials, kits, and / or methods are not mutually inconsistent.

[0130]

[0146] The above-described aspects may be implemented in any of numerous ways. For example, aspects of the present disclosure may be implemented using hardware, firmware, software, or any combination thereof. When implemented in software, the software code or instructions may be executed on any suitable processor or collection of processors, whether provided on a single computer or distributed among multiple computers. Furthermore, the instructions or software code may be stored in at least one non-transitory computer-readable storage medium.

[0131]

[0147] A computer may also be utilized to execute software code or instructions via its processor and may have one or more input and output devices. These devices may be used, among other things, to present a user interface. Examples of output devices that may be used to provide a user interface include a display screen for visual presentation of output and a speaker or other sound-generating device for audible presentation of output. Examples of input devices that may be used for a user interface include a keyboard and pointing devices such as a mouse, touchpad, and digitizing tablet. As another example, a computer may receive input information through voice recognition or through other audible formats.

[0132]

[0148] Such computers may be interconnected by one or more networks of any suitable form, including local or wide area networks such as enterprise networks, and intelligent networks (INs), or the Internet. Such networks may be based on any suitable technology and operate according to any suitable protocol, and may include wireless networks, wired networks, or fiber optic networks.

[0133]

[0149] The various methods or processes outlined herein may be coded as software / instructions executable on one or more processors using any one of a variety of operating systems or platforms. Additionally, such software may be written using any of a number of suitable programming languages and / or programming or scripting tools and compiled as executable machine code or intermediate code that runs on a framework or virtual machine.

[0134]

[0150] In this regard, various inventive concepts may be embodied as a computer-readable storage medium (or multiple computer-readable storage media) (e.g., computer memory, one or more floppy disks, compact disks, optical disks, magnetic tapes, flash memory, USB flash drives, SD cards, circuitry in a field programmable gate array or other semiconductor device, or other non-transitory or tangible computer storage medium) encoded with one or more programs that, when executed on one or more computers or other processors, perform methods that implement various aspects of the present disclosure as discussed above. The one or more computer-readable media may be portable, such that the one or more programs stored thereon can be loaded onto one or more different computers or other processors to implement various aspects of the present disclosure as discussed above.

[0135]

[0151] The terms "program" or "software" or "instructions" are used herein in a generic sense to refer to any type of computer code or set of computer-executable instructions that can be used to program a computer or other processor to implement various aspects as discussed above. Additionally, it should be recognized that, according to one aspect, one or more computer programs that, when executed, perform the methods of the present disclosure need not reside on a single computer or processor, but may be distributed in a modular manner among several different computers or processors to implement various aspects of the present disclosure.

[0136]

[0152] Computer-executable instructions may be in many forms, such as program modules, executed by one or more computers or other devices. Generally, program modules include routines, programs, objects, configurations, data structures, etc. that perform particular tasks or implement particular abstract data types. Typically, the functionality of the program modules may be combined or distributed as desired in various manners. Thus, one aspect of the present disclosure may be a computer program product that includes at least one non-transitory computer-readable storage medium in operative communication with a processor, the storage medium storing instructions that, when executed by the processor, implement the method or process described herein, the instructions comprising steps for performing the method(s) or process(es) detailed herein.

[0137]

[0153] Additionally, data structures may be stored in computer-readable media in any suitable form. For ease of illustration, data structures may be shown as having fields that are related through locations in the data structure. Such relationships may similarly be achieved by assigning storage for the fields locations in the computer-readable media that convey the relationship between the fields. However, any suitable mechanism may be used to establish relationships between information in fields of a data structure, including through the use of pointers, tags, or other mechanisms that establish relationships between data elements.

[0138]

[0154] All definitions defined and used herein should be understood to supersede dictionary definitions, definitions in documents incorporated by reference, and / or ordinary meanings of the defined terms.

[0139]

[0155] "Logic," as used herein, includes, but is not limited to, hardware, firmware, software, and / or combinations of each for performing a function(s) or action(s) and / or causing a function or action from another logic, method, and / or system. For example, based on a desired application or need, logic may include a software-controlled microprocessor, discrete logic such as a processor (e.g., a microprocessor), an application-specific integrated circuit (ASIC), a programmed logic device, a memory device containing instructions, an electrical device with memory, or the like. Logic may include one or more gates, combinations of gates, or other circuit components. Logic may also be embodied entirely as software. Where multiple logics are described, it may be possible to incorporate the multiple logics into one physical logic. Similarly, where a single logic is described, it may be possible to distribute the single logic among multiple physical logics.

[0140]

[0156] Furthermore, the logic(s) presented herein for achieving the various methods of this system may be directed to improvements over existing computer- or Internet-centric technologies that may not have previous analog versions. The logic(s) may provide specific functionality directly related to structures that address and solve some of the problems identified herein. The logic(s) may also provide significantly more advantages for solving these problems by providing illustrative inventive concepts as specific logical structures and coordinated functions of methods and systems. Furthermore, the logic(s) may also provide specific computer-implemented rules that improve existing technological processes. The logic(s) provided herein extend beyond simply collecting data, analyzing information, and displaying results. Furthermore, some or all of this disclosure may rely on underlying formulas derived from specific arrangements of equipment or components as described herein. For this reason, portions of this disclosure, such as those relating to specific arrangements of components, are not directed to abstract concepts. Furthermore, this disclosure and the appended claims present teachings that involve more than the performance of well-understood, routine, and conventional activities previously known in the art. In some of the methods or processes of the present disclosure, which may incorporate some aspect of natural phenomena, the steps of the process or method are new and useful additional features.

[0141]

[0157] The articles "a" and "an," as used herein in the specification and claims, should be understood to mean "at least one" unless clearly indicated to the contrary. The phrase "and / or," as used herein in the specification and claims (when present), should be understood to mean "either or both" of the elements so conjoined, i.e., elements present conjunctively in some cases and disjunctively in other cases. Multiple elements listed with "and / or" should be construed in the same manner, i.e., "one or more" of the elements so conjoined. Other elements other than those specifically identified by the "and / or" clause may optionally be present, whether related or unrelated to those elements specifically identified. Thus, as a non-limiting example, a reference to "A and / or B," when used in conjunction with open-ended language such as "comprising," can refer, in one aspect, to A only (optionally including elements other than B); in another aspect, to B only (optionally including elements other than A); in yet another aspect, to both A and B (optionally including other elements), etc. As used herein in the specification and claims, "or" should be understood to have the same meaning as "and / or" as defined above. For example, when separating items in a list, "or" or "and / or" should be interpreted to be inclusive, i.e., including at least one, but also more than one, of some or a list of elements, optionally including additional unlisted items. Only terms clearly indicated to the contrary, such as "only one of" or "exactly one of," or, when used in the claims, "consisting of," will refer to the inclusion of exactly one element of some or a list of elements. In general, the term "or," as used herein, should only be construed as indicating exclusive alternatives (i.e., "one or the other, but not both") when preceded by terms of exclusivity such as "any of," "one of," "only one of," or "exactly one of.""Consisting essentially of," when used in the claims, shall have its ordinary meaning as used in the field of patent law.

[0142]

[0158] As used herein in the specification and claims, the phrase "at least one," in connection with a list of one or more elements, should be understood to mean at least one element selected from any one or more of the elements in the list of elements, but not necessarily including at least one of each and every element specifically listed in the list of elements, or excluding any combination of elements in the list of elements. This definition also allows for elements other than those specifically identified in the list of elements to which the phrase "at least one" refers, whether related or unrelated to those specifically identified elements, may optionally be present. Thus, as a non-limiting example, "at least one of A and B" (or, equivalently, "at least one of A or B," or, equivalently, "at least one of A and / or B") can refer in one aspect to at least one, optionally including more than one, A with no B present (and optionally including elements other than B); in another aspect to at least one, optionally including more than one, B with no A present (and optionally including elements other than A); in yet another aspect to at least one, optionally including more than one, A and B (and optionally including other elements); etc.

[0143]

[0159] Although the elements of the present disclosure are described herein in relation to one another, it is possible for any one of the elements disclosed herein to comprise the subject matter of the invention if claimed or used alone. Following the example above, if a disclosed embodiment teaches features of elements A and B, there may be subject matter of the combination of A and B, A alone, or B alone, unless otherwise stated herein.

[0144]

[0160] When a feature or element is referred to herein as being "on" another feature or element, it can be directly on the other feature or element, or intervening features and / or elements may also be present. In contrast, when a feature or element is referred to as being "directly on" another feature or element, there are no intervening features or elements present. When a feature or element is referred to as being "connected," "attached," or "coupled" to another feature or element, it will also be understood that it can be directly connected, attached, or coupled to the other feature or element, or that intervening features or elements may be present. In contrast, when a feature or element is referred to as being "directly connected," "directly attached," or "directly coupled" to another feature or element, there are no intervening features or elements present. Although described or illustrated with respect to one embodiment, features and elements so described or illustrated may be applicable to other embodiments. It will also be recognized by those skilled in the art that a reference to a structure or feature disposed "adjacent" to another feature may have portions that overlap or underlie the adjacent feature.

[0145]

[0161] The terms "first" and "second" may be used herein to describe various features / elements, but these features / elements should not be limited by these terms unless the context dictates otherwise. These terms may be used to distinguish one feature / element from another. Thus, a first feature / element discussed herein may be referred to as a second feature / element, and similarly, a second feature / element discussed herein may be referred to as a first feature / element, without departing from the teachings of the present disclosure.

[0146]

[0162] An aspect is an implementation or example of the present disclosure. Reference herein to an "aspect," "one aspect," "some aspects," "one particular aspect," "exemplary aspect," or "other aspects," or the like, means that a particular feature, structure, or characteristic described in connection with an aspect is included in at least some aspects of the invention, but not necessarily in all aspects. Various occurrences of "aspect," "one aspect," "some aspects," "one particular aspect," "exemplary aspect," or "other aspects," or the like, do not necessarily all refer to the same aspect.

[0147]

[0163] When the specification states that a component, feature, structure, or characteristic "may," "might," or "could" be included, that particular component, feature, structure, or characteristic need not be included. When the specification or claims refer to "a" or "an" element, it does not mean that there is only one of that element. When the specification or claims refer to "additional" elements, it does not exclude the presence of more than one of the additional element.

[0148]

[0164] As used herein in the specification and claims, including those used in the examples, unless otherwise expressly stated, all numbers may be read as if preceded by the word "about" or "approximately," even if that term is not explicitly stated. The phrase "about" or "approximately," when describing a size and / or location, may be used to indicate that the described value and / or location is within a reasonable expected range of values and / or locations. For example, a numerical value may have a value of + / - 0.1% of the stated value (or range of values), + / - 1% of the stated value (or range of values), + / - 2% of the stated value (or range of values), + / - 5% of the stated value (or range of values), + / - 10% of the stated value (or range of values), etc. Any numerical ranges described herein are intended to include all subranges subsumed therein.

[0149]

[0165] Additionally, methods of carrying out the present disclosure may occur in a sequence different from that described herein. Therefore, unless expressly stated, the sequence of the method should not be read as a limitation. It is recognizable that similar results can be achieved by performing some of the method steps in a different order.

[0150]

[0166] In the claims and the foregoing specification, all transitional phrases such as "comprises," "includes," "supports," "has," "contains," "accompanying," "holds," "consisting of," and the like, are to be understood to be open-ended, i.e., to mean including but not limited to. Only the transitional phrases "consisting of" and "consisting essentially of" shall be closed or semi-closed transitional phrases, respectively, as set forth in the United States Patent Office Manual of Patent Examining Procedures.

[0151]

[0167] To the extent this disclosure utilizes the term "invention" in various titles or sections herein, this term is included as required by formatting requirements for word document submissions in accordance with U.S. Patent and Trademark Office guidelines / requirements and should not be construed in any manner as a disclaimer of any subject matter.

[0152]

[0168] In the foregoing description, certain terminology has been used for brevity, clarity, and understanding. Such terminology is used for purposes of description and is intended to be broadly construed, and no unnecessary limitations should be implied therefrom beyond the requirements of the prior art.

[0153]

[0169] Moreover, the descriptions and illustrations of various aspects of the present disclosure are by way of example, and the present disclosure is not limited to the exact details shown or described. The terminology used herein is for the purpose of describing particular aspects only and is not intended to limit the scope of the present disclosure, and is not intended to be exhaustive. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the present disclosure.

Claims

1. 1. An energy management system (EMS) for an aircraft, the EMS configured to be connectable to a plurality of source line replaceable units (source LRUs) and a plurality of sink line replaceable units (sink LRUs), the source LRUs being sources of power for a high voltage DC link used for propulsion, and the sink LRUs using the power from the high voltage DC link for propulsion, the EMS comprising: a communications interface configured to receive status information from each of the source LRU and sink LRU and to send commands to the source LRU and sink LRU, wherein the status information comprises information from each sensor in each of the LRUs and a determination that the information from each sensor is within a predetermined range; a redundant control path for controlling safety-critical operations, wherein the redundant control path is configured to independently determine whether to electrically isolate the LRU from the high-voltage DC link based on the status information from the LRU, and isolation is based on the independent determination; EMS equipped with:

2. The EMS of claim 1 , wherein the EMS is configured to achieve less than a threshold probability of catastrophic failure.

3. 3. The EMS of claim 1, wherein the aircraft has a parallel hybrid electric propulsion system or a parallel turbo-hybrid electric propulsion system, and the redundant control path includes a first processor in a first control path, wherein the first processor is configured to electrically isolate the LRU from the high-voltage DC link when the status information from the LRU indicates that information from a sensor is outside the predetermined range for the sensor and the LRU has determined that a condition is met, and the redundant control path also includes a second control path, wherein the second control path includes a human-machine interface in a cockpit in the aircraft for displaying the status information and receiving a command to isolate the LRU, and in response to the command, the LRU is electrically isolated from the high-voltage DC link.

4. 4. The EMS of claim 3, wherein each LRU and the first processor are configured to receive a key-on signal from the cockpit, and in response to the reception of the key-on signal, a processor in each LRU performs a built-in test for the LRU and sends the status information to the first processor via the communication interface, and the first processor is configured to verify that each sink LRU is ready to supply power based on the respective determination, and in response to the confirmation of readiness to supply power, issue a command to electrically connect each sink LRU to the high-voltage DC link, and to verify that each source LRU is ready to supply power based on the respective determination, and in response to the confirmation of readiness to supply power, issue a command to a source LRU to precharge, and when a preset precharge is reached, issue a command to electrically connect the source LRU to the high-voltage DC link.

5. 5. The EMS of claim 4, wherein when the first processor does not confirm that a sink LRU is ready to supply power or a source LRU is ready to supply power, the first processor is configured not to issue a command to the sink LRU or the source LRU to electrically connect to the high-voltage DC link.

6. 3. The EMS of claim 1, wherein the aircraft has a parallel hybrid electric propulsion system or a parallel turbo hybrid electric propulsion system, and the redundant control paths include a primary control path and a return control path, each control path including a processor configured to receive the status information, determine whether to isolate an LRU from the high-voltage DC link based on the status information, and transmit the determination to another processor, wherein if each processor determines based on the status information that a condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU, and when different determinations exist, the processor in the primary control path, the processor in the return control path, or both, or a processor in another control path executes a truth model to determine which determination based on the status information is valid, and when the determination that the condition is met is determined based on the truth model, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

7. The EMS of claim 6 , wherein the return control path is configured to take over control of each LRU if the primary control path has a failure.

8. The EMS of any one of claims 3 to 7, wherein the source LRU is an energy storage system, and the energy storage system (ESS) is configured to provide a first VDC.

9. 9. The EMS of claim 8, wherein the high voltage DC link is a second VDC, and the EMS further comprises conversion circuitry configured to convert the first VDC from the ESS to the second VDC.

10. The EMS of claim 9 , wherein the second VDC is greater than the first VDC.

11. The EMS according to any one of claims 3 to 10, wherein the source LRU comprises a prime mover, a generator, and an inverter.

12. The EMS of any one of claims 3 to 11, wherein the first processor is further configured to issue commands to each sink LRU based on a propulsion command from the flight deck.

13. 13. The EMS of claim 12, wherein the first processor is further configured to adjust the command to a sink LRU electrically connected to the high-voltage DC link when the sink LRU is electrically isolated from the high-voltage DC link.

14. 14. The EMS of claim 3, wherein the first processor is further configured to determine whether an LRU commanded to be electrically isolated from the high-voltage DC link is electrically isolated from the high-voltage DC link, and to issue a command to the cockpit to land in response to determining that the LRU is not electrically isolated.

15. the aircraft has an electric propulsion system, or a turbo-electric propulsion system, or a turbo-hybrid electric propulsion system, and the redundant control paths include at least three control paths, the at least three control paths including a primary control path and at least two return control paths, each control path including a processor and a communication interface; each LRU and each processor in at least three of the control paths are configured to receive a key-on signal from the cockpit, and in response to said receiving the key-on signal, the processor in each LRU performs a built-in test for said LRU and transmits said status information to each processor in at least three of the control paths via a respective one of said communication interfaces; each processor in at least three of the control paths is configured to independently confirm that each sink LRU is ready to supply power based on its respective status information and to transmit the confirmation, or lack thereof, to other processors in other control paths; when all control paths confirm that each sink LRU is ready to supply power, the processor in the primary control path issues a command to electrically connect each sink LRU to the high-voltage DC link; when one control path does not confirm that a sink LRU is ready to supply power and another control path confirms that the sink LRU is ready to supply power, the processor in the primary control path, or the processor in each control path, or an independent processor, executes a truth model to determine which confirmation output from each control path is valid; and when it is determined based on the truth model that the confirmation is valid, the processor in the primary control path issues a command to electrically connect the sink LRU to the high-voltage DC link; Each processor in at least three of the control paths is configured to confirm that each source LRU is ready to supply power based on the respective status information, and all control paths confirm that each source LRU is ready to supply power, and the processor in the primary control path issues a command to each source LRU to precharge, and when a preset precharge is reached, issues a command to electrically connect each respective source LRU to the high-voltage DC link or to electrically connect each respective source LRU to the high-voltage DC link without precharge; 3. The EMS of claim 1, wherein when one control path does not confirm that a source LRU is ready to supply power and another control path confirms that the source LRU is ready to supply power, the processor in the primary control path, or the processor in each control path, or an independent processor, executes a truth model to determine which confirmation output from each control path is valid, and when it is determined based on the truth model that the confirmation is valid, the processor in the primary control path electrically issues a command to precharge the source LRU, and when a preset precharge is reached, issues a command to electrically connect each source LRU to the high-voltage DC link or to electrically connect the source LRU to the high-voltage DC link without precharge.

16. 16. The EMS of claim 15, wherein each processor in the at least three control paths is configured to determine whether to electrically isolate a respective LRU based on the status information received from the LRU.

17. 17. The EMS of claim 16, wherein the processor in each control path is configured to receive the status information via its respective communication interface, determine whether to isolate an LRU from the high-voltage DC link based on the status information, and transmit the determination to other processors in other control paths; when the processor in each control path determines based on the status information that a condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU; when different determinations exist, the processor in the primary control path, the processor in each return control path, or another processor executes a truth model to determine which determination based on the status information is valid; and when the determination that the condition is met is determined based on the truth model, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

18. 18. The EMS of claim 17, wherein the flight deck comprises a human-machine interface configured to receive an override, and in response to the override, an electrically isolated LRU is commanded to reconnect to the high-voltage DC link.

19. 19. The EMS of any one of claims 15 to 18, wherein the processor in each of the at least three control paths is configured to receive propulsion commands from the flight deck and independently determine commands, and the processor in the primary control path issues commands to each sink LRU.

20. 20. The EMS of any one of claims 15 to 19, wherein the source LRU is an energy storage system, the energy storage system (ESS) configured to provide a first VDC, and the EMS further comprises conversion circuitry.

21. 21. The EMS of claim 20, wherein the conversion circuitry is a DC-DC converter, the DC-DC converter configured to convert the first VDC to a second VDC, and the second VDC is supplied as an accessory power source.

22. 21. The EMS of claim 20, wherein the conversion circuitry is a DC-AC converter, the DC-AC converter configured to convert the first VDC to a first AC, and the first AC is supplied as an accessory power source.

23. 23. The EMS of any one of claims 15 to 22, wherein a source LRU comprises a turbo-generator, and wherein the processor in each of the at least three control paths is configured to receive propulsion commands from the flight deck and independently determine commands, and wherein the processor in the primary control path issues commands to processors in each sink LRU and the turbo-generator.

24. The threshold probability of catastrophic failure is 10 -9 The EMS according to any one of claims 2 to 23,

Images