A smart battery disconnect protection architecture for airborne high-power modular multi-string battery packs

Abstract

To provide a smart battery disconnect and protection architecture for airborne high-power modular multi-string battery pack.SOLUTION: The invention provides methods and systems for protection / disconnect of airborne high-power / high-energy high-voltage modular multi-string battery packs (such as battery packs for airborne electric propulsion systems). The methods and systems are based on a dissimilar / redundant distributed battery pack protection architecture and use a smart mid-point battery disconnect cooperating with centralized battery management system. The resulting battery disconnect / protection system is configured to detect bus faults, load faults and string faults and then take appropriate action to isolate the detected fault. For example, in response to a short circuit in one battery string, the faulty battery string may be disconnected from the positive and negative busbars while the remaining battery strings continue to provide power.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] FIELD OF THE DISCLOSURE The present disclosure relates generally to systems and methods for managing modular battery systems that provide direct current (DC) power onboard vehicles such as aircraft. [Background technology]

[0002] When electric motors are used to propel an aircraft, electrical energy is provided by a power supply. For example, the electrical energy may be provided by a DC power supply including a string of battery modules. In one embodiment, the batteries are connected to a high voltage direct current (HVDC) bus. As used in this application, the term "connected" means coupled to provide power, and the term "disconnected" means uncoupled so as not to provide power. As used in this application, the term "high voltage" when used with respect to DC refers to a voltage of 600V or less. DC means any DC voltage exceeding

[0003] Some aircraft all-electric or hybrid electric propulsion systems require large, high-voltage (e.g., 600 / 1000 / 2000V) power supplies to power the large electric motors. DC ) battery packs are used. Aircraft battery packs may have an architecture in which multiple strings are arranged in parallel to ensure sufficient power flow to one or more loads under certain operating conditions. Aircraft applications have stringent safety and risk threshold standards for high-power / high-voltage electrical protection, requiring multiple, disparate, redundant protection, fail-safe, and shutdown mechanisms. (As used in this application, the term "fail-safe" refers to a design or practice that has the properties to prevent or mitigate the risk of a system failure resulting in a particular type of failure.) Aircraft applications require extremely high risk threshold and integrity standards for protection against battery overcharging and other events or combinations of events that could lead to battery thermal runaway.

[0004] Additionally, electric propulsion systems require protection from short circuits. (As used in this application, the term "short circuit" means an unintentional electrical circuit that allows current to flow through a path with no or very little electrical impedance.) A common type of short circuit occurs when a low-resistance conductor connects the positive and negative terminals of a battery. The low resistance of the connection allows large currents to flow through the battery, which can cause a rapid rise in temperature. During a short-circuit failure, a high-voltage battery pack can, for example, generate approximately 3,500 A per string, depending on the number and type of parallel cells. DC (On a system scale, it can reach approximately 10,000A depending on the number of parallel strings. DC Capable of generating short circuit currents exceeding high operating voltages (600-1000V or more). DC ) and high short circuit current (3,500A per string) DC Approximately 10,000A DC The combination of high voltage (equivalent to a system of 1000V) makes the development of a protection system a difficult task. DC Exacerbating factors include on-board constraints such as operating voltage (above 100V), operating altitude (55,000 ft), vibration environment, and operating life (25 years).

[0005] A battery management system is any electronic system that manages rechargeable batteries by protecting them from unsafe operations, monitors the battery status, calculates and reports secondary data, controls the environment, and maintains balance. A battery built with a battery management system that has a communication data bus is called a "smart battery."

[0006] The battery management system may monitor the state of the battery as represented by various parameters such as total voltage, individual cell voltage, average temperature, individual cell temperature, state of charge (SOC) indicating the charge level of the battery, state of health (SOH) indicating the remaining capacity of the battery, state of power (SOP) indicating the amount of power available at a given time, and other parameters. The battery management system may also control the charging of the battery. The battery management system may also be configured to manage the battery temperature. A central controller of the battery management system communicates internally with hardware operating at the cell scale. The battery management system may protect its batteries by preventing overcurrent (which may be different for charge and discharge modes), overvoltage (while charging), undervoltage (while discharging), overtemperature, undertemperature, ground fault, and leakage current detection.

[0007] The battery architecture and protection / disconnect systems of battery packs used in electric aircraft propulsion have not yet reached a certain stage of standardization. There is ample room to design innovative aircraft battery packs with protection / disconnect architectures that enhance aircraft safety without violating weight / volume constraints. Summary of the Invention [Problem to be solved by the invention]

[0008] The subject matter disclosed in some detail below is directed to methods and systems for protection / disconnection of aircraft-mounted high-power / high-energy, high-voltage, modular, multi-string battery packs (such as battery packs for aircraft-mounted electric propulsion systems). The methods and systems disclosed in this application focus on the operation of aircraft battery packs with a protection / disconnect architecture. In particular, the systems and methods are based on a heterogeneous / redundant distributed battery pack protection architecture, using a smart mid-section battery disconnect in cooperation with a centralized battery pack management system (BPMS).

[0009] As used herein, the term "battery module" refers to a battery containing a single battery cell or multiple battery cells wired in series, parallel, or a hybrid configuration. As used herein, the term "battery string" refers to multiple battery modules wired in series. As used herein, the term "battery pack" includes a single battery string or multiple battery strings wired in parallel. As used herein, the term "high power / high energy" refers to high specific power or high specific energy. As used herein, the term "specific energy" determines the battery capacity per unit weight (Wh / kg). As used herein, the term "specific power" refers to loading capability (W). As used herein, the modifier "smart" refers to the initiation of an action or device control by a computer or processor based on acquired sensor data indicating the current status of the battery system. [Means for solving the problem]

[0010] The architecture suitable for aircraft applications is (1) a modular / scalable multi-string battery pack system protection / disconnection architecture, (2) a redundant / heterogeneous protection architecture against severe events such as overcharge, overdischarge, overtemperature, and short circuit, and (3) a voltage of 1000V without the use of a combination of high-voltage vacuum sealed contactors and high-voltage fuses. DC and the string short circuit current exceeds 2000A. DC(4) a resettable structure that allows protection of the battery in the event of a system short circuit without requiring battery maintenance before returning to operation after a load / system short; (5) the ability to provide rapid protection against short circuit current (e.g., differential protection, circuit interruption in the event of a ground fault, instantaneous tripping, etc.) to minimize the sudden energy generated by the fault, potential damage to surrounding structures, and stress on components such as the battery cell fusible links; and (6) the ability to provide rapid protection against short circuit current (e.g., differential protection, circuit interruption in the event of a ground fault, instantaneous tripping, etc.) to minimize the stress on components such as the battery cell fusible links. This includes one or more of the following forms: (1) the ability to isolate short circuits within the battery pack without melting or stressing the links and preventing any arcing events within the battery; (2) soft-start capability for capacitive loads without the need for additional hardware; (3) elimination of single point failures by implementing a fault detection architecture with false positive protection; (4) (N-1) pack redundancy for string loss to improve availability and safety in propulsion applications; and (5) a weight-optimized solution (without the use of large high voltage components such as high voltage contactors / high voltage fuses originally used in train / ground substations).

[0011] Various embodiments of systems and methods for smart battery protection / disconnection in airborne high power / high energy high voltage modular multi-string battery packs are described in some detail below, one or more of which may be characterized by one or more of the following aspects:

[0012] One aspect of the protected subject matter, disclosed in detail below, is a battery system comprising: a battery pack including a first battery string including a positive busbar and a negative busbar, a first half-string and a second half-string; a first string contactor connected to the positive busbar and the first half-string; a first mid-section disconnect circuit connected to the first and second half-strings; a first mid-section current sensor that measures current flowing in the first mid-section disconnect circuit; and a first smart mid-section disconnect that opens the first mid-section disconnect circuit and the first string contactor after receiving an output from the first mid-section current sensor that indicates an overcurrent flowing in the first mid-section disconnect circuit. When the battery pack further includes a second battery string including a third half-string and a fourth half-string, the system further includes a third string contactor connected to the positive bus bar and the third half-string, a second mid-section disconnection circuit connected to the third and fourth half-strings, a second mid-section current sensor that measures a current flowing in the second mid-section disconnection circuit, and a second smart mid-section disconnect that opens the second mid-section disconnection circuit and the third string contactor in response to receiving an output from the second mid-section current sensor that indicates an overcurrent flowing in the second mid-section disconnection circuit.

[0013] According to some embodiments, the battery system described in the immediately preceding paragraph further comprises a battery pack management system connected to and in communication with the first and second smart mid-section disconnects, and further comprising a first load contactor connected to the positive bus bar, a second load contactor connected to the negative bus bar, and a load current sensor measuring current through the first load contactor, wherein the battery pack management system is configured to open the first and second load contactors after receiving data indicative of a load fault from the load current sensor, and to close the first and second mid-section disconnect circuits after opening the first and second load contactors. The battery system may further include a fourth string contactor connected to the negative busbar and the fourth half-string, a first end current sensor that measures a current flowing through the first string contactor, and a second end current sensor that measures a current flowing through the third string contactor, and the battery pack management system is configured to calculate a first difference between the currents measured by the first intermediate current sensor and the first end current sensor, open the first and second string contactors in response to the first difference exceeding a specified threshold, and calculate a second difference between the currents measured by the second intermediate current sensor and the second end current sensor, and open the third and fourth string contactors in response to the second difference exceeding a specified threshold.

[0014] Another aspect of the subject matter disclosed in detail below is a battery string including a positive bus bar and a negative bus bar, a first half-string and a second half-string, the first half-string including a first plurality of battery modules connected in series and the second half-string including a second plurality of battery modules connected in series, a string contactor connected to the positive bus bar and the first half-string, a mid-section disconnection circuit connected to the first and second half-strings, a mid-section current sensor for measuring a current flowing in the mid-section disconnection circuit, and a current sensor for detecting a current flowing in the mid-section disconnection circuit. a smart midsection disconnect that opens the midsection disconnect circuit after receiving an output from the midsection current sensor indicating current is flowing; and a plurality of first module monitors connected to and communicating with the smart midsection disconnect, each first module monitor comprising a sensor that measures a virtual cell voltage and an individual cell temperature within a corresponding battery module, the first smart midsection disconnect further configured to control a balancing function performed by the balancing circuit as a function of the measured virtual cell voltage and the individual cell temperature. The battery system may further comprise a battery pack management system connected to and communicating with the smart midsection disconnect, and a plurality of second module monitors connected to and communicating with the battery pack management system, each second module monitor comprising a sensor that measures a virtual cell voltage and an individual cell temperature within a corresponding battery module.

[0015] A further aspect of the protected subject matter, disclosed in detail below, is a method of operating a battery system including a battery string connected across a positive busbar and a negative busbar via a pair of string contactors when the pair of string contactors are closed, the battery string including a pair of single-sided strings connected in series via a mid-disconnect circuit, the method comprising the steps of measuring a current flowing in the mid-disconnect circuit, determining that the measured current in the mid-disconnect circuit exceeds a threshold indicative of an overcurrent, and opening the mid-disconnect circuit in response to determining that the measured current exceeds the threshold. According to some embodiments, the method further comprises opening a string contactor connected to a defective battery string after opening the mid-disconnect circuit of the defective battery string, and activating a pyro-fuse connected in series with the mid-disconnect circuit in response to the mid-disconnect circuit failing to open.

[0016] Yet another aspect is a method of operating a battery system including a battery string connected across a positive bus bar and a negative bus bar through a pair of string contactors when the pair of string contactors are closed, the battery string including a pair of single-sided strings connected in series through a mid-disconnect circuit, the method comprising measuring current through the mid-disconnect circuit, measuring current through string contactors connecting the battery string to the positive bus bar, calculating a difference between the measured currents, determining that the difference exceeds a threshold indicative of a string fault, and opening the mid-disconnect circuit and then opening the string contactors in response to determining that the difference exceeds the threshold.

[0017] Other aspects of systems and methods for smart battery protection / disconnection in airborne high power / high energy high voltage modular multi-string battery packs are disclosed below.

[0018] The features, functions, and advantages described in the above description may be realized separately in various embodiments or may be combined in yet other embodiments. Various embodiments will now be described with reference to the drawings to illustrate these and other aspects. None of the drawings are drawn to scale. [Brief explanation of the drawings]

[0019] [Figure 1] FIG. 1 illustrates an electric aerospace propulsion system architecture having one thruster according to one embodiment. [Figure 2] FIG. 10 illustrates an embodiment of a battery multi-string architecture having four battery strings, each consisting of two collections of four battery modules connected in series through a corresponding smart middle battery disconnect subsystem. [Figure 2A] FIG. 1 is a diagram illustrating one battery module and associated module monitor according to one proposed embodiment. [Figure 3] 3 is a diagram illustrating the portion of the system shown in FIG. 2 including the internal components of the mid-cell battery disconnect subsystem, according to one embodiment. The battery string is shown with an internal battery cell short circuit occurring within one virtual cell. [Figure 4] 4 illustrates the components shown in FIG. 3 when there is a short circuit across multiple virtual cells of the battery module. [Figure 4A] 5 is a diagram showing the internal components of the battery module in which the short circuit shown in FIG. 4 occurs. [Figure 5] 5 is a diagram depicting the same components shown in FIGS. 3 and 4, but in this example without the short circuit shown. [Figure 6] FIG. 10 illustrates a mid-cell disconnect subsystem having a mid-cell semiconductor switch in series with a pyrofuse according to another embodiment. [Figure 7] 1 is a flowchart identifying steps of a method for protecting a battery string in response to a short circuit, according to one embodiment. [Figure 8A]FIG. 1 is a circuit diagram illustrating some components of a smart mid-cell disconnect subsystem, including a transient voltage suppression device, a mid-cell disconnect circuit, and a desaturation protection module, according to one proposed implementation. [Figure 8B] FIG. 1 illustrates one of the components of a desaturation protection module according to one proposed implementation. [Figure 9A] 1 is a graph showing the short circuit current of a semiconductor switch versus time calculated for a typical battery after a short circuit occurs at time t=0. [Figure 9B] 10 is a graph showing semiconductor switch voltage and current after a short circuit occurs for a simulated mid-cell disconnect subsystem with desaturation protection and transient voltage suppression. [Figure 10] 10 is a graph showing semiconductor switch current versus time after a short circuit occurs for a simulated mid-cell disconnect subsystem with overcurrent protection. [Figure 11] FIG. 1 illustrates a pyroswitch configuration according to one proposed implementation. [Figure 12] 7 is a flowchart illustrating a soft-start control strategy for optimizing the trajectory of the value of the current through the middle semiconductor switch shown in FIG. 6 for pre-charging the high-voltage capacitive bus. [Figure 13A] 10 is a graph showing the power output when precharging a high voltage capacitive bus using a normal soft start procedure according to one proposed implementation. [Figure 13B] 10 is a graph showing the current when pre-charging a high voltage capacitive bus using a normal procedure of soft start according to one proposed implementation. [Figure 13C] 10 is a graph showing the voltage when pre-charging a high voltage capacitive bus using a normal procedure of soft start according to one proposed implementation. [Figure 14] FIG. 1 illustrates an example of a physical implementation of a mid-cell battery disconnect subsystem integrated onto a printed circuit board (PCB). [Figure 15]FIG. 1 illustrates a battery power distribution and battery pack management system connected to a battery charger in charging mode. [Figure 16] FIG. 1 illustrates a battery pack management system responsive to the detection of a short circuit. [Figure 17] 17 is a flowchart identifying steps of a fault resolution procedure performed by the battery pack management system shown in FIG. 16. [Figure 18] FIG. 1 illustrates a battery power distribution unit and a battery pack management system connected to a battery charger when an overcharge or overvoltage occurs in a charging mode. [Figure 19] 10 is a flowchart identifying the steps of an enhanced algorithm for clearing overcurrent faults that extends to disconnecting the battery string when the fault clearance device fails to open or fails and shorts out. [Figure 20] FIG. 3 is a block diagram representing the portion of the system shown in FIG. 2 at another time when a bus fault, load fault, or string fault has occurred. [Figure 21] 21 is a flowchart identifying the steps of an algorithm implementing a response by the battery pack disconnect / protection system to each of the faults shown in FIG. 20. DETAILED DESCRIPTION OF THE INVENTION

[0020] Reference will now be made to the drawings in which like elements in different drawings are numbered the same.

[0021] Exemplary embodiments of systems and methods for smart battery protection and disconnection in an airborne high-power / high-energy, high-voltage, modular, multi-string battery pack are described in some detail below. However, not all aspects of an actual implementation are described herein. Those skilled in the art will recognize that developing any of these embodiments will require many implementation-specific decisions to achieve the particular objectives of the developer, including meeting system- and commercial-related constraints that may change from one implementation to another. Moreover, while the effort required for such development may have been tedious and time-consuming, it will be recognized that it would not be an extraordinary undertaking for those skilled in the art having the benefit of this disclosure.

[0022] Figure 1 is a diagram illustrating an embodiment of an aerospace electric propulsion system architecture having one propeller 2. The propeller 2, partially shown in Figure 1, includes a motor controller 10, an AC motor 30 controlled by the motor controller 10, and a propeller 32 driven and rotated by the AC motor 30. The propeller 32 includes a propeller shaft 34 mechanically connected to the output shaft of the AC motor 30, and a plurality of propeller blades 36.

[0023] In some implementations, motor controller 10 has three channels that provide AC current to each of the stator winding groups of AC motor 30. Each channel of motor controller 10 includes a corresponding inverter with a power switch and a corresponding inverter controller that controls the state of the power switch (collectively referred to in this application as the "inverter / controller"). The inverters are connected in parallel with the windings of AC motor 30 (not shown in FIG. 1). The operation of the inverters is controlled by the controller, which sends switch control signals to and receives switch state signals from the inverters via switch signal lines (not shown in FIG. 1). The inverter converts DC power to polyphase AC power for AC motor 30.

[0024] As seen in FIG. 1, the motor controller 10 further includes an electric propulsion controller 10b (hereinafter "EPC 10b"). An inverter controller (not shown in FIG. 1) is connected and communicates with the EPC 10b to receive control signals from and provide feedback signals to the EPC 10b. The EPC 10b is responsible for managing and coordinating all of the inverter controllers. The EPC 10b receives pilot thrust and pitch inputs from thrust and pitch control levers (not shown in FIG. 1). The EPC 10b manages and coordinates the operation of the inverter controllers based on information from sensors and pilot inputs.

[0025] 1, the HVDC power supply is a battery pack 18. The battery pack 18 is connected to an HVDC power distribution system 20 via a battery power distribution unit (BPDU) 12. The BPDU 12 is essentially a housing that houses the hardware necessary to monitor, rectify, and control the DC power output by the battery pack 18. This DC power is received by the motor controller 10 via the HVDC power distribution system 20.

[0026] According to some embodiments, battery pack 18 includes a plurality of independent battery strings 24. Each battery string 24 includes a predetermined number of battery modules connected in series to form a battery string with a desired usable voltage / potential. In the example shown in FIG. 1, each battery string includes a first half-string 25a of a plurality (e.g., four) of series-connected battery modules, which is indirectly connected (via corresponding intermediate battery disconnects not shown in FIG. 2) to a second half-string 25b of a plurality (e.g., four) of series-connected battery modules.

[0027] Battery power distribution section 12 includes positive and negative high-voltage bus bars 38a and 38b (hereinafter "high-voltage bus bars 38a and 38b"). Battery power distribution section 12 further includes a first plurality of string contactors 8 connecting one end of battery strings 24 to high-voltage bus bar 38a and a second plurality of string contactors 8 connecting the other end of battery strings 24 to high-voltage bus bar 38b. (Contactors are electrically controlled switches used to switch power circuits. Contactors are designed to be directly connected to high-current load devices.) High-voltage DC power distribution system 20 receives DC power signals from battery strings 24 via string contactors 8 and provides this DC power to motor controller 10.

[0028] The battery power distribution section 12 further includes a battery pack management system 22 (hereinafter "BPMS 22"). The operation of the battery pack 18 is managed by the BPMS 22. The use of multiple parallel battery strings can provide redundancy in the event of a failure within the pack. The BPMS 22 may be configured to ensure redundancy protection, fail-safe operation, and selective deactivation of battery strings. The BPMS 22 may further be configured to protect the batteries from overcharging and to prevent other events or combinations of events that may lead to battery thermal runaway. In particular, the switching state of the string contactors 8 is controlled by the BPMS 22.

[0029] Continuing to refer to FIG. 1, the EPC 10b interfaces with the BPMS 22. The EPC 10b sends a digital torque control signal to the inverter controller and an analog pitch control signal to a governor (not shown in FIG. 1). The governor may be a constant-speed propeller governor configured to maintain a constant propeller revolutions per minute (RPM) by varying the pitch of the propeller blades. This is achieved by the hydraulic governor by controlling the flow of engine oil to the hydraulic mechanism of the propeller 32 using hydraulic valves.

[0030] FIG. 2 illustrates a multi-string battery architecture in the form of a battery pack 18 including multiple independent battery strings according to one embodiment. In the example shown in FIG. 2, the battery pack 18 includes four battery strings 24a-24d. Each battery string consists of two groups of several (four in this embodiment) battery modules 4 connected in series and further connected to each other in series via the corresponding (smart) mid-cell battery disconnection subsystem 14. Each string is constructed using multiple battery modules 4 connected in series (eight battery modules per string in the example shown in FIG. 2). Each battery string 24a-24d further includes multiple corresponding module monitors 6a and 6b. The status of each battery module is monitored by a corresponding pair of module monitors 6a and 6b. Each battery string 24a-24d supplies DC power to high-voltage busbars 38a and 38b via a corresponding string contactor 8. The DC power from the high-voltage busbars 38a and 38b is distributed to all HVDC loads.

[0031] As shown in FIG. 2 , each battery string 24a-24d has a dedicated set of string contactors 8 located on the positive and negative sides to provide galvanic isolation for each string. When the string contactors 8 are closed, the battery strings 24 are connected together within the battery power distribution section 12 via the high-voltage busbars 38a and 38b. In addition, a dedicated end current sensor 16 (e.g., a Hall-effect current sensor) is located between the contactors 8 connecting each half-string 25a to the positive (or negative) high-voltage busbar 38a. The BPMS 22 is configured (e.g., programmed) to control different positive and negative string contactors 8 depending on the operating mode (e.g., charging, discharging) and system / pack protection (e.g., system short-circuit protection, string current imbalance). Each pair of positive and negative string contactors 8 is dual-controlled by a corresponding mid-cell battery disconnection subsystem 14 and the BPMS 22. The BPMS 22 is connected to and communicates with all mid-cell battery disconnection subsystems 14 for coordination. The BPMS22 is responsible for communication with the electric propulsion system's autopilot unit and other line-replaceable units.

[0032] The battery power distribution 12 shown in FIG. 2 also includes an integrated neutral grounding network 52 (connected across the battery power output lines 40a and 40b) and an insulation monitoring device 26 (hereinafter "IMD 26"). The neutral of the battery pack is connected to mechanical ground through the neutral grounding network 52. The grounding impedance is used to balance the positive and negative bus voltages, taking into account positive and negative parasitic impedances to ground and the total insulation impedance required to ensure personal safety. For example, a ground switch can be used to lift the ground connection for sleep mode. The IMD 26 (described in more detail below) dynamically and actively monitors the resistance to ground.

[0033] FIG. 2A illustrates one battery module 4 and associated module monitors 6a and 6b according to one proposed embodiment. Each battery module 4 is a parallel / series arrangement of individual cells 5. In the example shown in FIG. 2A, the battery module 4 includes four columns of cells 5, each column containing 20 cells connected in parallel across a pair of cell bus bars 54a and 54b. Each parallel arrangement of cells is considered a virtual cell (or block). Four virtual cells 50a-50d are connected in series. This arrangement is achieved using corresponding fusible links 56 in series with each cell 5 to protect against cell failure. The basic module configuration is selected based on a tradeoff between safe voltage, weight for ease of handling, volume, and failure prevention.

[0034] Each battery module 4 is monitored by two independent and heterogeneous module monitoring units 6a and 6b (labeled MMU1 and MMU2 in FIG. 2A ). Each module monitor includes sensors 58 that individually measure each virtual cell voltage and each individual cell temperature. Module monitor 6a also includes a balancing circuit 60. Balancing circuit 60 performs passive (or active) balancing functions initiated and controlled by the associated middle battery disconnection subsystem 14. Module monitor 6a communicates sensor data representing the virtual cell voltages and individual cell temperatures to the associated middle battery disconnection subsystem 14. In charging mode, smart middle battery disconnection subsystem 14 sends commands to balancing circuit 60 to ensure proper balancing between the virtual cells. Module monitor 6b communicates sensor data representing the virtual cell voltages and individual cell temperatures to BPMS 22. Additionally, module monitor 6b can provide aggregate flags for out-of-range cell voltages and cell temperatures.

[0035] When an internal cell short circuit occurs, the battery may suffer from thermal runaway, which can lead to battery failure. Typically, the anode and cathode portions of a cell are separated by an insulating barrier. However, the insulating barrier may deteriorate, causing a short circuit between the anode and cathode portions through the barrier. This internal short circuit reduces the battery's internal resistance, which increases the likelihood of overcharging or overdischarging the cell, which in turn increases the cell temperature and can ultimately lead to thermal runaway.

[0036] FIG. 3 is a diagram illustrating the portion of the system shown in FIG. 2 including the internal components of the mid-cell battery disconnect subsystem 14, according to one embodiment. The battery string 24 is shown with an internal battery cell short circuit 42 occurring within one virtual cell. The mid-cell battery disconnect subsystem 14 includes a smart mid-point disconnect unit 28 (hereinafter “SMDU 28”) and a mid-point disconnect contactor 48. The SMDU 28 includes a processor configured to control the state of the mid-point disconnect contactor 48. The SMDU 28 is connected to and communicates with the BPMS 22. The mid-cell battery disconnect subsystem 14 further includes a mid-point current sensor 46 that outputs an electrical signal to the SMDU 28 representing the current flowing through the mid-cell battery disconnect subsystem 14 when the mid-point disconnect contactor 48 current sensor 46 is closed. The SMDU 28 also receives electrical signals representing individual cell temperatures and virtual cell voltages from the module monitors 6a and 6b via the MMU1 / SMDU data bus 7a and the MMU2 / BPMS data bus 7b. The BPMS 22 and SMDU 28 are configured to individually control the state of each string contactor 8.

[0037] FIG. 4 shows the components shown in FIG. 3 when there is an external short circuit 44 across the positive and negative electrodes of the battery module 4.

[0038] FIG. 5 depicts the same components shown in FIGS. 3 and 4 , but in this example, no short circuits are shown. Each battery string 24 has a corresponding dedicated SMDU 28. The purpose of the SMDU 28 is to ensure autonomous, safe operation of each battery string 24. The SMDU 28 includes a smart controller / disconnect system that provides battery protection / isolation and electrical protection / isolation for the battery string in the event of a fault. The mid-cell battery disconnect subsystem 14 further includes a mid-cell current sensor 46 that outputs an electrical signal to the SMDU 28 indicative of the current flowing through the first and second half strings 25 a and 25 b of the series-connected battery modules 4 that form the battery string 24. The mid-cell battery disconnect subsystem 14 further includes a mid-cell disconnect contactor 48 disposed between the mid-cell current sensor 46 and the half string 25 b. According to the embodiment shown in FIG. 5 , the SMDU 28 is configured to provide battery string protection by opening the mid-cell disconnect contactor 48 in the event of a fault, as indicated by the current flowing through the mid-cell current sensor 46.

[0039] 5, the SMDU 28 measures current using a current sensor (e.g., a Hall effect or shunt type current sensor) integrated into the SMDU 28 in series with the mid-disconnect contactor 48. In the event of a fault, the SMDU 28 activates and opens the mid-disconnect contactor 48, isolating the battery string 24. After opening the mid-disconnect contactor 48, the SMDU 28 subsequently opens the dedicated string contactor 8 to provide galvanic isolation.

[0040] Each battery module 4 includes basic protection measures to ensure safe standalone operation. In the event of an individual cell short circuit failure, the fusible link 56 in series with the failed cell 5 sees the current in all parallel cells 5 and opens due to the overcurrent. The failed cell 5 is isolated, and the battery module 4 remains operational, albeit at a reduced capacity. The voltage across one fusible link 56 is low (e.g., 5V DC(less than 100V), so no arcing will occur. In the event of an internal short circuit in the battery module (as shown in FIG. 4A), the composite fusible link 56 of one virtual cell 50 will open due to the overcurrent, isolating the battery module 4. The battery module 4 will therefore be open-circuited and inoperable. The module design (number of cells in series, fusible link sizing, etc.) allows for a situation where, when the fusible link 56 opens, the voltage of the fusible link 56 (at the expected altitude) will be below an acceptable threshold, and no sustained arcing will occur at this voltage. For example, if the voltage of all the fusible links 56 of a virtual cell (e.g., 100V) DC The voltage (less than 1 V) is so low that no arcing occurs at all. The cell fusible links 56 are a form of protection only against faults within the battery module (short circuit in a cell or short circuit in a virtual cell). In the case of intra-string installations, it is better not to open the composite fusible link or individual fusible links of a virtual cell in the event of an external short circuit. Opening a fusible link (especially a fusible link of a complete virtual cell) in the event of a fault outside the module can cause severe continuous arcing with high energy in the immediate vicinity of the cell.

[0041] FIG. 6 illustrates another embodiment of the mid-cell disconnect subsystem 14, which includes a mid-cell disconnect circuit 85 instead of the mid-cell disconnect contactor. The mid-cell disconnect circuit 85 includes a metal-oxide semiconductor field-effect transistor (MOSFET) 88 (or other suitable semiconductor switch) and a diode 90 connected in parallel. Solid-state devices can be used for larger battery pack sizes that can accommodate nominal voltages and currents greater than the contactors can withstand. The SMDU 28 shown in FIG. 6 is configured to provide battery string protection by opening the MOSFET 88 in the event of a fault.

[0042] In the embodiment shown in FIG. 6, the mid-cell battery disconnect subsystem 14 further includes a pyroswitch 62 (or other failsafe device) in series with the mid-cell disconnect circuit 85. The pyroswitch 62 may be activated by a failsafe trigger circuit 86. The mid-cell battery disconnect subsystem 14 shown in FIG. 6 further includes a transient voltage suppression device 84 (hereinafter "TVS device 84"), such as a transorb, Zener diode, or varistor, connected in parallel with the mid-cell disconnect circuit 85. The TVS device 84 is configured to direct unwanted energy away from the mid-cell disconnect circuit 85. For example, a transient voltage suppression diode (commonly known as a "transorb") is an electronic component used to protect sensitive electronic equipment from voltage spikes caused by other sources. When the voltage across the transorb exceeds a predetermined level, the transorb shunts excess current.

[0043] 6 illustrates the architecture of one embodiment of SMDU 28. SMDU 28 includes a battery protection module 68 that provides battery string protection functions (described above) and an electrical load control unit 70 (hereinafter "ELCU 70") that provides string electrical protection functions (described above).

[0044] The ELCU 70 is a processing unit (e.g., a microprocessor) with overall control functions. The ELCU 70 receives information from various downstream controllers, including the differential protection module 72, the isolation monitoring device 74, the desaturation protection module 76, the overcurrent protection module 78, and the soft-start control module 80. Based on the information received from the downstream controllers, the ELCU 70 makes adjustments using other elements of the electrical system, including the pyroswitch 62, the MOSFET 88, and the string contactors 8. For example, the ELCU 70 commands the MOSFET 88 and the string contactors 8 to open. In the following description, the mid-section disconnect circuit 85, the mid-section current sensor 46, the TVS device 84, the differential protection module 72, the isolation monitoring device 74, the desaturation protection module 76, and the overcurrent protection module 78 are collectively referred to as a solid-state power controller (hereinafter "SSPC 81"). The pyroswitch 62 is not part of the SSPC. Similarly, the soft-start control module 80 (designated "CTRL" in FIG. 14) is not part of the SSPC 81 (as seen in FIG. 14). That is, the IMD 26, desaturation protection module 76, and overcurrent protection module 78 are control functions that are physically implemented in the ELCU microprocessor, i.e., physically, they are on the same chip with the ELCU 70. The ELCU 70 also has additional control functions such as main contactor control and regulation with the BPMS 22. When implemented in the ELCU 70, these control functions "talk" to the SSPC 81 and pyroswitch 62 in a coordinated manner defined by the ELCU 70.

[0045] The SMDU disconnect circuit architecture shown in Figure 6 is based on a "fail-safe" one-way SSPC implementation. The SSPC implementation allows for fast fault isolation (microseconds) without arcing and without the use of large / heavy high-voltage electromechanical devices and / or fuses. The SMDU SSPC current is measured using an integrated current measurement (shunt or Hall-effect current sensor). The drain-source voltage V of a solid-state switch (e.g., MOSFET 88) is dsis also used for protection purposes as a reflection of the switch current.

[0046] 7 is a flowchart identifying steps in a method 200 for protecting a battery string in response to a short circuit, according to one embodiment. First, a short circuit is detected (step 202). In response to the detection of a short circuit, the SMDU 28 opens the SSPC (step 204). (As used in this application, the expression "opening an SSPC" means opening a switch or contactor incorporated in a mid-section disconnect circuit.) After opening the SSPC, the SMDU 28 opens (trips) the string contactor 8 (step 206). If a string protection trip occurs, the SMDU 28 reports the trip type to the BPMS 22 (step 208). The BPMS 22 resets the protection in response to all trip types reported by the different strings.

[0047] The SMDU disconnect architecture is chosen for the unidirectional SSPC to minimize losses during normal mode when compared to a bidirectional switch. The trade-off is that a unidirectional switch can only block current in one direction. The SSPC is designed to block and interrupt current only in discharge mode. In charge mode, the SSPC cannot block current because current can still flow through diode 90. The rationale for the unidirectional design is that in discharge mode, only high current disconnection capability / quick disconnection capability is required to protect against the high short circuit current characteristics of an uncontrolled battery. In charge mode, the differential voltage (V charger -V battery ) is applied, the string contactor 8 of one string will supply a battery charger current (e.g., 50-100A with a controlled current limited power supply) dc) can be interrupted. If a short circuit occurs across or within a string while in charging mode, the unaffected string automatically enters discharging mode (the string contributing to the fault), and the Hall-effect current sensor of the affected string detects the excessive current and then reports the condition to the SMDU 28 and BPMS 22. The unaffected string is then protected by its SSPC as described in the paragraph immediately above (with the option to re-engage its contactor after the fault is cleared). The string contactor 8 of the affected string is then commanded to open, which will interrupt current from the charger if the charger does not trip.

[0048] It is assumed that the fault in the affected string is isolated. Two types of faults can occur: a fault can occur on either side of the string (either the positive rail or the negative rail downstream of the SSPC so that the short circuit current does not flow to the load current sensor 92). In this case, the fault will not be detected by the load current sensor and the only means of protection is the fusible link (passive protection). If the fault occurs within the string between the positive and negative rails, the short circuit current will flow and be detected by the load current sensor 92, and will be cleared by the steps previously described in this disclosure.

[0049] String contactors 8 are used to provide galvanic isolation for the positive and negative high-voltage busbars 38a and 38b required for each battery string 24. When a fault is to be cleared, the SMDU solid-state disconnect circuit is always opened before opening the string contactors 8 during discharge mode. In this case, the string contactors 8 can be sized to interrupt currents, such as charging currents, by gently reducing voltage without reducing significant currents or voltages. An "open air" non-sealed contactor implementation can be advantageously used in a BDU implementation. By removing the high current / high voltage reduction constraint, this architecture can maximize the use of the string contactors 8, reducing weight and increasing reliability. As described below, a pyroswitch / fuse can be used as a backup disconnect to provide a secondary battery overcharge disable mechanism.

[0050] The fast opening of an SSPC can be used to implement certain electrical protections, such as desaturation switch protection, to minimize the sudden energy released during a short circuit. Desaturation protection is used to measure the voltage V across the semiconductor switch to determine whether the transistor (e.g., MOSFET) is operating in the fully on state. ds If the transistor is only partially on, i.e., not saturated, the device can overheat and self-destruct.

[0051] 8A is a circuit diagram showing some components of the smart middle battery disconnect subsystem 14 according to one proposed implementation, including a TVS device 84, a middle disconnect circuit 85, and a desaturation protection module 76. The middle disconnect circuit 85 includes a MOSFET 88 and a diode 90 connected in parallel. The TVS device 84 comprises a Zener diode 64. The smart middle battery disconnect subsystem 14 is configured to detect the drain-source voltage V of the MOSFET 88. dsThe desaturation protection module 76 further includes a driver 114 that is activated by the desaturation protection module 76 to drive the MOSFET 88 open when V exceeds a threshold. ds , and directly utilizes the control of driver 114 to open MOSFET 88. As shown in FIG. 8B, desaturation protection module 76 measures voltage V ds A comparator 110 is provided for outputting a trip signal in response to exceeding a threshold value.

[0052] For analog or digital hardware (e.g., FPGA) controlled implementations, desaturation protection can trip on a severe short circuit fault in less than 10 μs. Taking into account system impedance (inductance), desaturation protection can isolate the fault before the battery's maximum short circuit current capability is reached. For example, Figure 9A is a graph showing the calculated short circuit current versus time for a typical battery after a short circuit occurs at time t=0. The trip signal generated at time t=10 μs will increase the short circuit current to the maximum short circuit current of 4.4 kA. DC (steady state) without reaching 2.4kA DC During opening, the overvoltage due to the system inductance must be clamped by the TVS device 84. The TVS device 84 is in parallel with the mid-disconnect circuit 85, and the TVS device 84 clamps the overvoltage across the MOSFET 88 during quick opening, which is formed by the total system inductance and the opening dynamics. In the simulation results shown in Figure 9B, the drain-source voltage V ds =400V DC and current I ds =280I DC Desaturation protection tripped in less than 2 μs when the overvoltage V ds is approximately 1000V by the TVS device 84 DC was clamped to.

[0053] Desaturation protection must be blocked during start-up. The output voltage is sensed during start-up to determine if a load fault exists. If the output voltage increases normally, the load can be considered normal.

[0054] Referring again to FIG. 6, the overcurrent protection module 78 is configured to provide overcurrent protection using a standard time-current curve that shows how quickly a contactor or SSPC will trip at a given current magnitude. FIG. 10 is a graph showing an example of current through a solid-state switch versus time after a short circuit for a simulated mid-cell battery disconnect subsystem providing overcurrent protection. The numbers on the abscissa (horizontal axis) of the curve shown in FIG. 10 represent time (seconds). The overcurrent protection module 78 provides instantaneous trip protection to protect the solid-state switch and electrical system (batteries, wiring, etc.) in the event of a severe overcurrent.

[0055] 6 uses the mid-current measurement data obtained by the mid-current sensor 46 and the current measurement data obtained by the end current sensor 16 of the battery power distribution section 12. The ELCU 70 calculates the differential current of the battery string 24 and sets this differential current to a differential current threshold I dp Compare with.

[0056] According to one proposed implementation, the SMDU 28 is configured to implement differential current string protection using the positive end current sensor 16 and the mid-section current sensor 46. For each battery string 24, if the mid-section current does not equal the current sensed by the positive end current sensor 16, string differential protection is initiated and the battery string is isolated by opening the string contactor 8. The differential protection trip time is coordinated with the overcurrent sensing negative / positive current difference when Hall effect current sensors are utilized.

[0057] One of the serious issues with using solid-state switches in protective disconnect implementations is the potential failure mode of "fail shorted." For example, avalanche effects or critical energy switch thermal runaway can cause the solid-state switch to fail short. In this state, the solid-state switch cannot clear the fault and isolate the battery string. Typically, the switch continues to conduct until severe damage is caused to the switch package. The internal wirebond chip connections may eventually open / debond. Meanwhile, at high voltages and operating altitudes, sustained arcing may occur across the broken wirebond, causing further damage and allowing continued current to flow into the defect.

[0058] According to the embodiment shown in Figure 6, a fail-safe device is implemented in series with the solid state switch to provide redundancy. The fail-safe device is a pyroswitch element trigger with independent "fail-safe" protection. The voltage V of the solid state switch ds is sensed separately and used as a trigger to directly activate the pyroswitch 62. A timer is used to delay firing to allow the primary desaturation protection to open the SSPC before activating the pyroswitch 62. In the event of a short circuit of the SSPC, the pyroswitch 62 will fire directly and autonomously, isolating the circuit. The failsafe pyroswitch 62 is completely independent and does not require an auxiliary power source to operate. When the circuit is complete, the drain-source voltage V of the solid-state switch ds The pyroswitch 62 is powered and activated using a PyroSwitch 62. The pyroswitch 62 behaves like and mimics a traditional passive fuse. The pyroswitch 62 can be used to achieve short trip times (less than 1 millisecond), thereby limiting the energy and potential damage that can occur in a sudden event.

[0059] When commanding the pyroswitch 62 to open (essentially cutting through a thin copper plate with a "guillotine"), there is a potential risk of a sustained arc. To mitigate this problem, immediately after issuing the command to shear the current-carrying copper plate in the pyroswitch 62, a tiny diode / MOSFET auxiliary circuit (connected in parallel with the copper plate) is commanded to close, and this auxiliary circuit, which is in parallel with the current flowing through the arc, carries most of the short-circuit current. The voltage drop across the arc can be 20 V or more, while the voltage drop across the MOSFET is 0.7 V. Therefore, most of the short-circuit current flows through the parallel path, which is normally open. This results in the extinction of the arc in the pyroswitch 62. At this point, the short-circuit current bypasses the main current path and flows through a high-voltage fuse with a small current rating (e.g., a few amperes) to prevent the fuse from blowing before the MOSFET saturates. After a very short time, the fuse blows open, but because it is a high-voltage fuse, the arc does not persist. Therefore, the progression of the defect is prevented and the arc does not continue at all.

[0060] FIG. 11 shows a pyroswitch configuration according to one proposed implementation. Pyroswitch 62 includes a pyrofuse 82 located on main busbar 66. A pyrofuse is a type of high voltage fuse that uses a metal rod that bursts rather than melts to prevent arcing by breaking contact more quickly. Pyroswitch 62 is a miniature, lightweight, low current (5A) fuse located on parallel path 96. DC ) high voltage fuse 94. Parallel path 96 also includes auxiliary circuit 87 in series with fuse 94. Auxiliary circuit 87 is similar to mid-section disconnect circuit 85 (see FIG. 6) and includes a MOSFET in parallel with a diode.

[0061] In discharge mode in the event of a short circuit, when the pyrofuse 82 is activated, current flows through the parallel branch until the fuse 94 blows. The fuse 94 is used to provide a high-voltage fault clearing capability. A small parallel circuit allows for limiting an arcing event by blowing the pyrofuse 82 branched by the parallel circuit and clearing the fault through the fuse 94. Tandem protection can be implemented between the SSPC and the pyroswitch. The SSPC is used to open at its SOA (switching time, maximum current, system inductance) in response to a short circuit, while the pyroswitch covers the region (overvoltage) where the semiconductor has difficulty clearing the fault. In this example, an external trigger is used to activate the pyrofuse 82.

[0062] In charging mode, the same external signal can trigger activation of pyrofuse 82. If pyrofuse 82 is opened, charging current can still flow through parallel path 96, continuing to charge the battery. If the charging current exceeds its rated value (e.g., 5 A), DC ) or near its rated value, fuse 94 can be considered unblowable. To provide full redundancy for the string contactors in charging mode, the pyroswitch elements are designed to open and block during charging, allowing the net current to be zero. Parallel path 96 uses a diode / MOSFET circuit to block parallel path 96 during charging mode. It is important to note that during charging mode, the mid-point voltage difference is near zero and no arcing occurs, allowing pyrofuse 82 to blow without shunting. Pyrofuses 82 can be embedded in high-current PCB traces, along with separate, tiny parallel PCB traces containing fuse 94 and auxiliary circuitry 87. Both diode / MOSFET circuits (mid-point disconnect circuit 85 shown in FIG. 6 and auxiliary circuitry 87 shown in FIG. 14) may have TVS as part of their protection against overvoltage.

[0063] The pyrofuse 82 can be activated (during charge (overcharge) / discharge (overdischarge) mode) by an external signal (signal from the ELCU 70 or BPMS 22) as a trigger. In response to the above situation, the parallel path 96 can be blocked in both directions if necessary. If bidirectional blocking is required, a symmetrical back-to-back switch is implemented in the parallel path.

[0064] As described above with reference to Figure 6, the SMDU 28 also includes a soft-start control module 80. In normal mode, the SMDU 28 is capable of pre-charging the high voltage capacitive bus by actively controlling the semiconductor switches in a linear mode. The soft-start algorithm detects the voltage of the semiconductor devices and adjusts the gate drive voltage to maximize power (P max ) / Drain-source voltage (V ds ) is configured to control the current flowing through the semiconductor device so that the maximum power P max is determined by the safe operating area (SOA) of the switch, appropriately matched with desaturation protection.

[0065] Typically, DC power from the battery "enters" smoothly into the motor controller (a primary-type load), where a relatively large DC capacitor is placed across the high-voltage (+ and -) busbars. The source "sees" this DC capacitor as a capacitive load with very low resistance for the time required to charge the capacitor. This charging process involves a very large current being drawn by the source (due to the low resistance during the time the capacitor is being charged). Once the capacitor is fully charged, the current drops to a sub-nominal level, energizing the load and preparing it for operation. This is why MOSFET 88 is operated in its linear region—that is, why the amount of capacitor charging current is limited by limiting the voltage output of MOSFET 88. This is the initial step in preparing the motor controller for operation. In the power industry, this operation is known as "soft start," i.e., delaying the application of maximum voltage all at once and gradually increasing the voltage over a period of time. For high voltages, this period could be several seconds, for example, to safely ramp up to 1000V.

[0066] A soft-start routine eliminates problems caused by inrush current because it allows the current to increase to the required value over a period of time that can be adjusted. Inrush current is the large, instantaneous input current drawn by a power supply or electrical device when it is turned on. It is caused by the large initial current required to charge capacitors and inductors, or transformers. A soft-start routine has two main functions: (1) it prevents or reduces the magnitude of output voltage overshoot by ensuring that the output voltage does not rise too quickly, and (2) it reduces the large voltage drop that occurs when a partially discharged battery discharges a large inrush current. Because a soft-start routine reduces the magnitude of the inrush current, it also reduces the voltage drop during startup, allowing the system to maintain the voltage above the threshold that activates the system's under-voltage lockout (UVLO) mechanism.

[0067] FIG. 12 is a flowchart illustrating a soft-start control algorithm for optimizing the trajectory of the current through the intermediate semiconductor switch (MOSFET 88) to precharge the high-voltage capacitive busbar. The MOSFET 88 is connected to a load device 102. The ELCU 70's microcontroller 108 receives an electrical signal representing the output voltage from the voltage monitoring block 104 and outputs a current threshold obtained from a lookup table. A comparator 110 receives an electrical signal representing the current on the source side of the MOSFET 88 from the current monitoring block 106 and compares this current to a current threshold. When the measured current exceeds the current threshold, the comparator 110 outputs a control signal to a driver 114. The driver 114 controls the gate drive voltage of the MOSFET 88 by applying a pulse-width-modulated (PWM) signal filtered by a large RC filter 116. The comparator output is sent to the driver 114 via an optocoupler 112, an electronic component that uses light to transfer electrical signals between two isolated circuits. Optocoupler 112 prevents high voltage from affecting driver 114 .

[0068] 13A-13C are graphs showing power, current, and voltage when pre-charging a high-voltage capacitive bus using the normal soft-start procedure for the implementation shown in FIG. 12. For example, assume a 1 MW or larger source is capable of delivering 1000 A at 1000 V, but one wishes to limit the source's power output to 1000 W during the time required to charge the motor controller's capacitor. If MOSFET 88 is operated in its linear region so that its output current is very low (e.g., a few amps or tens of amps), applying a very low voltage to the gate and then gradually increasing this gate voltage will increase V ds to increase the charging current through MOSFET 88. Because the source power is limited (1000 W), the current is small and relatively stable, and V dsIt can be seen that the voltage rises (0.25 seconds) until it reaches 1000V (as shown in Figure 13C). The current spike to 1000A shown in Figure 13B is associated with the sharp step from 900V to 1000V seen in Figure 13C, but the system is designed to support this amount of current.

[0069] 14 is a diagram illustrating an example of a physical implementation of mid-section battery disconnect subsystem 14 integrated onto a printed circuit board 100 (hereinafter "PCB 100"). In this example, one side of PCB 100 is equipped with ELCU 70 and analog sensing 98, while the other side of PCB 100 is equipped with pyrofuse 82, fuse 94, and SSPC 81. The diagram illustrates that the above functionality can be implemented in hardware and integrated onto a PCB in a relatively compact and inexpensive manner.

[0070] 14, multiple sensing and control elements can be used to implement comprehensive control in the ELCU 70 (monitoring and processing information on cell voltage and temperature, cell state of charge, load current and voltage, desaturation voltage, etc.). In part, the element controlling the SSPC 81 can also control dedicated control elements such as the soft start control module 80 in addition to the pyroswitch 62 (see FIG. 6).

[0071] FIG. 15 illustrates the battery power distribution unit 12 connected to a battery charger 128 in charging mode. The battery charger 128 includes a safety control panel 130. The double-headed arrow indicates that the BPMS 22 is connected to and communicating with the safety control panel 130 of the battery charger 128. The battery power distribution unit 12 further includes high-voltage string contactors 8 and high-voltage load contactors 118 (shown in FIG. 16), the states of which can be controlled by the BPMS 22. The BPMS 22 is a controller (e.g., a microprocessor) responsible for implementing battery pack protection and aircraft system coordination functions. All individual battery strings 24 are electrically connected to the high-voltage busbars 38a and 38b of the battery power distribution unit 12 using a dedicated set of positive and negative contactors per battery string. For full personal safety, the string contactors 8 are in the open position, providing galvanic isolation between both the positive and negative rails.

[0072] In normal mode, the BPMS 22 controls the high-voltage contactors to configure the battery pack according to the operating mode selected by the user via the mode selection module 120. The BPMS controller is configured to coordinate with the individual SMDU controllers in selected operating modes, such as charging mode (bulk charging, string charging), discharging mode (active power provided to high-voltage loads), sleep mode, and off mode. For example, off mode can be accompanied by a lockout-tagout (LOTO) safety procedure used to ensure that machinery is properly shut down and cannot be restarted before maintenance or repair work is completed. The isolated power supply is locked and a tag is placed on the lock, identifying the worker who placed the tag. The worker then possesses the key to the lock, ensuring that only the worker can unlock and start the machinery. This prevents the machine from starting unexpectedly when it is in a hazardous condition or when the worker has direct contact with it. Other modes can easily be implemented using the BPMS 22 as a liaison and coordinator with the individual battery strings.

[0073] The BPMS22 is also configured to balance the charge between strings. Before entering discharge or bulk charge mode, it initiates soft-start mode to precharge the system capacitors. If two battery strings are not charged to the same voltage, circulating current may flow from one string to the other. SMDU soft-start mode is used to equalize charge between battery strings when necessary. The circulating current from one string to another is measured by a current sensor, and the resulting current measurement data is sent to the BPMS22. The BPMS22 commands the SMDU28 to operate in linear soft-start mode until the circulating current and string voltage difference are below an acceptable threshold. If the string voltages are too far apart and require a long time to balance, a "string" charge mode can be selected. In this mode, each string is individually precharged to a predetermined state of charge before entering bulk charge mode. The transition to bulk charge mode is initiated by the soft-start / equalization mode.

[0074] In charging mode, the BPMS 22 communicates with the battery charger 128 to adjust key charging parameters such as the desired charging current and charging voltage depending on the charging mode (bulk or single string), cell temperature, and charging profile. Strings can be charged independently of each other or in bulk charging mode. Bulk charging mode is used as the primary charging mode to quickly recharge the entire battery pack. When a new string is connected to the battery pack, single string charging mode is selected to charge the new string independently to a sufficient level before connecting it to the rest of the battery pack.

[0075] In discharge mode, the BPMS 22 configures the string contactors 8 to connect all available battery strings 24 to the available high-voltage busbars 38a and 38b and continuously monitors each individual string with assistance from each SMDU 28. The BPMS 22 is further configured to control the load contactors 118 to enable the required loads. The BPMS 22 provides the status of a charging algorithm based on coulomb counting or other techniques to report available energy levels to the aircraft. The BPMS 22 communicates available power to the loads to the main propulsion controller 10b (see FIG. 1) based on the number of available battery strings, their state of charge, and cell temperature. Based on this information, the main propulsion controller 10b actively adjusts the power applied to the propeller 32, taking into account power limitations.

[0076] When the BPMS 22 receives a command corresponding to a particular mode from an external controller, it performs an operation to initiate that mode. The external controller simply provides a discrete signal (high) corresponding to the given mode (e.g., a three-position selector switch). To prevent unintentional initiation of another mode, latching logic can be implemented to ensure that only the selected mode is active. In another embodiment, the charge mode cannot be initiated when the aircraft is in flight. In yet another embodiment, the discharge mode cannot be activated if the aircraft is on the ground and the battery state of charge is below a specified threshold.

[0077] The battery power distribution section 12 includes an embedded neutral-grounding network 52 and an IMD 26. The embedded neutral-grounding network 52 connects the battery pack neutral to mechanical ground. The grounding impedance is used to balance the positive and negative bus voltages, taking into account the positive and negative parasitic impedances to ground and the total insulation impedance required to ensure personal safety. A grounding switch can be used to lift the ground connection for sleep mode. The IMD 26 continuously monitors the battery pack and the entire propulsion system. In particular, the IMD 26 inputs a voltage waveform (square wave type) through the battery pack ground resistor to measure the positive and negative insulation impedance. The IMD 26 continuously monitors the battery pack and the entire propulsion system. Partial discharges are localized electrical discharges that can partially bridge the insulation between conductors in high-voltage electrical systems. They are the result of insulation failure when the electric field locally exceeds the breakdown strength. Such partial discharges can even further degrade the insulation between the conductors and potential breakdowns. Therefore, monitoring of partial discharges in high voltage systems is necessary to prevent breakdowns and damage in the power generation chain.

[0078] The BPMS 22 further includes a battery protection module 122 configured to provide redundant battery protection using the battery protection provided by the battery protection module 68 of the SMDU 28. The battery protection module 122 of the BPMS 22 implements specific parallel multi-string battery protection. Using dedicated string Hall effect current sensors ("HECS" in FIG. 15), the BPMS 22 can monitor each string current and detect current imbalances between strings. If the string currents indicate a severe imbalance among all battery strings, the BPMS 22 can isolate strings with out-of-range parameters using string current and other out-of-range parameters, such as cell voltage, cell temperature, and the expected current of each string.

[0079] The "Protection" function includes predefined responses to overcharge and overdischarge, as well as electrical protection. By its nature, "Overcharge" is a subset of the "Protection" function. Overcharge monitoring occurs only during battery charging. Differences exist in overcharge detection methods: individual cell temperature and cell voltage are monitored to prevent cell overcharging; virtual cell voltage is monitored to prevent overcharging; and individual string voltage (as the sum of individual virtual cell voltages) can be monitored as a secondary function to prevent string overcharging. Upon detecting an "Overcharge" condition (different from the cell balancing function), the charger is instructed to stop power flow and the charging contactor (not shown in FIG. 15) is instructed to open. The overall "Protection" function has numerous other capabilities that monitor for several conditions (e.g., short circuits between the positive and negative conductors, short circuits to ground or excessive leakage current, and temperature rise) and activate corresponding control loops that initiate predefined protection procedures to mitigate the anomaly. For example, there are three different types of faults described below with reference to FIGS. 19 and 20.

[0080] FIG. 16 illustrates the BPMS 22 responding to the detection of a short-circuit fault 124. FIG. 17 is a flowchart identifying the steps of a fault resolution procedure 210 performed by the BPMS 22 shown in FIG. 16. First, a short circuit is detected (step 212). In response to detecting the short circuit, the BPMS 22 opens the SSPC (step 214). (As used in this application, the phrase "opening an SSPC" means opening a switch or contactor incorporated in the mid-section disconnect circuit.) After opening the SSPC, the BPMS 22 opens (trips) the load contactor 118 (step 216). After tripping the load contactor 118, the BPMS 22 closes the SSPC.

[0081] After a string protection trip, the BPMS 22 is responsible for reconfiguring and resetting the different battery strings depending on the reported trip. For example, if one battery string is shown as experiencing a differential protection trip and all other battery strings indicate overcurrent or desaturation protection trips, the BPMS 22 will isolate the faulty battery string tripped by the differential protection and reset the non-faulty battery strings tripped by overcurrent or desaturation. A similar procedure can be followed for other fault situations (e.g., overtemperature or open string) where one string is faulty and the others are not.

[0082] Depending on the number of battery strings available, the BPMS 22 communicates with the electric propulsion controller to adjust the power drawn from the battery pack. The BPMS 22 sets power limits based on the number of available battery strings, the state of charge of different battery strings, cell temperature, and the mission profile. Power limits are dynamically adjusted during flight (including in the event of a battery string failure).

[0083] Referring again to Figure 16, the BPMS 22 and SMDUs 28 cooperate to enable an optimized system protection fault clearance procedure 210 shown in Figure 17. The BPMS 22 is configured to command all SMDUs to open after detecting a fault on the load side. The SMDUs may also sense the fault current and command the mid-section disconnect means to open as redundant protection (secondary protection) to the BPMS protection. In other words, the BPMS detection and commanding the mid-section to open is the primary protection level, while the operation of the SMDU itself is the secondary protection level to clear the fault in one of the loads.

[0084] For example, for a short-circuit fault 124 in the high-voltage load, the BPMS 22 commands all SMDUs 28 to open their respective mid-disconnect circuits (mid-disconnect contactors 48 shown in FIG. 5 and MOSFETs 88 shown in FIG. 6). To isolate the fault and prevent any short-circuit current from flowing, the BPMS 22 can act to open the high-voltage load contactor 118. Opening the mid-disconnect circuit brings the high-voltage busbar voltage to zero, preventing the short-circuit current from reaching the battery. The high-voltage load contactor 118 can be opened without risk of arcing or significant stress. After the high-voltage load contactor is opened, the BPMS 22 can ask the SMDUs 28 to reclose their mid-disconnect circuits to rebuild the high-voltage busbar voltage. The zero-current / zero-voltage opening short-circuit clearance procedure allows for the use of contactors optimized for high-voltage load distribution. The fast SSPC control allows for easy implementation of the DC foldback concept, which allows for a short time to execute the fault clearance procedure 210 and for the busbar voltage to be quickly ramped back up after the fault is cleared.

[0085] In the case of internal battery fault conditions, the BPMS 22 is configured to provide redundant protection using the SMDU / MMU1 protection described above for critical protection against cell overcharge, overtemperature, and overdischarge defects. Each module monitor 6b ("MMU2" in Figure 2A) monitors and monitors key cell parameters (e.g., V cell2 and T cell2 ) to the BPMS 22. In the event of a fault, the BPMS 22 is configured to use the string contactor 8 (see FIG. 3) as a resettable disconnect in the event of a battery protection trip, similar to the action initiated by the SMDU 28 and module monitor 6a ("MMU1" in FIG. 2A). In addition, the BPMS 22 is configured to directly activate the pyroswitch element 66 (see FIG. 6) as a redundant, non-resettable, heterogeneous shutdown mechanism in the event that the first (SMDU / MMU1) protection layer fails to adequately isolate the battery string or battery pack.

[0086] According to the embodiment shown in FIG. 18 , a third layer of protection (hereinafter, “BPMS ‘Overcharge 3’ protection unit 134”) is added for extremely serious events such as overcharge / overvoltage. To enable the BPMS ‘Overcharge 3’ protection unit 134 to be simple and robust, it is designed to use only the string module voltage or the positive and negative battery pack voltages of the string measured by the SMDU overvoltage detection circuit 140 as monitoring / triggering criteria. The BPMS ‘Overcharge 3’ protection unit 134 is activated when the module voltage (or one-side string voltage) becomes significantly unbalanced. In addition, the BPMS ‘Overcharge 3’ protection unit 134 is also activated when the module (or one-side string) voltage exceeds a maximum threshold. The BPMS ‘Overcharge 3’ protection unit 134 directly communicates with the battery charger ‘Overcharge 3’ protection unit 136 in the safety control panel 130, which interrupts the charger’s output stage. The disable mechanism 126 bypasses the battery charger controller and disables the PWM driver of the battery charger output stage directly. Alternatively, a battery charger contactor can be used to provide an alternative disable mechanism.

[0087] According to the embodiment shown in Figure 18, the battery charger 128 further includes a separate overvoltage protector 138 as part of the safety control panel 130. The battery charger overvoltage protector 138 detects the cell voltage V cell to 4.6V DCThe overvoltage protection section 138 activates the battery charger housekeeping power supply, completely disabling the battery charger electronics (shown as "HKPS Deactivate 132" in FIG. 18). (High-power converters used in industrial systems require an auxiliary power supply to support the housekeeping needs of the power supply unit. For example, an auxiliary power supply is commonly used to power the battery charger's on-board control electronics and voltage and current feedback sensing electronics. The housekeeping power supply is typically an isolated DC-DC converter that generates multiple outputs for output control devices.) Both the overcharge protection and overvoltage protection layers can be incorporated into the safety control panel 130, which derives its power directly from the battery, which has its own housekeeping power supply.

[0088] In summary, the embodiment shown in FIG. 18 incorporates the following layers of protection: (1) the first deactivation circuit is T cell1 and V cell1 (For example, V cell1 <4.3V DC ) is a resettable string contactor opening means by SMDU / MMU1. (2) The second deactivation circuit is T cell2 and V cell2 (For example, V cell2 <4.4V DC (3) The third disable circuit is a means for disabling the battery charger driver by the BPMS / MMU2 / safety control panel based on the battery module voltage or one-side string voltage. (4) Internal battery charger overvoltage protection.

[0089] To ensure reliable operation of a system containing multiple parallel battery strings, each individual string must be monitored for (a) overcurrent if a short circuit occurs external to the battery string in the system between one or more of the loads or the positive and negative high-voltage busbars 38a and 38b of the battery pack, and (b) any differential current flow within the battery strings if a short circuit occurs in one of the battery strings within the battery pack. The former relates to instantaneous trip protection of the entire battery pack in the event of a serious fault in the above situation (such as isolating the faulty load line or completely shutting down the system if the fault occurs between the busbars), while the latter is selective protection that isolates the faulty battery string so that the battery pack can operate after a short reset. Differential protection requires two current sensors in each battery string. The same current sensor may be used for overcurrent protection.

[0090] 19 is a flowchart identifying the steps of an enhanced algorithm 250 for clearing overcurrent faults that extends to disconnecting a battery string when a fault clearance device fails to open or when a fault clearance device fails and shorts out. First, the SMDU 28 detects an overcurrent fault (step 252). In response to detecting an overcurrent fault, the SMDU 28 opens its SSPC (step 254). (As used in this application, the phrase "opening an SSPC" means opening a switch or contactor incorporated in a mid-section disconnect circuit that is part of the SSPC.) After opening the SSPC, the SMDU 28 opens the current I through the battery string. 1C is the short circuit current I s.c._CIf the SMDU 28 determines in step 256 that the fault has been cleared, the fault clearance operation is terminated. If the SMDU 28 determines in step 256 that the fault has not been cleared, the failsafe trigger circuit 86 (see FIG. 6) is closed (step 258). This causes the pyroswitch 62 to open (step 260). The failsafe trigger circuit 86 is then opened (step 262). This results in the battery string 24 associated with the open pyroswitch 62 being disconnected (state 264). The fault clearance operation is then terminated.

[0091] Each SMDU 28 is configured to execute the steps of the algorithm that clears the fault by opening the SSPC of that SMDU 28, with an extension to disconnecting the battery string if the SSPC fails to open or if the SSPC fails and shorts out. This extension is a fail-safe trigger procedure that is considered an abnormal operation (because it is based on the activation of a pyrofuse) that will cause irrecoverable shutdown of the battery pack. This is not the preferred way to clear a fault, and is considered a last resort to prevent the battery pack from catching fire.

[0092] 2 is a block diagram representing the portions of the system shown in FIG. 2 that are relevant to the occurrence of either a bus fault 142, a load fault 146, or a string fault 144. A bus fault 142 is a serious short circuit fault between the positive high voltage bus bar 38a and the negative high voltage bus bar 38b external to the battery strings 24. A load fault 146 is a serious fault between the positive and negative lines of one load (load 1 in this example). A string fault 144 occurs internal to the battery pack in one of the N battery strings 24 (N is an integer greater than 1).

[0093] Each battery string 24 includes a pair of half-strings 25a and 25b (each half-string includes multiple battery modules connected in series). The battery disconnect / protection system includes respective mid-section disconnect contactors (not shown in FIG. 20) disposed between half-strings 25a and 25b, respective string contactors 8a disposed between half-string 25a and positive high-voltage busbar 38a, and respective string contactors 8b disposed between half-string 25b and negative high-voltage busbar 38b.

[0094] The battery disconnection / protection system further includes an SMDU 28 that monitors each battery string 24. Each SMDU 28 is configured to provide a battery string protection function that opens a middle disconnect circuit (not shown in FIG. 20 ) corresponding to that SMDU 28 when a fault is indicated by current flowing through its corresponding middle current sensor 46. Additionally, a differential protection function uses middle current measurement data obtained by the middle current sensor 46 and current measurement data obtained by the end current sensors 16 that measure the difference in current for each of the N battery strings 24. Each SMDU 28 is connected to and communicates with the BPMS 22.

[0095] 20, positive high voltage bus bar 38a is connected to loads 1 and 2 through corresponding load contactors 118a, and negative high voltage bus bar 38b is connected to loads 1 and 2 through corresponding load contactors 118b. Load current is measured by corresponding load current sensors 92.

[0096] To avoid any confusion regarding the notation used in Figure 20, the N SMDUs 28 are identified as SMDU1 through SMDUN, the N intermediate current sensors 46 are identified as HECS1C through HECSNC, the N end current sensors 16 are identified as HECS1P through HECSNP, the N positive-side string contactors 8a are identified as C1P through CNP, and the N negative-side string contactors 8b are identified as C1N through CNN. Furthermore, the set of load contactors 118a are identified as C1LP and C2LP, respectively, the set of load contactors 118b are identified as C1LN and C2LN, respectively, and the set of load current sensors 92 are identified as HECS1L and HECS2L. The same identifiers are referenced in Figure 21.

[0097] Figure 21 is a flow chart identifying the steps of an algorithm 300 for implementing selective overcurrent and differential protection responses by the battery pack disconnect / protection system for each of the faults shown in Figure 20. The notation used is as follows: I 1P ~I NP is the current detected by each of the N edge current sensors 16, and I 1C ~I NC is the current detected by each of the N intermediate current sensors 46, and I 1L ~I ML is the current detected by each of the M load current sensors 92, and I s.c._C =I s.c._P is the current threshold for detection of a short circuit by the middle current sensor 46 and the end current sensor 16 when there is no difference (i.e., the short circuit current generated by one battery string when the short circuit occurs outside the string), and I s.c._L is the current threshold for detection of a short circuit by the load current sensor 92 when the short circuit occurs on the load side, dI / dt is the threshold for the rate of change of the short circuit current (i.e., how quickly the current rises steadily after a short circuit occurs in the system; this threshold depends on the battery chemistry but may typically be quantified as several hundred amperes per millisecond or more), and I dpis the differential current threshold (i.e., the threshold for detecting the difference between the currents detected by the end current sensor 16 and the middle current sensor 46 of the same string, respectively).

[0098] In process 302, the N SMDUs 28 (rate of change) are compared to a threshold value dI / dt. For overcurrent protection, the SMDUs 1C ~I NC or the string current I 1P ~I NP can be used since they are usually equal (if there is no difference in current which would indicate a short circuit within the string).

[0099] If any fault occurs (bus fault 142, string fault 144, and load fault 146 identified in FIG. 20), each intermediate current sensor 46 (HECSiC i=1,...,N) reports a short-circuit current above a threshold, in which case the overcurrent fault clearance scheme 308 is invoked by the SMDU. The SMDU 28 recognizes the overcurrent (OC) fault and reports an "overcurrent = TRUE" status to the BPMS 22 (fault), indicating that all SMDUs 28 are in a fault state. In this situation, it is assumed that the SMDU's SSPCs open as part of their normal operation. If one or more SSPCs fail to open, they command the corresponding string or strings to disconnect by activating a pyro-fuse (described above with reference to FIG. 19). This is abnormal operation.

[0100] In process 304, the BPMS 22 receives the readouts from the corresponding M load current sensors 92 (HECSjL, j=1, . . . , M, where M is the number of parallel loads) and calculates the load current I 1L ~I ML is the threshold I s.c._L The threshold is compared with I s.c._C As low as N*I s.c_CAt the same time, if the detected fault is not a load fault due to a particular load (i.e., fault 142 or 144 in FIG. 20), the load current sensor 92 will report a load current that is much lower than the load current threshold and close to zero. Since this is not a load fault condition, the load (e.g., Load 1 and Load 2 as seen in FIG. 20) will be treated by the BPMS 22 as being in a normal state (load HECS is OC or "No"). If the fault was in the busbar, the mid-section current sensor 46 would report a large fault current, the load current sensor 92 would not report a large current, and the load current sensor 92 would be essentially zero (the load current would be the product N*I s.c_C (The fault current is never nearly equal to 320.) Therefore, the BPMS 22 only accepts the fault current reported by the SMDU 28, determines that the fault is on the bus, and ultimately requests that the motor / load be deactivated. In particular, after verifying that the load fault has cleared by reading a zero value from the load current sensor 92, it can safely command the motor to deactivate (step 322). This procedure determines the initiation of protection to mitigate a severe bus fault 320 between the positive and negative high voltage busbars 38a and 38b.

[0101] In contrast, if the fault occurs on the load side, this case must be distinguished from a bus fault. In this case (load-side fault), the affected load current sensor 92 (HECSjL) reports a load overcurrent to the BPMS 22. At the same time, all SMDUs 28 report a fault to the BPMS because of the overcurrent in the SMDU. In the event of a severe fault between the positive and negative rails of one of the loads (e.g., Load 1 in FIG. 20), in addition to the reading from the intermediate current sensor 46 (HECSiC) that reported the short circuit current condition, the load current sensor HECS1L (see FIG. 20) will report N*I s.c._string (I s.c._string(where C1LP and C1LN are short-circuit currents in one string and are approximately equal to the short-circuit currents in the other strings), while the other load current sensors HECSjL report load currents close to zero. If the current clearing capability of the load contactors C1LP and C1LN is sufficient to interrupt the large fault current, the above readings of the load current sensors HECSjL are sufficient for the BPMS 22 to determine that a short-circuit fault condition has occurred in one of the loads (load 1 in this case: YES (LOAD 1)) and to clear the short-circuit fault condition by opening the load contactors C1LP and C1LN (step 324) to isolate the faulty load. All of the mid-disconnect contactors of the N SMDUs are then closed (step 326), thereby restoring power flow to the remaining loads. After all of the battery strings have been reconnected to the non-faulty loads, a motor restart 332 is initiated. If the current clearing capability of the load contactors C1LP and C1LN is not sufficient to interrupt the large fault current without destruction, the SMDU commands all mid-section contactors or SSPCs to open first, then open the load contactors C1LP and C1LN, and then close the mid-section SSPCs or contactors.

[0102] In process 306, the BPMS 22 receives the readings from each of the N edge current sensors 16 (HECSiP, i=1, . . . ,N, where N is the number of battery strings), and the BPMS 22 calculates the string current I 1P ~I MP Threshold I s.c._PIn this third example, a fault occurs within one of the strings of batteries (i=1 in this example). This is the only example where the end current sensors 16 (HECSiP) are incorporated into the control loop. From a global perspective, all end current sensors 16 will report a short circuit current. In addition to this, from the perspective of the case where the differential protection function is monitored, the differential protection module will report that the difference in readings between HECS1P and HECS1C is much larger than the specified differential threshold ΔI. This is because the end current sensor HECS1P will detect a very large difference (approximately (N-1)*I) as current flows into the string, contributing to the fault, and then current from other strings of batteries will flow into the short circuit path. s.c._C This threshold is (N-1)*I because it detects a current with the opposite sign to the short circuit current of the original string read by the HECS1C (ΔI of other strings is essentially zero). The magnitude of this threshold is (N-1)*I s.c._C The current does not need to be equal to 3A, but can be as low as 10-100A to shorten the trip time for differential protection. Furthermore, when a current difference is detected by the pair of end current sensors and mid-current sensors, both return values ​​very close to zero. In this state, the BPMS 22 detects a differential protection state for the first string (i=1) in addition to an overcurrent (Yes (first string)). The protection initiation procedure for clearing the fault is similar to that described above for load faults. The string fault is cleared by opening string contactors C1P and C1N (step 328) to isolate the non-faulty battery string. The mid-disconnect contactors of the other (N-1) SMDUs (SMDU2-SMDUUN) are then closed (step 330), thereby restoring power flow to the remaining battery strings. After all of the battery strings have been reconnected to the busbars, a motor restart 332 is initiated.

[0103] To briefly summarize the above, a fault condition is detected as follows: in the faulty string (the first string in this example), the middle current sensor HECS1C reports a large current indicating a fault, which is approximately the same as all the other (N-1) middle current sensors 46. This indicates an overcurrent condition. The load current sensor 92 does not report a large fault current, so the detected fault is not on the load side. The BPMS 22 then determines whether the fault is a bus fault or a string fault. When all end current sensors 16 report approximately the same current as that reported by their respective middle current sensors 46 (ΔI=I 1P -I 1C =I dp ≒20A), the BPMS22 determines that a bus fault has occurred. In contrast, when a string fault occurs, the end current sensor HECS1P detects -(N-1)I s.c._C This is the second condition required to determine that the detected fault is a string fault. This is because the differential protection threshold I is exceeded when ΔI is calculated as the absolute value of the currents detected by current sensors HECS1C and HECS1P subtracted from each other. dp = 20A, which is much larger than approximately (N-2)I s.c._C Therefore, upon detection of a string fault condition, the BPMS 22 performs isolation of the faulty string and reconfigures the batteries to operate in an (N-1) configuration (one less operational battery string).

[0104] While the protection scheme described above is originally designed to provide (N-1) redundancy in terms of battery string availability, the number of potentially defective strings may be further reduced to (N-2), (N-3), etc., and their elimination may ensure the required mission integrity. Furthermore, the minimum level of redundancy may be easily determined by reducing the motor power output during the mission to an acceptable extent.

[0105] During load and string fault clearance, the BPMS 22 issues a time delay (τ) command between the opening of the center tap SSPC and the opening of the string contactors C1P and C1N and the load contactors C1LP and C1LN to isolate the string and load, respectively. This is because excessive current may flow into the fault even before the contactors open to create galvanic isolation. The delay τ therefore mitigates any mis-synchronization of the opening of the center tap SSPCs of the N SMDUs 28.

[0106] Some systems, devices, applications, or processes are described herein as including several modules. The modules may be different functional units that may be implemented in software, hardware, or a combination thereof, except for the modules mentioned above that are preferably implemented as hardware or firmware to enable the streaming calculations disclosed herein. If the functionality of the modules is performed in any part through software, the modules may include non-transitory tangible computer-readable storage media.

[0107] The flowcharts and block diagrams of the different illustrated embodiments illustrate the architecture, functionality, and operation of some possible implementations of the apparatus and methods in the example embodiments. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, function, and / or portion of an operation or step. For example, one or more of the blocks may be implemented as program code, in hardware, or a combination of the program code and hardware. If implemented in hardware, the hardware may, for example, take the form of integrated circuits that are manufactured or configured to perform one or more operations in the flowcharts or block diagrams.

[0108] The embodiments disclosed above employ one or more processing or computing devices. Typically, such devices include processors, processing devices, or controllers, including, for example, general-purpose central processing units, microcontrollers, reduced instruction set computer processors, application-specific integrated circuits, programmable logic circuits, field-programmable gate arrays, digital signal processors, and / or any other circuits or processing devices capable of performing the functions described herein. The methods described herein may be encoded as executable instructions embodied in a non-transitory, tangible, computer-readable storage medium (including, but not limited to, a storage device and / or a memory device). Such instructions, when executed by a processing device, cause the processing device to perform at least portions of the methods described herein.

[0109] The methods described herein may be encoded as executable instructions embodied in a non-transitory, tangible, computer-readable storage medium (including, but not limited to, a storage device and / or a memory device) that, when executed by a processing system or computer system, cause the system device to perform at least portions of the methods described herein.

[0110] While systems and methods for smart battery protection / disconnection in aircraft-mounted high-power / high-energy high-voltage modular multi-string battery packs have been described with reference to various embodiments, those skilled in the art will recognize that various changes may be made and equivalents may be substituted for elements of the embodiments without departing from the scope of the teachings of the present application. In addition, numerous modifications may be made to adapt the teachings of the present application to a particular situation without departing from the scope of the teachings of the present application. Therefore, it is not intended that the claims be limited to the specific embodiments disclosed herein.

[0111] Further aspects of the present disclosure are described below.

[0112] A1. A positive busbar and a negative busbar; a battery string including a first half-string and a second half-string, the first half-string including a first plurality of battery modules connected in series, and the second half-string including a second plurality of battery modules connected in series; a first string contactor connected to the positive busbar and the first half-string; a second contactor connected to the negative busbar and the second half string; a mid-section disconnection circuit connected to the first and second half-strings; an intermediate current sensor for measuring a current flowing in the intermediate disconnection circuit; a smart midsection disconnect that opens the midsection disconnect circuit after receiving an output from the midsection current sensor indicating that an overcurrent is flowing in the midsection disconnect circuit; a plurality of first module monitors connected in communication with the smart midsection disconnect, each first module monitor comprising a sensor for measuring a virtual cell voltage and an individual cell temperature within a corresponding battery module; Equipped with the smart midsection disconnect is further configured to control the balancing function performed by the balancing circuit as a function of the measured virtual cell voltage and the individual cell temperature. Battery system.

[0113] A2. A battery pack management system connected to and communicating with the smart intermediate disconnection unit; a plurality of second module monitors connected to and communicating with the battery pack management system, each second module monitor having a sensor for measuring a virtual cell voltage and an individual cell temperature within a corresponding battery module; The battery system of paragraph A1, further comprising:

[0114] A3. A method of operating a battery system comprising a battery string connected across a positive bus bar and a negative bus bar through a pair of string contactors when the pair of string contactors are closed, the battery string comprising a pair of single-sided strings connected in series through a mid-section disconnect circuit, the method comprising: measuring the current flowing in the mid-section disconnect circuit; measuring the current through a string contactor connecting the battery string to the positive busbar; calculating the difference between the measured currents; determining that the difference exceeds a threshold indicative of a string defect; after opening the mid-section disconnect circuit, opening the string contactors in response to determining that the difference exceeds a threshold value; A method comprising: [Explanation of symbols]

[0115] 2 Propulsion device 3 Overcharging 4 series-connected battery modules 5 parallel cells 6a Module monitoring section 6b Module monitoring section 7a SMDU data bus 7a BPMS Data Bus 8 High Voltage String Contactors 8a String Contactor 8b String Contactor 10 Motor Controller 10b Main electric propulsion controller, EPC 12 Battery power distribution section 14 Smart mid-cell battery disconnection subsystem 16 Edge current sensor 18 Battery pack 20 High Voltage DC Power Distribution System, HVDC Power Distribution System 22 BPMS 24 battery strings 24a battery string 24b battery string 24c battery string 24d battery string 25a single string 25b single string 26 IMD 28 SMDU 30 AC motor 32 propeller 34 Propeller shaft 36 propeller blades 38a high voltage busbar 38b High Voltage Busbar 40a battery power output line 42 Internal short circuit 44 External Short Circuit 46 Intermediate current sensor 48 Intermediate disconnect contactor 50 virtual cells 50a Virtual Cell 50b Virtual Cell 50c Virtual Cell 50d Virtual Cell 52 Built-in neutral grounding network 54a Cell bus bar 54b Cell bus bar 56 Synthetic Fusible Link 58 Sensors 60 Balanced Circuit 62 Pyro Switch, Fail-Safe Pyro Switch 64 Zener diode 66 Main busbar, pyroswitch element 68 Battery Protection Module 70 ELCU 72 String Differential Protection Module 74 Insulation Monitoring Device 76 Desaturation Protection Module 78 Overcurrent Protection Module 80 Soft Start Control Module 81 SSPC 82 Pyro Fuse 84 TVS devices 85 Intermediate disconnection circuit 86 Fail-safe trigger circuit 87 Auxiliary circuit 88 MOSFET 90 Diode 92 Load current sensor 94 High Voltage Fuse 96 parallel routes 98 Analog Sensor 100 Printed Circuit Boards 102 Load Device 104 Voltage monitoring block 106 Current monitoring block 108 Microcontrollers 110 Comparator 112 Optocoupler 114 Driver 116 RC filter 118 High Voltage Load Contactor 118a load contactor 118b load contactor 120 Mode Selection Module 122 Battery Protection Module 124 Short Circuit Defect 126 Operation deactivation mechanism 128 battery charger 130 Safety control panel 132 HKPS out of operation 134 BPMS "Overcharge 3" protection section 136 Battery charger “overcharge 3” protection part 138 Battery charger overvoltage protection unit 140 SMDU overvoltage detection circuit 142 Busbar Defect 144 String Defects 146 Load Defect 200 ways 210 System Protection Fault Resolution Procedures 250 Algorithms 264 Status 300 Algorithms 308 Overcurrent Defect Elimination Scheme 320 Busbar Defect 332 Restart

Claims

1. a positive busbar and a negative busbar; a battery pack including a first battery string including a first half-string and a second half-string; a first string contactor connected to the positive busbar and the first half-string; a second string contactor connected to the negative busbar and the second half string; a first intermediate disconnection circuit connected to the first and second half strings; a first intermediate current sensor for measuring a current flowing through the first intermediate disconnection circuit; a first smart middle section disconnect unit that opens the first middle section disconnect circuit after receiving an output from the first middle section current sensor indicating that an overcurrent is flowing through the first middle section disconnect circuit; A battery system comprising: the first smart mid-section disconnect is further configured to open the first string contactor after opening the first mid-section disconnect circuit, and the first smart mid-section disconnect is further configured to open the second string contactor after opening the first mid-section disconnect circuit.

2. 10. The battery system of claim 1, wherein the first mid-disconnect circuit comprises a mid-disconnect contactor.

3. 2. The battery system of claim 1, wherein the first mid-section disconnect circuit comprises a semiconductor switch, the semiconductor switch further comprising a pyrofuse connected in series with the first mid-section disconnect circuit, and the first smart mid-section disconnect is further configured to activate the pyrofuse in response to the semiconductor switch failing to open.

4. The battery system according to claim 3 , further comprising a fuse connected in parallel with the pyrofuse.

5. The battery pack further includes a second battery string including a third half-string and a fourth half-string, and the battery system further includes: a third string contactor connected to the positive busbar and the third half-string; a fourth string contactor connected to the negative busbar and the fourth half-string; a second intermediate disconnection circuit connected to the third and fourth half-strings; a second intermediate current sensor for measuring a current flowing through the second intermediate disconnection circuit; a second smart midsection disconnect that opens the second midsection disconnect circuit and the third string contactor in response to receiving an output from the second midsection current sensor indicating an overcurrent flowing in the second midsection disconnect circuit; The battery system of claim 1 further comprising:

6. The battery system of claim 5 , further comprising a battery pack management system connected to and communicating with the first and second smart middle disconnects.

7. a first load contactor connected to the positive busbar; a second load contactor connected to the negative busbar; a load current sensor that measures the current flowing through the first load contactor; Furthermore, The battery pack management system includes: opening the first and second load contactors after receiving data from the load current sensor indicative of a load fault; closing the first and second intermediate disconnect circuits after opening the first and second load contactors It is configured as follows: The battery system according to claim 6 .

8. A first end current sensor that measures the current flowing through the first string contactor; a second end current sensor for measuring current flowing through the third string contactor; Furthermore, The battery pack management system includes: opening the first mid-section disconnect circuit and thereafter opening the first and second string contactors in response to a first difference, the first difference being a difference in current measured by the first mid-section current sensor and a first end current sensor, exceeding a specified threshold; and opening the second mid-section disconnect circuit and thereafter opening the third and fourth string contactors in response to a second difference, the second difference being a difference in current measured by the second mid-section current sensor and the second end current sensor, exceeding the specified threshold. It is configured as follows: The battery system according to claim 6 .

9. The battery pack management system includes: closing the second mid-section disconnect circuit after opening the first and second string contactors; closing the first mid-section disconnect circuit after opening the third and fourth string contactors; The battery system of claim 8 further configured as follows:

10. 7. The battery system of claim 6, wherein the battery pack management system is further configured to output power limiting commands to an electric propulsion controller to adjust the power drawn from the battery pack, the power limiting commands being based on a number of available battery strings, a state of charge of the battery strings, and a mission profile.

11. 2. The battery system of claim 1, further comprising a module monitor connected to and communicating with the first smart middle disconnect and comprising sensors and balancing circuits that measure virtual cell voltages and individual cell temperatures within the battery modules of the first half-string, the first smart middle disconnect further configured to control a virtual cell-to-virtual cell balancing function performed by the balancing circuits as a function of the measured virtual cell voltages and individual cell temperatures.

12. 2. The battery system of claim 1, wherein the first smart mid-disconnect is further configured to execute a soft start control algorithm to optimize a trajectory of a value of current through the first mid-disconnect circuit to pre-charge a capacitance between the positive bus bar and the negative bus bar.

13. A positive bus bar and a negative bus bar; a battery pack including a battery string including a first half-string and a second half-string; a first string contactor connected to the positive busbar and the first half-string; a second string contactor connected to the negative busbar and the second half string; a mid-disconnect circuit connected to the first and second half-strings, measuring the current flowing through the mid-section disconnect circuit; determining that the measured current in the mid-section disconnect circuit exceeds a threshold indicative of an overcurrent; opening the mid-section disconnect circuit in response to the determination that the measured current exceeds the threshold; opening the first string contactor after opening the mid-section disconnect circuit; opening the second string contactor after opening the mid-section disconnect circuit; A method comprising:

14. 14. The method of claim 13, further comprising the step of activating a pyrofuse connected in series with the mid-section disconnect circuit in response to the mid-section disconnect circuit failing to open.

Images