Aircraft propulsion utilizing a safety-critical energy management system

Abstract

An energy management system (EMS) for an aircraft is provided. The aircraft may have one of a plurality of propulsion systems, such as a parallel hybrid electric propulsion system, a parallel turboelectric propulsion system, an electric propulsion system, a turboelectric propulsion system, and a turbohybrid electric propulsion system. The EMS includes redundant control paths for controlling safety-critical operations. Each redundant control path is configured to independently determine whether to electrically isolate a line replaceable unit (LRU) from a high-voltage direct current link (HVDC link) based on status information from the LRU. The isolation is based on the independent determination. The HVDC link is used for propulsion. The number of redundant control paths and components may depend on the type of propulsion system.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001]

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 63 / 389,599, filed on July 15, 2022, which is hereby incorporated by reference in its entirety into the present specification.

TECHNICAL FIELD

[0002]

[0002] The present disclosure relates to energy management systems for different aircraft propulsion architectures.

BACKGROUND ART

[0003]

[0003] The most well-known aircraft use prime movers such as jet engines for propulsion. However, recently, it has been proposed to use electric motor(s) either to supply propulsive force or to assist jet engines for propulsion. While it is common for ground vehicles such as cars and buses to use electric motors or hybrid power, their use in aircraft has not been successfully applied. This is because many of the techniques used for ground vehicles do not translate directly to aircraft propulsion. This is also because the power requirements for aircraft propulsion are significantly higher than those for cars or buses, as well as the flight duration.

[0004]

[0004] Aircraft systems also require extensive testing to meet stringent safety requirements for passing certification. This testing covers the hardware and software elements of the system such that the probability of the system experiencing a catastrophic failure is extremely low. A catastrophic failure is a failure that may result in imminent loss of life and property.

SUMMARY OF THE INVENTION

[0005]

[0005] Therefore, an energy management system (EMS) for an aircraft is disclosed. The EMS may be connected to a plurality of line-switching units (LRUs). The LRUs may be sink LRUs or source LRUs. The source LRU is a source of power for a high-voltage DC link (HVDC link), and the sink LRU uses power from the HVDC link. The HVDC link may be used for propulsion. The EMS includes one or more communication interfaces. The communication interfaces may be configured to receive status information from each of the source LRUs and sink LRUs. The status information may include information from each sensor in each LRU and a determination that the information from each sensor is within a predetermined range. The communication interfaces may be used to transmit commands to the source LRUs and sink LRUs. The EMS includes redundant control paths for controlling safety-critical operations. The redundant control paths are configured to independently determine whether to electrically isolate the LRUs from the HVDC link based on status information from the LRUs. Isolation of the LRUs is based on independent determination.

[0006]

[0006] The number of redundant control paths and components may depend on the type of propulsion system. An aircraft may have one of several propulsion systems, such as a parallel hybrid electric propulsion system, a parallel turboelectric propulsion system, an electric propulsion system, a turboelectric propulsion system, and a turbohybrid electric propulsion system.

[0007]

[0007] In aspects of the present disclosure, the EMS may be configured to achieve a threshold probability of catastrophic failure below 10. For example, the threshold probability of catastrophic failure is 10 -9 It is possible.

[0008]

[0008] In aspects of the present invention, the redundant control path may also independently determine whether to electrically connect the LRU to the HVDC link. [Brief explanation of the drawing]

[0009] [Figure 1]

[0009] An example of a system according to the embodiments of this disclosure is given. [Figure 2]

[0010] An example of an energy management system in a parallel turbohybrid propulsion system according to the embodiments of this disclosure is provided. [Figure 3]

[0011] An example of an energy management system in a parallel hybrid electric propulsion system according to the aspects of this disclosure is provided. [Figure 4]

[0012] An example of an energy management system according to the aspects of this disclosure is provided. [Figure 5]

[0013] Figures 2 and 3 illustrate an example of a distributed system control unit according to the present disclosure for an energy management system. [Figure 6]

[0014] An example of a power conversion unit according to the embodiments of this disclosure is provided. [Figure 7]

[0015] Figure 5 illustrates an example of a key-on management method according to the present disclosure for a distributed system control unit. [Figure 8]

[0016] Figure 5 illustrates an example of an in-flight management method for a distributed system control unit according to an embodiment of the present disclosure, for the connection of a line switching unit. [Figure 9]

[0017] Figure 5 illustrates an in-flight management method for a distributed system control unit in response to receiving commands from the cockpit according to an aspect of this disclosure. [Figure 10]

[0018] Figures 2 and 3 illustrate another system control unit, either a federated or distributed type, for the propulsion system, according to the embodiments of this disclosure. [Figure 11]

[0019] Figure 10 illustrates an example of an in-flight management method for the line switching unit connection according to an aspect of this disclosure for the system control unit. [Figure 12]

[0020] An example of an energy management system in an all-electric propulsion system according to the embodiments of this disclosure is provided. [Figure 13]

[0021] illustrates an energy management system in a turbo-electric propulsion system according to aspects of the present disclosure. [Figure 14]

[0022] illustrates an energy management system in a turbo-hybrid electric propulsion system according to aspects of the present disclosure. [Figure 15]

[0023] illustrates a federated or distributed system control unit according to aspects of the present disclosure for the propulsion system of Figures 12 to 14. [Figure 16]

[0024] illustrates a method for key-on management according to aspects of the present disclosure for the system control unit of Figure 15. [Figure 17] illustrates a method for key-on management according to aspects of the present disclosure for the system control unit of Figure 15. [Figure 18] illustrates a method for key-on management according to aspects of the present disclosure for the system control unit of Figure 15. [Figure 19]

[0025] illustrates a method for in-flight management of a bus tie unit connection according to aspects of the present disclosure for the system control unit of Figure 15. [Description of Embodiments]

[0010]

[0026] Aspects of the present disclosure provide an energy management system (EMS) 10 that enables an aircraft propulsion system to have a catastrophic failure probability rate below a predetermined threshold. The predetermined threshold may be a threshold required for the aircraft to meet certification. In some aspects, the predetermined threshold is 10 -9 . In some aspects, the EMS 10 achieves this by using redundant control paths. The number of redundant control paths, the functionality achieved by the redundant control paths, and the control may be based on the type of propulsion architecture for the aircraft. The aircraft may be a conventional takeoff and landing (CTOL) or vertical takeoff and landing (VTOL) aircraft.

[0011]

[0027] The EMS10 may be connected to a source line replacement unit (source LRU20) and a sink line replacement unit (sink LRU25). The type of source LRU20 may depend on the propulsion architecture for the aircraft. For example, the source LRU20 may be an energy storage system (ESS) 20A, such as in a parallel turbohybrid propulsion system 100A (as illustrated in Figure 2), a parallel hybrid electric propulsion system 100B (as illustrated in Figure 3), an all-electric propulsion system 100C (as illustrated in Figure 12), and a turbohybrid electric propulsion system 100E (as illustrated in Figure 14).

[0012]

[0028] The ESS20A may comprise a control unit 200, an energy storage device 205, a thermal management unit, and a bus tie contactor / circuit breaker 215 (also known as contactor 215). The control unit 200 may comprise a microprocessor, a field-programmable gate array (FPGA), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a multi-chip module (MCM), or a combination of discrete logic (referred to herein, individually or collectively, as a “processor”). For example, a processor may comprise both a microprocessor and an FPGA. The microprocessor may comprise software for performing the functions described herein. The microprocessor may also comprise memory. Alternatively, the memory may be separate. The memory may comprise random access memory (RAM), read-only memory (ROM), flash memory, etc. The control unit 200 may further comprise one or more interfaces, such as an analog interface and a COM bus interface. The control unit 200 may further include serial or wireless network interfaces such as Ethernet®, ARINC429, 422, and 485 interfaces. The interfaces may receive key-on signals from the cockpit / flight deck 40. The interfaces may also be used to receive commands from the EMS 10, such as pre-charge commands, commands for opening and closing contactors or circuit breakers 215, and commands for supplying power to the high-voltage DC link (HVDC225A). The processor in the ESS 20A is configured to determine status information from one or more sensors in the ESS 20A. Status information for the ESS may include voltage, overvoltage, undervoltage, current, overcurrent, undercurrent, ground voltage, state of charge (SOC), delta SOC, temperature, and other characteristics of the ESS. The processor may determine whether each characteristic is within a predetermined range (this range may be stored in memory). The processor may also be configured to transmit status information to the EMS 10 when key-on and periodically during flight. The processor in the ESS 20A may be configured to perform embedded tests.

[0013]

[0029] The processor may also be configured to respond to commands from the EMS 10, such as by opening and closing contactors / circuit breakers 215 as needed, precharging lines, and supplying power. The processor may also supply local bias power to the BIT.

[0014]

[0030] The energy storage device ESD205 supplies DC power to HVDC225A via DC link 225 (and EMS10). The ESD may be a lithium-ion battery. ESD205 may also include, as an alternative or addition, an ultracapacitor, a lead-acid battery, and other energy storage media. The ultracapacitor may include an electric double-layer capacitor (EDLC), also known as a supercapacitor, supercapacitor, or electrochemical double-layer capacitor, which has an electrochemical capacitor with a relatively high energy density.

[0015]

[0031] The supplied power may be a first voltage 225 (DC link 225). The voltage may be the same as or different from the voltage of HVDC link 225A, depending on the propulsion architecture for the aircraft, the size of the aircraft, and the mission.

[0016]

[0032] In aspects of this disclosure, the nominal voltage of the first voltage 225 is greater than 400 VDC. For example, the first voltage 225 may be 800 VDC.

[0017]

[0033] The thermal management unit 210 can control the temperature of the ESS 20A to maintain the environment within a preset thermal environment, for example, within a range, in order to achieve safe and optimal thermal conditions. In aspects of this disclosure, the thermal management unit 210 may include a liquid cooling plate, a fan, and a pump for moving liquid through pipes passing through the plate. The pipes may include one or more controllable valves for controlling the liquid passing through the pipes. These valves may be controlled via actuators. In aspects of this disclosure, a processor in the ESS 20A controls the actuators. In other aspects, the thermal management unit 210 may have its own processing elements, including a microprocessor, an FPGA, and combinations thereof. Additionally, the ESS 20A may have other thermal cooling materials to maintain temperature.

[0018]

[0034] The bus tie contactor / circuit breaker 215 provides protection for DC links 225, 225A, etc. The type of device in the circuit may depend on the voltage and propulsion architecture of the DC link. The contactor / circuit breaker 215 is designed for high voltage. High voltage as used herein means voltages higher than 50VDC. The contactor may be thermal, electromechanical, or solid-state. In other embodiments, the contactor may be a combination thereof. The circuit breaker may be fabricated from the above. In embodiments of this disclosure, both bus tie contactors and circuit breakers may be used. However, in other embodiments, either may be used. In embodiments of this disclosure, a processor in the ESS 20A may control the bus tie contactor / circuit breaker 215 based on commands from the EMS 10. In other embodiments, the bus tie contactor / circuit breaker 215 may have a dedicated processor such as a microprocessor or FPGA or a combination thereof.

[0019]

[0035] In other embodiments, the source LRU 20 may also be a turbogenerator 20B located in a parallel turbo-hybrid propulsion system 100A (as illustrated in Figure 2), a turbo-electric propulsion system 100D (as illustrated in Figure 13), and a turbo-hybrid electric propulsion system 100E (as illustrated in Figure 14). The turbogenerator 20B may comprise a prime mover such as a turbo engine 430, a generator 425, and a power conversion unit (PCU) 400. The turbo engine 430 may receive fuel via a fuel line (not shown). The size and type of the turbo engine 430 may depend on the size of the aircraft, the propulsion architecture, and the flight duration and application (mission). Additionally, the size and type of the turbo engine 430 may be based on the number of turbogenerators 20B. The generator 425 may be a permanent magnet generator, such as a surface permanent magnet generator or an internal permanent magnet generator. However, other types of generators may be used, such as wound field, induction, synchronous reluctance (SynR), axial flux machinery, and switched reluctance generators. The type of generator used is not limited to those described above, and other machines suitable for converting mechanical motion into electrical energy may be used. The generator 425 is connected to the output shaft 435 of the turbo engine. The generator 425 may supply three-phase AC 440 to the power conversion unit 400.

[0020]

[0036] The PCU400 may include a control unit 405, a power stage 410, an input / output filter 415, and a bus tie contactor / circuit breaker 215.

[0021]

[0037] The control unit 405 may include a processor as described above. For example, the processor may include a combination of a microprocessor and an FPGA. The microprocessor may include software for performing the functions described herein. The microprocessor may also include memory. Alternatively, the memory may be separate. The memory may include random access memory (RAM), read-only memory (ROM), flash memory, etc. The control unit 405 may further include one or more interfaces, such as an analog interface and a COM bus interface. The control unit 405 may further include other network interfaces, such as Ethernet, serial buses such as ARINC429, 422, 485 interfaces, or wireless interfaces. The interface may receive key-on signals from the cockpit / flight deck 40. The interface may also be used to receive commands from the EMS 10, such as commands for opening and closing contactors or circuit breakers 215 and for supplying power to the high-voltage DC link 225A. The processor in the PCU is configured to determine status information from one or more sensors in the PCU 400. Status information for the PCU may include voltage, overvoltage, undervoltage, current, overcurrent, undercurrent, ground voltage, state of charge (SOC), delta SOC, temperature, and other characteristics of the PCU. The processor may determine whether each characteristic is within a predetermined range (the range may be stored in memory). The processor may also be configured to transmit status information to the EMS10 when the key is turned on and periodically during flight. The processor in the PCU also controls the generator 425 to supply power for propulsion based on commands from the EMS10. The manner in which the generator 425 is controlled may depend on the type of generator 425. For example, the control may be field-directed control, spatial vector modulation, or deadbeat control.

[0022]

[0038] The power stage 410 may include a circuit configuration (inverter) for converting AC power 440 received from the generator 425 into power for DC link 225B. In aspects of this disclosure, the circuit configuration may include high-power semiconductor switching devices such as metal oxide field-effect transistors (MOSFETs), insulated-gate bipolar transistors (IGBTs), high-electron-mobility transistors (HMETs), or thyristors. The semiconductors may be silicon, silicon carbide, gallium nitride, and / or other materials. In some aspects, the switching devices may be configured in a single-level, two-level, or multi-level configuration.

[0023]

[0039] The power stage 410 may also include a drive circuit configuration for biasing the switching elements. The processor in the turbo generator 20B may be configured to perform embedded tests.

[0024]

[0040] The power stage 410 may also be equipped with the above-mentioned reference sensors (voltage, current, temperature, etc.).

[0025]

[0041] The input / output filter 415 is configured to filter the output of the power stage 410 to improve power quality. The filter 415 may comprise one or more capacitors C and inductors L for an LC filter. In other embodiments, the filter 415 may comprise or instead comprise one or more diodes D.

[0026]

[0042] A similar bus-type contactor / circuit breaker 215 may be used in the turbo generator 20B.

[0027]

[0043] The number of ESS20A and turbo generators 20B can be determined based on the aircraft's size and other application, as well as mission-dependent parameters such as speed, flight length, maneuverability, etc.

[0028]

[0044] The sink LRU25 may be a parallel turbo propulsion unit 25A, such as in a parallel turbo-hybrid propulsion system 100A (as illustrated in Figure 2) or a parallel hybrid electric propulsion system 100B (as illustrated in Figure 3). The parallel turbo propulsion unit 25A may comprise a turbo engine 430A, a motor 425A, a PCU 400A, a mixing gearbox 505, and a propulsion fan 510. In the parallel turbo propulsion unit 25A, two mechanical shafts 435A (from engine 430A) and 435B (from motor 425A) are connected to the fan 510 via the mixing gearbox 505. The mixing gearbox 505 allows the speeds of the mechanical shafts 435A / 435B to be appropriately combined via a gear ratio to achieve the speed for the fan 510.

[0029]

[0045] Motor 425A may be an electromachine similar to those described above, such as a permanent magnet, including surface permanent magnets or internal permanent magnets. However, other types of electromachines may be used, such as wound field, induction, synchronous reluctance (SynR), axial flux machine, and switched reluctance. The type of motor used is not limited to those described above, and other machines suitable for converting electrical energy (AC power 440A) into mechanical motion may be used.

[0030]

[0046] The PCU400A in the parallel turbo propulsion unit 25A is similar to the PCU400 in the turbo generator 20B in that it comprises a control unit 405A, a power stage 410A, an input / output filter 415A, and a bus tie contactor / circuit breaker 425A. Since the HVDC link 225A can be higher than the DC links 225 and 225B, the bus tie contactor and circuit breaker 425A need to be designed for higher ratings.

[0031]

[0047] The control unit 405A may include a processor as described above. For example, the processor may be a combination of a microprocessor and an FPGA. The microprocessor may include software for performing the functions described herein. The microprocessor may also include memory. Alternatively, the memory may be separate. The memory may include random access memory (RAM), read-only memory (ROM), flash memory, etc. The control unit 405A may further include one or more interfaces, such as an analog interface and a COM bus interface. The control unit 405A may further include other network interfaces, such as Ethernet, serial interfaces such as ARINC429, 422, 485 interfaces, or wireless interfaces. The interface may receive key-on signals from the cockpit / flight deck 40. The interface may also be used to receive commands from the EMS 10, such as commands for opening and closing contactors or circuit breakers 425A and for supplying mechanical power to the fan 510 using the HVDC link 225A. The processor in the PCU is configured to determine status information from one or more sensors in the PCU 400A. Status information about the PCU may include voltage, overvoltage, undervoltage, current, overcurrent, undercurrent, ground voltage, state of charge (SOC), delta SOC, temperature, and other characteristics of the PCU. The processor may determine whether each characteristic is within a set range. The processor may also be configured to transmit status information to the EMS 10 when the key is on and periodically during flight. The processor in the PCU also controls the motor 425A to provide mechanical power based on commands from the EMS 10 for propulsion. The mode in which the motor 425A is controlled may depend on the type of motor 425A. For example, the control may be field-directed control, spatial vector modulation, or deadbeat control.

[0032]

[0048] The 410A power stage may include a circuit configuration (inverter) that converts the received HVDC link of 225A to AC power of 440A for the 425A motor. The circuit configuration may be the same as, or reversed from, that described above.

[0033]

[0049] The sink LRU25 may be an electric propulsion unit 25B, such as in an all-electric propulsion system 100C (as illustrated in Figure 12), a turboelectric propulsion system 100D (as illustrated in Figure 13), and a turbohybrid electric propulsion system 100E (as illustrated in Figure 14). The electric propulsion unit 25B is similar to the parallel turbo propulsion unit 25A, except that the turbo engine 430A (and shaft 435A) and the mixing gearbox 505 are removed. The shaft 435B from the motor 425A may be connected directly to the fan 510 or indirectly through a gearbox (not shown).

[0034]

[0050] In this case as well, the number of parallel turbo propulsion units 25A or electric propulsion units 25B may be determined based on the aircraft's size and other application, as well as mission-dependent parameters such as speed, flight length, maneuverability, etc.

[0035]

[0051] The use of the propulsion architecture described herein results in fuel cost savings per flight. For example, less than 30-70% of fuel may be used. In addition, the use of this architecture leads to a dramatic reduction in emissions, which opens up new routes and markets that were previously not economically viable. Furthermore, the propulsion architecture allows the airframer to maximize the efficiency of air travel by positioning certain LRUs within the system in more aerodynamically advantageous locations.

[0036]

[0052] For example, the use of a parallel turbo-hybrid propulsion system 100A (as illustrated in Figure 2) may make it possible to achieve an optimal fuel combustion rate that results in a net reduction of 20-40% in fuel consumption, even if the route is extended beyond what the ESS 20A can handle. This is because the source includes both the turbo-generator 20B and the ESS 20A. In addition, a net reduction of 50-70% in fuel consumption may be achieved due to the efficiency in controlling the combination of sources. Moreover, since multiple parallel turbo-propulsion units (distributed propulsion) may be present, power can be optimally supplied from the cockpit 40 to achieve the desired performance. In the case of all-electric propulsion, 100% fuel combustion savings are achieved.

[0037]

[0053] Figure 4 illustrates an EMS 10 according to an embodiment of the present disclosure. The EMS 10 comprises a system control unit (SCU) 300, a power conversion unit 305, a power distribution unit 310, and a bus tie contactor / circuit breaker 215.

[0038]

[0054] In aspects of this disclosure, the EMS 10 may be implemented as distributed control. Figure 5 illustrates an example of an SCU 300 having distributed control. In the SCU 300 illustrated in Figure 5, there are two control paths, one of which is via the cockpit 40. In aspects of this disclosure, the cockpit 40 includes a human-machine interface (HMI) 614. The HMI 614 may include a display, means for receiving commands from a pilot or user, and a processor. The display may be a screen on a panel in the cockpit. The display may also be a head-up display or a head-mounted display. The display may show status information from LRUs 20, 25. The status information may be transmitted directly from LRUs 20, 25 to the HMI 614 via the COM bus interface 612B. The transmission / reception of status information is not limited to via the COM bus interface 612B. For example, the status information may be transmitted via an analog interface. The pilot or user may use means for receiving commands to instruct the LRUs 20, 25 to open contactors or circuit breakers 215, 425A to disconnect them from the HVDC link 225A. For example, the pilot or user may look at the status information and determine that the LRU failure is related to a safety-critical issue, and then remove the LRU from the HVDC link 225A.

[0039]

[0055] In response to receiving this command, the processor in the HMI614 relays the command to the appropriate LRU, opening contactors or circuit breakers 215 and 425A and disconnecting from the HVDC link 225A.

[0040]

[0056] The means for receiving commands may be a touch panel on the display, a push button, or a switch.

[0041]

[0057] The second control path may comprise a processor 600, a COM bus interface 612A, and an analog interface 610. As illustrated, the second control path may also comprise memory. In aspects of this disclosure, the processor may be a combination of elements including software running on hardware and hardware in firmware. As described above, the processor 600 may comprise a microprocessor, FPGA, DSP, ASIC, MCM, or analog circuit configuration. In aspects of this disclosure, the processor may comprise a combination of a microprocessor and an FPGA. The memory 605 may comprise random access memory (RAM), read-only memory (ROM), flash memory, etc.

[0042]

[0058] The analog interface 610 may be configured to receive a key-on signal from the cockpit 40. The COM bus interface 612A may receive status information from the LRUs 20 and 25. In other embodiments, status information may be received by the analog interface(s).

[0043]

[0059] Figure 6 illustrates an example of a power conversion unit 305. The power conversion unit 305 may comprise a plurality of DC-DC converters 640A to 640N. One of the converters may be used to convert a DC voltage (first voltage 225) to VDC for the HVDC link 225A. This converter may be a buck-boost converter. This may be used when the voltage from the HVDC link 225A is higher than the first voltage 225 supplied by the ESS 20A. Another DC-DC converter (or the same) may be used to convert the voltage on the DC link 225B to the HVDC link 225A. In aspects of this disclosure, voltage 225 is the same as voltage 225B.

[0044]

[0060] In other embodiments, different DC-DC converters may be used to supply local bias voltages for hardware such as processors and to bias switches. The source of the bias voltage may be in the cockpit or a low-voltage DC battery. In embodiments of this disclosure, the DC-DC converter in EMS10 may supply local bias voltages to the hardware in LRU20, 25 when the key is on. In other embodiments, each LRU has its own DC-DC converter to supply local bias voltages.

[0045]

[0061] In other embodiments, the EMS10 may have a DC-DC converter for supplying DC power to accessories. DC accessories may include lighting and radio equipment.

[0046]

[0062] In other embodiments, the power conversion unit 305 may comprise DC-AC converters 642A to 642N (e.g., inverters). These inverters may be used to supply AC power to AC accessories. AC accessories are typically motor-driven. Thus, the EMS 10 can be coupled to motors for the associated accessories. For example, AC accessories may comprise air compressors and air conditioning compressors. As used herein, the phrase “AC accessory” also refers to subsystems required for the accessory to function.

[0047]

[0063] The power distribution unit 310 may be equipped with multiple connection terminals and cabling. The connection terminals are configured to receive connector cables for electrically connecting LRUs 20, 25 to the EMS 10. The power distribution unit 310 may be distributed throughout the aircraft and separated as needed to route cables from one LRU to another via the EMS 10.

[0048]

[0064] The SCU300 illustrated in Figure 5 provides redundant control paths, but these redundant control paths may not be used for each control instance. For example, in an aspect of this disclosure, when a key-on is received, neither control path may be used to determine whether to connect the LRU to the HVDC link 225A.

[0049]

[0065] Figure 7 illustrates a method for responding to a key-on signal from the cockpit 40 according to an aspect of the present disclosure for the architecture illustrated in Figures 2 and 3.

[0050]

[0066] In S1, each LRU20, 25 and EMS10 receives a key-on signal from the cockpit 40. The key-on signal may be transmitted via an analog interface(s). The key-on signal may be received with DC power to perform an embedded test (BIT) and bias certain circuit configurations necessary to communicate with the EMS10, and vice versa.

[0051]

[0067] In S3, each LRU20, 25 executes its respective BIT. In the BIT, the sensors within LRU20, 25 report the sensed / detected values ​​to their respective processors. In aspects of this disclosure, each processor in the control units 200 and 400A (and 400, depending on the architecture) determines whether the sensed values ​​are within a predetermined range. The predetermined range for each sensed parameter may be stored in the respective memory within each LRU20, 25. If the sensed parameter is outside the predetermined range, LRU20, 25 adds a fault determination to the status information (e.g., fault = yes). The status information may include the fault determination and the raw sensed values ​​from the sensor(s), respectively. In other aspects, the processors in the control units 200 and 400A (and 400, depending on the architecture) may calculate additional information based on the sensed values ​​and add the calculated additional information to the status information. In S5, each LRU20, 25 transmits the status information to the EMS10 (SCU300) via the COM bus interface. In S7, the processor 600 (in the SCU 300) receives reports from each LRU 20, 25 containing status information. For each LRU 20, 25, the processor 600 determines in S9 from the status information whether the LRU 20, 25 is ready (for example, to receive power or to generate power). In an aspect of this disclosure, if the processor in the LRU control unit determines that a fault exists, the processor 600 determines in S9 that the LRU is not ready to receive or supply power (N in S9), does not issue a command to close the contactors 215 / 425A, generates a fault report in S11, and logs the report in memory.

[0052]

[0068] On the other hand, when the sink LRU 25 is functioning correctly, the processor 600 issues a command to the sink LRU 25 in S13 to close contactor 425A to the HVDC link 225A. Also, when the source LRU 20 is functioning correctly and is an LRU that needs to be precharged, such as ESS 20A, the processor 600 may issue a command to ESS 20A in S15 to precharge. When a source LRU 20, such as a turbo generator 20B (if included in the architecture), does not need to be precharged, the processor 600 may issue a command to the turbo generator 20B to close contactor 215 that electrically connects the turbo generator 20B to the HVDC link 225A (via EMS 10). The EMS may also close its contactors 215 / 425A. The above commands may be issued via the COM bus interface 612A.

[0053]

[0069] In S17, the sink LRU25 receives a command, and the processor in the control unit 405A causes the contactor 425A to close in order to connect the LRU25 to the HVDC link 225A.

[0054]

[0070] In S19A, the turbo generator 20B (if included in the architecture) receives a command, and the processor in the control unit 405 causes the contactor 215 to close, connecting the LRU 25 to the HVDC link 225A (via the EMS 10).

[0055]

[0071] In S19, the ESS20A receives a command to precharge. In an embodiment of the present disclosure, the ESS20A has a precharge circuit configuration, which may include a contactor in parallel with an inrush resistor. In response to the receipt of the command, the processor in the control unit 200 causes the contactor to close. In this embodiment, sensors on both sides of the contactor measure current / voltage. The sensed values ​​may be used to determine whether the DC link 225 is sufficiently precharged.

[0056]

[0072] In S21, the processor 600 determines whether the ESS 20A has closed its precharge contactor. In embodiments of this disclosure, voltage and current sensors may be used for this determination. In embodiments of this disclosure, a processor in the control unit 200 may report the sensed values ​​to the processor 600. If the processor 600 determines that the precharge contactor is not closed (remains open) (N in S21), the ESS 20A is not connected to the HVDC link 225A, and a fault report is logged in S11. Once the precharge contactor is closed, the processor 600 waits to instruct the ESS 20A to close the main contactor 215 until the precharge reaches a predetermined condition. In embodiments of this disclosure, the predetermined condition may be a steady-state voltage, e.g., a balanced voltage. In other embodiments, the predetermined condition may be current-based.

[0057]

[0073] In S23, the processor 600 may use the sensed value to determine whether a predetermined condition is met. If the precharge is sufficient (Y in S23), the processor 600 issues a command to the processor in the control unit 200 to open the precharge contactor and close the main contactor 215 (in S25). If the precharge is insufficient (and after a preset time period has elapsed), the processor 600 keeps the main contactor 215 open and generates a fault report in S11.

[0058]

[0074] In S27, the processor in the control unit 200 receives a command, opens the pre-charge contactor, and closes the main contactor 215. If the main contactor 215 is not closed, the processor 600 generates a fault report in S11. The report may include a timestamp.

[0059]

[0075] Figure 8 illustrates an example of redundant control of the connection status of LRU20 and 25 during operation in an aircraft in flight.

[0060]

[0076] In S100, each control path receives reports from each LRU20, 25. The reports are received periodically. These reports include the values ​​sensed from the sensors and the fault determinations made by each processor, for example, the sensed values ​​being outside a predetermined range. The report(s) are received by the processor 600 and HMI614 via their respective COM bus interfaces 612A, 612B.

[0061]

[0077] In S102, status information (judgment and raw sensed data) may be displayed on the HMI display. In S104, each control path independently checks / determines whether LRU 20, 25 has a fault. For example, the processor 600 determines whether the report indicates that a fault has been determined, and additionally, the processor 600 may also compare the sensed value to a predetermined range for the parameter (the predetermined range may also be stored in memory in the EMS 10). Additionally, a pilot who looks at the HMI display can recognize the fault determination. In aspects of this disclosure, the display may use different colors or displays for sensed values ​​outside the predetermined range. If there is no fault (N in S104), the control path returns to S100. In contrast, if there is a fault (Y in S104), each control path independently determines in S106 whether the fault could cause or has caused a safety-critical problem. A safety-critical problem is the possibility of an imminent danger to human life and health. The processor 600 may determine a safety-critical problem based on the magnitude of an out-of-range value or a combination of values. The processor 600 may have a lookup table that defines safety-critical problems based on the sensed output. The pilot may also look at the sensed values ​​on the display and determine whether a fault is causing or will cause a safety-critical problem. If either control path determines that LRU 20, 25 has a safety-critical problem (Y in S108), the LRU may be isolated from the HVDC link 225A. For example, either or both of the HMI 614 and / or processor 600 may issue a command to LRU 20, 25 in S110 to open contactors 215 / 425A. The command may be transmitted via the respective COM buses 612A, 612B.

[0062]

[0078] If the failure does not cause a safety-critical problem (N in S108), the processor 600 generates a report indicating the failure status in S112 and logs it.

[0063]

[0079] In aspects of this disclosure, safety criticality may also be determined by inspecting the aircraft's performance, such as changes in trajectory, speed, altitude, etc.

[0064]

[0080] In S114, the processor 600 (and HMI 614) monitors and determines whether the safety-critical fault LRU has been isolated from the HVDC link 225A by verifying that the contactor / circuit breaker is open using the appropriate sensors. If it is determined that the safety-critical fault LRU has been isolated (Y in S114), the processor 600 continues to control the remaining LRUs in S118 based on the propulsion command from the cockpit 40.

[0065]

[0081] If it is determined that a safety-critical fault LRU cannot be isolated (contactor 215 / 425A is not open), the processor 600 may, in S116, issue a command for emergency landing to the cockpit 40 via the COM bus 612A. The processor 600 may also, in S116, generate a report with events.

[0066]

[0082] Figure 9 illustrates an example of a method for responding to a propulsion command from the cockpit 40 according to an aspect of the present disclosure.

[0067]

[0083] In S200, the processor 600 may receive propulsion commands from the cockpit 40. Propulsion commands may be power commands, torque commands, or velocity commands. Commands may include vectors such as direction. In S202, the processor 600 may determine whether there are LRUs 20, 25 isolated due to a fault. This is because the EMS 10 may control the LRUs to take isolated LRUs into consideration, and for example in S204B, may adjust the “normal commands” as needed to maintain desired performance while achieving minimum aerodynamic integrity.

[0068]

[0084] When there are no isolated LRUs, for example, fully connected LRUs L020, 25, the processor 600 executes architecture and aircraft-based control logic in S204A to determine appropriate control commands to issue to each LRU20, 25. The control commands may also be speed, torque, or power commands as needed to achieve minimum aerodynamic integrity. In aspects of this disclosure, the control commands may differ for parallel turbo-hybrid propulsion system 100A or parallel hybrid propulsion system 100B. The specific control logic may also be aircraft-specific and may be customized by the aircraft manufacturer.

[0069]

[0085] When there are isolated LRUs 20 and 25, the processor 600 executes architecture and aircraft-based control logic in S204B to determine the appropriate control commands to issue to each LRU 20 and 25, while boosting power / thrust from the remaining LRUs as needed.

[0070]

[0086] The amount of augmentation and which LRUs are augmented may also be specific to the architecture and aircraft in order to achieve the desired propulsion commanded from the cockpit 40.

[0071]

[0087] In S206, the processor 600 issues the command determined (in either S204A or S204B) to LRU20 and 25 connected to the HVDC link 225A.

[0072]

[0088] Figure 10 illustrates another SCU300A for EMS10 according to an aspect of the present disclosure. In the SCU300A, no HMI is shown, and the redundant control path comprises a primary control path and a return control path. In aspects of the present disclosure, control via an HMI as described above may also be included.

[0073]

[0089] In the SCU300A, each control path may comprise a processor 600, memory 605, an analog interface, and a COM bus interface 612A. In aspects of this disclosure, the primary control path further comprises a truth model. The truth model is stored in memory 605 and can be executed by the processor 600. The truth model is a mapping of sensor outputs to valid fault / non-fault determination. In another aspect of this disclosure, the truth model may, alternatively, be executed in the processor 600 in the return path. In yet another aspect of this disclosure, the truth model may be executed in both the primary and return control paths. In yet another aspect of this disclosure, the truth model may be executed only in a separate, independent processor (not shown in Figure 10). The primary control path is configured to take commands from the cockpit 40, issue commands to the LRUs 20 and 25, receive status information from the LRUs 20 and 25, and control the LRUs accordingly. The recovery control path receives commands from the cockpit 40, but is configured not to issue commands to LRUs 20 and 25 unless the primary control path fails. The recovery control path also receives reports from the LRUs and determines whether a safety-critical failure has occurred, but is configured not to issue commands to isolate the LRUs unless the primary control path fails.

[0074]

[0090] Each processor 600 can communicate with other processors 600.

[0075]

[0091] In this case as well, the redundant control path may not be used when the key is turned on. However, in other embodiments, the redundant control path may be used.

[0076]

[0092] Figure 11 illustrates another example of redundant control of the connection status of LRU20,25 during operation in an aircraft in flight. At S100, each processor 600 receives status information from LRU20,25 (each LRU). The reports are received periodically.

[0077]

[0093] In S106A, each processor 600 independently determines whether there is a failure, and if there is a failure, the processor 600 independently determines whether the failure is causing or will likely cause a safety-critical problem.

[0078]

[0094] Each independent decision is sent to the other control path (other processor) in S1100.

[0079]

[0095] The processor 600 determines whether there is agreement. If the control path agrees that there is a safety-critical problem in the LRU (Y in S108A), the processor 600 for the primary control path issues a command in S110 to open contactor 215 / 425A to isolate the faulty safety-critical LRU from HVDC link 225A.

[0080]

[0096] If there is a disagreement and one of the control paths determines that there is a safety-critical problem in one of the LRUs (N in S108A, but Y in S1102), then in S1104, the Truth Model is run on the status information to independently determine which of the safety-critical problem determinations is valid.

[0081]

[0097] The Truth model examines the raw sensor values ​​and, based on the sensor values, determines whether the LRU has a safety-critical problem. In other aspects of this disclosure, the voting engine may be run by one or both of the processors 600. The voting engine may be run by an external processor.

[0082]

[0098] If the Truth Model confirms that there is a safety-critical problem in the LRU (valid safety-critical determination) (Y in S1106), the processor 600 for the primary control path issues a command to the faulty safety-critical LRU in S110 to open contactor 215 / 425A and isolate it from HVDC link 225A.

[0083]

[0099] If the Truth Model determines that there is no safety-critical issue in the LRU (invalid safety-critical determination) (N in S1106), the processor 600 (in the primary control path) generates an event report in S112 and logs the event in memory 605. In aspects of this disclosure, the log indicates that there was a disagreement.

[0084]

[0100] When there is an agreement that there is a failure but no safety-critical issue (N in S1102), processor 600 (in the primary control path) generates an event report in S112 and logs the event in memory 605. If the control path does not confirm that the first instance has failed, the process returns to S100.

[0085]

[0101] In S114, each processor 600 monitors and determines whether a faulty safety-critical LRU is isolated from the HVDC link 225A by verifying that the contactor / circuit breaker is open using the appropriate sensor. If it is determined that a faulty safety-critical LRU is isolated (Y in S114), the processor 600 (in the primary control path) continues to control the remaining LRUs in S118 based on the propulsion command from the cockpit 40.

[0086]

[0102] In S1, each sink LRU25 and EMS10 receives a key-on signal from the cockpit 40. In S3, each sink LRU25 executes its respective BIT. In the BIT, the sensors within the LRU25 report the sensed / detected values ​​to their respective processors. The control unit 405A determines the result of the BIT and transmits status information to each processor 600 in the redundant control path.

[0087]

[0103] In S1, each sink LRU25 and EMS10 receives a key-on signal from the cockpit 40. In S3, each sink LRU25 executes its respective BIT. In the BIT, the sensors within the LRU25 report the sensed / detected values ​​to their respective processors. The control unit 405A determines the result of the BIT and transmits status information to each processor 600 in the redundant control path.

[0088]

[0104] In S7, each processor 600 in the redundant control path receives status information. In S9A, each processor 600 in the redundant control path independently determines whether the sink LRU 25 is ready to receive power. This determination is based on the status information (and the determination made by each LRU). Once the determination / confirmation is made in each processor 600, each processor 600 sends its independent determination to the other processors 600 in S1100.

[0089]

[0105] If there is an agreement among all processors 600 in each control path that there is a failure (safety critical failure), for example, that it is not ready to receive power (Y in S108A), then the processor 600 in the primary control path generates a report indicating the failure in S11 and logs the report in memory.

[0090]

[0106] When there is disagreement between redundant control paths (N in S108A and Y in S1102), the processors 600 in the primary control path may, in S1104, run a truth model to independently determine whether the initial judgment of each processor 600 is valid. As described above, the truth model may be in the return control path and / or in the external processor. As described above, the truth model may examine sensor values ​​to determine / verify whether the sink LRU has a safety-critical fault (e.g., is ready to receive power).

[0091]

[0107] In S1104, the Truth Model is executed by processor 600 (or an external processor) to determine whether there are any faults (safety-critical problems).

[0092]

[0108] If the Truth Model determines that the safety critical judgment is not valid (inaccurate) (N in S1106), or if there is an agreement that there is no safety critical problem (N in S1102), the processor 600 in the primary control path issues a command to the sink LRU 25 in S13 to close its contactor 425A and connect to the HVDC link 225A.

[0093]

[0109] If the Truth Model determines that a safety-critical problem exists (the safety-critical determination is valid) (Y in S1106), the processor 600 in the primary control path generates a fault report in S11 and logs the report in memory. The processor 600 in the primary control path also does not issue a command to the sink LRU25 to connect to the HVDC link 225A.

[0094]

[0110] Processor 600 in the redundant control path performs a similar process for source LRU20. However, in S9B, each processor 600 determines whether source LRU20 is ready to supply power.

[0095]

[0111] When there is an agreement that source LRU20 has a safety-critical problem, source LRU20 is not connected to HVDC link 225A (in S11), and a fault report is generated.

[0096]

[0112] If the Truth Model determines that the safety critical judgment is not valid (inaccurate) (N in S1106), or if there is an agreement that there are no safety critical problems (N in S1102), the processor 600 in the primary control path issues a command to the source LRU 25 in S15 to precharge or close the main contactor 215 in the turbo generator 20B (if precharging is required). For example, the ESS 20A may need to be precharged. Therefore, in S15, the processor 600 in the primary control path issues a command to the ESS 20A to close the contactor in order to precharge.

[0097]

[0113] In aspects of this disclosure, S21 and S23 in Figure 17 may be executed by processor 600 in the primary control path. In other aspects of this disclosure, S21 and S23 may be executed redundantly in each control path, and in case of disagreement, the truth model may be executed.

[0098]

[0114] In this case as well, a voting engine may be used instead of a truth model.

[0099]

[0115] Figure 18 illustrates an example of a method for determining whether to take off according to an aspect of the present disclosure.

[0100]

[0116] In S1800, the processor 600 in each control path may determine whether the LRUs 20 and 25 are electrically isolated (disconnected) from the HVDC link 225A. If all LRUs are connected, the processor 600 in the primary path may, in S1806, confirm to the cockpit 40 that the aircraft can take off (e.g., a normal takeoff). If the processor 600 determines that the LRUs 20 and 25 are isolated, for example, disconnected, faulty safety-critical LRUs, each processor 600 determines in S1802 whether it is safe to take off without the isolated LRUs. This determination may be architecture-specific and aircraft-specific. For example, this determination may be based on the number of remaining ESS 20A, turbo generators 20B, and electric propulsion units 25B. This determination may also be based on the size of the aircraft, the additional capacity initially provided, the length of the flight, and the mission.

[0101]

[0117] If it is determined that it is safe to take off (Y in S1802) (all processors in all control paths agree), the processor 600 in the primary path may, in S1806, confirm to the cockpit 40 that the aircraft may take off (e.g., a normal takeoff). If all processors 600 (in all control paths) agree that it is not safe to take off, the processor 600 in the primary control path issues a command to the cockpit 40 not to take off in S1804. In aspects of this disclosure, if there is disagreement, a truth model may be executed.

[0102]

[0118] Figure 19 illustrates another example of redundant control of the connection status of the operational LRU20,25 during aircraft flight. The difference between the example in Figure 11 and the example in Figure 19 is that, before controlling LRU20,25 to be isolated, each processor 600 determines in S1900 whether it is safe to isolate LRU20,25 from HVDC link 225A. If it is not safe, the processor 600 in the primary control path issues a command to have an emergency landing; otherwise, the process moves to S110.

[0103]

[0119] In a first aspect of this disclosure, an EMS (for aircraft) is configured to be connectable to a plurality of source line switching units (source LRUs) and a plurality of sink line switching units (sink LRUs). The source LRUs are sources of power for a high-voltage DC link used for propulsion, and the sink LRUs use power from the high-voltage DC link for propulsion. The EMS comprises a communication interface and a redundant control path for controlling safety-critical operations. The communication interface is configured to receive status information from each of the source LRUs and sink LRUs. The status information comprises information from each sensor within each LRU and a determination that the information from each sensor is within a predetermined range. The communication interface is configured to send commands to the source LRUs and sink LRUs. The redundant control path is configured to independently determine whether to electrically isolate the LRUs from the high-voltage DC link based on the status information from the LRUs. Isolation is based on an independent determination.

[0104]

[0120] Further according to the first aspect, in a second aspect of the present disclosure, the EMS is configured to achieve a threshold probability of catastrophic failure below a certain threshold.

[0105]

[0121] In a third aspect of the present disclosure, further according to the first or second aspect, the aircraft has a parallel hybrid electric propulsion system or a parallel turbohybrid electric propulsion system. A redundant control path comprises a first processor in the first control path, which is configured to electrically isolate the LRU from a high-voltage DC link when status information from the LRU indicates that the LRU has determined that the conditions are met and that information from the sensor is outside a predetermined range for the sensor. The redundant control path also comprises a second control path, which comprises a human-machine interface in the cockpit of the aircraft for displaying status information and receiving a command to isolate the LRU. In response to this command, the LRU is electrically isolated from the high-voltage DC link.

[0106]

[0122] In accordance with the third aspect, in a fourth aspect of the present disclosure, each LRU and the first processor are configured to receive a key-on signal from the cockpit. In response to receiving the key-on signal, the processor in each LRU performs built-in tests for the LRU and transmits status information to the first processor via a communication interface. The first processor is configured to determine, based on its own judgment, that each sink LRU is ready to supply power, and in response to the confirmation that it is ready to supply power, to issue a command to electrically connect each sink LRU to a high-voltage DC link; and to determine, based on its own judgment, that each source LRU is ready to supply power, and in response to the confirmation that it is ready to supply power, to issue a command to precharge the source LRU, and when a preset precharge is reached, to issue a command to electrically connect the source LRU to a high-voltage DC link.

[0107]

[0123] Further according to the fourth aspect, in a fifth aspect of the present disclosure, the first processor is configured not to issue a command to the sink LRU or source LRU to electrically connect to a high-voltage DC link when the first processor does not determine that the sink LRU or source LRU is ready to supply power.

[0108]

[0124] In a sixth aspect of the Disclosure, further according to the first or second aspect, the aircraft has a parallel hybrid electric propulsion system or a parallel turbohybrid electric propulsion system. The redundant control path comprises a primary control path and a return control path. Each control path comprises a processor. Each processor is configured to receive status information, determine based on the status information whether to isolate the LRU from the high-voltage DC link, and transmit the determination to the other processor. If each processor determines, based on the status information, that the condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU. If there are different determinations, the processor in the primary control path, the processor in the return control path, or both, or the processor in the other control path, runs a truth model to determine which determination based on the status information is valid. If, based on the truth model, it is determined that the condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

[0109]

[0125] In addition to the sixth aspect, the seventh aspect of the present disclosure is configured to take over control of each LRU in the event that the primary control path fails.

[0110]

[0126] In addition to any of the third to seventh aspects of the present disclosure, in the eighth aspect of the present disclosure, the source LRU is an energy storage system, and the energy storage system (ESS) is configured to supply a first VDC.

[0111]

[0127] In addition to the eighth aspect, according to the ninth aspect of the present disclosure, the high-voltage DC link is a second VDC, and the EMS further comprises a conversion circuit configuration configured to convert the first VDC from the ESS to the second VDC.

[0112]

[0128] In addition to the ninth aspect, in the tenth aspect of this disclosure, the second VDC is greater than the first VDC.

[0113]

[0129] In addition to any of the third to tenth embodiments of this disclosure, the eleventh embodiment of this disclosure includes a prime mover, a generator, and an inverter.

[0114]

[0130] In addition to any of the third to eleventh aspects of the present disclosure, in a twelfth aspect of the present disclosure, the first processor is further configured to issue commands to each sink LRU based on a propulsion command from the cockpit.

[0115]

[0131] In addition to the twelfth aspect, in the thirteenth aspect of the present disclosure, the first processor is further configured to coordinate commands to a sink LRU that is electrically connected to a high-voltage DC link when the sink LRU is electrically isolated from the high-voltage DC link.

[0116]

[0132] In addition to any of the third to thirteenth aspects of the present disclosure, the fourteenth aspect of the present disclosure further configures the first processor to determine whether an LRU that has been commanded to be electrically isolated from a high-voltage DC link is electrically isolated from a high-voltage DC link, and in response to the determination that the LRU is not electrically isolated, to issue a command to the cockpit to land.

[0117]

[0133] In addition to the first or second aspects, a fifteenth aspect of the present disclosure provides an aircraft having an electric propulsion system, a turboelectric propulsion system, or a turbohybrid electric propulsion system. The redundant control path comprises at least three control paths. The at least three control paths comprise a primary control path and at least two return control paths. Each control path comprises a processor and a communication interface. Each LRU and each processor in the at least three control paths are configured to receive a key-on signal from the cockpit. In response to receiving the key-on signal, the processor in each LRU performs an embedded test for the LRU and transmits status information to each processor in the at least three control paths via their respective communication interfaces. Each processor in the at least three control paths is configured to independently verify, based on their respective status information, that each sink LRU is ready to be powered and to transmit verification or lack thereof to other processors in the other control paths, and all control paths verify that each sink LRU is ready to be powered, and the processor in the primary control path issues a command to electrically connect each sink LRU to a high-voltage DC link. When one control path fails to confirm that the sink LRU is ready to receive power, but another control path confirms that the sink is ready to receive power, the processor in the primary control path, or the processors in each control path, or an independent processor, runs a truth model to determine which confirmation output from each control path is valid. Based on the truth model, if it is determined that the confirmation is valid, the processor in the primary control path issues a command to electrically connect the sink LRU to the high-voltage DC link.Each processor in at least three control paths is configured to verify, based on their respective status information, that each source LRU is ready to supply power. Once all control paths have verified that each source LRU is ready to supply power, the processor in the primary control path issues a command to precharge each source LRU. When the preset precharge is reached, it issues a command to electrically connect each source LRU to the high-voltage DC link, or to electrically connect each source LRU to the high-voltage DC link without precharging. When one control path fails to verify that a source LRU is ready to supply power, but another control path does, the processor in the primary control path, or each control path, or an independent processor, runs a truth model to determine which verification output from each control path is valid. Based on the Truth Model, if the verification is deemed valid, the processor in the primary control path electrically issues a command to the source LRUs to precharge, and when the preset precharge is reached, it issues a command to electrically connect each source LRU to the high-voltage DC link, or to electrically connect the source LRUs to the high-voltage DC link without precharging.

[0118]

[0134] In addition to the 15th aspect, in the 16th aspect of the present disclosure, each processor in at least three control paths is configured to determine whether to electrically isolate the LRU based on status information received from the respective LRU.

[0119]

[0135] In addition to the sixteenth aspect, in the seventeenth aspect of the present disclosure, a processor in each control path is configured to receive status information via its respective communication interface, determine whether to isolate the LRU from the high-voltage DC link based on the status information, and transmit the determination to other processors in other control paths. If, based on the status information, a processor in each control path determines that the condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate it. If there are differing determinations, the processor in the primary control path, each return control path processor, or another processor runs a truth model to determine which determination based on the status information is valid. If, based on the truth model, it is determined that the condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate it.

[0120]

[0136] In addition to the seventeenth aspect, in the eighteenth aspect of the present disclosure, the cockpit includes a human-machine interface configured to receive overrides. In response to overrides, an electrically isolated LRU is commanded to reconnect to a high-voltage DC link.

[0121]

[0137] In addition to any of the 15th to 18th aspects, in the 19th aspect of the present disclosure, a processor in each of at least three control paths is configured to receive propulsion commands from the cockpit and independently determine the commands, and a processor in the primary control path issues commands to each sink LRU.

[0122]

[0138] In addition to any of the 15th to 19th embodiments, in the 20th embodiment of the present disclosure, the source LRU is an energy storage system, the energy storage system (ESS) is configured to supply a first VDC, and the EMS further comprises a conversion circuit configuration.

[0123]

[0139] In addition to the 20th aspect, in the 21st aspect of the present disclosure, the conversion circuit configuration is a DC-DC converter. The DC-DC converter is configured to convert a first VDC to a second VDC. The second VDC is supplied as an accessory power supply.

[0124]

[0140] In addition to the 20th aspect, in the 22nd aspect of the present disclosure, the conversion circuit configuration is a DC-AC converter. The DC-AC converter is configured to convert a first VDC to a first AC. The first AC is supplied as an accessory power supply.

[0125]

[0141] In addition to any of the 15th to 22nd aspects, in the 23rd aspect of the present disclosure, the source LRU comprises a turbogenerator, and a processor in each of at least three control paths is configured to receive propulsion commands from the cockpit and independently determine the commands, and a processor in the primary control path issues commands to the processors in each sink LRU and turbogenerator.

[0126]

[0142] In addition to any of the second to 23rd aspects of this disclosure, the 24th aspect of this disclosure has a threshold probability of catastrophic failure of 10 -9 That is the case.

[0127]

[0143] As described herein, aspects of the present disclosure may include one or more electrical, pneumatic, hydraulic, or other similar secondary components and / or systems. The present disclosure is therefore intended and understood to include any necessary operating components. For example, an electrical component will be understood to include any suitable and necessary wiring, fuses, or the like for its normal operation. Similarly, any pneumatic system provided may include any secondary or peripheral components such as air hoses, compressors, valves, meters, or the like. Any connections between various components not expressly described herein may be made by any suitable means, including mechanical fasteners or more permanent mounting means such as welding or the like. Alternatively, where feasible and / or desirable, the various components of the present disclosure may be formed integrally as a single unit.

[0128]

[0144] Various inventive concepts can be embodied in one or more methods, and examples are provided. The operations performed as part of the methods can be ordered in any suitable manner. Thus, although the exemplary embodiments of this disclosure are shown as sequential operations, embodiments can be constructed in which the operations are performed in a different order than those exemplified, which may include performing several operations simultaneously.

[0129]

[0145] While various embodiments of the invention have been described and illustrated herein, those skilled in the art will readily conceive of a variety of other means and / or structures for performing the functions and / or obtaining one or more of the results and / or benefits described herein, and each of such variations and / or modifications will be considered to fall within the scope of the embodiments of the invention described herein. More generally, those skilled in the art will readily recognize that all parameters, dimensions, materials and configurations described herein are intended to be illustrative, and that actual parameters, dimensions, materials and / or configurations will depend on one or more specific uses in which the teachings of the invention are used. Those skilled in the art will be able to recognize or verify many equivalents to a particular embodiment of the invention described herein without using mere routine experimentation. Accordingly, it should be understood that the embodiments described herein are presented only as examples, and within the scope of the appended claims and their equivalents, embodiments of the invention may be carried out in ways other than those specifically described and claimed. The embodiments of the invention of this disclosure cover each individual feature, system, article, material, kit and / or method described herein. In addition, any combination of two or more such features, systems, articles, materials, kits, and / or methods is included within the scope of the inventions of this disclosure, provided that such features, systems, articles, materials, kits, and / or methods are not mutually inconsistent.

[0130]

[0146] The embodiments described above can be implemented in any of a number of ways. For example, embodiments of the present disclosure can be implemented using hardware, firmware, software, or any combination thereof. When implemented in software, the software code or instructions can be executed on any suitable processor or set of processors, whether provided to a single computer or distributed among multiple computers. Furthermore, the instructions or software code can be stored in at least one non-temporary computer-readable storage medium.

[0131]

[0147] Furthermore, a computer may be used to execute software code or instructions via its processor and may have one or more input and output devices. These devices may, among other things, be used to present a user interface. Examples of output devices that may be used to provide a user interface include a display screen for visual presentation of output and a speaker or other sound-generating device for audible presentation of output. Examples of input devices that may be used for a user interface include a keyboard, as well as pointing devices such as a mouse, touchpad, and digitizing tablet. As another example, a computer may receive input information through speech recognition or through other audible formats.

[0132]

[0148] Such computers may be interconnected by one or more networks of any suitable form, including local area networks or wide area networks such as enterprise networks, and intelligent networks (INs), or the Internet. Such networks may be based on any suitable technology, operate according to any suitable protocol, and may include wireless networks, wired networks, or fiber optic networks.

[0133]

[0149] The various methods or processes outlined herein may be coded as software / instructions executable on one or more processors using any one of a variety of operating systems or platforms. Additionally, such software may be written using any of several suitable programming languages ​​and / or programming or scripting tools, and may be compiled as executable machine code or intermediate code that runs on a framework or virtual machine.

[0134]

[0150] In this regard, various invention concepts may be embodied as computer-readable storage media (or multiple computer-readable storage media) (e.g., computer memory, one or more floppy disks, compact disks, optical disks, magnetic tapes, flash memory, USB flash drives, SD cards, field-programmable gate arrays or circuit configurations in other semiconductor devices, or other non-temporary or tangible computer storage media) encoded with one or more programs that, when executed on one or more computers or other processors, perform methods for implementing the various aspects of the present disclosure discussed above. One or more computer-readable media may be portable such that one or more programs stored thereon can be loaded onto one or more different computers or other processors to implement the various aspects of the present disclosure discussed above.

[0135]

[0151] The terms “program,” “software,” or “instructions” are used herein in a general sense to refer to any type of computer code or set of computer executable instructions that may be used to program a computer or other processor to implement the various aspects discussed above. Additionally, it should be noted that, according to one aspect, one or more computer programs that, when executed, perform the methods of the Disclosure, do not need to reside on a single computer or processor, but can be modularly distributed among several different computers or processors to implement the various aspects of the Disclosure.

[0136]

[0152] Computer executable instructions can take many forms, such as program modules, which are executed by one or more computers or other devices. Generally, a program module includes routines, programs, objects, configurations, data structures, etc., that perform a specific task or implement a specific abstract data type. Typically, the functionality of a program module can be combined or distributed in various ways as desired. Thus, one aspect of the present disclosure may be a computer program product comprising at least one non-temporary computer-readable storage medium that operably communicates with a processor, the storage medium storing instructions that, when executed by the processor, implement the methods or processes described herein, the instructions comprising steps for performing the methods or processes described herein.

[0137]

[0153] Furthermore, data structures can be stored in a computer-readable medium in any suitable form. For simplicity of illustration, a data structure may be shown as having fields associated through locations within the data structure. Such relationships can also be achieved by allocating locations in the computer-readable medium that convey the relationships between fields to storage for the fields. However, any suitable mechanism can be used to establish relationships between information in the fields of a data structure, including through the use of pointers, tags, or other mechanisms that establish relationships between data elements.

[0138]

[0154] All definitions defined and used herein should be understood to take precedence over dictionary definitions, definitions in literature referenced by reference, and / or the ordinary meanings of the terms defined.

[0139]

[0155] As used herein, “logic” includes, but is not limited to, hardware, firmware, software, and / or combinations thereof for performing functions or actions and / or for triggering functions or actions from other logic, methods, and / or systems. For example, depending on the desired application or need, logic may include software-controlled microprocessors, discrete logic such as processors (e.g., microprocessors), application-specific integrated circuits (ASICs), programmed logic devices, memory devices containing instructions, electrical devices with memory, or similar. Logic may include one or more gates, combinations of gates, or other circuit components. Logic can also be fully embodied as software. Where multiple logics are described, it may be possible to combine multiple logics into a single physical logic. Similarly, where a single logic is described, it may be possible to distribute that single logic across multiple physical logics.

[0140]

[0156] Furthermore, the logic(s) presented herein to achieve various methods of this system may be intended to improve existing computer-centric or internet-centric technologies that may not have prior analog versions. The logic(s) may provide specific functions directly related to structures that address and solve some of the problems identified herein. The logic(s) may also provide significantly more advantages to solving these problems by providing illustrative inventive concepts as specific logical structures and harmonized functions of methods and systems. Furthermore, the logic(s) may also provide specific computer implementation rules that improve existing technical processes. The logic(s) provided herein extend beyond simply collecting data, analyzing information, and displaying results. Furthermore, parts or all of this disclosure may rely on underlying formulas derived from specific arrangements of equipment or components as described herein. Thus, parts of this disclosure that relate to specific arrangements of components do not cover abstract concepts. Furthermore, this disclosure and the accompanying claims present teachings that go beyond the performance of previously known, well understood, routine, and conventional activities in the art. In some of the methods or processes of this disclosure that may incorporate several aspects of natural phenomena, the steps of the process or method are novel and useful additional features.

[0141]

[0157] The articles "a" and "an," when used herein in the specification and claims, should be understood to mean "at least one" unless the opposite is explicitly stated. The phrase "and / or," when used herein in the specification and claims (where present), should be understood to mean "either or both" of the elements thus combined, that is, elements that exist conjunct in some cases and disjunct in others. Multiple elements enumerated by "and / or" should be similarly interpreted as "one or more" of the elements thus combined. Other elements other than those specifically identified by the "and / or" clause may exist at will, whether related to or unrelated to those specifically identified elements. Therefore, as a non-restrictive example, when used in conjunction with unrestrictive language such as "equipped with," a reference to "A and / or B" can, in one aspect, refer to A only (optionally including elements other than B), in another aspect, refer to B only (optionally including elements other than A), in yet another aspect, refer to both A and B (optionally including other elements), and so on. When used herein in the specification and claims, "or" should be understood to have the same meaning as "and / or" as defined above. For example, when separating items in a list, "or" or "and / or" should be interpreted as inclusive, that is, including at least one of several elements or lists of elements, but also including more than one, and optionally including additional unlisted items. Only terms that clearly indicate the opposite, such as "only one of" or "exactly one of" or, when used in claims, "consisting of," would refer to including exactly one element of several elements or lists of elements. In general, the term “or” as used herein should be interpreted only as indicating an exclusive substitution (i.e., “one or the other, but not both”) when preceded by an exclusive term such as “either of the following,” “one of the following,” “only one of the following,” or “exactly one of the following.”When used in patent claims, "essentially consisting of" should have its usual meaning, as it does in the field of patent law.

[0142]

[0158] As used herein in the specification and claims, the phrase “at least one” means, in relation to a list of one or more elements, at least one element selected from any one or more elements in the list of elements, but not necessarily including at least one of all elements specifically enumerated in the list of elements, nor excluding any combination of elements in the list of elements. This definition also allows for the presence of elements other than those specifically identified in the list of elements to which the phrase “at least one” refers, whether related to or unrelated to those specifically identified elements, at the discretion of the user. Therefore, as a non-restrictive example, "at least one of A and B" (or equivalently, "at least one of A or B," or equivalently, "at least one of A and / or B") may, in one aspect, refer to A which contains at least one B which is not present, and optionally more than one (and optionally other elements); in another aspect, refer to B which contains at least one A which is not present, and optionally more than one (and optionally other elements); and in yet another aspect, refer to A and B which contain at least one B which is not present, and optionally more than one (and optionally other elements), etc.

[0143]

[0159] Although the components of this disclosure are described herein in relation to one another, if claimed or used individually, one of the components disclosed herein may constitute the subject matter of the invention. In accordance with the above example, if the disclosed aspects teach the features of components A and B, then, unless otherwise stated herein, there may be subject matter of a combination of A and B, A alone, or B alone.

[0144]

[0160] When a feature or element is referred to herein as being "on top of" another feature or element, it may be directly on top of the other feature or element, or there may be intervening features and / or elements. In contrast, when a feature or element is referred to as being "directly on top of" another feature or element, there are no intervening features or elements. When a feature or element is referred to as being "connected," "attached," or "combined" to another feature or element, it will also be understood that it may be directly connected, attached, or combined to the other feature or element, or there may be intervening features or elements. In contrast, when a feature or element is referred to as being "directly connected," "directly attached," or "directly combined" to another feature or element, there are no intervening features or elements. Features and elements described or shown in relation to one embodiment may be applicable to other embodiments. A reference to a structure or feature positioned "adjacent" to another feature will also be recognized by those skilled in the art, as it may have a portion overlapping or beneath the adjacent feature.

[0145]

[0161] The terms “first” and “second” may be used herein to describe various features / elements, but these features / elements should not be limited by these terms unless otherwise indicated in the context. These terms may be used to distinguish one feature / element from another. Thus, without departing from the teachings of this disclosure, the first feature / element discussed herein may be referred to as the second feature / element, and similarly, the second feature / element discussed herein may be referred to as the first feature / element.

[0146]

[0162] An embodiment is an implementation or example of the present disclosure. Any reference herein to “embodiment,” “one embodiment,” “several embodiments,” “one specific embodiment,” “explanatory embodiment,” or “other embodiments,” or similar, means that certain characteristics, structures, or features described in relation to an embodiment are included in at least some embodiments of the present invention, but not necessarily in all embodiments. Various appearances of “embodiment,” “one embodiment,” “several embodiments,” “one specific embodiment,” “explanatory embodiment,” or “other embodiments,” or similar, do not necessarily refer to the same embodiment.

[0147]

[0163] Where this specification states that a component, feature, structure, or characteristic may be included ("may," "might," or "could"), that particular component, feature, structure, or characteristic does not have to be included. Where this specification or the claims refer to an "a" or "an" element, it does not mean that there is only one of that element. Where this specification or the claims refer to an "additional" element, it does not mean that there is more than one additional element.

[0148]

[0164] Where used herein in the specification and claims, including as used in examples, all numbers may be read as if preceded by the words “about” or “approximately,” even if the term is not explicitly stated, unless otherwise indicated. The phrase “about” or “approximately” may be used when describing size and / or location to indicate that the described value and / or location is within a reasonable expected range of the value and / or location. For example, a number may have values ​​such as + / -0.1% of the stated value (or range of value), + / -1% of the stated value (or range of value), + / -2% of the stated value (or range of value), + / -5% of the stated value (or range of value), + / -10% of the stated value (or range of value), etc. Any numerical range described herein is intended to include all subranges contained therein.

[0149]

[0165] In addition, the methods for carrying out this disclosure may occur in sequences different from those described herein. Therefore, unless otherwise specified, the sequences of the methods should not be read as limiting. It is recognizable that similar results can be achieved by performing some of the steps of the methods in a different order.

[0150]

[0166] In the claims and the foregoing specification, all transitional phrases such as “equipment,” “includes,” “supports,” “possess,” “contains,” “accompany,” “holds,” “consist of,” and similar should be understood to mean unrestrictive, i.e., including but not limited to. Only the transitional phrases “consist of” and “essentially consisting of” are considered closed or semi-closed transitional phrases, respectively, as described in the U.S. Patent and Trademark Office's Patent Examination Procedure Manual.

[0151]

[0167] To the extent that this disclosure uses the term “invention” in any title or section thereof, the term is included as required by the formatting requirements for Word document submissions in accordance with the U.S. Patent and Trademark Office guidelines / requirements and should not be considered in any way as a denial of any subject matter.

[0152]

[0168] In the above explanation, certain terms are used for the sake of brevity, clarity, and understanding. Since such terms are used for explanatory purposes and are intended to be interpreted broadly, they should not imply any unnecessary limitations beyond the requirements of prior art.

[0153]

[0169] Furthermore, the descriptions and examples of the various aspects of this disclosure are illustrative, and this disclosure is not limited to the very details shown or described. The technical terms used herein are for illustrative purposes only and are not intended to limit or exhaustively describe the scope of this disclosure. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of this disclosure. The following is a direct reproduction of the claims as originally filed. [1] An energy management system (EMS) for an aircraft, the EMS being configured to be connectable to a plurality of source line switching units (source LRUs) and a plurality of sink line switching units (sink LRUs), the source LRUs being sources of power for a high-voltage DC link used for propulsion, the sink LRUs using the power from the high-voltage DC link for propulsion, and the EMS, A communication interface configured to receive status information from each of the source LRU and sink LRU and to transmit commands to the source LRU and sink LRU, wherein the status information comprises information from each sensor within each LRU and a determination that the information from each sensor is within a predetermined range. A redundant control path for controlling safety-critical operations, wherein the redundant control path is configured to independently determine whether to electrically isolate the LRU from the high-voltage DC link based on the status information from the LRU, and isolation is determined based on the independent determination. EMS equipped with [2] The EMS according to [1], wherein the EMS is configured to achieve a threshold probability of catastrophic failure below a certain threshold. [3] The aircraft has a parallel hybrid electric propulsion system or a parallel turbo hybrid electric propulsion system, and the redundant control path comprises a first processor in a first control path, wherein the first processor is configured to electrically isolate the LRU from the high-voltage DC link when status information from the LRU indicates that the LRU has determined that the LRU has determined that the conditions are met, and the redundant control path also comprises a second control path, wherein the second control path comprises a human-machine interface in the cockpit of the aircraft for displaying the status information and receiving commands to isolate the LRU, and in response to the commands, the LRU is electrically isolated from the high-voltage DC link, as described in [1] or [2]. [4] Each LRU and the first processor are configured to receive a key-on signal from the cockpit, and in response to the reception of the key-on signal, the processor in each LRU performs an embedded test for the LRU and transmits the status information to the first processor via the communication interface, the first processor is configured to confirm, based on its respective determination, that each sink LRU is ready to supply power, and in response to the confirmation that it is ready to supply power, it issues a command to electrically connect each of the sink LRU to the high-voltage DC link, and each source LRU is configured to confirm, based on its respective determination, that it is ready to supply power, and in response to the confirmation that it is ready to supply power, it issues a command to precharge the source LRU, and when a preset precharge is reached, it issues a command to electrically connect the source LRU to the high-voltage DC link, as described in [3]. [5] The EMS as described in [4], wherein the first processor is configured not to issue a command to the sink LRU or the source LRU to electrically connect to the high-voltage DC link when the first processor does not determine whether the sink LRU or the source LRU is ready to supply power. [6] The aircraft has a parallel hybrid electric propulsion system or a parallel turbohybrid electric propulsion system, and the redundant control path comprises a primary control path and a return control path, each control path comprises a processor, each processor configured to receive the status information, determine whether to isolate the LRU from the high-voltage DC link based on the status information, and transmit the determination to the other processor, and if each processor determines based on the status information that the conditions are met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU, and if different determinations exist, the processor in the primary control path, the processor in the return control path, or both, or the processor in the other control path runs a truth model to determine which determination based on the status information is valid, and if, based on the truth model, the determination that the conditions are met is determined, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU, as described in [1] or [2]. [7] The EMS according to [6], wherein the recovery control path is configured to take over control of each LRU when the primary control path has a failure. [8] The source LRU is an energy storage system, the energy storage system (ESS) is configured to supply a first VDC, as described in any one of [3] to [7]. [9] The EMS according to [8], wherein the high-voltage DC link is a second VDC, and the EMS further comprises a conversion circuit configuration configured to convert the first VDC from the ESS to the second VDC.

[10] The EMS according to [9], wherein the second VDC is greater than the first VDC.

[11] The source LRU is an EMS as described in any one of [3] to

[10] , comprising a prime mover, a generator, and an inverter.

[12] The EMS according to any one of [3] to

[11] , wherein the first processor is further configured to issue commands to each sink LRU based on a propulsion command from the cockpit.

[13] The first processor is further configured to coordinate the commands to the sink LRU electrically connected to the high-voltage DC link when the sink LRU is electrically isolated from the high-voltage DC link, as described in

[12] .

[14] The EMS according to any one of [3] to

[13] , wherein the first processor is further configured to determine whether an LRU that has been commanded to be electrically isolated from the high-voltage DC link is electrically isolated from the high-voltage DC link, and in response to the determination that the LRU is not electrically isolated, to issue a command to the cockpit to land.

[15] The aircraft has an electric propulsion system or a turboelectric propulsion system or a turbohybrid electric propulsion system, the redundant control path comprises at least three control paths, the at least three control paths comprising a primary control path and at least two return control paths, each control path comprising a processor and a communication interface, Each LRU and each processor in at least three of the control paths are configured to receive a key-on signal from the cockpit, and in response to the reception of the key-on signal, the processor in each LRU performs an embedded test for the LRU and transmits the status information to each of the at least three processors in the control paths via their respective communication interfaces. Each processor in at least three of the control paths is configured to independently verify, based on its respective status information, that each sink LRU is ready to be powered, and to transmit such verification or lack thereof to other processors in other control paths, and when all control paths verify that each sink LRU is ready to be powered, the processor in the primary control path issues a command to electrically connect each of the sink LRUs to the high-voltage DC link, and when one control path does not verify that the sink LRU is ready to be powered, and another control path verifies that the sink LRU is ready to be powered, the processor in the primary control path, or the processor in each control path, or an independent processor, runs a truth model to determine which verification output from each control path is valid, and when, based on the truth model, it is determined that the verification is valid, the processor in the primary control path issues a command to electrically connect the sink LRU to the high-voltage DC link. Each processor in at least three of the control paths is configured to verify, based on the respective status information, that each source LRU is ready to supply power, and all control paths verify that each source LRU is ready to supply power, and the processor in the primary control path issues a command to each source LRU to precharge, and when the preset precharge is reached, issues a command to electrically connect each source LRU to the high-voltage DC link, or to electrically connect each source LRU to the high-voltage DC link without precharging, The EMS as described in [1] or [2], where one control path does not confirm that the source LRU is ready to supply power, but another control path confirms that the source LRU is ready to supply power, the processor in the primary control path, or the processor in each control path, or an independent processor, runs a truth model to determine which confirmation output from each control path is valid, and if, based on the truth model, the confirmation is determined to be valid, the processor in the primary control path electrically issues a command to the source LRU to precharge, and when the preset precharge is reached, issues a command to electrically connect each source LRU to the high-voltage DC link, or to electrically connect the source LRU to the high-voltage DC link without precharging.

[16] The EMS according to

[15] , wherein each processor in at least three of the control paths is configured to determine whether to electrically isolate the LRU based on the status information received from the respective LRU.

[17] The EMS as described in

[16] , wherein the processor in each control path is configured to receive the status information via its respective communication interface, determine whether to isolate the LRU from the high-voltage DC link based on the status information, and transmit the determination to other processors in other control paths, and if the processor in each control path determines that the condition is met based on the status information, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU, and if different determinations exist, the processor in the primary control path, the processor in each return control path, or another processor runs a truth model to determine which determination based on the status information is valid, and if the determination that the condition is met is determined based on the truth model, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

[18] The control room comprises a human-machine interface configured to receive overrides, and in response to such overrides, the electrically isolated LRU is commanded to reconnect to the high-voltage DC link, as described in

[17] .

[19] The EMS as described in any one of

[15] to

[18] , wherein the processor in each of at least three of the control paths is configured to receive propulsion commands from the cockpit and independently determine the commands, and the processor in the primary control path issues commands to each sink LRU.

[20] The source LRU is an energy storage system, the energy storage system (ESS) is configured to supply a first VDC, and the EMS further comprises a conversion circuit configuration, the EMS according to any one of

[15] to

[19] .

[21] The conversion circuit configuration is a DC-DC converter, the DC-DC converter is configured to convert the first VDC to a second VDC, the second VDC is supplied as an accessory power supply, the EMS as described in

[20] .

[22] The conversion circuit configuration is a DC-AC converter, the DC-AC converter is configured to convert the first VDC to a first AC, the first AC is supplied as an accessory power supply, the EMS as described in

[20] .

[23] The source LRU comprises a turbogenerator, and the processor in each of at least three of the control paths is configured to receive propulsion commands from the cockpit and independently determine the commands, and the processor in the primary control path issues commands to the processors in each sink LRU and the turbogenerator, as described in any one of

[15] to

[22] .

[24] The threshold probability of a catastrophic failure is 10 -9 The EMS described in any one of the items [2] to

[23] .

Claims

1. An energy management system (EMS) for an aircraft, the EMS is configured to be connectable to a plurality of source line switching units (source LRUs) and a plurality of sink line switching units (sink LRUs), the source LRUs being sources of power for a high-voltage DC link used for propulsion, the sink LRUs using the power from the high-voltage DC link for propulsion, and the EMS, A communication interface configured to receive status information from each of the source LRU and sink LRU and to transmit commands to the source LRU and sink LRU, wherein the status information comprises information from each sensor within each LRU and a determination that the information from each sensor is within a predetermined range. A redundant control path for controlling safety-critical operations, Equipped with, Here, the redundant control path is configured to independently determine whether to electrically isolate the LRU from the high-voltage DC link based on the status information from the LRU, and isolation is determined based on the independent determination. The redundant control path also comprises a second control path, the EMS, which includes a human-machine interface in the cockpit of the aircraft for displaying the status information and receiving commands to isolate the LRU.

2. The EMS according to claim 1, wherein the EMS is configured to achieve a threshold probability of catastrophic failure below a certain threshold.

3. The aircraft has a parallel hybrid electric propulsion system or a parallel turbohybrid electric propulsion system, the redundant control path comprises a first processor in a first control path, wherein the first processor is configured to electrically isolate the LRU from the high-voltage DC link when the status information from the LRU indicates that the LRU has determined that information from the sensor is outside the predetermined range for the sensor and that a condition has been met, and in response to the command, the LRU is electrically isolated from the high-voltage DC link, the EMS according to claim 1 or 2.

4. The EMS according to claim 3, wherein each LRU and the first processor are configured to receive a key-on signal from the cockpit, and in response to the reception of the key-on signal, the processor in each LRU performs an embedded test for the LRU and transmits the status information to the first processor via the communication interface, the first processor is configured to confirm, based on its respective determination, that each sink LRU is ready to receive power, and in response to the confirmation that it is ready to receive power, it issues a command to electrically connect each of the sink LRUs to the high-voltage DC link, and based on its respective determination, that each source LRU is ready to supply power, and in response to the confirmation that it is ready to supply power, it issues a command to precharge the source LRU, and when a preset precharge is reached, it issues a command to electrically connect the source LRU to the high-voltage DC link.

5. The EMS according to claim 4, wherein when the first processor does not determine that the sink LRU is ready to receive power or the source LRU is ready to supply power, the first processor is configured not to issue a command to the sink LRU or the source LRU to electrically connect to the high-voltage DC link.

6. The EMS according to claim 1 or 2, wherein the aircraft has a parallel hybrid electric propulsion system or a parallel turbohybrid electric propulsion system, the redundant control path comprises a primary control path and a return control path, each control path comprises a processor, each processor configured to receive the status information, determine based on the status information whether to isolate the LRU from the high-voltage DC link, and transmit the determination to other processors, and if each processor determines based on the status information that the conditions are met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU, and if different determinations exist, the processor in the primary control path, the processor in the return control path, or both, or the processor in another control path runs a truth model to determine which determination based on the status information is valid, and if, based on the truth model, the determination that the conditions are met is determined, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

7. The EMS according to claim 6, wherein the recovery control path is configured to take over control of each LRU when the primary control path has a failure.

8. The EMS according to claim 3, wherein the source LRU is an energy storage system, and the energy storage system (ESS) is configured to supply a first VDC.

9. The EMS according to claim 8, wherein the high-voltage DC link is a second VDC, and the EMS further comprises a conversion circuit configuration configured to convert the first VDC from the ESS to the second VDC.

10. The EMS according to claim 9, wherein the second VDC is greater than the first VDC.

11. The source LRU comprises a prime mover, a generator, and an inverter, as described in claim 3.

12. The EMS according to claim 3, wherein the first processor is further configured to issue commands to each sink LRU based on a propulsion command from the cockpit.

13. The EMS according to claim 12, wherein the first processor is further configured to coordinate the commands to a sink LRU that is electrically connected to the high-voltage DC link when the sink LRU is electrically isolated from the high-voltage DC link.

14. The EMS according to claim 3, wherein the first processor is further configured to determine whether an LRU commanded to be electrically isolated from the high-voltage DC link is electrically isolated from the high-voltage DC link, and in response to the determination that the LRU is not electrically isolated, to issue a command to the cockpit to land.

15. The aircraft has an electric propulsion system, a turboelectric propulsion system, or a turbohybrid electric propulsion system, and the redundant control path comprises at least three control paths, the at least three control paths comprising a primary control path and at least two return control paths, and each control path comprises a processor and a communication interface. Each LRU and each processor in at least three of the control paths are configured to receive a key-on signal from the cockpit, and in response to the reception of the key-on signal, the processor in each LRU performs an embedded test for the LRU and transmits the status information to each of the at least three processors in the control paths via their respective communication interfaces. Each processor in at least three of the control paths is configured to independently verify, based on its respective status information, that each sink LRU is ready to receive power, and to transmit such verification or lack thereof to other processors in other control paths, and when all control paths verify that each sink LRU is ready to receive power, the processor in the primary control path issues a command to electrically connect each of the sink LRUs to the high-voltage DC link, and when one control path does not verify that the sink LRU is ready to receive power, and another control path verifies that the sink LRU is ready to receive power, the processor in the primary control path, or the processor in each control path, or an independent processor, runs a truth model to determine which verification output from each control path is valid, and when, based on the truth model, it is determined that the verification is valid, the processor in the primary control path issues a command to electrically connect the sink LRU to the high-voltage DC link. Each processor in at least three of the control paths is configured to verify, based on the respective status information, that each source LRU is ready to supply power, and all control paths verify that each source LRU is ready to supply power, and the processor in the primary control path issues a command to precharge each source LRU, and when the preset precharge is reached, issues a command to electrically connect each source LRU to the high-voltage DC link, or to electrically connect each source LRU to the high-voltage DC link without precharging, EMS according to claim 1 or 2, when one control path fails to confirm that the source LRU is ready to supply power, but another control path confirms that the source LRU is ready to supply power, the processor in the primary control path, or the processor in each control path, or an independent processor, runs a truth model to determine which confirmation output from each control path is valid, and if, based on the truth model, the confirmation is determined to be valid, the processor in the primary control path electrically issues a command to the source LRU to precharge, and when the preset precharge is reached, issues a command to electrically connect each source LRU to the high-voltage DC link, or to electrically connect the source LRU to the high-voltage DC link without precharging.

16. The EMS according to claim 15, wherein each processor in at least three of the control paths is configured to determine whether to electrically isolate the LRU based on the status information received from the respective LRU.

17. The EMS according to claim 16, wherein the processor in each control path is configured to receive the status information via its respective communication interface, determine whether to isolate the LRU from the high-voltage DC link based on the status information, and transmit the determination to other processors in other control paths, and if, based on the status information, the processor in each control path determines that the condition is met, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU, and if different determinations exist, the processor in the primary control path, the processor in each return control path, or another processor runs a truth model to determine which determination based on the status information is valid, and if, based on the truth model, the determination that the condition is met is determined, the processor in the primary control path issues a command to the LRU to electrically isolate the LRU.

18. The EMS according to claim 17, wherein the control room comprises a human-machine interface configured to receive overrides, and in response to such overrides, the electrically isolated LRU is commanded to reconnect to the high-voltage DC link.

19. The EMS according to claim 15, wherein the processor in at least three of the control paths is configured to receive propulsion commands from the cockpit and independently determine the commands, and the processor in the primary control path issues commands to each sink LRU.

20. The EMS according to claim 15, wherein the source LRU is an energy storage system, the energy storage system (ESS) is configured to supply a first VDC, and the EMS further comprises a conversion circuit configuration.

21. The EMS according to claim 20, wherein the conversion circuit configuration is a DC-DC converter, the DC-DC converter is configured to convert the first VDC to a second VDC, and the second VDC is supplied as an accessory power supply.

22. The EMS according to claim 20, wherein the conversion circuit configuration is a DC-AC converter, the DC-AC converter is configured to convert the first VDC to a first AC, and the first AC is supplied as an accessory power supply.

23. The EMS according to claim 15, wherein the source LRU comprises a turbogenerator, and the processor in each of the at least three control paths is configured to receive propulsion commands from the cockpit and independently determine the commands, and the processor in the primary control path issues commands to the processors in each sink LRU and the turbogenerator.

24. The threshold probability of a catastrophic failure is 10 -9 The EMS according to claim 2.

Images