Systems and methods for fail-safe battery protection independent from battery management system

Abstract

A method and system for simultaneously preventing overcharging of a rechargeable battery string are disclosed. A system includes: a pair of disconnecting devices; a power distribution bus electrically connected to the battery string via the disconnecting devices; a battery charger connected to supply battery power to the power distribution bus for charging the battery string; a module monitoring unit configured to sense individual battery cell voltages during charging; a first processor configured to open one of the disconnecting devices when the sensed individual battery cell voltage indicates overcharging; a plurality of sensors connected to sense the full string voltage measured across the battery string and the first and second half-string voltages measured across a first and second half-string of the battery string; and a second processor connected to receive sensor data during charging. The second processor is configured to independently open a second disconnecting device when the sensor data indicates continuous overcharging.

Description

Technical Field

[0001] This disclosure relates in general to systems and methods for mitigating overcharging during controlled or uncontrolled charging of modular battery systems on transportation vehicles (such as aircraft). Prior Technology

[0002] When a motor is used to propel an aircraft, electrical energy is provided by a power source. For example, electrical energy can be supplied by a DC power source comprising several battery modules connected in series. As used herein, the term "battery module" means a battery comprising a single battery cell or multiple battery cells connected in series, parallel, or a combination thereof. As used herein, the term "battery string" means a plurality of battery modules connected in series. In one embodiment, the battery string provides high-voltage direct current (HVDC) power when connected to a distribution bus via the closing of an intermediate switch or contactor. As used herein, the term "connected" means coupled to provide power, and the term "disconnected" means decoupled to not provide power. As used herein, the term "high voltage" in the context of DC power actually means any DC voltage higher than 600 V DC.

[0003] In some aircraft with all-electric or hybrid-electric propulsion systems, high-capacity, high-voltage (e.g., 600 / 1000 / 2000 V DC) battery packs are used to supply power to large motors. Aircraft battery packs may have a multi-string, parallel-connected architecture to ensure sufficient power flow to the load at a fixed operating level. In airborne applications, the safety and criticality levels for high-power / high-voltage electrical protection are extremely stringent, requiring multiple different redundancies, including fail-safe and shutdown mechanisms. (As used herein, the term "fail-safe" means a design feature or practice that inherently responds to the unsafe consequences of a system failure in the event of a specific type of failure.) Airborne applications require extremely high levels of criticality and integrity for battery overcharge protection or other events or combinations of events that could lead to battery thermal runaway.

[0004] During normal regeneration or failure modes, the battery (e.g., lithium-ion battery) can be charged by the battery charger electronics and HVDC load. The Battery Management System (BMS) serves as the first layer of protection, typically including redundant monitoring and protection using individual cell voltages to prevent overcharging using a dual-cell management unit (hereinafter referred to as the "module monitoring unit"). For aircraft applications, an additional, independent, and distinct layer of failure safety is required, separate from the battery management unit, to provide a dual- or triple-redundant solution that meets CAT III airworthiness requirements (e.g., a failure probability of less than 10⁻⁹).

[0005] Specifically, a solution is needed to address the challenges of providing redundant, independent, and fail-safe operation during aircraft battery charging to mitigate various scenarios. At least three different types of failure events can cause lithium-ion battery overcharging: (1) failure of the battery charger regulation circuit resulting in a battery charging voltage higher than the charging end voltage; (2) internal battery failure causing fewer battery cells to be connected in series, and the battery charger operating within its normal charging end voltage range (e.g., a short circuit in a battery module is eliminated by an internal fuse link); (3) uncontrolled regeneration of power fed back to the battery in the event of motor and / or converter failure or malfunction. This is an important consideration for both ground and flight operations, as current trends aim to reduce battery charging time by utilizing high-voltage fast chargers, which are inherently difficult to control accurately or require more reliable and expensive solutions for control.

[0006] Currently, protection during charging is implemented by the module management unit (MMU) of the BMS at the charging source (such as a battery charger) or at an active control load (if regenerative charging is possible). Typically, the MMU is designed to detect overcharge conditions by monitoring the voltage of each individual battery cell and isolating the cells. Furthermore, the solution implemented in the MMU relies on monitoring individual battery cells, which increases the cost of the battery system and reduces system reliability as the operating voltage increases (proportional to the increase in the number of series-connected battery cells required to reach the operating voltage). An independent layer of protection and isolation (fail-safe type) separate from the MMU would provide additional safety for the aforementioned overcharge conditions. Summary of the Invention

[0007] The following details some aspects of systems and methods for providing redundancy and differentiated protection against overcharging of airborne high-voltage battery packs, such as those used in airborne electric propulsion systems. As used herein, the term "battery pack" includes a single battery string or a plurality of battery strings connected in parallel, each battery string containing a plurality of battery modules connected in series. The battery overcharge protection schemes proposed herein include a separate and independent layer of fail-safety, distinct from the module management unit (MMU), to provide a dual-redundancy or triple-redundancy solution compliant with CAT III airworthiness requirements. This additional layer of fail-safety is robust and simple. Preferably, this additional layer of fail-safety does not utilize individual battery cell voltage sensing.

[0008] According to some embodiments, the system and method include a battery protection device that is connected and configured to provide redundant and distinct protection against overcharging of the battery pack during battery charge and discharge cycles. The battery protection device proposed herein provides independent fail-safe protection against overcharging, external to the battery management system.

[0009] The proposed design of the independent fail-safe triple-redundant battery protection system employs a solution different from that of conventional battery protection systems. According to some embodiments, the fail-safe device uses voltage sensors to measure the voltage across the entire battery string, from the middle tap of the battery string to the positive and negative busbars, and the voltage across the entire string (the potential difference between the positive and negative busbars). The voltage is processed by hardware (e.g., a field-programmable gate array) or software in a manner different from that implemented in the MMU and within the charger of the fail-safe device, and compared to predetermined threshold levels. The threshold levels are dynamically calculated to monitor whether the voltage is within a safety margin. The safety margin is defined to avoid: (a) battery overvoltage from positive to negative; and (b) voltage imbalance between the two half-strings of the same battery string during charge and discharge cycles. Upon detection of an abnormal state, the fail-safe controller commands an internal independent disconnect device to open the circuit, thereby eliminating the erroneous state (e.g., by isolating the erroneous state). The fail-safe device can be implemented in a dedicated housing or embedded in the aircraft's power distribution panel.

[0010] Although some details of various embodiments of systems and methods for providing redundant and different protections against overcharging of onboard high-voltage battery packs will be described below, one or more of these embodiments may be characterized by one or more of the following points.

[0011] One perspective of the subject matter detailed below is a system for rechargeable battery strings, comprising first and second half strings electrically connected at an intermediate point, each half string comprising a corresponding plurality of battery modules connected in series, each battery module comprising a corresponding plurality of battery cells. This system includes: a first plurality of sensors connected to sense a full string voltage measured across the battery string, a first half string voltage measured across the first string, and a second half string voltage measured across the second half string; a fail-safe overcharge system including a first disconnect device and a processor connected to receive sensor data from the first plurality of sensors during charging and send commands to the first disconnect device; a power distribution bus electrically connected to the battery string via the first disconnect device when the first disconnect device is closed; and a battery charger connected and configured to supply battery power to the power distribution bus for recharging the battery string. The processor of the fail-safe overcharge system is configured to send a command to open a first disconnect device when sensor data from a first plurality of sensors indicates an undesirable electrical state during charging. This undesirable electrical state is mitigated by stopping charging. More specifically, the processor of the fail-safe overcharge system is programmed to derive a first measurement from the sensor data, compare the first measurement with a first threshold, and send a command to open the first disconnect device when the first measurement exceeds the first threshold.

[0012] According to some embodiments, the system described in the previous paragraph further includes a second disconnecting device, through which the power distribution bus is electrically connected to the battery string when the first and second disconnecting devices are closed. In this case, the processor of the fail-safe overcharge system is further programmed to derive a second measurement from sensor data, compare the value of the second measurement with a second threshold that is higher than the first threshold, and send a command to open the second disconnecting device when the second measurement exceeds the second threshold. In one proposed embodiment, the first disconnecting device is a contactor, and the second disconnecting device is a high-temperature switch.

[0013] Another aspect of the subject matter detailed below is a method for charging a battery string comprising first and second half-strings electrically connected at an intermediate point, each half-string comprising a corresponding plurality of battery modules connected in series, each battery module comprising a corresponding plurality of battery cells. The method includes: charging the battery string via a first disconnect device in a closed-circuit state; measuring the voltage of the first half-string across the first half-string during charging; measuring the voltage of the second half-string across the second half-string during charging; calculating the difference between the measured voltages of the first and second half-strings; comparing the difference with a difference threshold; and issuing a command to open the first disconnect device in response to a difference greater than the difference threshold.

[0014] Another perspective on the subject matter detailed below is a system for a rechargeable battery string, comprising first and second half strings electrically connected at a midpoint, each half string comprising a corresponding plurality of battery modules connected in series, each battery module comprising a corresponding plurality of battery cells. The system includes: first and second disconnection devices; a power distribution bus electrically connected to the battery string via the first and second disconnection devices when the first and second disconnection devices are closed; a battery charger connected and configured to supply battery power to the power distribution bus for recharging the battery string; and a module monitoring unit connected to the power distribution bus. The system comprises: a first processor configured to sense individual cell voltages of battery cells during charging; a first processor configured to open a first disconnect device when the individual cell voltage sensed by the module monitoring unit indicates overcharging; a plurality of sensors connected to sense the full string voltage across the battery string, the first half string voltage across the first half string, and the second half string voltage across the second half string; and a second processor connected to receive sensor data from the plurality of sensors during charging and configured to open a second disconnect device when the sensor data indicates overcharging.

[0015] Other perspectives on systems and methods for providing redundant and different protections against overcharging of onboard high-voltage battery packs are disclosed below. Simple Explanation of the Diagram

[0016] The features, functions, and advantages may be achieved independently in various embodiments or may be combined in other embodiments. For the purpose of illustrating the above and other points, various embodiments will be described below with reference to the accompanying drawings. These drawings are not to scale. [Figure 1] is a schematic diagram of the propulsion architecture of a hybrid electric aircraft, in which a single thruster is alternately driven by an engine or a motor via a gearbox. [Figure 2] is a schematic diagram of a multi-string battery architecture with four battery strings. Each string consists of two groups of four battery modules connected in series through a corresponding intelligent intermediate point battery disconnection subsystem. [Figure 3] is a diagram illustrating a single battery module and related battery module monitoring units, which are connected and configured to monitor the individual battery cell voltages within the battery module. [Figure 4] is a diagram illustrating the battery cell overcharge failure tree, which forms the logical basis used in one embodiment of the battery protection system proposed in this paper. [Figure 5A] is a diagram illustrating the situation in which all battery modules in a battery string remain electrically connected after the battery charger regulation circuit fails during battery charging. [Figure 5B] is a diagram illustrating a situation in which one of the battery modules in a battery string with eight modules (each module consisting of multiple battery cells) becomes short-circuited during battery charging, thereby endangering the other battery cells in the battery string from overcharging. [Figure 6] is a diagram illustrating a portion of the system described in Schematic 2 and identifying the components of a typical intermediate point battery disconnection subsystem. This diagram includes symbols indicating that a single battery module or a portion thereof has been lost due to a short circuit within the battery module. [Figure 7] is a diagram of the internal components of the short-circuit battery module described in Schematic 6. [Figure 8] is a diagram illustrating a set of voltage sensors configured to measure the full and half-string voltages in a battery string with a short-circuited battery module (as described in Figure 5B). [Figure 9] is a schematic diagram of the propulsion architecture of a hybrid electric aircraft, in which the power distribution panel includes fail-safe devices to provide fail-safe protection against battery overcharging, independent of the battery management system. [Figure 10] is a diagram identifying the components of a battery system and a battery management system comprising two battery strings connected to a fail-safe battery overcharge protection circuit according to one embodiment. [Figure 11] is a flowchart of the steps for identifying an algorithm based on a proposed implementation for monitoring the voltage of battery strings and half strings to prevent overcharging. [Figure 12] is a diagram identifying components of a battery system and a battery management system comprising two battery strings connected to a fail-safe battery overcharge protection circuit according to another embodiment. This diagram includes symbols indicating that half of the battery string has been lost due to a short circuit. [Figure 13] is a diagram illustrating the improved battery cell overcharge failure tree, which forms the logical basis used in another embodiment of the battery protection system proposed herein. [Figure 14] is a diagram of a hybrid electric aircraft propulsion architecture of the type described in Schematic 9, which has an additional layer of overvoltage protection incorporated into the individual loads, the individual protection of which is invoked when the failure of the load causes the regenerative mode to excessively increase the battery voltage. [Figure 15] is a diagram showing a motor controller electrically connected to the motor and incorporated into a safety control board to protect the battery from the current regenerated by the motor in failure modes.

[0017] Referring below to the accompanying drawings, similar elements in different drawings have the same element symbols. Implementation

[0018] The following describes in considerable detail illustrative embodiments of systems and methods for providing redundant and differentiated protection against overcharging of onboard high-voltage battery packs. However, not all features of the actual embodiments are described in this specification. Those skilled in the art will understand that in the development of any such actual embodiment, numerous implementation-specific decisions must be made to achieve the developer's specific objectives, such as compliance with system-related and business-related constraints, which will vary between embodiments. Furthermore, it should be understood that such development work can be complex and time-consuming, but is nonetheless a routine task for those generally skilled in the art who will benefit from this invention.

[0019] The novel technology proposed herein can be added to the hybrid electric aircraft propulsion system 2 shown in Figure 1, wherein the thruster 32 is alternately driven by the engine 34 or the AC motor 30 via a gearbox 36. However, the technology proposed herein is also applied to an all-electric architecture. In either case, the thruster 32 includes a thruster shaft mechanically coupled to the output shaft of the AC motor 30 and a plurality of thruster blades.

[0020] The hybrid electric aircraft propulsion system 2 described in Figure 1 includes a battery system 21 connected to a distribution panel 20 via positive and negative high-voltage buses 38a and 38b (hereinafter referred to as "high-voltage buses 38a and 38b"). The distribution panel 20 includes a distribution bus 44 and a plurality of disconnect devices 62 on the load side. Various loads are connected to the distribution bus 44 via the disconnect devices 62. The battery system 21 includes a battery pack 18 and a battery management system 22 (hereinafter referred to as "BMS 22"). The battery pack 18 provides power to the distribution bus 44. The battery pack 18 is monitored and operated by the BMS 22. The battery pack 18 is connected to and disconnected from the distribution bus 44 via a set of contactors 8 driven by corresponding repeaters 9 on either the positive or negative terminals. The BMS 22 issues commands to the repeaters 9 to open or close the contactors 8.

[0021] Power from battery pack 18 flows into distribution bus 44 (which has two rails: positive and negative; for simplicity, Figure 1 describes the two rails as a single element). On the load side of distribution bus 44, there are multiple loads connected via a dedicated disconnect device 62. Generally, large loads can be such as AC motor 30 and pump 68 as described in Figure 1. AC motor 30 and pump 68 are powered by receiving DC power from battery pack 18 via distribution bus 44 from their respective motor controllers 10 and 66. In a hybrid architecture, AC motor 30 can be coupled to aircraft thruster 32 via gearbox 36. At the output shaft of gearbox, thruster 32 is attached to generate thrust. Smaller utility loads (such as cooling pumps) can use blocking diodes 70 to prevent power backflow towards the source during regeneration.

[0022] The hybrid electric aircraft propulsion system 2 described in Figure 1 further includes a battery charger 64. The battery charger 64 is used only when the aircraft is on the ground and the battery pack 18 needs charging. The battery charger 64 provides power to the battery pack 18 via a power distribution bus 44. The load is normally OFF when the battery pack 18 is charging. When all aircraft loads are OFF, the battery charger 64 is connected to the power distribution bus 44 on the load side and the battery pack 18 is connected to the power distribution bus 44 on the source side. The battery pack 18 is ready to charge whenever the BMS 22 issues a corresponding command. The BMS 22 continuously monitors the battery pack 18 during the charging cycle.

[0023] Figure 2 is a schematic diagram of a battery multi-string architecture according to one embodiment, having a battery pack 18 comprising multiple independent battery strings. The battery pack 18 is connected to a distribution panel 20 (see Figure 1) via a battery power distribution unit (BPDU) 12. The BPDU 12 is essentially a housing containing the hardware required for monitoring, connecting, and controlling the DC power output from the battery pack 18.

[0024] According to the battery system 21 described in Figure 2, the BPDU 12 includes high-voltage busbars 38a and 38b. The BPDU 12 further includes a first plurality of string contactors 8 connecting one end of the battery string 24 to the high-voltage busbar 38a, and a second plurality of string contactors 8 connecting the other end of the battery string 24 to the high-voltage busbar 38b. (A contactor is a controlled switch used to switch power circuits. Contactors are designed to be directly connected to high-current load devices.) The switchboard 20 receives DC power signals from battery strings 24a-24d via the string contactors 8 (when closed) and supplies this DC power to the motor controller 10.

[0025] BPDU 12 further includes a Battery Management System 22 (hereinafter referred to as "BMS 22"). The operation of the battery pack 18 is managed by BMS 22. Multiple parallel battery strings 24a-24d provide redundancy in the event of internal battery pack failure. BMS 22 can be configured to ensure redundant protection of the battery strings, fail-safe operation, and selective deactivation. BMS 22 can be further configured to provide battery overcharge protection or to warn of other events or combinations of events that may lead to battery thermal runaway. More specifically, the switching state of the string contactor 8 is controlled by BMS 22. Essentially, BMS 22 is the first layer of protection in conjunction with the charger. If any layer of protection fails, the fail-safe device described herein disconnects the battery from the rest of the system.

[0026] In the example described in Figure 2, the battery pack 18 comprises four battery strings 24a-24d. Each battery string consists of two groups of several (four in this embodiment) battery modules 4, which are connected in series and further connected in series with each other via a corresponding (smart) intermediate point battery disconnection subsystem 14. Each string contains multiple battery modules 4 connected in series (eight battery modules per string in the example described in Figure 2). Each battery string 24a-24d further includes a corresponding plurality of module monitoring units 6a and 6b (hereinafter referred to as "MMU 6a and 6b"). A corresponding pair of MMUs 6a and 6b monitors the status of each battery module. Each battery string 24a-24d supplies DC power to high-voltage busbars 38a and 38b via a corresponding string contactor 8. The DC power from the high-voltage busbars 38a and 38b is distributed to all HVDC loads.

[0027] As shown in Figure 2, each battery string 24a-24d has a dedicated set of string contactors 8 located at the positive and negative terminals to provide string-by-string current separation. When the string contactors 8 are closed, the battery strings 24 are connected together in the BPDU 12 via high-voltage buses 38a and 38b. Additionally, dedicated terminal current sensors 16 (e.g., Hall effect current sensors) are positioned between the contactor 8 connecting each half of the string 25a and the positive (or negative) high-voltage bus 38a. The BMS 22 is configured (e.g., programmed) to control the different positive and negative string contactors 8 based on operating modes (charging, discharging, etc.) and system / battery pack protections (system short-circuit protection, unbalanced string current, etc.). Each pair of positive and negative string contactors 8 is dually controlled by their respective intermediate-point battery disconnect subsystem 14 and the BMS 22. The BMS 22 is communicatively coupled to all intermediate-point battery disconnect subsystems 14 for coordination purposes. BMS 22 is responsible for communicating with the autopilot and other line-swappable units of the electric propulsion system.

[0028] The BPDU 12 depicted in Figure 2 also includes an integrated neutral grounding network 52 (connected across battery power output lines 40a and 40b) and an insulation monitoring device 26 (hereinafter referred to as "IMD 26"). The battery pack neutral point is connected to the mechanical ground via the neutral grounding network 52. The grounding impedance is used to balance the positive and negative bus voltages, while taking into account parasitic positive and negative grounding impedances and the total insulation impedance required to ensure personal safety. For example, a grounding switch can be used to disconnect the grounding connection in sleep mode. The IMD 26 dynamically and actively monitors the grounding resistance.

[0029] Internal short circuits within battery cells can lead to thermal runaway, which can cause battery failure. Typically, the anode and cathode portions of a battery are separated by an insulating barrier. However, this barrier can deteriorate, allowing a short circuit to form between the anode and cathode portions. This internal short circuit reduces the battery's internal resistance, thereby increasing the likelihood of overcharging or over-discharging, which in turn increases the cell temperature and can ultimately lead to thermal runaway.

[0030] In an alternative, the battery pack 18 described in Figure 1 can receive power from connected loads during discharge operation (with battery charger 64 OFF). For example, the AC motor 30 and motor controller 10 can regenerate DC power back to the distribution bus 44 during normal motor deceleration, braking phases, or transient operation. Furthermore, specific motor / motor controller failure conditions can also establish a situation with significant regeneration. The regenerated DC power needs to be absorbed by the battery source (or by other loads connected to the same distribution bus). Loads connected via blocking diode 70 are not regenerated back to the system. Under normal operating conditions, the motor and motor controller control the amount of energy regenerated to the system and battery pack 18, taking into account the maximum permissible system voltage / current. Under failure conditions, power can be regenerated uncontrolled and may damage the battery pack 18 due to excessive voltage or current. MMUs 6a and 6b (see Figures 6a and 6b) form the first layer of protection within the battery system 21 to isolate the battery pack 18 when power is regenerated uncontrolled.

[0031] Figure 3 is a diagram illustrating a single battery module 4 and associated MMUs 6a and 6b according to a proposed embodiment. Each battery module 4 is a parallel / series arrangement of single battery cells 5. As shown in Figure 3, the battery module 4 includes four rows of battery cells 5, each row comprising twenty battery cells connected in parallel across a pair of battery busbars 54a and 54b. Each parallel battery cell arrangement is considered a virtual battery cell (or battery brick). Four virtual battery cells 50a-50d are connected in series. This battery arrangement is completed using a corresponding fuse link 56 connected in series with each individual battery cell 5 to prevent battery failure. The basic module configuration is selected considering trade-offs in safe voltage, manageable weight, volume, and failure suppression.

[0032] Each battery module 4 is monitored by two independent and distinct module monitoring units 6a and 6b (labeled MMU1 and MMU2 in Figure 3). Each module monitoring unit includes sensors 58 for independently measuring the voltage of each virtual battery cell and the temperature of each individual battery cell. Module monitoring unit 6a also includes a balancing circuit 60. The balancing circuit 60 implements a passive (or active) balancing function initiated and controlled by an associated intermediate point battery disconnection subsystem 14. Module monitoring unit 6a transmits sensor data indicating the virtual battery cell voltage and individual battery cell temperature to the associated intermediate point battery disconnection subsystem 14. In charging mode, the (intelligent) intermediate point battery disconnection subsystem 14 sends commands to the balancing circuit 60 to ensure proper balance among the virtual battery cells. Module monitoring unit 6b transmits sensor data indicating the virtual battery cell voltage and individual battery cell temperature to the BMS 22. Additionally, module monitoring unit 6b can provide aggregated flags indicating that the battery cell voltage and battery cell temperature are out of range.

[0033] When battery system 21 is operating, MMUs 6a and 6b monitor individual battery cell voltages and transmit the data to BMS 22 and intermediate point battery disconnection subsystem 14. BMS 22 and intermediate point battery disconnection subsystem 14 also receive readings from Hall effect current sensors (as shown in Figure 2) to monitor overcurrent conditions. BMS 22 and intermediate point battery disconnection subsystem 14 detect overcharge conditions by checking if the voltage of one or more battery cells exceeds a safety margin. In such cases, both BMS 22 and intermediate point battery disconnection subsystem 14 command contactor 8 to open to isolate battery pack 18 from potential additional overcharge. Furthermore, during charging mode, BMS 22 controls balancing circuit 60 to equalize the charge between battery cells (see Figure 3).

[0034] MMUs 6a and 6b monitor the cell voltage and temperature. As described above, if one of the cells is overcharged to a level above the safety threshold voltage, both BMS 22 and the intermediate point battery disconnect subsystem 14 issue commands to disconnect the contactors 8 on the positive and negative terminals. The fusible link 5 shown in Figure 3 provides protection against internal short circuits in the cell. If this occurs, all other parallel-connected cells (19 in the example shown in Figure 3) will feed excessive current into the short-circuited cell, causing the battery module to overheat into thermal runaway. To mitigate this, the fusible link 5, with a small cross-section, is typically connected to the cathode and blows if the current exceeds a certain threshold. Similarly, when a short circuit occurs outside the series-connected stack of virtual cell cells in battery module 4, all fusible links 5 of one of the virtual cell cells in the battery module blow, thereby clearing the failure.

[0035] The battery system 21 may be composed of lithium-ion batteries. At least three different types of failure events can cause lithium-ion batteries to overcharge: (1) failure of the battery charger regulation circuit causing the battery charging voltage to be higher than the charging end voltage; (2) internal failure of the battery causing a small number of battery cells to be connected in series and the battery charger to operate within its normal charging end voltage range (e.g., a short circuit in a battery module is eliminated by an internal fuse link); (3) uncontrollable regeneration of power fed back to the battery in the event of failure or malfunction of the motor and / or motor controller (inverter).

[0036] For example, in the case of lithium-ion batteries, a failure in the battery charger regulation circuit can cause the charger's regulation voltage to exceed the charging end voltage (e.g., 900 V DC). MMUs 6a and 6b should detect this by monitoring the voltage of each individual battery cell (e.g., MMU1 > 4.3 V DC, MMU2 > 4.4 V DC). An internal battery failure can cause fewer battery cells to be connected in series, and the battery charger 64 to operate within its normal charging end voltage range (e.g., a short circuit in one battery module is eliminated by an internal fuse link). MMUs 6a and 6b should detect this by monitoring the voltage of each individual battery cell (MMU1 > 4.3 V DC, MMU2 > 4.4 V DC) and then isolate the battery modules.

[0037] A completely independent layer of protection, distinct from the battery system, is required to meet stringent aerospace requirements. This application proposes an additional layer of protection to mitigate the risk of overcharging caused by uncontrolled regeneration due to HVDC loads (such as motors / motor controllers), battery charger failure, or internal battery failure.

[0038] Figure 4 illustrates a battery cell overcharge failure tree 23, which forms the logical basis for implementing fail-safe functions in a redundant and varied manner. This logical basis is illustrated by AND gates 76 and 78 and OR gate 80 in Figure 4. The battery cell overcharge failure tree 23 is based on the assumption that a battery cell (e.g., a lithium-ion battery) is normally charged to 4.2 V DC (the absolute maximum voltage a lithium-ion battery cell can withstand under normal environmental conditions is 4.6 V DC). Therefore, a battery module consisting of 192 battery cells connected in series (the number of parallel connections is irrelevant at this point) should be charged to 192 * 4.2 V DC = 806 V DC (state of charge (SOC) equals 100%). If the battery charger malfunctions (e.g., the output voltage exceeds 806 V DC) and both MMU1 and MMU2 fail (as two independent failures), the battery cell will overcharge to a voltage higher than 4.6 V DC. At this point, it is impossible to prevent the battery cell from overcharging, overheating, and eventually entering a thermal runaway state. Another scenario is that MMU1 and MMU2 fail again when one of the battery modules fails to short-circuit across its terminals. The charger continues to supply 806 V DC, but fewer battery modules are connected in series (e.g., only seven instead of eight). In such a case, the battery cells can also be overcharged and fail.

[0039] Figure 5A is a diagram illustrating the situation where all battery modules 4 of the battery string 24 remain electrically connected after a failure of the battery charger regulation circuit during battery charging. In this example, the maximum battery charger voltage reaches 883.2 V DC, under which condition the battery cell voltage is equal to 4.6 V DC. Therefore, Figure 5A depicts the situation where the lithium-ion battery cell enters a thermal runaway state after the battery charger loses regulation and exceeds the absolute safety limit. Thus, if the battery charger cannot controllably provide 192 x 4.6 V DC = 883 V DC, the battery enters a thermal runaway state upon MMU failure.

[0040] Figure 5B illustrates a scenario where one battery module 4 in a battery string 24 with eight battery modules (each module consisting of multiple battery cells) experiences an internal short circuit 42 during battery charging, thereby exposing the remaining battery cells in the battery string 24 to the risk of overcharging. When a battery consists of multiple battery modules connected in series, the size of the battery modules determines the design safety margin to address overcharging. The example described in Figure 5B is as follows: Under normal charging conditions, the battery charger provides 806 V DC to charge each of the 192 battery cells connected in series to 4.2 V DC. The maximum number of battery cells connected in series that a battery module should contain in the event of a short circuit is 192 – 806 / 4.6 = 16 battery cells / module. If one battery module fails due to a short circuit, the remaining batteries (176) will be charged to 806 / 176 = 4.58 V DC (this is abnormal but may not lead to thermal runaway). In contrast, if only 172 out of 192 battery cells are operational, the individual cell voltage will be 4.7 V DC, which exceeds the design limit of 4.6 V DC and increases the risk of overcharging. Therefore, the minimum number of battery cells required to avoid overcharging in this example is 176. This solution is inherently safe for module short-circuit failures and will not induce overcharging in the event of a module short circuit. However, it imposes design limitations on using smaller battery modules and having a higher module count per cell, thereby impacting cost, complexity, and reliability.

[0041] Typically, each module has more than 20 cells connected in series (in one case, 24, which results in 806 / (192 - 24) = 4.8 V DC per cell). Reducing the number of cells to 16 increases the number of series-connected battery modules from 8 to 12. This leads to significantly higher cost and reduced volume and specific energy of the battery system, and consequently, reduced system efficiency. The technology proposed in this paper provides a protection solution to address module failure when the battery module has a high number of series-connected cells.

[0042] Figure 6 is a diagram of a portion of the system described in Schematic Diagram 2 and includes the internal components of an intermediate point battery disconnection subsystem 14 according to a proposed embodiment. Battery strings 24 are shown in a state where a single battery module or a portion of a module is lost due to a short circuit 42 in an internal module. The intermediate point battery disconnection subsystem 14 includes an intelligent intermediate point disconnection unit 28 (hereinafter referred to as "SMDU 28") and an intermediate point disconnection contactor 48. Each battery string 24 has its own dedicated SMDU 28. The SMDU 28 includes a processor configured to control the state of the intermediate point disconnection contactor 48. The SMDU 28 is communicatively coupled to a BMS 22. The intermediate point battery disconnection subsystem 14 further includes an intermediate point current sensor 46, which outputs an electrical signal to the SMDU 28 to indicate the current flowing through the intermediate point battery disconnection subsystem 14 when the intermediate point current sensor 46 is closed. SMDU 28 also receives electrical signals indicating individual cell temperatures and virtual cell voltages from module monitoring units 6a and 6b via MMU1 / SMDU data bus 7a and MMU2 / BMS data bus 7b. BMS 22 and SMDU 28 are configured to independently control the state of series contactor 8.

[0043] The purpose of SMDU 28 is to ensure the autonomous and safe operation of each battery string 24. SMDU 28 includes an intelligent controller / disconnection system for implementing battery and electrical protection / isolation of the battery string 24 in the event of a failure. The intermediate point battery disconnection subsystem 14 further includes an intermediate point current sensor 46, which outputs an electrical signal to SMDU 28 to indicate the current flowing through the first half string 25a and the second half string 25b in the series-connected battery modules 4. The intermediate point battery disconnection subsystem 14 further includes an intermediate point disconnection contactor 48 disposed between the intermediate point current sensor 46 and the second half string 25b. According to the embodiment shown in FIG. 5, SMDU 28 is configured to implement a battery string protection function that opens the intermediate point disconnection contactor 48 when a failure is indicated by the current flowing through the intermediate point current sensor 46.

[0044] SMDU 28 is further configured to communicate with each module monitoring unit 6a. Each module monitoring unit 6a reports its key parameters (T cell1, V cell1, etc.) to its corresponding SMDU. SMDU 28 is configured to implement specific battery cell protection functions to ensure the safety of the battery string 24. According to one proposed embodiment, SMDU 28 is configured to take action in response to any of the following conditions: overcharging (e.g., V cell > 4.2 V DC); over-discharging (e.g., V cell < 2.5 V DC); overheating (e.g., T cell > 80°C); high charging rate (e.g., I charge > 1C for 30Q battery cells or I charge > 3C for battery cells with LTO anodes); low temperature (e.g., T cell < 20°C); and virtual battery cell imbalance (e.g., ΔV cell > 50 mV). In the event of an internal failure in the battery module string, SMDU 28 will open the intermediate point disconnect contactor 48 and subsequently open the dedicated string contactor 8.

[0045] In charging mode, SMDU 28 controls the balancing circuit 60 embedded in the module monitoring unit 6a (MMU1) to ensure proper balance among the virtual battery cells. For charging or regenerating modes, the SMDU / MMU1 battery protection will open the series contactor 8 to stop the charging current. Optionally, the battery charger can receive information to regulate the charging current or reset the regenerated power to zero. Battery pack-level BMPS / MMU2 battery protection will provide redundancy and battery-critical protections (overcharge, over-discharge, overheating, etc.) different from those of SMDU / MMU1.

[0046] SMDU 28 is also configured to implement series protection functions. SMDU 28 is configured to implement specific battery series protections, such as: overcurrent protection (trip curve example); series differential current protection; and optional series insulation monitoring protection (using IMD 26 shown in Figure 2).

[0047] SMDU 28 uses an integrated current sensor (such as a Hall effect or shunt current sensor) connected in series with the intermediate point disconnect contactor 48 to measure current, as shown in Figure 6. In the event of a failure, SMDU 28 will open the intermediate point disconnect contactor 48 and disconnect the battery string 24. Sequentially, after opening the intermediate point disconnect contactor 48, SMDU 28 will open a dedicated string contactor 8 to provide current isolation.

[0048] Figure 7 is a diagram of the internal components of the short-circuited battery module described in Schematic 6. In this case, the internal short circuit 42 is between battery bus 54a of virtual battery cell 50a and battery bus 54b of virtual battery cell 50d. All fuse links of a virtual battery cell will respond to the short circuit and blow, thereby eliminating the failure. (Due to the random dispersion of the resistance of individual links, it is impossible to predict which virtual battery cell will be the first to blow all its fuse links.)

[0049] Each battery module 4 includes basic protection to ensure safe independent operation. In the event of an individual battery short-circuit failure, the fuse link 56 connected in series with the failed battery cell 5 will see the current of all parallel battery cells 5 and will become open due to overcurrent. The failed battery cell 5 will be isolated and battery module 4 will continue to operate with reduced capacity. No arcing occurs due to the low voltage (e.g., < 5 V DC) across a single fuse link 56. In the event of an internal short circuit 42 within the battery module (as shown in Figure 7), the combined fuse link 56 of a dummy battery cell 50 will become open due to overcurrent and isolate battery module 4. Therefore, battery module 4 will become open and inoperable. The module design (number of series battery cells, fuse link size, etc.) enables this state, where if fuse link 56 becomes open, the voltage across fuse link 56 (at the height under consideration) will be below an acceptable threshold and no sustained arcing will occur. For example, no arcing occurs due to the low voltage (e.g., < 100 V DC) of all the fuse links 56 across the dummy cell. The fuse links 56 of the cell are a protection feature used only for internal battery module failures (cell short circuits or dummy cell short circuits). When installed in strings, the combined or individual fuse links of the dummy cells do not present an open circuit due to an external short circuit. An open circuit in the fuse links (especially for a complete dummy cell) in the event of an external module failure can generate a significant, continuous arc with high energy near the cell.

[0050] Figures 6 and 7 illustrate the scenario where a single battery module, or a portion thereof, is lost due to an internal short circuit 42 within the battery module. If such a failure occurs, a very large current flows from the parallel-connected battery cells (multiple parallel-connected battery cells form a dummy battery cell; multiple series-connected dummy battery cells form a module) through the circuitry formed at the failure location. At some point, the fuse link 56 of one of the dummy battery cells blows, thereby breaking the circuit and causing the short-circuit current to stop. However, the other modules in the battery string 24 continue to supply current through the failure location to the load, bypassing the short-circuited battery module (see Figure 7).

[0051] During a charging cycle, the current supplied by the battery charger 64 (see Figure 1) is limited. Therefore, after clearing the failure across the battery modules by making the fuse link 56 open, the battery system 21 remains connected to the battery charger 64 and continues to be charged, which may result in battery overcharging as described above (overcharging of the other seven of the eight battery modules).

[0052] The proposed fail-safe battery protection scheme is based on the concept of providing the ability to disconnect the battery from the charger, independent of the BMS 22's ability to prevent overcharging or abuse of the battery in charging or discharging modes. It provides an additional layer of fail-safe protection (last resort) that: (a) is independent of the BMS 22 and MMUs 6a and 6b (see Figure 3); (b) uses different data processing techniques (e.g., if software is used to process BMS data, the data processing performed by the fail-safe device is done in the FPGA); (c) is completely separate from the battery system 21; (d) is simple and robust (no need to use individual battery cell voltages); (e) prevents overcharging in both charging and discharging modes; and (f) does not use blocking diodes in discharging mode (otherwise, it would cause significant losses and additional heat to the high-voltage power system and would not allow for normal regeneration / energy recovery modes).

[0053] On one hand, to detect charging failures, the proposed battery charging protection scheme measures the string voltage (Vbat) across the ends of each battery string and detects when the measured string voltage exceeds a string voltage threshold indicating an anomaly. On the other hand, to detect short-circuit failures in battery modules, the proposed scheme measures the half-string voltages (Vstack(+) and Vstack(-)) across the ends of the two half-strings of each battery string and detects when the difference between them exceeds a half-string voltage difference threshold indicating an anomaly. Optionally, the voltage across individual battery modules can be measured to detect anomalies during charging.

[0054] According to various embodiments, additional redundant battery protection can be provided by simple battery protection hardware (e.g., FPGA or discrete logic) embedded in a distribution panel or separate distribution box with a dedicated housekeeping power supply that operates using the battery voltage. According to one proposed embodiment, the fail-safe battery overcharge protection circuit includes a dedicated contactor and a dedicated high-temperature switch, which can be sequentially activated to disconnect the battery from the battery charger. More specifically, if the contactor fails to operate, the high-temperature switch can be activated in response to a further increase in the measured overcharge voltage. An additional shunt can be used to prevent excessive charging current and short-circuit failure.

[0055] Figure 8 is a schematic diagram of a set of voltage sensors 3a-3c arranged to measure the full and half-string voltages in a battery string 24 with a short circuit 42 (as shown in Figure 5B). Figure 8 shows the settings used to measure and report voltages to conclude an anomaly (e.g., the battery module is OFF due to short circuit 42). Voltage sensor 3a measures the half-string voltage Vstack(+) from the V(+) rail to the midpoint of the battery string 24. The half-string voltage Vstack(+) across the terminals of half-string 25a is equal to the difference between V(+) and the midpoint voltage Vmp. Voltage sensor 3b measures the half-string voltage Vstack(-) from the V(-) rail to the midpoint of the battery string 24 (corresponding to half-string 25b). The half-string voltage Vstack(-) across the terminals of half-string 25b is equal to the difference between V(-) and the midpoint voltage Vmp. Voltage sensor 3c measures the full-string voltage Vbat from the V(+) rail to the V(-) rail. The total voltage Vbat across the terminals of battery string 24 is equal to the difference between V(+) and V(-). According to an alternative embodiment, any combination of the two voltage sensors enables the desired function by performing the following mathematical operation: Vstack(+) + Vstack(-) = Vbat, or Vbat - Vstack(+) = Vstack(-), or Vbat - Vstack(-) = Vstack(+), but in these cases, the calculated voltages are not independent.

[0056] The measured value Vbat is compared with the set voltage level used for charging. If, during a charging cycle, the voltage detected by the sensor is greater than Vbat + Vacc (nominal voltage) and Vbat - Vacc + dV (the absolute maximum voltage that does not allow thermal runaway, where Vacc is the accuracy of the sensor (e.g., 2.5%) and dV is the margin above the nominal voltage that the battery can withstand (e.g., for a single battery cell with a nominal voltage of 4.2 V DC, the safety margin is 0.4 V DC)), and the absolute maximum voltage may be 4.6 V DC minus Vacc), then this condition is identified as overcharge by BMS 22 (see Figure 2). For example, if a sensor rated at 1000 V DC has an accuracy of ±0.5% (±5 V DC), then the measured nominal voltage of the entire battery pack consisting of 192 cell units should not exceed (192 x 4.2) + 5 = 806.54 + 5 = 811.4 V DC, and the absolute maximum voltage will be Vbat = (192 x 4.6 V DC) - 5 V DC = 878.2 V DC. We can conclude that the safety threshold dV is determined as dV = (Vmax_cell – Vnom_cell) x #of_cells = (4.6 – 4.2) x 192 = 76.8 V DC.

[0057] Assuming the voltage sensor measuring the half-string voltage is rated at 500 V and has an accuracy of ±0.5% (±2.5 V DC), then for a half-string of 192 battery cells, the nominal voltage is 192 / 2 x 4.2 V DC ± 2.5 V DC = 403.2 V DC ± 2.5 V DC. If even one battery module is missing, due to the accuracy issue, the readings of Vstack(+) and Vstack(‒) will differ by more than the sum of 2 x (±2.5 V DC) = 5 V DC, and the threshold dV is set to, for example, 15 V. For example, the maximum normal difference in such a case is 20 V DC, such as if Vstack(+) and Vstack(-) read 413.2 V DC and 393.2 V DC respectively. In practice, these figures should reflect the maximum number of battery cells per single battery module. For example, as previously described with reference to Figure 5, if the total number of battery cells in the battery string is 192, then it can be determined that the maximum number of battery cells per module should be 16. Therefore, when one battery module is missing, the battery cell (at 100% SOC) is exposed to 806.2 / 176 = 4.58 V DC per cell, which is within safety limits. The unbalanced voltage is 16 x 4.2 V DC = 67.2 V DC (greater than the 20-V threshold). However, in practice, OEMs attempt to maximize the number of battery cells per battery module, and implementing redundant protection different from BMS protection is imperative.

[0058] Voltage sensor readings are reported to fail-safe devices (besides the BMS) as three (or at least two) independent measurements. The fail-safe device includes a processor configured to check the voltage measurement Vbat for absolute overvoltage and imbalance and issue commands to clear the failure state, as described below with reference to Figure 11. An alternative solution is to measure the voltage of each battery module (e.g., eight modules) and apply similar imbalance logic protection, but this increases complexity and cost and reduces system reliability.

[0059] Figure 9 is a schematic diagram of the propulsion architecture of a hybrid electric aircraft, wherein the power distribution panel 20 includes a fail-safe battery overcharge protection device 1, independent of the BMS 22, to provide fail-safe protection against battery overcharging. The fail-safe battery overcharge protection device 1 is independent of the rest of the system as follows: (a) the fail-safe battery overcharge protection device 1 uses a dedicated housekeeping power supply 11 to draw its own power from the battery pack 18; (b) optionally, the fail-safe battery overcharge protection device 1 can receive power from the aircraft's auxiliary power supply ("Aux PS" in Figure 8); (c) the fail-safe battery overcharge protection device 1 uses its own dedicated sensors for monitoring, including a current sensor 15 shown in Figure 9 and voltage sensors 3a-3c shown in Figure 8.

[0060] In Figure 9, contacts 19a-19c indicate the taps for measuring the voltage Vmp at the midpoint relative to a reference voltage, the voltage V(+) of the positive high voltage bus 38a, and the voltage V(-) of the negative high voltage bus 38b. Contacts 19a-19c are electrically connected to one input terminal of the voltage sensors 3a-3c shown in Figure 8, respectively. The fail-safe battery overcharge protection device 1 includes a fail-safe overcharge processor 13, which processes the output from the voltage sensors 3a-3c. The difference between the measured voltages Vmp and V(+) at contacts 19a and 19b is the half-string voltage Vstack(+) across the end terminal of half-string 25a. The difference between the measured voltages Vmp and V(-) at contacts 19a and 19c is the half-string voltage Vstack(-) across the end terminal of half-string 25b. The difference between the measured voltages V(+) and V(-) at contacts 19b and 19c is the full-string voltage Vbat across the end terminals of battery string 24. In an alternative embodiment, if battery string 24 has a high-impedance center tap, these voltages can be referenced to ground. Alternatively, both the fail-safe battery overcharge protection device 1 and BMS 22 can independently measure the same full-string and half-string voltages. Furthermore, for health monitoring reasons, the measurements performed by BMS 22 can be compared with those performed by fail-safe battery overcharge protection device 1.

[0061] The fail-safe overcharge processor 13 receives power from the housekeeping power supply 11 and three (or at least two) signals from voltage sensors 3a-3c. The fail-safe overcharge processor 13 then compares Vbat with a preset threshold calculated as explained below with reference to FIG11. If Vbat exceeds the threshold, the fail-safe overcharge processor 13 identifies an overvoltage (from battery charger 64 or AC motor 30 in regenerative mode) and commands contactor 17 (displayed on negative high voltage busbar 38b) to present an open circuit. This operation is reconfigurable; that is, contactor 17 can be overwritten by the pilot to present a closed circuit again. Alternatively, as a different protection measure, if contactor 17 is failed to weld or if contactor 17 fails to disconnect current, the high-temperature switch 72 can also be commanded to present an open circuit. The high-temperature switch 72 includes a high-temperature fuse disposed along positive high voltage busbar 38a. High-temperature fuses are a type of fuse used for high voltages. They use explosives instead of melting metal strips to prevent arcing by breaking the contacts more quickly.

[0062] When the housekeeping power supply 11 fails, the contactor 17 of the fail-safe battery overcharge protection device 1 will automatically release to an open circuit state, thereby isolating the battery pack 18 to a safe condition. Similarly, the fail-safe overcharge processor 13 receives Vstack(+) and Vstack(-) readings and compares these values ​​to determine the health of the two half-chains, such as determining whether the battery module is inoperable.

[0063] The fail-safe battery overcharge protection device 1 can be implemented in a separate housing. Preferably, the fail-safe battery overcharge protection device 1 is embedded in existing aircraft equipment, such as a power distribution panel 20 that may also include a power distribution bus 44 and a disconnect device 62 on the load side. Similarly, three or two voltage sensors may also be installed inside the power distribution panel 20 to ensure absolute isolation between the fail-safe battery overcharge protection device 1 and the battery system 21.

[0064] Figure 10 is a diagram identifying the components of a battery system according to an alternative embodiment, including two battery strings 25a and 25b connected to the fail-safe battery overcharge protection device 1 and the BMS 22. In this example, the fail-safe overcharge processor 13 receives current measurements from a shunt current sensor connected to the positive high voltage busbar 38a.

[0065] Figure 11 is a flowchart illustrating the steps of an algorithm 100 for monitoring full-string and half-string voltages to prevent overcharging according to a proposed embodiment. More specifically, algorithm 100 initiates protection based on voltage sensor readings and preset thresholds. Algorithm 100 is implemented while the battery string 24 is being charged. For example, any disconnecting devices (including contactor 17 and high-temperature switch 72) positioned between the battery string 24 and the battery charger 64, as shown in Figure 9, are closed during charging. During charging, voltages V(+), V(-), and Vmp are sensed (step 102). Based on these sensed voltages, the full-string and half-string voltages are measured. More specifically, the first half-string voltage Vstack(+) = V(+) - Vmp is measured across half-string 25a (step 106), and the second half-string voltage Vstack(-) = V(-) - Vmp is measured across half-string 25b (step 108). In addition, the full string voltage Vbat = V(+) + V(-) is measured across the battery string 24 (step 110). Finally, the difference ΔVstack between the measured first half-string voltage Vstack(+) and the second half-string voltage Vstack(-) is calculated (step 104).

[0066] Referring again to Figure 11, the difference ΔVstack is compared with the difference threshold ΔVthr (step 112). On the one hand, if it is determined in step 112 that the difference ΔVstack is not greater than the difference threshold ΔVthr, the process returns to step 102. On the other hand, if it is determined in step 112 that the difference ΔVstack is greater than the difference threshold ΔVthr, the fail-safe overcharge processor 13 (see Figure 9) issues a command to open-circuit the contactor 17 (step 120).

[0067] Furthermore, the fail-safe overcharge processor 13 is configured (in hardware or software) to compare the measured full-string voltage Vbat with the full-string voltage threshold Vthr(bat) (step 118). On one hand, if it is determined in step 118 that the measured full-string voltage Vbat is not greater than the full-string voltage threshold Vthr(bat), the process returns to step 102. On the other hand, if it is determined in step 118 that the measured full-string voltage Vbat is greater than the full-string voltage threshold Vthr(bat), the fail-safe overcharge processor 13 issues a command to open-circuit the contactor 17 (step 120).

[0068] Furthermore, the fail-safe overcharge processor 13 is configured to compare the measured value of the half-string voltage Vstack(+) with the half-string voltage threshold Vthr(+) (step 114), and also to compare the measured value of the half-string voltage Vstack(-) with the half-string voltage threshold Vthr(-) (step 116). If it is determined in step 114 that the measured half-string voltage Vstack(+) is not greater than the half-string voltage threshold Vthr(+), the process returns to step 102. Similarly, if it is determined in step 116 that the measured half-string voltage Vstack(-) is not greater than the half-string voltage threshold Vthr(-), the process returns to step 102. Conversely, if it is determined in step 114 that the measured half-string voltage Vstack(+) is greater than the half-string voltage threshold Vthr(+) and if it is determined in step 116 that the measured half-string voltage Vstack(-) is greater than the half-string voltage threshold Vthr(-), the fail-safe overcharge processor 13 confirms that the sensor has not failed by comparing ΔV(+) = Vstack(+) - Vthr(+) with ΔV(-) = Vstack(-) - Vthr(-). If ΔV(+) = ΔV(-), the fail-safe overcharge processor 13 issues a command to open-circuit contactor 17 (step 120).

[0069] A difference threshold ΔVthr is calculated such that when the system is in a state where one battery module is not operating, the difference ΔVstack will be greater than the difference threshold ΔVthr. Then, when the first threshold is reached, a command is issued to open contactor 17. In this embodiment, if contactor 17 has been soldered and the voltage continues to increase, a second threshold can be used to activate the high-temperature switch 72. This coordination also takes into account that if the housekeeping power supply 11 loses power, the high-temperature switch 72 cannot be commanded to disconnect the circuit, and simultaneously the contactor automatically opens due to the loss of its low-voltage hold (which normally would).

[0070] This includes monitoring Vbat (if three voltage sensors are used) in steps 110 and 118, or calculating Vstack(+) + Vstack(-) (if two voltage sensors are used). The measured full-string voltage Vbat is compared to a full-string voltage threshold Vthr(bat), which can be dynamically adjusted by the fail-safe overcharge processor 13 using a programmed lookup table of battery voltage as a function of consumed energy. If the full-string voltage threshold Vthr(bat) is exceeded, the fail-safe overcharge processor 13 concludes that the battery charger 56 has entered an unregulated state or that the feedback voltage generated during regeneration is too high, and the battery pack 18 is disconnected by making the contactor 17 or the high-temperature switch 72 open.

[0071] The flowchart shown in Figure 11 illustrates the voltage-based logic used by the fail-safe overcharge processor 13 to determine the appropriate battery protection response. In an alternative implementation, current-based logic may be used. Figure 12 is a diagram identifying the components of the battery system 21 connected to the fail-safe battery overcharge protection circuit 1, which is configured to process data from three current sensors: current sensor 46, connected at the midpoint between battery half-strings 25a and 25b; and current sensors 15a and 15b, which are embedded in or attached to the distribution panel 20. Figure 12 illustrates a scenario where battery half-string 25a has been lost due to a short circuit 42.

[0072] As a different protection measure, if contactor 17 becomes welded or if the current exceeds the contactor's breaking current capability, a command can be issued to open the high-temperature switch 72. The latter is particularly important if the fail-safe device detects an overcurrent condition (by analyzing the readings of current sensors 15a and / or 15b): if a short circuit occurs between the fail-safe device and battery system 21, current sensors 15a and 15b report a current significantly greater than the charging current (first current threshold) during a charging cycle, and the fail-safe overcharge processor 13 issues a command to open the high-temperature switch 72 and contactor 17. Another charging condition occurs when a short circuit occurs inside the battery (between the positive and center taps or between the negative and center taps), in which current sensor 46 reports a very high current (second current threshold 2), far exceeding the normal charging current detected by all current sensors 15a, 15b, and 46. This constitutes differential protection, which causes BMS 22 to send a command to shut down the battery, and BMS 22 communicates this abnormal situation to fail-safe overcharge processor 13, which is then activated to disconnect the battery charger by opening contactor 17 and high-temperature switch 72. Activation of high-temperature switch 72 results in a non-resettable system configuration. If a short circuit occurs upstream of distribution panel 20 between the positive and negative terminals during discharge, current sensors 15a and 15b both detect a very high short-circuit current, and the fail-safe device interrupts the short circuit by opening contactor 17 and high-temperature switch 72.

[0073] Figure 13 is a schematic diagram of the improved battery cell overcharge failure tree 23', which forms the logical basis used to implement fail-safe functions in a redundant and varied manner. This logical basis is illustrated by AND gates 76, 78, 82, 84 and OR gate 80 in Figure 4. The battery cell overcharge failure tree 23' is based on the assumption that lithium-ion batteries are typically charged to 4.2 V DC and should remain below 2.6 V DC during operation. Therefore, a battery module consisting of 192 battery cells connected in series (the number of parallel connections is irrelevant at this time) should be charged to 192 * 4.2 V DC = 806 V DC (state of charge (SOC) equals 100%). If the battery charger loses regulation (e.g., the output voltage exceeds 806 V DC) and both MMU1 and MMU2 fail (as two independent failures) and the overvoltage protection function fails, the battery becomes overcharged to above 4.6 V DC. At this point, it is impossible to prevent the battery from overcharging, overheating, and eventually entering a thermal runaway state. Another scenario occurs when one battery module in the battery pack fails to short-circuit across its terminals, and both MMU1 and MMU2 malfunction, along with a communication failure between the fail-safe device and the intermediate point, resulting in a loss of protection. The charger continues to supply 806 V DC, but fewer battery modules are connected in series (e.g., only seven instead of eight). In such a case, the battery cell can also be overcharged and fail.

[0074] Figure 14 is a diagram of a hybrid electric aircraft propulsion architecture of the type described in Schematic 9, with an additional layer of independent overvoltage protection incorporated into individual loads. This individual protection is invoked when load failure causes an excessive increase in battery voltage during regenerative mode. Overvoltage (OV) protection is implemented in each of the multiple loads and in other connections to the distribution bus 44 (e.g., battery chargers). The differences in how protection is implemented depend primarily on the type of equipment connected to the load side of the system. If a load fails and regeneration occurs, this load is preferably isolated before the fail-safe device is activated, thereby allowing the remaining healthy loads to continue operating.

[0075] In the example depicted in Figure 14, the motor controller 10 includes an overvoltage protection circuit 90a. For example, when the motor controller 10 generates an overvoltage due to failure, this overvoltage can be monitored by detecting when the voltage at its terminals exceeds a preset threshold; additionally, a shunt current sensor 74a detects a negative current flowing out of the motor controller 10. In such a case, the failed motor controller is commanded to shut down. Similarly, the battery charger 64 also includes an overvoltage protection circuit 90b, which receives sensing data from the shunt current sensor 74b.

[0076] According to one embodiment, isolated independent protection is embedded in each HVDC master load. This protection is implemented based on monitoring voltage and current and then applying logic to prevent failures caused by excessive voltage or current returning to the distribution bus 44 and battery system 21 from the load. For load failures that could lead to bus and battery overvoltages, it may be advantageous to shut down the load to establish a safe condition without interrupting service to other loads. In the case of a motor controller 10 that converts DC power to AC power for an AC motor, the regenerative mode drive bus voltage can be terminated by disabling the pulse width modulation driver and / or the housekeeping power supply. For example, the overvoltage protection circuit 90a in the motor controller 10 can be configured to activate protection when the regenerated voltage exceeds 850 V DC. Then, after a time delay, the fail-safe battery overcharge protection device 1 is configured to open contact 17 when the regenerated voltage exceeds 865 V DC (if the load protection fails). Following a further time delay, the fail-safe battery overcharge protection device 1 is configured to activate the high-temperature switch 72 when the regenerated voltage exceeds 875 V DC (if the contactor fails to present an open circuit). Therefore, the fail-safe layer can be set to a higher coordination level to prevent load failure.

[0077] Figure 15 is a schematic diagram of a motor controller 10 electrically connected to an AC motor 30 and incorporated into a safety control board 94 to protect a battery (not shown in Figure 15) from current regenerated by the AC motor 30 in a failure mode. The AC motor 30 operates under the control of the motor controller 10. In some embodiments, the motor controller 10 has three channels for supplying AC current to corresponding groups of stator windings 98 in the AC motor 30. Each channel of the motor controller 10 (only one channel is shown in Figure 15) includes a corresponding converter 91 connected in parallel to the windings 98 of the AC motor 30. In the simplified embodiment described in Figure 15, the channel includes the converter 91 (including three sets of power switches 86 associated with the three phases respectively) and a DC link capacitor 95 connected across HVDC busbars 99a and 99b. A corresponding diode 88 is connected in anti-parallel to each power switch 86.

[0078] The operation of each converter 91 is controlled by a corresponding converter controller 92, which sends switching control signals to the converter 91 via switching signal lines (not shown in Figure 15) and receives switching status signals from the converter 91. The converter 14 converts DC power into multiphase AC power for use in the AC motor 30. The combination of the converter and the converter controller forms a DC-to-AC converter as part of the motor controller 10. More specifically, the converter controller 92 generates pulse-width modulation (PWM) signals that serve as reference currents and voltages provided to the AC motor 30 to achieve optimal mechanical torque output. These reference signals are modulated using a PWM generation function, which establishes commands sent to the gate drivers of the power switches 86 in the converters 91 controlled by the converter controller 92.

[0079] In the scenario depicted in Figure 15, the DC component of the regenerated electrical energy is continuously fed back into the system by the motor controller 10. Typically, the battery receives an acceptable level of power when below overcharge conditions. However, in the case where the AC motor 30 continues to rotate at the same speed and nothing counteracts the resulting motor back electromotive force (EMF), the motor back EMF suddenly increases. The regenerated voltage is then rectified through the freewheeling diode 88 of the motor controller 10, and the resulting voltage is significantly higher than the DC link voltage provided by the battery system. When this occurs, the AC motor 30 will uncontrollably regenerate energy back into the battery system. Since the battery is a low-impedance source and the regenerated power is significant, a large current flows back into the battery. This current can be much greater than the battery's nominal charging current. This undesirable situation can lead to battery overcharging and subsequent overheating and thermal runaway.

[0080] If overvoltage and overcurrent flowing into the system are detected, the safety control board 94 is configured to determine that an overcharge condition exists and commands power switches 86a and 86b (which may be, for example, MOSFETs or IGBTs) to open-circuit by removing power from their gates, thus isolating the load (in this case, the AC motor 30) from the rest of the system. More specifically, the safety control board 94 may include a voltage sensor to measure the voltage across the DC link capacitor 95. A shunt current sensor 74 detects a negative current flowing out of the motor controller 10. The shutdown mechanism 96 directly disables the PWM driver.

[0081] The flowcharts and block diagrams in the various described embodiments illustrate the architecture, functionality, and operation of some feasible implementations of the devices and methods in the illustrative embodiments. For this purpose, each block in a flowchart or block diagram may represent a module, segment, function, and / or part of an operation or step. For example, one or more blocks may be implemented as program code, implemented in hardware, or implemented as a combination of program code and hardware. When implemented in hardware, the hardware may, for example, take the form of integrated circuitry, which is manufactured or configured to perform one or more operations in the flowchart or block diagram.

[0082] The embodiments disclosed above use one or more processing or computing devices. Such devices typically include processors, processing devices, or controllers, such as general-purpose central processing units, microcontrollers, reduced instruction set computer processors, application-specific integrated circuits, programmable logic circuits, field-programmable gate arrays, digital signal processors, and / or any other circuitry or processing devices capable of performing the functions described herein. The methods described herein may be encoded as executable instructions embodied in a non-transitory tangible computer-readable storage medium (including, but not limited to, storage devices and / or memory devices). When executed by a processing device, such instructions cause the processing device to perform at least a portion of the methods described herein.

[0083] The methods described herein can be encoded as executable instructions embodied in a non-transitory tangible computer-readable storage medium (including, but not limited to, storage devices and / or memory devices). When executed by a processing or computing system, such instructions cause a system device to perform at least a portion of the methods described herein.

[0084] Although systems and methods for providing redundancy and different protections against overcharging of airborne high-voltage battery packs have been described with reference to various embodiments, those skilled in the art will understand that various changes can be made and equivalents can be substituted for elements therein without departing from the scope of the teachings herein. Furthermore, many modifications can be made to adapt the teachings herein to specific situations without departing from their scope. Therefore, it is intended that the scope of the claims be limited to the specific embodiments disclosed herein.

[0085] In the appended claims of the method, any alphabetical order of the steps is for the sole purpose of enabling subsequent shorthand references to the preceding steps, and not for the purpose of limiting the scope of the claims to the method steps that are required to be performed in alphabetical order.

[0086] Note: The following paragraphs present further perspectives from this revelation:

[0087] A1, a system for a rechargeable battery string, the battery string comprising first and second half strings electrically connected at a midpoint, each half string comprising a corresponding plurality of battery modules connected in series, each battery module comprising a corresponding plurality of battery cells, comprising: First and second disconnection devices; A power distribution bus that is electrically connected to the battery string via the first and second disconnect devices when the first and second disconnect devices are closed; A battery charger, which is connected and configured to supply battery power to a power distribution bus for charging battery strings; A module monitoring unit configured to sense the individual cell voltage of a battery cell during charging; A first processor is configured to open a first disconnect device when an individual battery cell voltage sensed by the module monitoring unit indicates overcharging; A plurality of sensors, connected to sense the voltage across the entire battery string, the voltage across the first half string, and the voltage across the second half string; and A second processor is connected to receive sensor data from a plurality of sensors during charging and is configured to open a second disconnect device when the sensor data indicates overcharging.

[0088] A2, as described in paragraph A1, further includes an interior handling power supply configured to convert power from the battery string into power for opening the second disconnect device.

[0089] A3, as described in paragraph A1, wherein the second processor is programmed to derive a first measurement from sensor data, compares the first measurement with a first threshold, and sends a command to open the first disconnect device when the first measurement exceeds the first threshold.

[0090] A4, as described in paragraph A3, wherein the first measurement is the difference between the sensed first and second half-string voltages, and the first threshold is a difference threshold.

[0091] A5, as described in paragraph A3, wherein the first measurement is the magnitude of the sensed first half-string voltage, and the first threshold is the half-string voltage threshold.

[0092] A6, as described in paragraph A3, wherein the first measurement is the magnitude of the sensed battery string voltage, and the first threshold is the battery string voltage threshold.

[0093] A7, as described in paragraph A3, further includes a third disconnect device, through which the power distribution bus is electrically connected to the battery string when the first to third disconnect devices are closed. The second processor is further programmed to derive a second measurement from sensor data, compares the value of the second measurement with a second threshold that is higher than the first threshold, and sends a command to open the third disconnect device when the second measurement exceeds the second threshold.

[0094] A8, as described in paragraph A7, in which the second disconnecting device is a contactor and the third disconnecting device is a high-temperature switch.

[0095] 1: Fail-safe battery overcharge protection device 2: Hybrid electric vehicle propulsion system 3a, 3b, 3c: Voltage sensors 4: Battery Module 5: Battery cell 6a, 6b: Module Monitoring Unit (MMU) 7a:MMU1 / SMDU Data Bus 7b: MMU2 / BMS Data Bus 8: (Series) Contactor 9: Repeater 10: Motor controller 11: Housekeeping Power Supply (HKPS) 12: Battery Power Distribution Unit (BPDU) 13: Fail-safe overcharge processor 14: Midpoint Battery Disconnection Subsystem 15, 15a, 15b: Current sensor (CS) 16: Endpoint Current Sensor 17: Contactor 18: Battery Pack 19a, 19b, 19c: Contact 20: Distribution panel 21: Battery System 22: Battery Management System (BMS) 23, 23': Battery cell overcharge failure tree 24, 24a, 24b, 24c, 24d: Battery string 25a: First half string 25b: Second half string 26: Insulation Monitoring Device (IMD) 28: Intelligent Midpoint Disconnection Unit (SMDU) 30: AC motor 32: Thruster 34: Engine 36: Gearbox 38a: (Positive) High Voltage Busbar 38b: (Negative) High Voltage Busbar 40a, 40b: Battery power output cables 42: (Internal) Short circuit 44: Distribution Bus 46: Midpoint Current Sensor (CS) 48: Disconnect contactor at midpoint 50a, 50b, 50c, 50d: Virtual battery cells 52: Neutral grounding network 54a, 54b: Battery busbars 56: Circuit Breaker Link 58: Sensor 60: Balanced circuit 62: Disconnect device 64: Battery Charger 66: Motor Controller (MC) 68: Pump 70: Blocking Diode 72: High Temperature Switch 74, 74a, 74b: Shunt type current sensor 76, 78, 82, 84: AND gate 80:OR gate 86, 86a, 86b: Power switches 88: Diode 90a, 90b: Overvoltage (0V) protection circuit 91: Converter 92: Converter Controller 94: Safety Control Board 95: DC link capacitor 96: Closure of the organization 98: Winding 99a, 99b: High Voltage Direct Current (HVDC) Busbars 100:Algorithm 102, 104, 106, 108, 110, 112, 114, 116, 118, 120: Steps

Claims

1. A system for a rechargeable battery string, the battery string comprising a first half-string and a second half-string electrically connected at a midpoint, each half-string comprising a plurality of corresponding battery modules connected in series, each battery module comprising a plurality of corresponding battery cells, the system comprising: A first plurality of sensors, connected to sense the full-string voltage across the battery string, the first half-string voltage across the first half-string, and the second half-string voltage across the second half-string; a fail-safe overcharge system including a first disconnect device and a processor, the processor of the fail-safe overcharge system being connected to receive sensor data from the first plurality of sensors during charging and to send commands to the first disconnect device; a power distribution bus electrically connected to the battery string via the first disconnect device when the first disconnect device is closed; and a battery charger connected and configured to supply battery power to the power distribution bus for charging the battery string, wherein the processor of the fail-safe overcharge system is configured to send the command to open the first disconnect device when the sensor data from the first plurality of sensors indicates an undesirable electrical state during charging, the undesirable electrical state being mitigated by stopping charging. A second plurality of sensors, connected to sense the cell voltage and temperature of each of the plurality of battery cells; and a battery management system including a second disconnect device and a processor, the processor of the battery management system being connected to receive sensor data from the second plurality of sensors during the charging period and to send the command to the second disconnect device, wherein the power distribution bus is electrically connected to the battery string via the first disconnect device and the second disconnect device when both the first disconnect device and the second disconnect device are closed; and wherein the processor of the battery management system is configured to send the command to open the second disconnect device when the sensor data from the second plurality of sensors indicates an undesirable electrical state during the charging period, the undesirable electrical state being mitigated by stopping charging.

2. The system of claim 1, wherein the processor of the fail-safe overcharge system is programmed to derive a first measurement from the sensor data, compare the first measurement with a first threshold, and send the command to open the first disconnect device when the first measurement exceeds the first threshold.

3. The system of claim 2, wherein the first measurement is the difference between the sensed first half-string voltage and the second half-string voltage, and the first threshold is a difference threshold.

4. The system of claim 2, wherein the first measurement is the magnitude of the sensed first half-string voltage, and the first threshold is a half-string voltage threshold.

5. The system of claim 2, wherein the first measurement is a magnitude of the sensed battery string voltage, and the first threshold is a battery string voltage threshold.

6. The system of claim 1, wherein the first disconnecting device is a contactor and the second disconnecting device is a high-temperature switch.

7. The system of claim 1, further comprising a distribution panel, including the distribution bus of the first disconnect device and the fail-safe overcharge system disposed on the distribution panel.

8. A method for a rechargeable battery string, the battery string comprising a first half-string and a second half-string electrically connected at a midpoint, each half-string comprising a plurality of corresponding battery modules connected in series, each battery module comprising a plurality of corresponding battery cells, the method comprising: The battery string is charged via a first disconnection device of a fail-safe overcharge system and a second disconnection device of a battery management system, both of which are in a closed-circuit state. During charging, a first plurality of sensors measure the full string voltage, the first half string voltage across the first half string, and the second half string voltage across the second half string, respectively. When sensor data from the first plurality of sensors indicates an undesirable electrical state during charging, the processor of the fail-safe overcharge system issues a command to open the first disconnection device of the fail-safe overcharge system, and the undesirable electrical state is mitigated by stopping charging. A second plurality of sensors sense the cell voltage and temperature of each of the plurality of battery cells. When sensor data from the second plurality of sensors indicates an undesirable electrical state during charging, the processor of the battery management system sends the command to open the second disconnection device of the battery management system, and the undesirable electrical state is mitigated by stopping charging.

9. The method of claim 8, further comprising: deriving a first measurement from the sensor data by the processor of the fail-safe overcharge system; comparing the first measurement with a first threshold by the processor of the fail-safe overcharge system; and sending the command by the processor of the fail-safe overcharge system to open the first disconnect device when the first measurement exceeds the first threshold.

10. The method of claim 9, wherein the first measurement is the difference between the sensed first half-string voltage and the second half-string voltage, and the first threshold is a difference threshold.

11. The method of claim 9, wherein comparing the first measurement and the first threshold includes: Compare the measured full-string voltage value with the full-string voltage threshold.

12. The method of claim 9, wherein comparing the first measurement and the first threshold includes: Compare the measured value of the first half-string voltage with the first half-string voltage threshold.

13. The method of claim 9, wherein comparing the first measurement and the first threshold includes: Compare the measured value of the second half-string voltage with the second half-string voltage threshold.

14. The method of claim 8, wherein charging the battery string includes enabling a battery charger connected to provide direct current to the battery string via the first disconnection device.

15. The method of claim 8, wherein charging the battery string includes supplying DC power to the battery string from a motor controller via the first disconnection device.

Images