Propulsion system, propulsion control device, and propulsion control program

Abstract

A propulsion system (30) comprises a supply path (130) for supplying electric power from a battery (31) to a motor (61). In a power supply path (131) of the supply path (130), a power supply switch (86) is provided between the battery (31) and an inverter circuit (85). The inverter circuit (85) has arm switches (116, 117). When an anomaly pertaining to the motor (61) occurs, a flight control device (40) performs a multi-blocking process. In the multi-blocking process, the supply path (130) is blocked by a plurality of switches which are the power supply switch (86) and the arm switches (116, 117). In the multi-blocking process, after the arm switches (116, 117) has reduced an abnormal-state current, the power supply switch (86) blocks the supply path (130).

Description

Propulsion system, propulsion control device, and propulsion control program CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application is based on Patent Application No. 2023-131629 filed in Japan on August 10, 2023, and the contents of the original application are incorporated by reference in their entirety.

[0002] The disclosure in this specification relates to a propulsion system, a propulsion control device, and a propulsion control program.

[0003] Patent Document 1 describes a rotating electric machine device mounted on a vehicle. The rotating electric machine device includes a motor, an inverter, and a control device. The motor is provided with a circuit breaker that can interrupt the neutral point of the motor. When an abnormality occurs in the rotating electric machine device, the control device uses the circuit breaker to interrupt the abnormal current flowing through the neutral point of the motor.

[0004] Japanese Patent Application Laid-Open No. 2021-114874

[0005] However, in the above-mentioned Patent Document 1, there is a concern that if the abnormal current becomes excessively large, an arc discharge may occur in the circuit breaker, and the circuit breaker may not be able to interrupt the abnormal current.

[0006] One object of the present disclosure is to provide a propulsion system, a propulsion control device, and a propulsion control program that can improve the safety of an aircraft.

[0007] The multiple aspects disclosed in this specification employ different technical means to achieve their respective objectives. Furthermore, the reference symbols in parentheses in the claims and this section are merely examples showing the correspondence between specific means described in the embodiments below as one aspect, and do not limit the technical scope.

[0008] In order to achieve the above object, the first propulsion system disclosed is a propulsion system for propelling an aircraft, and comprises: a motor that is driven to propel the aircraft using power supplied from a power supply unit; a power conversion unit that has a conversion switch provided in a supply path that supplies power from the power supply unit to the motor and converts the power supplied from the power supply unit to the motor by driving the conversion switch; a power switch that is provided in the supply path between the power supply unit and the power conversion unit and cuts off the supply path; and an abnormality cut-off unit that, when an abnormality related to the motor occurs, cuts off the supply path using at least one of the conversion switch and the power switch in a manner depending on the abnormality state.

[0009] According to the first propulsion system, when an abnormality occurs in the motor, the supply path is interrupted by at least one of the conversion switch and the power switch in a manner corresponding to the abnormality. In this configuration, by driving the conversion switch to reduce the abnormal current flowing through the supply path, the reduced abnormal current can be interrupted by the power switch. This prevents the power switch from being able to interrupt the abnormal current due to an excessively large abnormal current, which would otherwise reduce the safety of the aircraft. This therefore improves the safety of the aircraft.

[0010] The second propulsion system disclosed is a propulsion system for propelling an aircraft, and includes: a motor that is driven to propel the aircraft using power supplied from a power supply unit; a power conversion unit that has a conversion switch provided in a supply path that supplies power from the power supply unit to the motor and converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch that is provided in the supply path between the power supply unit and the power conversion unit and cuts off the supply path.

[0011] According to the second propulsion system, a conversion switch and a power switch are provided in the supply path. In this configuration, if an abnormality occurs in the motor, the supply path can be shut off by at least one of the conversion switch and the power switch in a manner that corresponds to the abnormality. Therefore, as with the first propulsion system, the safety of the aircraft can be improved.

[0012] The disclosed propulsion control device is a propulsion control device that controls a propulsion system having: a motor that drives the aircraft using power supplied from a power supply unit to propel it; a power conversion unit that has a conversion switch provided in a supply path that supplies power from the power supply unit to the motor and converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch that is provided in the supply path between the power supply unit and the power conversion unit and cuts off the supply path, and is equipped with: an abnormality determination unit that determines whether an abnormality has occurred with the motor; and an abnormality cut-off unit that, if an abnormality with the motor occurs, cuts off the supply path using at least one of the conversion switch and the power switch in a manner according to the state of the abnormality.

[0013] The propulsion control device described above can improve the safety of the flying object, similarly to the first propulsion system described above.

[0014] The disclosed propulsion control program is a propulsion control program that causes at least one processor to execute control of a propulsion system having: a motor that drives the aircraft using power supplied from a power supply unit to propel it; a power conversion unit that has a conversion switch provided in a supply path that supplies power from the power supply unit to the motor and converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch that is provided in the supply path between the power supply unit and the power conversion unit and cuts off the supply path, and that causes at least one processor to execute the following processes: a process that determines whether an abnormality has occurred with the motor; and a process that, if an abnormality has occurred with the motor, cuts off the supply path using at least one of the conversion switch and the power switch in a manner corresponding to the state of the abnormality.

[0015] According to the above propulsion control program, the safety of the flying object can be improved, similarly to the first propulsion system.

[0016] 10. A diagram showing the configuration of an eVTOL in a first embodiment. A block diagram showing the electrical configuration of a propulsion system. A diagram showing the circuit configuration of an inverter device. A diagram showing an electrical connection circuit between multiple EPUs and a battery. A flowchart showing the procedure for flight control processing. A flowchart showing the procedure for power supply shutdown processing. A flowchart showing the procedure for multiple abnormality processing. A flowchart showing the procedure for ground inspection processing. A flowchart showing the procedure for discharge inspection processing. A flowchart showing the procedure for power supply shutdown processing in a second embodiment. A flowchart showing the procedure for power supply shutdown processing in a third embodiment. A flowchart showing the procedure for power supply shutdown processing in a fourth embodiment. A flowchart showing the procedure for multiple abnormality processing in a fifth embodiment. A flowchart showing the procedure for multiple abnormality processing in a sixth embodiment. A diagram showing the circuit configuration of an inverter device in a seventh embodiment. A flowchart showing the procedure for flight control processing. A flowchart showing the procedure for multi-shutdown processing. A flowchart showing the procedure for AC shutdown processing. A flowchart showing the procedure for ground inspection processing. A flowchart showing the procedure for discharge inspection processing. A flowchart showing the procedure for AC shutdown processing in an eighth embodiment. A flowchart showing the procedure for AC shutdown processing in a ninth embodiment. A block diagram showing the electrical configuration of a propulsion system in a tenth embodiment. 13. A flowchart showing the procedure for flight control processing. A flowchart showing the procedure for multi-inverter processing. A flowchart showing the procedure for flight control processing in an eleventh embodiment. A flowchart showing the procedure for shut-off setting processing. A flowchart showing the procedure for shut-off setting processing in a twelfth embodiment. A flowchart showing the procedure for flight control processing in a thirteenth embodiment. A flowchart showing the procedure for short-circuit response processing. A diagram for explaining the flow of regenerative current. A flowchart showing the procedure for short-circuit response processing in a fourteenth embodiment. A block diagram showing the electrical configuration of a propulsion system in a fifteenth embodiment. A flowchart showing the procedure for flight control processing. A flowchart showing the procedure for propeller stop processing. A block diagram showing the electrical configuration of a propulsion system in a sixteenth embodiment. A flowchart showing the procedure for flight control processing. A flowchart showing the procedure for propeller rotation continuation processing. A block diagram showing the electrical configuration of a propulsion system in a seventeenth embodiment.FIG. 17 is a block diagram showing the electrical configuration of a propulsion system in a modified example 17-1.

[0017] Hereinafter, several embodiments for carrying out the present disclosure will be described with reference to the drawings. In each embodiment, parts corresponding to matters described in the preceding embodiment will be assigned the same reference numerals, and duplicate descriptions may be omitted. In each embodiment, when only a part of the configuration is described, other previously described embodiments may be applied to the other parts of the configuration. In addition to combinations of parts that are specifically specified as being combinable in each embodiment, it is also possible to partially combine embodiments even if not specified, as long as there is no particular problem with the combination.

[0018] First Embodiment The propulsion system 30 shown in FIG. 1 is mounted on an eVTOL 10. The eVTOL 10 is an electric vertical take-off and landing aircraft. An electric vertical take-off and landing aircraft is an electric vertical take-off and landing aircraft capable of vertical take-off and landing. eVTOL is an abbreviation for electric Vertical Take-Off and Landing aircraft. The eVTOL 10 is an electric air vehicle that flies in the atmosphere and is sometimes referred to as an electric air vehicle. The eVTOL 10 is also an electric aircraft and is sometimes referred to as an electric aircraft. The eVTOL 10 is a manned air vehicle that carries a crew member. The crew member of the eVTOL 10 includes a pilot who operates or drives the vehicle. The propulsion system 30 is a system that drives the eVTOL 10 to propel it. The propulsion system 30 is sometimes referred to as a flight system.

[0019] The eVTOL 10 has an airframe 11 and a propeller 20. The airframe 11 has an airframe main body 12 and wings 13. The airframe main body 12 is the fuselage of the airframe 11 and has a shape that extends, for example, from front to back. The airframe main body 12 has a crew cabin 14 for crew members to ride in. The wings 13 extend from the airframe main body 12 and multiple wings 13 are provided on the airframe main body 12. The wings 13 are fixed wings. The multiple wings 13 include main wings, a tail, and the like.

[0020] The eVTOL 10 has a cabin. The cabin is provided inside the eVTOL 10. For example, the cabin is the internal space of the aircraft body 12 and is formed by the aircraft body 12. The cabin can be a crew cabin 14 or a cargo bay. The crew cabin 14 can be a passenger cabin or a pilot cabin. The crew cabin 14 is provided with seats for crew members to sit in. The crew cabin 14 does not have to be occupied by crew members, and may instead house cargo.

[0021] A plurality of propellers 20 are provided on the airframe 11. The eVTOL 10 is a multicopter having at least three propellers 20. For example, at least six propellers 20 are provided on the airframe 11. The propellers 20 are provided on each of the airframe body 12 and the wings 13. The propellers 20 rotate around a propeller axis. The propeller axis is, for example, the center line of the propeller 20. The propellers 20 can generate thrust and lift for the eVTOL 10. The propellers 20 are sometimes referred to as rotors or rotating blades.

[0022] The eVTOL 10 has multiple propellers 20, which makes it easier to maintain aircraft balance. Even if the propeller output of one propeller 20 unintentionally decreases, the eVTOL 10 can continue flight using the remaining propellers 20. Propeller output includes the rotation speed and torque of the propellers 20.

[0023] The propeller 20 has blades, a boss, and a propeller shaft. A plurality of blades are arranged in the circumferential direction of the propeller axis. The boss connects the plurality of blades. The propeller shaft is the rotation axis of the propeller 20 and extends from the boss along the propeller axis.

[0024] Flight modes of the eVTOL 10 include vertical takeoff, vertical landing, cruise, hovering, etc. Flight modes are sometimes referred to as flight modes. In vertical takeoff, the eVTOL 10 can take off without running. In vertical takeoff, the eVTOL 10 may ascend vertically or may ascend diagonally upward. In vertical landing, the eVTOL 10 can land without running. In vertical landing, the eVTOL 10 may descend vertically or may descend diagonally downward.

[0025] Cruising is sometimes referred to as level flight. In cruising, the eVTOL 10 may fly horizontally without moving vertically, or may fly horizontally while moving vertically. Hovering is sometimes referred to as stationary flight. In hovering, the eVTOL 10 may fly as if stationary at a predetermined position in the air, or the eVTOL 10 may deviate vertically or horizontally from the predetermined position.

[0026] The flight modes of the eVTOL 10 also include lift. In lift, the eVTOL 10 moves up and down. As a lift, the eVTOL 10 may ascend diagonally upward or descend diagonally downward. The eVTOL 10 takes off vertically by lifting upward. The eVTOL 10 lands vertically by lifting downward.

[0027] The eVTOL 10 is a tilt rotor aircraft. The eVTOL 10 has an adjustable tilt angle for the propeller 20. The eVTOL 10 can have one propeller 20 function as both a lift propeller and a cruise propeller. For example, when the eVTOL 10 lifts, the tilt angle is adjusted so that the propeller 20 functions as a lift rotor. When the eVTOL 10 cruises, the tilt angle is adjusted so that the propeller 20 functions as a cruise rotor. Note that the eVTOL 10 does not have to be a tilt rotor aircraft. For example, the eVTOL 10 may have separate propellers 20 for lift and cruise.

[0028] The eVTOL 10 has a battery 31, a distributor 32, a communication unit 34, a flight control device 40, and an EPU 50. The battery 31, distributor 32, communication unit 34, flight control device 40, and EPU 50 are included in a propulsion system 30. Note that the propulsion system 30 only needs to include at least the flight control device 40 and the EPU 50. The flight control device 40 is sometimes referred to as a flight controller.

[0029] The battery 31 is electrically connected to the EPU 50. The battery 31 is a power supply unit that supplies power to the EPU 50 and corresponds to a power supply unit. The battery 31 is a DC voltage source that applies a DC voltage to the EPU 50. The battery 31 has a rechargeable secondary battery. Examples of such secondary batteries include a lithium ion battery and a nickel-metal hydride battery. The battery 31 is capable of storing power and corresponds to a power storage device. Note that a fuel cell, a generator, or the like may be used as the power supply unit in addition to or instead of the battery 31.

[0030] The distributor 32 is electrically connected to the battery 31 and the plurality of EPUs 50. The distributor 32 distributes power from the battery 31 to the plurality of EPUs 50. The battery 31 is electrically connected to the plurality of EPUs 50 via the distributor 32. The battery 31 supplies power to the EPUs 50 via the distributor 32.

[0031] The communication unit 34 is a communication device capable of wireless communication with an external device. The external device is a device located away from the eVTOL 10. Examples of external devices include communication devices installed in external facilities on the ground and communication devices installed in other flying vehicles. Examples of external facilities include a control center and a management center. The communication unit 34 is capable of communication with the flight control device 40. The communication unit 34 is connected to the flight control device 40 so that it can communicate via wired communication. Note that the communication unit 34 may also be capable of wireless communication with the flight control device 40.

[0032] 1 and 2 , the EPU 50 is a device that drives the propeller 20 to rotate, and corresponds to a drive device. EPU is an abbreviation for Electric Propulsion Unit. The EPU 50 is sometimes referred to as an electric drive device or an electric drive system. An EPU 50 is provided for each of the multiple propellers 20. The EPUs 50 are arranged on the propellers 20 along the propeller axis. All of the multiple EPUs 50 are fixed to the airframe 11. The EPUs 50 support the propellers 20 so that they can rotate. The EPUs 50 are connected to the propellers 20. The propellers 20 are fixed to the airframe 11 via the EPUs 50.

[0033] As shown in FIG. 2 , the eVTOL 10 has a propulsion device 100. The propulsion device 100 is formed to include a propeller 20 and an EPU 50. The propulsion device 100 is a device for propelling the eVTOL 10. The propulsion device 100 causes the eVTOL 10 to fly by rotating the propeller 20. The eVTOL 10 is also a moving body that moves using the propulsion device 100. A plurality of propulsion devices 100 are provided in the eVTOL 10. One propulsion device 100 includes one propeller 20 and one EPU 50 for driving the propeller 20. Note that only the EPU 50 of the propeller 20 and the EPU 50 may be referred to as the propulsion device 100.

[0034] The EPU 50 has a motor device 60 and an inverter device 80. The motor device 60 has a motor 61 and a motor housing 70. The motor housing 70 is a housing and houses the motor 61. The motor 61 is a multi-phase AC motor. The motor 61 is a multi-phase AC rotating electric machine. The motor 61 is the flight drive source for the eVTOL 10 and functions as an electric motor. The motor 61 is a motor generator. The motor 61 functions as a generator during regeneration. For example, a brushless motor is used as the motor 61.

[0035] The motor 61 drives and rotates the propeller 20, enabling the eVTOL 10 to fly. The motor 61 is a flight motor for flying the eVTOL 10. The motor 61 drives and rotates the propeller 20 by being powered by battery power. The battery power is power supplied to the motor 61 from the battery 31. In this embodiment, the powering of the motor 61 may be simply referred to as driving the motor 61. The motor 61 generates regenerative power by, for example, rotating the propeller 20 due to an external force such as flight wind. The regenerative power is power generated by regeneration of the motor 61.

[0036] The motor 61 has a motor stator 62 and a motor rotor 63. The motor 61 has the motor stator 62. The motor stator 62 is a stator and is fixed to a motor housing 70. The motor rotor 63 rotates relative to the motor stator 62. The rotation of the motor rotor 63 is sometimes referred to as the rotation of the motor 61. The motor 61 is, for example, an axial gap motor. In the motor 61, the motor stator 62 and the motor rotor 63 are aligned in the axial direction of the motor 61. The motor 61 has a motor shaft that rotates together with the motor rotor 63. The motor shaft is rotatably supported by the motor housing 70 or the like.

[0037] The motor 61 is driven by power being supplied to the motor stator 62. The motor stator 62 has a stator coil 62a and a coil neutral point 62b. The stator coil 62a is a coil provided for each of the multiple phases. The stator coil 62a forms an armature. The coil neutral point 62b is the neutral point of the stator coils 62a of the multiple phases. The coil neutral point 62b connects the stator coils 62a of the multiple phases. When power is supplied to the motor stator 62, a current flows through the stator coil 62a, causing the motor rotor 63 to rotate. Driving the motor 61 to rotate the motor rotor 63 is sometimes referred to as rotational driving of the motor 61.

[0038] The inverter device 80 drives the motor device 60 by supplying power to the motor device 60. The inverter device 80 is a drive unit for driving the motor 61 and corresponds to a motor drive unit. The inverter device 80 has an inverter circuit 85 and an inverter housing 90. The inverter circuit 85 converts the power supplied from the battery 31 to the motor 61. The inverter circuit 85 is supplied with DC power from the battery 31. The inverter circuit 85 converts the DC power to AC power and supplies the AC power to the motor 61. The inverter circuit 85 is sometimes referred to as an inverter or a power conversion unit. The inverter circuit 85 performs power conversion for each of the multiple phases. The motor 61 is driven in accordance with the voltage and current supplied from the inverter circuit 85. The inverter housing 90 is a housing that houses the inverter circuit 85 and an inverter control unit 81, which will be described later.

[0039] The inverter device 80 has an inverter control unit 81. The inverter control unit 81 performs motor control via an inverter circuit 85. The motor control is control for driving the motor 61. The inverter control unit 81 also performs propulsion control. The propulsion control is control for driving the propulsion device 100. The propulsion control includes motor control. The propulsion control is also control for controlling the EPU 50, and is sometimes referred to as EPU control.

[0040] The inverter control unit 81 has, for example, an ECU. ECU is an abbreviation for Electronic Control Unit. The inverter control unit 81 has a processor 82, a memory 83, and a program 84. The inverter control unit 81 is mainly configured with a computer. This computer has the processor 82, memory 83, an input / output interface, a bus connecting these, etc. The memory 83 stores the program 84. The program 84 is a program for performing propulsion control. The program 84 corresponds to a propulsion control program.

[0041] The processor 82 is hardware for arithmetic processing coupled to the memory 83. The processor 82 executes various processes by accessing the memory 83. The memory 83 is a storage medium that stores a control program and the like. For example, the memory 83 is a non-transitory tangible storage medium that non-temporarily stores computer-readable programs and data. The non-transitory tangible storage medium is a non-transitory tangible storage medium, and is realized by a semiconductor memory, a magnetic disk, or the like. The program 84 includes computer-readable instructions that cause the processor 82 to execute various functions. The processor 82 is a processing unit that executes predetermined processes by executing the instructions included in the program 84.

[0042] The inverter control unit 81 controls the motor according to the required output. The required output is the motor output required of the inverter control unit 81. The required output includes, for example, the required torque required for the output torque. The required output is included in a command signal output by the flight control device 40 to the inverter control unit 81. The inverter control unit 81 adjusts the motor output according to the required output. The required output and required torque are sometimes referred to as target output and target torque. Note that torque, current, voltage, motor rotation speed, etc. may also be used as the motor output.

[0043] The inverter control unit 81 controls the motor using command signals from the flight control device 40 and detection signals from various sensors. The various sensors are communicatively connected to the inverter control unit 81. The various sensors include a motor sensor, a battery sensor, and an inverter sensor. The motor sensor is a temperature sensor or the like provided in the motor device 60. The battery sensor is a temperature sensor or the like provided in the battery 31. The inverter sensor is a temperature sensor or the like provided in the inverter device 80.

[0044] The flight control device 40 is communicatively connected to the inverter control unit 81. The flight control device 40 and the inverter control unit 81 may be capable of wireless communication. The flight control device 40 performs overall control to coordinate the drive of the multiple propulsion devices 100. The overall control coordinates the propulsion controls performed by each of the multiple inverter control units 81. The flight control device 40 performs flight control. Flight control is control for flying the eVTOL 10. As flight control, the flight control device 40 controls the propulsion system 30 and the EPU 50. Flight control is also control for propelling the eVTOL 10, and is sometimes referred to as propulsion control. The flight control device 40 corresponds to a propulsion control device.

[0045] The flight control device 40 has, for example, an ECU. The flight control device 40 has a processor 42, a memory 43, and a program 44. The flight control device 40 is mainly composed of a computer. This computer has the processor 42, the memory 43, an input / output interface, a bus connecting these, etc. The memory 43 stores the program 44. The program 44 is a program for performing flight control.

[0046] The processor 42 is hardware for arithmetic processing coupled to the memory 43. The processor 42 executes various processes by accessing the memory 43. The memory 43 is a storage medium that stores a control program and the like. For example, the memory 43 is a non-transient tangible storage medium that non-temporarily stores computer-readable programs and data. The program 44 includes computer-readable instructions that cause the processor 42 to execute various functions. The processor 42 is a processing unit that executes predetermined processes by executing the instructions included in the program 44.

[0047] The flight control device 40 outputs information necessary for propulsion control to the inverter control unit 81. The flight control device 40 is a host ECU for the inverter control unit 81. The flight control device 40 individually controls the multiple propulsion devices 100 according to the flight mode of the eVTOL 10, etc. The flight control device 40 can individually adjust the output of the propulsion devices 100 for each propulsion device 100. For example, the flight control device 40 outputs a required output to each of the multiple propulsion devices 100. The required output is the output required of the propulsion device 100. An example of the required output is the required torque required of the motor 61. Note that torque, current, voltage, motor rotation speed, etc. may also be used as the required output.

[0048] The flight control device 40 performs flight control in accordance with the flight state of the eVTOL 10 and detection signals from various sensors. The flight state of the eVTOL 10 includes the flight mode and the flight attitude of the eVTOL 10. The various sensors are connected to the flight control device 40 so as to be able to communicate with each other.

[0049] 2, the motor device 60 is shown as MOT, the motor stator 62 as STA, and the motor rotor 63 as ROT. The inverter device 80 is shown as MCU, the inverter circuit 85 as INV, the power switch 86 as MC, and the inverter control unit 81 as ICD. The processor 82 is shown as PRO, the memory 83 as MEM, and the program 84 as PG. The flight control device 40 is shown as FCD, the processor 42 as PRO, the memory 43 as MEM, and the program 44 as PG.

[0050] 3 , the propulsion system 30 has a P line 111, an N line 112, and an output line 113. The P line 111 and the N line 112 electrically connect the battery 31 and the inverter circuit 85. The P line 111 and the N line 112 are formed by bus bars, electrical wiring, etc. At least a portion of the P line 111 and at least a portion of the N line 112 are included in the propulsion device 100.

[0051] The P line 111 is electrically connected to the positive electrode of the battery 31. The N line 112 is electrically connected to the negative electrode of the battery 31. In the battery 31, the positive electrode is the high-potential electrode, and the negative electrode is the low-potential electrode. The P line 111 and the N line 112 are power lines for supplying power from the battery 31 to the inverter circuit 85. The P line 111 is a high-potential power line and may be referred to as a high-potential line. The N line 112 is a low-potential power line and may be referred to as a low-potential line.

[0052] The output line 113 is a power line for supplying power from the inverter circuit 85 to the motor 61. The output line 113 electrically connects the motor 61 and the inverter circuit 85. For example, the output line 113 is electrically connected to the motor stator 62. The output line 113 is formed by a bus bar, electrical wiring, or the like. At least a portion of the output line 113 is included in the propulsion device 100.

[0053] The inverter device 80 has a smoothing capacitor 114. The smoothing capacitor 114 is a capacitor that smoothes the DC voltage supplied from the battery 31. The smoothing capacitor 114 is connected to the P line 111 and the N line 112 between the battery 31 and the inverter circuit 85. The smoothing capacitor 114 is connected in parallel to the inverter circuit 85.

[0054] The inverter device 80 has a filter circuit such as an EMI filter. The filter circuit is provided between the smoothing capacitor 114 and the battery 31. The filter circuit reduces noise such as electromagnetic noise. The filter circuit is connected in parallel with the inverter circuit 85 and the battery 31.

[0055] The inverter circuit 85 is a power conversion circuit, for example, a DC-AC conversion circuit. The inverter circuit 85 has upper and lower arm circuits 115 for multiple phases. For example, the inverter circuit 85 has an upper and lower arm circuit 115 for each of the U phase, V phase, and W phase. The upper and lower arm circuits 115 have an upper arm switch 116 and a lower arm switch 117. The arm switches 116 and 117 are connected in series to the battery 31. The upper arm switch 116 is electrically connected to the P line 111. The lower arm switch 117 is electrically connected to the N line 112.

[0056] The arm switches 116 and 117 are formed of semiconductor switches or the like. A semiconductor switch is a switch that does not have mechanical contacts. The arm switches 116 and 117 are transistors such as MOSFETs and IGBTs. MOSFET is an abbreviation for Metal-Oxide-Semiconductor Field-Effect Transistor. IGBT is an abbreviation for Insulated Gate Bipolar Transistor. The arm switches 116 and 117 are switch elements that can convert power by switching. The switch elements are semiconductor elements such as power elements. The arm switches 116 and 117 are conversion switches for converting power. The arm switches 116 and 117 can be transitioned between a conducting state in which current can be passed and a blocking state in which current is blocked.

[0057] The upper and lower arm circuit 115 has an upper arm diode 116a and a lower arm diode 117a. The arm diodes 116a and 117a are reflux diodes and are connected in anti-parallel to the arm switches 116 and 117. The arm diodes 116a and 117a may be parasitic diodes of the arm switches 116 and 117, or may be diodes provided separately from the parasitic diodes. The upper arm diode 116a is connected in anti-parallel to the upper arm switch 116. The lower arm diode 117a is connected in anti-parallel to the lower arm switch 117.

[0058] The output line 113 is electrically connected to the upper and lower arm circuits 115 for each of the multiple phases. The output line 113 is connected between an upper arm switch 116 and a lower arm switch 117. A plurality of the output lines 113 are connected to the motor 61.

[0059] The inverter control unit 81 is formed by a control circuit and the like. The control circuit is provided on a control substrate. The control substrate is sometimes referred to as a control board. The inverter device 80 has a drive circuit (not shown). The drive circuit drives the arm switches 116 and 117 in response to a command signal from the inverter control unit 81. For example, the drive circuit can apply a drive voltage to the gate terminals of the arm switches 116 and 117. The drive circuit is sometimes referred to as a gate drive circuit. The drive circuit is provided on a drive substrate. The drive substrate is sometimes referred to as a drive board or a gate drive board.

[0060] The propulsion system 30 has a supply path 130. The supply path 130 is a path for supplying power from the battery 31 to the motor 61. The supply path 130 includes the battery 31, lines 111 to 113, an inverter circuit 85, and the motor 61. Power is supplied from the battery 31 to the motor 61 through the supply path 130. When the motor 61 is powered, a powering current flows through the supply path 130. The powering current is a current generated by battery power.

[0061] The supply path 130 has a power path 131 and a motor path 132. The power path 131 is a path for supplying power from the battery 31 to the inverter circuit 85. A DC current flows through the power path 131 as a power running current. The power path 131 includes the battery 31, a P line 111, and an N line 112. The motor path 132 is a path for supplying power from the inverter circuit 85 to the motor 61. An AC current flows through the motor path 132 as a power running current. The motor path 132 includes the inverter circuit 85, an output line 113, and the motor 61.

[0062] During regeneration of the motor 61, regenerative power may be supplied from the motor 61 to the battery 31 and the smoothing capacitor 114. When regenerative power is generated in the motor 61, a regenerative current flows through the supply path 130. The regenerative current is a current generated by the regenerative power. In the motor 61, a counter electromotive force is generated as the motor 61 regenerates, and this counter electromotive force generates a regenerative current. The regenerative current flows through the power supply path 131 and the motor path 132, similar to the power running current.

[0063] The propulsion system 30 has a power switch 86. The power switch 86 is a switch such as an SMR. SMR is an abbreviation for System Main Relay. The power switch 86 is formed by including a mechanical switch or a mechanical relay having mechanical contacts. The power switch 86 can be switched between an energized state and an interrupted state. The energized state of the power switch 86 is sometimes referred to as a closed state, and the interrupted state is sometimes referred to as an open state.

[0064] The power switch 86 is provided in the supply path 130 between the battery 31 and the inverter circuit 85. The power switch 86 is capable of interrupting the supply path 130. The power switch 86 is capable of interrupting the current flowing through the supply path 130. Currents that the power switch 86 can interrupt include power running current, regenerative current, and abnormal current (described later). The power switch 86 is provided in the power path 131. The power switch 86 is capable of interrupting the power path 131. The power switch 86 is capable of interrupting the current flowing through the power path 131. The power switch 86 is capable of interrupting DC current and is sometimes referred to as a DC switch. The power switch 86 is provided in at least one of the P line 111 and the N line 112 in the power path 131. For example, the power switch 86 is provided in each of the P line 111 and the N line 112.

[0065] Even when the power supply from the battery 31 to the motor 61 is cut off by the power switch 86, the power supply from the battery 31 to the flight control device 40 and the inverter control unit 81 continues. In this case, the flight control device 40 and the inverter control unit 81 can drive the inverter circuit 85 so that the arm switches 116 and 117 turn on and off. In other words, the flight control device 40 and the inverter control unit 81 can control the motor even when the power supply from the battery 31 to the motor 61 is cut off. In FIG. 2, the battery 31 is shown as BAT and the motor 61 as MOT.

[0066] As shown in FIG. 4 , a power switch 86 is provided individually for each of the multiple propulsion devices 100. The power switch 86 is included in the propulsion device 100. For example, the power switch 86 is provided in the inverter device 80. The eVTOL 10 is provided with multiple propulsion devices 100, and therefore multiple EPUs 50. The multiple EPUs 50 include a first EPU 501 to a sixth EPU 506. A power switch 86 is provided individually for each of the first EPU 501 to the sixth EPU 506. Note that the power switch 86 may be provided independently of the propulsion devices 100. For example, the power switch 86 may be provided in the battery 31 or the flight control device 40.

[0067] The propulsion system 30 has a common path 35 and branch paths 36. Both the common path 35 and the branch paths 36 are formed by at least a portion of the supply path 130. The common path 35 is a path shared by multiple propulsion devices 100. The common path 35 is a path shared by multiple EPUs 50. The common path 35 includes at least a battery 31. The branch path 36 is a path branching from the common path 35. The branch path 36 is connected to each of the multiple EPUs 50. The branch path 36 branches off from the supply path 130 between the battery 31 and the power switch 86. In the propulsion system 30, the common path 35 and the branch paths 36 connect the multiple EPUs 50 in parallel to the battery 31.

[0068] The power switch 86 is communicatively connected to the flight control device 40. The flight control device 40 controls the power switch 86. The power switch 86 has an actuator such as a solenoid. The flight control device 40 opens and closes the power switch 86 by driving the actuator, for example. The flight control device 40 can individually drive the power switch 86 for each of the multiple EPUs 50. The flight control device 40 controls the power switch 86 by outputting a command signal. The command signal from the flight control device 40 is input to the power switch 86 without passing through the inverter control unit 81. Note that the command signal from the flight control device 40 may also be input to the power switch 86 via the inverter control unit 81.

[0069] 3 , the propulsion device 100 has, as various sensors, a power supply current sensor 121, a motor current sensor 122, a power supply voltage sensor 125, and a motor voltage sensor 126. The current sensors 121, 122 and the voltage sensors 125, 126 are included in the propulsion system 30. For example, the current sensors 121, 122 and the voltage sensors 125, 126 are included in the inverter device 80. Note that the motor current sensor 122 and the motor voltage sensor 126 may also be included in the motor device 60.

[0070] The power supply current sensor 121 is provided in the supply path 130 between the battery 31 and the inverter circuit 85. For example, the power supply current sensor 121 is provided in the power supply path 131 between the battery 31 and the smoothing capacitor 114. The power supply current sensor 121 is provided in the P line 111. The power supply current sensor 121 detects the current flowing in the power supply path 131. The power supply current sensor 121 is capable of detecting a direct current. The power supply current sensor 121 is sometimes referred to as an HVDC current sensor. The power supply current sensor 121 may be provided in at least one of the P line 111 and the N line 112.

[0071] The motor current sensor 122 is provided on the supply path 130 between the inverter circuit 85 and the motor 61. For example, the motor current sensor 122 is provided on the motor path 132 between the inverter circuit 85 and the motor 61. The motor current sensor 122 is provided on each of the multi-phase output lines 113. The motor current sensor 122 detects the current flowing through the motor path 132. The motor current sensor 122 is capable of detecting AC current. The motor current sensor 122 may be provided on at least one of the multi-phase output lines 113.

[0072] The power supply voltage sensor 125 detects the power supply voltage. The power supply voltage is the voltage applied to the inverter circuit 85. The power supply voltage is the voltage input to the inverter circuit 85. The power supply voltage sensor 125 outputs a detection signal corresponding to the power supply voltage. The power supply voltage sensor 125 is provided in the power supply path 131 between the power switch 86 and the inverter circuit 85. The power supply voltage sensor 125 detects the potential difference between the P line 111 and the N line 112 as the power supply voltage. The power supply voltage sensor 125 can detect DC voltage. The power supply voltage sensor 125 is sometimes referred to as an HVDC voltage sensor.

[0073] The motor voltage sensor 126 detects the motor voltage. The motor voltage is the voltage applied to the motor 61. The motor voltage is the voltage output from the inverter circuit 85 and is sometimes referred to as the output voltage. The motor voltage sensor 126 outputs a detection signal corresponding to the motor voltage. The motor voltage sensor 126 is provided in the motor path 132 between the motor current sensor 122 and the motor 61. For example, the motor voltage is the voltage applied to the stator coil 62a. The motor voltage sensor 126 detects the inter-phase voltage of multiple phases as the motor voltage. The motor voltage sensor 126 detects the inter-phase voltage for all pairs of two phases. The motor voltage sensor 126 is capable of detecting AC voltage. Note that the motor voltage sensor 126 may detect the inter-phase voltage for at least one pair.

[0074] The propulsion system 30 has a battery voltage sensor 31a as one of various sensors. The battery voltage sensor 31a detects the battery voltage. The battery voltage is the voltage output by the battery 31. The battery voltage sensor 31a is provided in the battery 31. The battery voltage sensor 31a outputs a detection signal corresponding to the battery voltage. The battery voltage sensor 31a can detect DC voltage. The battery voltage sensor 31a is sometimes referred to as an HVDC voltage sensor.

[0075] The current sensors 121, 122 and the voltage sensors 31a, 125 output detection signals to the flight control device 40. The detection signals of the current sensors 121, 122 and the voltage sensors 31a, 125 may be input to the flight control device 40 via the inverter control unit 81, or may be input to the flight control device 40 without passing through the inverter control unit 81. For example, the detection signal of the battery voltage sensor 31a is input to the flight control device 40 without passing through the inverter control unit 81. The detection signals of the current sensors 121, 122 and the motor voltage sensor 126 are input to the flight control device 40 via the inverter control unit 81. In FIG. 3, the battery voltage sensor 31a and the motor voltage sensor 126 are illustrated as VS.

[0076] The flight control device 40 performs flight control processing, which will be described with reference to the flowchart in Figure 5. The flight control device 40 repeatedly executes the flight control processing at a predetermined control period.

[0077] The flight control device 40 acquires eVTOL information in step S101 shown in Figure 5. The eVTOL information is information that indicates the status of the eVTOL 10. Examples of eVTOL information include information that indicates the flight status of the eVTOL 10 and information that indicates the status of the propulsion device 100. Information that indicates the status of the propulsion device 100 includes the open / closed state of the power switch 86, the drive status of the motor 61, the drive status of the inverter circuit 85, and detection results of various sensors. Examples of eVTOL information include information input to the flight control device 40 from an external device via the communication unit 34.

[0078] In step S102, the flight control device 40 determines whether the eVTOL 10 is in flight. This determination is made using eVTOL information. If the eVTOL 10 is in flight, the flight control device 40 proceeds to step S103. In step S103, the flight control device 40 determines whether an EPU abnormality has occurred. This determination is made using eVTOL information such as sensor values. An EPU abnormality is an abnormality in the EPU 50. Examples of EPU abnormalities include an abnormality in the motor device 60 and an abnormality in the inverter device 80. The function of the flight control device 40 that executes the processing of step S103 corresponds to the abnormality determination unit.

[0079] For example, the flight control device 40 uses sensor values ​​as eVTOL information to determine whether or not an EPU abnormality exists. The sensor values ​​are the detection results of various sensors, such as the current sensors 121 and 122 and the voltage sensors 125 and 126. The sensor values ​​are sometimes referred to as sensor outputs. The flight control device 40 determines whether the sensor value for each of the multiple propulsion devices 100 is within a normal range. The flight control device 40 then determines that an EPU abnormality has occurred for any propulsion device 100 whose sensor value is outside the normal range. If a sensor value is outside the normal range, the flight control device 40 determines that the sensor value is an abnormal value.

[0080] If an EPU abnormality occurs, the flight control device 40 proceeds to step S104. In step S104, the flight control device 40 identifies the EPU abnormality state. The flight control device 40 estimates the EPU abnormality state using eVTOL information such as the detection signals from the current sensors 121 and 122 and the voltage sensors 31a, 125, and 126. The EPU abnormality state includes the type of abnormality and the level of the abnormality. The flight control device 40 also estimates which of the multiple EPUs 50 is the abnormal EPU. The abnormal EPU is the EPU 50 in which the EPU abnormality occurred.

[0081] The flight control device 40 also determines whether the EPU abnormality is an abnormality related to the motor 61. Abnormalities related to the motor 61 include abnormalities related to the structure of the motor device 60, such as the shape, abnormalities related to the supply path 130, abnormalities related to the inverter control unit 81, abnormalities related to the propulsion system 30, and the like.

[0082] If an abnormality occurs in the motor 61, an abnormal current may flow in the supply path 130. For example, if an abnormality in the motor 61 occurs, such as a short circuit or a ground fault in the supply path 130, an abnormal current will flow in the supply path 130. An example of an abnormal current is an overcurrent that flows in the supply path 130 due to a short circuit or a ground fault in the supply path 130. Examples of short circuits in the supply path 130 include a short circuit that occurs in the power supply path 131 and a short circuit that occurs in the motor path 132. Examples of short circuits in the power supply path 131 include a short circuit that occurs in the battery 31, a short circuit that occurs in the smoothing capacitor 114, a short circuit that occurs between the P line 111 and the N line 112, etc.

[0083] A short circuit in the motor path 132 may occur in the arm switches 116 and 117. When a short circuit occurs in the arm switches 116 and 117, a short circuit may occur between the P line 111 or N line 112 and the output line 113. For example, the P line 111 and the N line 112 may be short-circuited via the output line 113.

[0084] Furthermore, examples of short circuits in the motor path 132 include a short circuit that occurs between at least two output lines 113 and a short circuit that occurs in the motor 61. Examples of short circuits in the motor 61 include a short circuit that occurs in the stator coil 62a of one phase and a short circuit that occurs between the stator coils 62a of multiple phases. Examples of short circuits that occur in the stator coil 62a of one phase include a short circuit that occurs between at least two winding portions. In the motor 61, multiple winding portions are stacked by winding the coil wire.

[0085] Short circuits that occur in the supply path 130 include dead shorts and slight shorts. In the supply path 130, dead shorts occur when path forming parts such as bus bars with different potentials come into contact with each other. For example, a dead short occurs when a high-potential path and a low-potential path in the supply path 130 are short-circuited. Dead shorts include a dead short that occurs in the power supply path 131 and a dead short that occurs in the motor path 132.

[0086] Dead shorts in the power supply path 131 include a dead short that occurs in the battery 31, a dead short that occurs due to a short in the smoothing capacitor 114 or the filter circuit, and a dead short that occurs between the P line 111 and the N line 112. Dead shorts in the motor path 132 include a dead short that occurs due to a short in the arm switches 116 and 117, a dead short that occurs between at least two output lines 113, and a dead short that occurs in the motor 61. In the motor 61, a dead short may occur when the stator coils 62a between multiple phases come into contact with each other.

[0087] A dead short caused by battery 31 is detected by battery voltage sensor 31a, power supply voltage sensor 125, etc. as a voltage drop of battery 31. A dead short between P line 111 and N line 112 caused by smoothing capacitor 114 or arm switches 116 and 117 is detected by power supply current sensor 121, etc. as an overcurrent in P line 111 or N line 112.

[0088] A dead short circuit caused by at least two output lines 113 is detected by the power supply current sensor 121, the drive circuit, etc. as an overcurrent in the power supply path 131. In particular, a dead short circuit that occurs between the motor current sensor 122 and the motor 61 in the output line 113 is detected by the motor current sensor 122, etc. as an overcurrent in the output line 113.

[0089] In the motor 61, a slight short circuit may occur when a portion of the stator coil 62a is short-circuited. For example, in the stator coil 62a formed by winding twisted wire, a slight short circuit may occur when a portion of the twisted wire is short-circuited. Dead shorts and slight shorts in the motor 61 are detected by the inverter control unit 81 or the like. For example, the inverter control unit 81 detects the torque, rotation speed, and deviation of the motor 61 to detect a short circuit in the motor 61. The inverter control unit 81 also detects a phase deviation of the phase current of the motor 61 to detect a short circuit in the motor 61.

[0090] A ground fault in the supply path 130 may occur when the power path 131 is grounded via the inverter housing 90 or the like, or when the motor path 132 is grounded via the motor housing 70 or the like. An example of a ground fault in the motor path 132 is a ground fault that occurs in the motor 61. An example of a ground fault in the motor 61 is when the stator coil 62a is grounded via the motor housing 70 or the like.

[0091] Abnormalities related to the inverter control unit 81 include abnormalities in the control board and abnormalities in the drive board. Abnormalities in the control board include a short circuit in the output circuit that outputs a signal from the control circuit to the drive circuit. Abnormalities in the drive board include a short circuit in the input circuit that inputs a signal from the control circuit to the drive circuit.

[0092] In step S105, the flight control device 40 determines whether there is one abnormal EPU. In other words, the flight control device 40 determines whether there are multiple abnormal EPUs.

[0093] If there is only one abnormal EPU, the flight control device 40 performs multi-shutdown processing in steps S106 to S109. In multi-shutdown processing, the supply path 130 is shut off at multiple locations. For example, in multi-shutdown processing, the supply path 130 is shut off by multiple switches, namely the power switch 86 and the arm switches 116 and 117. The flight control device 40 shuts off the supply path 130 by at least one of the power switch 86 and the arm switches 116 and 117. The function of the flight control device 40 that executes the processing of steps S106 to S109 corresponds to the abnormality shutoff unit.

[0094] The flight control device 40 executes inverter shutdown processing in step S106 of the multi-shutdown processing. The inverter shutdown processing involves processing to reduce the abnormal current flowing through the supply path 130. For example, the inverter shutdown processing involves processing to shut off the abnormal current using the inverter circuit 85. The flight control device 40 shuts off the abnormal current by switching the inverter circuit 85 to a shutdown state. The shutdown state of the inverter circuit 85 is a state in which the arm switches 116 and 117 shut off the abnormal current for all of the multiple phases. For example, in the shutdown state of the inverter circuit 85, both the upper arm switch 116 and the lower arm switch 117 are in a shutdown state for all of the multiple phases. The inverter circuit 85 may also be switched to a reduced state. The reduced state of the inverter circuit 85 is a state for reducing the abnormal current. One of the reduced states of the inverter circuit 85 is the shutdown state. The function of the flight control device 40 that executes the processing of step S106 corresponds to a current reduction unit.

[0095] In step S107, the flight control device 40 determines whether a power cutoff request has been made. Cutting off the power means cutting off the power supply path 131 using the power switch 86. The flight control device 40 determines that a power cutoff request has been made when a power cutoff is necessary. For example, when it is necessary for the motor 61 to generate regenerative power, the flight control device 40 determines that a power cutoff request has not been made. On the other hand, when it is not necessary for the motor 61 to generate regenerative power, the flight control device 40 determines that a power cutoff request has been made. In the motor 61, regenerative braking occurs, which reduces the rotational force of the motor 61 and the propeller 20, as the regenerative power is stored in the smoothing capacitor 114 or the battery 31.

[0096] If a power cutoff request is received, the flight control device 40 proceeds to step S108. The flight control device 40 performs power cutoff processing in step S108. The power cutoff processing involves processing to shut down the power supply. By performing power cutoff processing after inverter cutoff processing, the flight control device 40 cuts off the abnormal current with the power switch 86 after the inverter circuit 85 starts reducing the abnormal current. The function of the flight control device 40 that executes the processing of step S108 corresponds to the power cutoff unit.

[0097] The power supply cutoff process will be described with reference to the flowchart in Figure 6. In step S201 shown in Figure 6, the flight control device 40 determines whether the power supply current Idc is equal to or less than the power supply current threshold TIdc. The power supply current Idc is an abnormal current that flows through the power supply path 131. The flight control device 40 calculates the power supply current Idc using the detection result of the power supply current sensor 121. The power supply current threshold TIdc is a value determined in advance through testing or the like, and is stored in the memory 43 or the like. The power supply current threshold TIdc is set to a current value that allows the power switch 86 to cut off. For example, the power supply current threshold TIdc is set to a value corresponding to the rated current of the power supply switch 86.

[0098] If the inverter shutdown process reduces the power supply current Idc to the power supply current threshold value TIdc, the flight control device 40 proceeds to step S203. In step S203, the flight control device 40 performs power shutdown execution processing. In the power shutdown execution processing, the power switch 86 is switched to the shutdown state. After the power supply current Idc has been reduced by the inverter shutdown process, the flight control device 40 shuts off the power supply current Idc using the power switch 86. The function of the flight control device 40 that executes the processing of step S203 corresponds to the power supply reduction shutdown unit.

[0099] For example, consider a comparative example in which, unlike the present embodiment, the flight control device 40 performs a power shutdown execution process without performing an inverter shutdown process. In this comparative example, a situation may easily occur in which the power switch 86 shuts off the power supply current Idc when the power supply current Idc, which is an abnormality current, is greater than the power supply current threshold TIdc. In this situation, even if the power switch 86 is switched to the shutdown state, there is a concern that the power supply current Idc may not be shut off due to an arc discharge occurring in the power switch 86. Furthermore, there is a concern that a malfunction or malfunction of the power switch 86 may occur due to an arc discharge occurring in the power switch 86. In contrast, in the present embodiment, the power supply current Idc is reduced to the power supply current threshold TIdc, making it easier for the power switch 86 to shut off the power supply current Idc, and making it less likely for a malfunction or malfunction of the power switch 86 to occur.

[0100] If the power supply current Idc is not equal to or less than the power supply current threshold T1dc, the flight control device 40 proceeds to step S202. In step S202, the flight control device 40 determines whether the inverter time Tinv has reached the inverter time threshold TTinv. The inverter time Tinv is the elapsed time since the inverter shutdown process started reducing the power supply current Idc.

[0101] When inverter shutdown processing is performed, a surge voltage is likely to occur in the power supply path 131 due to the inverter circuit 85 shutting down the current during an abnormality. Examples of surge voltages include load dump. The inverter time Tinv is the time required to wait until this surge voltage decreases. The inverter time threshold value TTinv is a value determined in advance by testing or the like, and is stored in the memory 43 or the like. The inverter time threshold value TTinv is set according to the time required for the surge voltage generated by the inverter shutdown processing to decrease.

[0102] When the inverter time Tinv reaches the inverter time threshold TTinv, the flight control device 40 proceeds to step S203 and performs power cutoff execution processing. When the inverter time Tinv reaches the inverter time threshold TTinv, the flight control device 40 cuts off the power supply current Idc using the power switch 86. The function of the flight control device 40 that executes the processing of step S203 corresponds to the power supply elapsed cutoff unit.

[0103] For example, consider a comparative example in which, unlike the present embodiment, the flight control device 40 performs a power shutdown execution process without waiting after the inverter shutdown process. In this comparative example, a situation is likely to occur in which the power switch 86 shuts off the abnormal current when a large surge voltage is generated due to the inverter circuit 85 shutting off the abnormal current. In this situation, there is a concern that an abnormality will occur in the inverter circuit 85 or the power switch 86 when the power switch 86 is switched to the shutdown state. For example, there is a concern that the inverter circuit 85 will have an abnormality in the arm switches 116 and 117 due to damage from the surge voltage. There is a concern that the power switch 86 will be damaged by the surge voltage. In contrast, in the present embodiment, the power switch 86 shuts off the abnormal current when the surge voltage has been reduced, making it less likely that an abnormality will occur in the inverter circuit 85 or the power switch 86 due to the surge voltage.

[0104] Returning to FIG. 5 , after the power shutdown process, the flight control device 40 proceeds to step S109. In step S109, the flight control device 40 performs a motor discharge process. In the motor discharge process, a process is performed to release the residual power in the smoothing capacitor 114 to the motor 61. In the smoothing capacitor 114, the residual charge flows to the motor 61 as a discharge current, thereby discharging the residual power at the motor 61. The flight control device 40 drives the inverter circuit 85 so that the discharge current flows to the motor 61. In the motor discharge process, the residual power remaining in the supply path 130 is discharged by the motor 61.

[0105] The flight control device 40 does not necessarily have to perform the motor discharge process. For example, the flight control device 40 determines whether to perform the motor discharge process. This determination is based on where in the supply path 130 the abnormality occurs. For example, if an abnormality such as a short circuit occurs in a portion of the supply path 130 through which a discharge current flows, the flight control device 40 determines not to perform the motor discharge process. Examples of portions through which a discharge current flows include the arm switches 116 and 117 and the stator coil 62a. If a short circuit occurs in the arm switches 116 and 117 or the stator coil 62a, and a discharge current flows through the arm switches 116 and 117 or the stator coil 62a, there is a concern that the discharge current may cause an EPU abnormality to spread or progress. In contrast, if a short circuit occurs in the arm switches 116 and 117 or the stator coil 62a, the flight control device 40 may not perform the motor discharge process, thereby suppressing the spread or progression of the EPU abnormality due to the discharge current.

[0106] The flight control device 40 performs an abnormality notification process in step S110. The abnormality notification process is a process for notifying the pilot, external facilities, etc. that an EPU abnormality has occurred. The abnormality notification process, which is performed after steps S106 to S109, notifies the pilot that there is one abnormal EPU, that multi-shutdown processing has been performed on the abnormal EPU, etc. Note that in the abnormality notification process, the content to be notified may be stored in memory 43, etc.

[0107] In step S105, if there is more than one abnormal EPU, the flight control device 40 determines that there are multiple abnormal EPUs and proceeds to step S111. In step S111, the flight control device 40 performs multiple abnormality processing. The multiple abnormality processing is processing to deal with the occurrence of multiple abnormal EPUs.

[0108] In the propulsion system 30, if an EPU abnormality occurs in at least one EPU 50, the effect of the EPU abnormality may appear in the sensor values ​​of the normal EPU via the common path 35 or the branch path 36. A normal EPU is an EPU 50 in which no EPU abnormality actually occurs. Because the presence or absence of an EPU abnormality is determined for an EPU 50 using sensor values, there is a concern that the sensor values ​​of the normal EPU may become abnormal due to the influence of the EPU abnormality. In other words, there is a concern that the normal EPU may be erroneously estimated as an apparently abnormal EPU in step S104 above. In response to this, the flight control device 40 can confirm that multiple abnormal EPUs are not apparently abnormal EPUs in the multiple abnormality processing.

[0109] The multiple abnormality processing will be described with reference to the flowchart in Figure 7. The flight control device 40 sets a first abnormal EPU in step S401 shown in Figure 7. Of the multiple abnormal EPUs identified in step S104 above, the flight control device 40 sets the abnormal EPU with the highest degree of abnormality as the first abnormal EPU. For example, the flight control device 40 calculates the amount of deviation of the sensor value from the normal range for each of the multiple abnormal EPUs. Then, the flight control device 40 sets the abnormal EPU with the largest deviation of the sensor value as the first abnormal EPU.

[0110] The flight control device 40 may set the abnormal EPU with the largest number of abnormal sensor values ​​as the first abnormal EPU. For example, the flight control device 40 acquires the detection results of the current sensors 121, 122 and the voltage sensors 125, 126 as four sensor values ​​for each of the abnormal EPUs. If there is only one abnormal EPU for which all four sensor values ​​are abnormal, the flight control device 40 sets this abnormal EPU as the first abnormal EPU.

[0111] Also, assume that there are two abnormal EPUs. In this case, in one abnormal EPU, both the sensor value for the power supply path 131 and the sensor value for the motor path 132 are abnormal, and in the other abnormal EPU, only the sensor value for the power supply path 131 is abnormal. The flight control device 40 may set the abnormal EPU in which both the sensor values ​​for the power supply path 131 and the sensor values ​​for the motor path 132 are abnormal as the first abnormal EPU.

[0112] Furthermore, the flight control device 40 may set the abnormal EPU in which an abnormal value was detected earliest as the first abnormal EPU among the multiple abnormal EPUs. For example, the flight control device 40 may monitor the sensor values ​​in real time using high-speed sampling and accurately obtain the timing when the abnormal value was detected. High-speed sampling may be, for example, sampling every few milliseconds to a few microseconds.

[0113] In step S402, the flight control device 40 performs multi-shutdown processing on the first abnormal EPU. In this multi-shutdown processing, the same processing as the multi-shutdown processing of steps S106 to S109 described above is performed on the first abnormal EPU. In other words, in this multi-shutdown processing, the drive of the first abnormal EPU is stopped. The function of the flight control device 40 that executes the processing of step S402 corresponds to the abnormality shutdown unit.

[0114] In step S403, the flight control device 40 determines whether the abnormalities in the other abnormal EPUs other than the first abnormal EPU have been resolved. This determination is made for the other abnormal EPUs using eVTOL information such as sensor values, as in step S103 above. If the abnormalities in the other abnormal EPUs have been resolved, the flight control device 40 determines that the EPU abnormality in the first abnormal EPU has had an effect on the other abnormal EPUs, and then ends this multiple abnormality processing.

[0115] If the abnormality in the other abnormal EPU is not resolved, the flight control device 40 determines that an EPU abnormality independent of the EPU abnormality in the first abnormal EPU has occurred in the other abnormal EPU. If the abnormality in the other abnormal EPU has not been resolved, the flight control device 40 proceeds to step S404. In step S404, the flight control device 40 sets the other abnormal EPU as the second abnormal EPU. The flight control device 40 sets all of the other abnormal EPUs as the second abnormal EPU. For example, if there are multiple other abnormal EPUs, the flight control device 40 sets multiple second abnormal EPUs. By setting the other abnormal EPU as the second abnormal EPU, the flight control device 40 suspends the determination of whether an abnormality exists for the other abnormal EPU.

[0116] 5, after step S111, the flight control device 40 proceeds to step S110 and performs an abnormality notification process. When the abnormality notification process is performed after step S111, the abnormality notification process notifies the user that there are multiple abnormal EPUs, that multi-shutdown processing has been performed on the first abnormal EPU, that there is a second abnormal EPU, and so on.

[0117] In step S102, if the eVTOL 10 is not in flight, the flight control device 40 proceeds to step S112. In step S112, the flight control device 40 determines whether to perform a ground inspection. A ground inspection is an inspection of the eVTOL 10 when the eVTOL 10 is not in flight and is on the ground. For example, when the eVTOL 10 begins preparations for takeoff, the flight control device 40 determines that a ground inspection will be performed. The flight control device 40 determines whether to perform a ground inspection in response to input operations by the pilot or operator.

[0118] If a ground inspection is to be performed, the flight control device 40 proceeds to step S113 and performs ground inspection processing. In the ground inspection processing, inspections of the eVTOL 10 include inspections of the motor 61, etc. Inspections of the motor 61 include inspections of the motor device 60, inspections of the supply path 130, inspections of the inverter control unit 81, and inspections of the propulsion system 30. Inspections of the supply path 130 include inspections of the power path 131 and inspections of the motor path 132. Inspections of the supply path 130 also include inspections of various switches. For example, inspections of various switches include confirming that the power switch 86 and arm switches 116 and 117 are operating normally. The function of the flight control device 40 that executes the processing of step S113 corresponds to the switch inspection unit.

[0119] The ground inspection process will be described with reference to the flowchart in Figure 8. In step S501 shown in Figure 8, the flight control device 40 determines whether the propulsion system 30 is to be started. For example, the flight control device 40 determines that the propulsion system 30 is to be started when the power to the propulsion system 30 is turned on. Starting the propulsion system 30 includes starting the flight control device 40 and starting the inverter control unit 81. In conjunction with starting the propulsion system 30, the flight control device 40 performs inspections related to the propulsion system 30, such as inspecting the power switch 86 and arm switches 116 and 117.

[0120] When the propulsion system 30 is started, the flight control device 40 sets the supply path 130 to its initial state in steps S502 and S503. In this initial state, no current flows through the supply path 130. Also, in this initial state, there is no residual power remaining in the smoothing capacitor 114. In step S502, the flight control device 40 sets the power switch 86 to the OFF state. In step S503, the flight control device 40 sets the inverter circuit 85 to the OFF state. For example, the flight control device 40 sets all of the arm switches 116 and 117 in the inverter circuit 85 to the OFF state.

[0121] The flight control device 40 performs a flight prohibition process in step S504. The flight prohibition process involves processing to prohibit flight of the eVTOL 10. For example, the flight control device 40 sets a flight prohibition flag in the memory 43 or the like. The flight prohibition flag is a flag that indicates that flight of the eVTOL 10 is prohibited. The flight control device 40 may also clear the flight permission flag. The flight permission flag is a flag that indicates flight permission for the eVTOL 10. When the flight permission flag is not set in the memory 43 or the like, flight of the eVTOL 10 is prohibited.

[0122] In step S505, the flight control device 40 determines whether the sensor values ​​are normal. The sensor values ​​become initial values ​​when the supply path 130 is in an initial state. The flight control device 40 determines whether the sensor values ​​are initial values. If the sensor values ​​are initial values, the flight control device 40 determines that the sensor values ​​are normal. For example, the initial values ​​of the sensor values ​​of the current sensors 121, 122 and the voltage sensors 125, 126 are zero. If the sensor values ​​of the current sensors 121, 122 and the voltage sensors 125, 126 are approximately zero, the flight control device 40 determines that the sensor values ​​are normal.

[0123] If the sensor value is normal, the flight control device 40 proceeds to step S506. In step S506, the flight control device 40 switches the power switch 86 to the conducting state. When the power switch 86 is switched to the conducting state, a power supply voltage corresponding to the battery voltage is applied to the inverter circuit 85 and the smoothing capacitor 114.

[0124] In step S507, the flight control device 40 determines whether the power supply voltage is normal. The flight control device 40 calculates the battery voltage and the power supply voltage using the detection signals of the battery voltage sensor 31a and the power supply voltage sensor 125. The flight control device 40 then determines whether the power supply voltage has a value corresponding to the battery voltage. If the power supply voltage has a value corresponding to the battery voltage, the flight control device 40 determines that the power supply voltage is normal. If the power supply voltage is too high or too low compared to the battery voltage, the flight control device 40 determines that the power supply voltage is abnormal.

[0125] The flight control device 40 may determine whether the power supply voltage is normal multiple times. For example, after determining that the power supply voltage is normal in step S507, the flight control device 40 may again perform the processes of steps S502 and S505 to S507. After the power supply energization process of step S506, the power supply shutdown process of step S502 and the normality determination of the sensor value in step S505 are again performed, thereby confirming whether the power switch 86 can normally shut off the current flowing through the power supply path 131. After determining that the power supply voltage is normal, the flight control device 40 again switches the power switch 86 to the shutdown state to determine whether the sensor value is normal, and then switches the power switch 86 to the energized state to determine whether the power supply voltage is normal.

[0126] If the power supply voltage is normal, the flight control device 40 proceeds to step S508. In step S508, the flight control device 40 switches the inverter circuit 85 to a conductive state. When the inverter circuit 85 is in a conductive state, the arm switches 116 and 117 are in a conductive state so that current flows to at least one phase. For example, the flight control device 40 drives the arm switches 116 and 117 so that current flows to all phases in sequence. This allows the flight control device 40 to confirm that all arm switches 116 and 117 normally transition from a cut-off state to a conductive state.

[0127] In step S509, the flight control device 40 performs diagnostic processing to confirm that the current set by the flight control device 40 is flowing to the motor 61. For example, the flight control device 40 drives the inverter circuit 85 so that a powering current that is sufficiently smaller than that in normal motor control flows.

[0128] In step S510, the flight control device 40 determines whether or not the power supply to the motor 61 is normal. This determination is made using sensor values ​​and the like. For example, the flight control device 40 determines whether or not the arm switches 116 and 117 are operating normally using the power supply results of step S508 and the diagnosis results of step S509. If the arm switches 116 and 117 are operating normally, the flight control device 40 determines that the power supply to the motor 61 is normal.

[0129] The flight control device 40 may determine whether or not the power supply to the motor 61 is normal multiple times. For example, after determining that the power supply to the motor 61 is normal in step S510, the flight control device 40 may again perform the processes of steps S503 and S508 to S510. In this case, after the inverter power supply process of step S508, the inverter cut-off process of step S503 and the normality determination of the sensor value of step S505 are again performed with the power switch 86 not interrupting the power path 131. This confirms whether the arm switches 116 and 117 can normally interrupt the current flowing through the inverter circuit 85. After determining that the power supply to the motor 61 is normal, the flight control device 40 again switches the inverter circuit 85 to the cut-off state, drives the inverter circuit 85 so that the motor 61 is again energized, and determines whether or not the power supply to the motor 61 is normal.

[0130] If the power supply to the motor 61 is normal, the flight control device 40 proceeds to step S511. In step S511, the flight control device 40 performs a normal notification process. In the normal notification process, the flight control device 40 notifies the user that the power switch 86 and the inverter circuit 85 are operating normally.

[0131] In step S512, the flight control device 40 performs flight permission processing. In the flight permission processing, processing is performed to permit flight of the eVTOL 10. For example, the flight control device 40 clears the flight prohibition flag. Note that the flight control device 40 may also set the flight permission flag in the memory 43, etc.

[0132] In steps S505, S507, and S510, if any of the sensor values, power supply voltage, and power supply to the motor 61 are abnormal, the flight control device 40 proceeds to step S513. In step S513, the flight control device 40 performs an abnormality notification process. The abnormality notification process notifies the user that the power switch 86 or the inverter circuit 85 is not operating normally.

[0133] Returning to FIG. 5 , after steps S101 to S113, the flight control device 40 proceeds to step S114. In step S114, the flight control device 40 performs a discharge inspection process. In the discharge inspection process, inspections of the eVTOL 10 are performed, such as inspections of the motor 61. In the discharge inspection process, the discharge of the smoothing capacitor 114 is used to inspect the motor 61. For example, in the discharge inspection process, the discharge of the smoothing capacitor 114 is used to confirm that the power switch 86 and the arm switches 116 and 117 are operating normally. The function of the flight control device 40 that executes the process of step S114 corresponds to the switch inspection unit.

[0134] The discharge inspection process will be described with reference to the flowchart in Figure 9. In step S601 shown in Figure 9, the flight control device 40 determines whether or not a discharge request has been made. A discharge request may be made when the drive of the motor 61 is stopped during flight or after landing of the eVTOL 10. In other words, a stop request may be made to the EPU 50. For example, the flight control device 40 determines whether or not the inverter circuit 85 has been switched to a cut-off state to stop the drive of the motor 61. If the inverter circuit 85 has been switched to a cut-off state, the flight control device 40 determines that a discharge request has been made.

[0135] If there is a discharge request, the flight control device 40 proceeds to step S602. In step S602, the flight control device 40 performs power-off processing. In the power-off processing, processing is performed to cut off the power path 131 using the power switch 86 in order to discharge the smoothing capacitor 114. For example, the flight control device 40 performs power-off processing in the same manner as in step S108 above.

[0136] In step S603, the flight control device 40 performs inverter energization processing. In the inverter energization processing, processing is performed to switch the inverter circuit 85 to a conductive state. In the inverter energization processing, the inverter circuit 85 is driven so that the residual power of the smoothing capacitor 114 is discharged to the motor 61 via the inverter circuit 85. As a result of the inverter energization processing, a discharge current flows through the inverter circuit 85.

[0137] In step S604, the flight control device 40 determines whether the discharge current Idis is greater than or equal to the first discharge threshold TIdis1. The discharge current Idis is the discharge current flowing through the motor path 132. The flight control device 40 calculates the discharge current Idis using the detection signal of the motor current sensor 122. The discharge current Idis flows from the smoothing capacitor 114 to the motor 61 via the inverter circuit 85 and the output line 113. The first discharge threshold TIdis1 is a value determined in advance through testing or the like and is stored in the memory 43 or the like. The first discharge threshold TIdis1 is set to a value that indicates that the smoothing capacitor 114 is discharging normally. If the discharge current Idis is large enough to reach the first discharge threshold TIdis1, the flight control device 40 determines that the smoothing capacitor 114 is discharging normally. In this case, the smoothing capacitor 114 is in the middle of discharging.

[0138] Cases in which the discharge current Idis is so small as to not reach the first discharge threshold TIdis1 include when the smoothing capacitor 114 is not discharging normally or when there is too little residual power in the smoothing capacitor 114. If the discharge current Idis is smaller than the first discharge threshold TIdis1, it is difficult to inspect the motor 61, and the flight control device 40 immediately ends the discharge inspection process.

[0139] If the discharge current Idis reaches the first discharge threshold TIdis1, the flight control device 40 proceeds to step S605. In step S605, the flight control device 40 performs inverter shutdown processing. In the inverter shutdown processing, processing is performed to switch the inverter circuit 85 to a shutdown state. In the inverter shutdown processing, the inverter circuit 85 is driven so that the discharge current is shut off by the inverter circuit 85.

[0140] In step S606, the flight control device 40 determines whether the discharge current Idis is smaller than the second discharge threshold TIdis2. The second discharge threshold TIdis2 is a value determined in advance through testing or the like and stored in the memory 43 or the like. The second discharge threshold TIdis2 is set to a value that indicates that motor discharge has been stopped by the inverter circuit 85. If the discharge current Idis becomes smaller than the second discharge threshold TIdis2 as a result of the inverter shutdown process, the flight control device 40 determines that the inverter circuit 85 has successfully shut off the discharge current Idis. On the other hand, if the discharge current Idis does not become smaller than the second discharge threshold TIdis2 despite the inverter shutdown process being performed, the flight control device 40 determines that the inverter circuit 85 has not successfully shut off the discharge current Idis.

[0141] If the discharge current Idis is smaller than the second discharge threshold TIdis2, the flight control device 40 proceeds to step S607. In step S607, the flight control device 40 performs inverter normal processing. During inverter normal processing, a notification is issued that the inverter circuit 85 is operating normally. In a normal inverter circuit 85, the discharge current Idis is both applied and cut off normally by the arm switches 116 and 117.

[0142] If the discharge current Idis is not less than the second discharge threshold value TIdis2, the flight control device 40 proceeds to step S608. In step S608, the flight control device 40 performs inverter abnormality processing. In inverter abnormality processing, a notification is issued that the inverter circuit 85 is not operating normally. If the arm switches 116, 117 in the inverter circuit 85 do not normally supply or cut off at least one of the discharge current Idis, the inverter circuit 85 is not normal.

[0143] Note that when the inverter shut-off process of step S605 is performed, the discharge of the smoothing capacitor 114 may be stopped midway. Therefore, the flight control device 40 may perform the inverter energization process again after determining whether the discharge current Idis is smaller than the second discharge threshold TIdis2. For example, after steps S607 and S608, the flight control device 40 may perform the inverter energization process until the discharge of the smoothing capacitor 114 is complete.

[0144] According to the present embodiment described so far, when an abnormality occurs in the motor 61, the flight control device 40 shuts off the supply path 130 using at least one of the power switch 86 and the arm switches 116, 117 in a manner that corresponds to the nature of the abnormality. With this configuration, by driving the arm switches 116, 117 to reduce the power supply current Idc, which is the current during an abnormality, it is possible to have the power switch 86 shut off the reduced power supply current Idc. This prevents the power supply current Idc from being too large, which would otherwise cause the power switch 86 to be unable to shut off the power supply current Idc, and thus reduce the safety of the eVTOL 10. This can improve the safety of the eVTOL 10.

[0145] According to this embodiment, the flight control device 40 cuts off the power supply current Idc using the power switch 86 after the arm switches 116, 117 start reducing the power supply current Idc. With this configuration, the power supply current Idc reduced by the arm switches 116, 117 can be cut off by the power switch 86. Therefore, compared to a configuration in which the arm switches 116, 117 do not reduce the power supply current Idc, unlike this embodiment, even if the power supply switch 86 is made lighter and its cutting performance is reduced, the power supply current Idc can still be cut off by the power switch 86. Therefore, the weight of the power switch 86 can be reduced.

[0146] For example, unlike the present embodiment, a configuration is assumed in which the power supply current Idc is cut off by the power supply switch 86 before being reduced by the arm switches 116 and 117. In this configuration, the power supply switch 86 cuts off the power supply current Idc while it remains a large current, which tends to place a heavy burden on the power supply switch 86 and the supply path 130 when the current is cut off.

[0147] In contrast, according to this embodiment, the flight control device 40 cuts off the power supply current Idc with the power switch 86 after the power supply current Idc is reduced by the arm switches 116 and 117. With this configuration, there is no need for the power switch 86 to cut off the power supply current Idc while it remains a large current. This reduces the burden on the power switch 86 and the supply path 130 when the power switch 86 cuts off the power supply current Idc. In other words, the risk of the power switch 86 cutting off a large current can be avoided. Furthermore, because the power supply current Idc is reduced by the arm switches 116 and 117, arc discharge is less likely to occur when the power switch 86 physically cuts off the supply path 130. This allows the power switch 86 to reliably cut off the power supply current Idc.

[0148] According to this embodiment, the flight control device 40 cuts off the power supply current Idc with the power switch 86 after the inverter time Tinv reaches the inverter time threshold TTinv. With this configuration, even if a surge voltage occurs as a result of the arm switches 116 and 117 reducing the power supply current Idc, the power switch 86 can wait for the surge voltage to reduce before cutting off the power supply current Idc. This prevents the power switch 86 and the supply path 130 from being burdened by the surge voltage when the power switch 86 cuts off the power supply current Idc. In other words, it is possible to reduce the burden on the power switch 86 and the supply path 130 when the power switch 86 cuts off the power supply current Idc.

[0149] The propulsion device 100 mounted on the eVTOL 10 is required to have high output and be lightweight, due in part to the fact that the eVTOL 10 is a manned aircraft. For example, with regard to high output, an output of several tens to several hundreds of kW is required for each propulsion device 100. For this reason, in the propulsion device 100 mounted on the eVTOL 10, a high voltage is applied to the supply path 130, and a large current flows through the supply path 130. In a manned aircraft such as the eVTOL 10, a high voltage is more likely to be applied to the supply path 130, and a large current is more likely to flow, compared to a small aircraft such as a drone. For this reason, in the eVTOL 10, if the current in the supply path 130 is not reduced during an abnormality and is shut off by the power switch 86, surge currents and the like are likely to become large, which can have a significant impact on the control circuit and the like.

[0150] In contrast, in this embodiment, the abnormal current reduced by the inverter circuit 85 is cut off by the power switch 86, which makes it easier to reduce surge currents and the like when the power switch 86 cuts off the current. Therefore, the current cutoff by the power switch 86 is less likely to affect the control circuit and the like.

[0151] According to this embodiment, the flight control device 40 performs inspection processing to confirm that the power switch 86 and the arm switches 116, 117 are operating normally. With this configuration, if an abnormality occurs with the motor 61, inverter shutdown processing, power shutdown processing, and the like can be performed on the assumption that the power switch 86 and the arm switches 116, 117 are operating normally. This prevents the safety of the eVTOL 10 from being reduced due to a failure to shut off the power supply current Idc.

[0152] According to this embodiment, the flight control device 40 inspects the power switch 86 and the arm switches 116, 117 when the propulsion system 30 is started during the ground inspection process. Furthermore, the flight control device 40 inspects the power switch 86 and the arm switches 116, 117 when a stop request is issued to the EPU 50 as a discharge request during the discharge inspection process. Therefore, inspections of the power switch 86 and the arm switches 116, 117 are repeatedly performed each time the EPU 50 is started or stopped. In this way, increasing the frequency of inspections of the power switch 86 and the arm switches 116, 117 makes it easier to detect abnormalities in the power switch 86 and the arm switches 116, 117 early. Therefore, inspections of various switches can enhance the safety of the eVTOL 10.

[0153] In this embodiment, multiple propulsion devices 100 are electrically connected in parallel to the battery 31. In this configuration, if an abnormality related to the motor 61 occurs in at least one propulsion device 100, the sensor value may become abnormal not only in the propulsion device 100 in which the abnormality related to the motor 61 has occurred, but also in propulsion devices 100 in which no abnormality related to the motor 61 has occurred. In contrast, according to this embodiment, if multiple propulsion devices 100 exhibit abnormal sensor values, only the propulsion device 100 that is truly suspected of having a malfunction is stopped. This configuration makes it possible to avoid unnecessary impairment of the flight capabilities of the eVTOL 10 due to stopping the drive of multiple propulsion devices 100.

[0154] According to the present embodiment, both the arm switches 116, 117 and the power switch 86 are provided on the supply path 130. With this configuration, if an abnormality occurs in the motor 61, the supply path 130 can be shut off by at least one of the arm switches 116, 117 and the power switch 86 in a manner that corresponds to the state of the abnormality. Therefore, as described above, the safety of the eVTOL 10 can be improved.

[0155] In this embodiment, both the arm switches 116, 117 and the power switch 86 can cut off the supply path 130. In this configuration, even if an abnormality occurs in one of the arm switches 116, 117 and the power switch 86, the other can cut off the supply path 130. Therefore, if the arm switches 116, 117 and the power switch 86 are safety devices for cutting off the supply path 130, redundancy of this safety device can be ensured.

[0156] Furthermore, with this configuration, if an abnormality occurs in the motor 61, the arm switches 116, 117 and the power switch 86 can shut off the supply path 130 in a manner that prevents the abnormality from spreading to the motor 61 or other parts or devices in the propulsion system 30. Furthermore, the arm switches 116, 117 and the power switch 86 can shut off the supply path 130 in a manner that prevents the abnormality from progressing. Therefore, the arm switches 116, 117 and the power switch 86 can suppress the spread and progression of the abnormality in the motor 61.

[0157] In this embodiment, the power switch 86 has a mechanical contact. In this configuration, the power switch 86 physically cuts off the supply path 130. This allows for a configuration in which the power switch 86 reliably cuts off the abnormal current flowing through the supply path 130. For example, if an abnormality such as welding occurs in the power switch 86, there is a concern that the power switch 86 may not be able to cut off the supply path 130. However, even in this case, in this embodiment, the arm switches 116 and 117 can cut off the supply path 130.

[0158] In this embodiment, when an abnormality occurs in the motor 61, the arm switches 116 and 117, which are semiconductor switches, are shut off, and then the power switch 86, which is a mechanical switch, is shut off. Therefore, the burden on the power switch 86 when shutting off the power supply current Idc can be reduced by the semiconductor switch. Furthermore, in the inverter circuit 85, the arm switches 116 and 117 can shut off the abnormal current at the timing when the abnormal current in each of the multiple phases becomes small. Therefore, the burden on the arm switches 116 and 117 when shutting off the abnormal current can be reduced.

[0159] Second Embodiment In a second embodiment, in a power cutoff process, the abnormal current is reduced by the arm switches 116 and 117, and then the abnormal current is cut off by the power switch 86. Configurations, actions, and effects not specifically described in the second embodiment are the same as those in the first embodiment. The second embodiment will be described mainly focusing on differences from the first embodiment.

[0160] In this embodiment, the power supply cutoff process will be described with reference to the flowchart in Fig. 10. In step S201 shown in Fig. 10, the flight control device 40 determines whether the power supply current Idc is equal to or less than the power supply current threshold TIdc, as in the first embodiment. If the power supply current Idc is equal to or less than the power supply current threshold TIdc, the flight control device 40 proceeds to step S205, where it performs power supply cutoff execution processing, as in step S203 in the first embodiment. The function of the flight control device 40 that executes the processing of step S205 corresponds to a power supply reduction cutoff unit.

[0161] If the power supply current Idc is not equal to or less than the power supply current threshold TIdc, the flight control device 40 proceeds to step S204. In step S204, the flight control device 40 determines whether a dead short has occurred in the supply path 130 as an EPU abnormality. For example, the flight control device 40 performs at least one of determining whether the motor current Iac is equal to or less than the motor dead threshold and determining whether the power supply current Idc is equal to or greater than the power supply dead threshold. The motor current Iac is an abnormal current flowing through the motor path 132. The flight control device 40 calculates the motor current Iac using the detection result of the motor current sensor 122. The motor dead threshold and power supply dead threshold are values ​​determined in advance through testing or the like and stored in the memory 43 or the like. The motor dead threshold and power supply dead threshold are set to values ​​that indicate a dead short has occurred in the supply path 130.

[0162] If at least one of the following conditions is met: motor current Iac is equal to or less than the motor dead threshold, and power supply current Idc is equal to or greater than the power supply dead threshold, the flight control device 40 determines that a dead short has occurred in the supply path 130. In this case, the flight control device 40 proceeds to step S205 and performs power shutdown processing. In this case, even if the power supply current Idc does not decrease despite the execution of inverter shutdown processing due to the occurrence of a dead short in the supply path 130, the power switch 86 shuts off the power supply path 131. Therefore, the power switch 86 suppresses the spread and progression of the abnormality caused by the dead short in the propulsion system 30.

[0163] Third Embodiment In the first embodiment, when the power switch 86 interrupts the abnormal current, it is determined whether or not the inverter time Tinv has reached the inverter time threshold value TTinv. In contrast, in the third embodiment, when the power switch 86 interrupts the power supply path 131, it is not determined whether or not the inverter time Tinv has reached the inverter time threshold value TTinv. Configurations, actions, and effects that are not particularly described in the third embodiment are the same as those in the first embodiment. The third embodiment will be described mainly with reference to differences from the first embodiment.

[0164] In this embodiment, the power supply shutdown process will be described with reference to the flowchart in FIG. 11 . In step S201 shown in FIG. 11 , the flight control device 40 determines whether the power supply current Idc is equal to or less than the power supply current threshold TIdc, as in the first embodiment. If the power supply current Idc is equal to or less than the power supply current threshold TIdc, the flight control device 40 proceeds to step S206 and performs power supply shutdown execution processing, as in step S203 in the first embodiment. The function of the flight control device 40 that executes the processing of step S206 corresponds to the power supply reduction shutdown unit. On the other hand, if the power supply current Idc is not equal to or less than the power supply current threshold TIdc, the flight control device 40 immediately ends this power supply shutdown process regardless of the inverter time Tinv.

[0165] <Fourth Embodiment> In the first embodiment, when the power switch 86 interrupts the abnormal current, it is determined whether the power supply current Idc is equal to or less than the power supply current threshold TIdc. In contrast, in the fourth embodiment, when the power switch 86 interrupts the power supply path 131, it is not determined whether the power supply current Idc is equal to or less than the power supply current threshold TIdc. Configurations, actions, and effects that are not particularly described in the fourth embodiment are the same as those in the first embodiment. The fourth embodiment will be described mainly focusing on differences from the first embodiment.

[0166] In this embodiment, the power supply shutdown process will be described with reference to the flowchart in FIG. 12 . In step S202 shown in FIG. 12 , the flight control device 40 determines whether the inverter time Tinv has reached the inverter time threshold TTinv, as in the first embodiment. If the inverter time Tinv has reached the inverter time threshold TTinv, the flight control device 40 proceeds to step S207 and performs power supply shutdown execution processing, as in step S203 in the first embodiment. The function of the flight control device 40 that executes the processing of step S207 corresponds to the power supply elapsed shutdown unit. On the other hand, if the inverter time Tinv has not reached the inverter time threshold TTinv, the flight control device 40 ends this power supply shutdown process immediately, regardless of whether the power supply current Idc increases or decreases.

[0167] Fifth Embodiment In the first embodiment, in the multiple abnormality processing, the multi-shutdown processing is performed only on the first abnormal EPU out of the first abnormal EPU and the second abnormal EPU. In the fifth embodiment, in the multiple abnormality processing, the multi-shutdown processing is performed on both the first abnormal EPU and the second abnormal EPU. The configuration, operation, and effects not specifically described in the fifth embodiment are the same as those in the first embodiment. In the fifth embodiment, the differences from the first embodiment will be mainly described.

[0168] In this embodiment, the multiple abnormality processing will be described with reference to the flowchart in FIG. 13. The flight control device 40 performs the same processing as in the first embodiment in steps S401 to S403 shown in FIG. 13. If the abnormalities in the other abnormal EPUs have not been resolved in step S403, the flight control device 40 proceeds to step S701. The flight control device 40 determines that the first abnormal EPU is an apparent abnormal EPU and performs first recovery processing in step S701. The first recovery processing involves processing to restore the power switch 86 of the first abnormal EPU to an energized state. The flight control device 40 restarts the motor 61 of the first abnormal EPU by performing the first recovery processing, etc.

[0169] In step S404, the flight control device 40 sets another abnormal EPU as the second abnormal EPU, as in the first embodiment. In this embodiment, the flight control device 40 sets one abnormal EPU as the second abnormal EPU. For example, if there are multiple abnormal EPUs other than the first abnormal EPU, the flight control device 40 sets the abnormal EPU with the highest degree of abnormality among these abnormal EPUs as the second abnormal EPU.

[0170] The flight control device 40 performs second multi-shutdown processing in step S702. In the second multi-shutdown processing, multi-shutdown processing is performed on the second abnormal EPU. In the second multi-shutdown processing, processing similar to the multi-shutdown processing of the first embodiment is performed on the second abnormal EPU. The function of the flight control device 40 that executes the processing of step S702 corresponds to the abnormality shutdown unit.

[0171] In step S703, the flight control device 40 determines whether the abnormalities in the other abnormal EPUs other than the second abnormal EPU have been resolved. This determination is made using eVTOL information, such as sensor values, for the other abnormal EPUs. If the abnormalities in the other abnormal EPUs have been resolved, the flight control device 40 determines that the second abnormal EPU was an apparent abnormal EPU and terminates this multiple abnormality processing.

[0172] If the abnormality in another abnormal EPU other than the second abnormal EPU is not resolved, the flight control device 40 determines that an EPU abnormality independent of the EPU abnormality in the second abnormal EPU has occurred in the other abnormal EPU, and proceeds to step S704. In step S704, the flight control device 40 determines whether the second abnormal EPU can be updated. For example, if there are other abnormal EPUs in addition to the second abnormal EPU, the flight control device 40 determines that the second abnormal EPU can be updated to the other abnormal EPU, and proceeds to step S705. If there are no other abnormal EPUs in addition to the second abnormal EPU, it determines that the second abnormal EPU cannot be updated, and ends this multiple abnormality processing.

[0173] If the second abnormal EPU can be updated, the flight control device 40 proceeds to step S705 and performs a second recovery process. This process involves returning the power switch 86 of the second abnormal EPU to an energized state. By performing the second recovery process, the flight control device 40 restarts the motor 61 of the second abnormal EPU.

[0174] In step S706, the flight control device 40 updates the second abnormal EPU to another abnormal EPU. After step S706, the flight control device 40 returns to step S702. The flight control device 40 repeats steps S702 to S706 until there are no other abnormal EPUs that can be updated to the second abnormal EPU. The fact that there are no other abnormal EPUs that can be updated to the second abnormal EPU indicates that a determination has been made for all abnormal EPUs as to whether the abnormalities in the other abnormal EPUs have been resolved by the multi-shutdown process. Note that if there are no other abnormal EPUs that can be updated to the second abnormal EPU but the abnormality in at least one abnormal EPU has not been resolved, the flight control device 40 may stop driving all abnormal EPUs.

[0175] In this embodiment, if multiple abnormal EPUs occur, the multi-shutdown process and recovery process are performed on each of the multiple abnormal EPUs in turn. This has the disadvantage of not resolving the abnormality in the eVTOL 10 until it is confirmed that the abnormal EPU is not an apparent abnormal EPU. On the other hand, it is possible to restart an EPU 50 that is ultimately confirmed to be an apparent abnormal EPU. This makes it possible to stop the operation of only the abnormal EPU where an EPU abnormality actually occurs. Therefore, even if an EPU abnormality occurs in the eVTOL 10, the impact of the EPU abnormality on the flight of the eVTOL 10 can be minimized.

[0176] Sixth Embodiment In the fifth embodiment, in the multiple abnormality processing, an apparently abnormal EPU among multiple abnormal EPUs is reactivated. In contrast, in the sixth embodiment, in the multiple abnormality processing, all of the multiple abnormal EPUs may not be reactivated. The configurations, actions, and effects not specifically described in the sixth embodiment are the same as those in the first embodiment. In the sixth embodiment, the differences from the first embodiment will be mainly described.

[0177] In this embodiment, the multiple abnormality processing will be described with reference to the flowchart in Fig. 14. In step S801 shown in Fig. 14, the flight control device 40 determines whether to stop the operation of all abnormal EPUs. The flight control device 40 determines whether to stop the operation of all abnormal EPUs depending on the state of the EPU abnormality. For example, if the EPU abnormality in at least one abnormal EPU includes a dead short in the supply path 130, the EPU abnormality is determined to be a very high level abnormality, and it is determined that the operation of all abnormal EPUs should be stopped.

[0178] On the other hand, if the EPU abnormality in at least one abnormal EPU does not include a dead short in the supply path 130, it is determined that there is no need to stop the operation of all of the abnormal EPUs. If there is no need to stop the operation of all of the abnormal EPUs, the flight control device 40 performs the processes of steps S401 to S404, as in the first embodiment.

[0179] If all abnormal EPUs are to be shut down, the flight control device 40 proceeds to step S802. In step S802, the flight control device 40 performs a full multi-shutdown process. In the full multi-shutdown process, processing is performed to shut down the operation of all abnormal EPUs. In the full multi-shutdown process, processing similar to steps S106 to S109 in the first embodiment is performed for all abnormal EPUs. The function in the flight control device 40 that executes the processing of step S802 corresponds to the abnormality shutdown unit.

[0180] In this embodiment, if multiple abnormal EPUs occur, the drive of all of the abnormal EPUs is stopped. With this configuration, if an extremely high-level abnormality such as a dead short occurs as an EPU abnormality, the drive of all abnormal EPUs is stopped, thereby suppressing the spread and progression of the EPU abnormality. In this way, if an EPU abnormality occurs that may cause an excessively high level of voltage or current to be detected due to a dead short or the like, it is preferable to quickly resolve the EPU abnormality by, for example, quickly stopping the EPU 50 suspected of being abnormal.

[0181] On the other hand, if the EPU abnormality does not include a dead short, and the EPU abnormality continues for a certain period of time but is unlikely to suddenly reduce the safety of the eVTOL 10, it is preferable to identify the abnormal EPU in which the EPU abnormality is truly occurring. Then, stopping the operation of only the abnormal EPU in which the EPU abnormality truly is occurring, such as the first abnormal EPU, is reasonable in terms of ensuring the safety of the eVTOL 10.

[0182] Seventh Embodiment In the seventh embodiment, a motor switch is provided in the supply path between the power conversion unit and the motor. The configurations, actions, and effects of the seventh embodiment that are not specifically described are the same as those of the first embodiment. The seventh embodiment will be described mainly focusing on the differences from the first embodiment.

[0183] As shown in FIG. 15 , the propulsion system 30 has a motor switch 87. The motor switch 87 is provided in each of the multiple propulsion devices 100. For example, the motor switch 87 is included in the inverter device 80. The motor switch 87 is formed to include a mechanical switch or a mechanical relay having mechanical contacts. The motor switch 87 can be switched between an energized state and an interrupted state. The energized state of the motor switch 87 is sometimes referred to as a closed state, and the interrupted state is sometimes referred to as an open state. The motor switch 87 may be included in the motor device 60, or may be provided independently of the propulsion devices 100.

[0184] The motor switch 87 is provided in the supply path 130 between the inverter circuit 85 and the motor 61. The motor switch 87 is capable of interrupting the supply path 130. The motor switch 87 is capable of interrupting the current flowing through the supply path 130. The motor switch 87 is provided in the motor path 132. The motor switch 87 is capable of interrupting the motor path 132. The motor switch 87 is capable of interrupting the current flowing through the motor path 132. The motor switch 87 is capable of interrupting AC current, and is sometimes referred to as an AC switch. The motor switch 87 is provided in at least one of the multi-phase output lines 113 in the motor path 132. For example, the motor switch 87 is provided in each of the multi-phase output lines 113.

[0185] Currents that can be cut off by the motor switch 87 include a power running current, a regenerative current, and an abnormal current. For example, when regenerative power is generated in the motor 61, the regenerative current may flow to the power supply path 131 side through the motor switch 87, the arm switches 116 and 117, the power switch 86, etc. In this case, even if the arm switches 116 and 117 are in an interrupted state, the regenerative current may flow to the power supply path 131 side through the arm diodes 116a and 117a. In contrast, when the motor path 132 is interrupted by the motor switch 87, the motor switch 87 prevents the regenerative current from flowing toward the arm diodes 116a and 117a.

[0186] The propulsion system 30 has a discharge circuit 141 and a discharge switch 142. The discharge circuit 141 and the discharge switch 142 are provided in each of the multiple propulsion devices 100. For example, the discharge circuit 141 and the discharge switch 142 are included in the inverter device 80. The discharge circuit 141 and the discharge switch 142 are provided for the smoothing capacitor 114. Note that the discharge circuit 141 and the discharge switch 142 may be provided independently of the inverter device 80 and the propulsion devices 100.

[0187] The discharge circuit 141 is a circuit for discharging residual power in the smoothing capacitor 114. The discharge circuit 141 is formed to include a resistor element, a capacitor element, etc. The discharge circuit 141 is a dedicated circuit for discharging the smoothing capacitor 114. The discharge circuit 141 is capable of discharging residual power remaining in the supply path 130. The discharge circuit 141 is electrically connected to the smoothing capacitor 114. The discharge circuit 141 is provided in the power supply path 131 between the inverter circuit 85 and the smoothing capacitor 114. The discharge circuit 141 is connected in parallel to the smoothing capacitor 114 and the battery 31. In FIG. 15 , the discharge circuit 141 is illustrated as DCH.

[0188] The discharge switch 142 is connected in series to the discharge circuit 141. The discharge switch 142 is formed of a semiconductor switch or the like. The discharge switch 142 can be switched between a conducting state and a cut-off state. When the discharge switch 142 is in the conducting state, it can allow a discharge current from the smoothing capacitor 114 to flow to the discharge circuit 141.

[0189] In this embodiment, the flight control process will be described with reference to the flowchart of Fig. 16. The flight control device 40 performs the same processes as in the first embodiment in steps S101 to S105 and S110 to S112 shown in Fig. 16.

[0190] In step S105, if there is one abnormal EPU, the flight control device 40 proceeds to step S1001 and performs multi-shutdown processing. In multi-shutdown processing, the supply path 130 is shut off by multiple switches, namely the power switch 86, the arm switches 116 and 117, and the motor switch 87. The flight control device 40 shuts off the supply path 130 by at least one of the power switch 86, the arm switches 116 and 117, and the motor switch 87. The flight control device 40 also shuts off the supply path 130 by at least one of the power switch 86 and the arm switches 116 and 117. The function of the flight control device 40 that executes the processing of step S1001 corresponds to a selective shutoff unit.

[0191] The multi-shutdown processing will be described with reference to the flowchart in Figure 17. In step S1101 of the multi-shutdown processing, the flight control device 40 determines whether an EPU abnormality has occurred related to the power supply path 131. Abnormalities related to the power supply path 131 include a short circuit or a ground fault in the power supply path 131. Short circuits in the power supply path 131 include a short circuit in the battery 31, the smoothing capacitor 114, the filter circuit, etc.

[0192] The flight control device 40 uses the sensor values ​​of the battery voltage sensor 31a, the power supply voltage sensor 125, and the power supply current sensor 121 to determine whether an abnormality has occurred in the power supply path 131. Examples of cases in which a short circuit has occurred in the power supply path 131 include when an overcurrent in the power supply path 131 is detected by the sensor value of the power supply current sensor 121, or when a low voltage in the power supply path 131 is detected by the sensor values ​​of the voltage sensors 31a and 125.

[0193] If an abnormality occurs in the power supply path 131, the flight control device 40 performs a power supply multi-shutdown process in steps S1102 to S1105. In the power supply multi-shutdown process, the supply path 130 is shut off at multiple locations. If an abnormality occurs in the power supply path 131, there is a concern that the power supply current Idc may become an overcurrent in the abnormal current event, which is greater than the possibility that the motor current Iac may become an overcurrent. For example, if a dead short occurs in the power supply path 131, there is a concern that the power supply current Idc may flow as a large current into the P line 111 or the N line 112. In response to this, the power supply multi-shutdown process switches the inverter circuit 85 and the motor switch 87 to a shutoff state to reduce the power supply current Idc. In the power supply multi-shutdown process, the motor switch 87 shuts off the motor path 132, and then the power switch 86 shuts off the power supply path 131. The function of the flight control device 40 that executes the processes of steps S1102 to S1105 corresponds to a power supply trailing shutdown unit.

[0194] In step S1102 of the power supply multi-shutdown process, the flight control device 40 performs inverter shutdown processing similar to step S106 in the first embodiment. The functions of the flight control device 40 that execute the processing of step S1102 correspond to the current reduction unit and the selective reduction unit.

[0195] In step S1103, the flight control device 40 performs motor shutdown processing. In the motor shutdown processing, processing is performed to execute motor shutdown. Motor shutdown is performed by shutting off the motor path 132 using the motor switch 87. By performing the motor shutdown processing after the inverter shutdown processing, the flight control device 40 shuts off the abnormal current using the motor switch 87 after the timing at which the inverter circuit 85 starts reducing the abnormal current. The function of the flight control device 40 that executes the processing of step S1103 corresponds to the motor shutdown unit.

[0196] The motor cutoff process will be described with reference to the flowchart in Figure 18. In step S1201 shown in Figure 18, the flight control device 40 determines whether the motor current Iac is equal to or less than the motor current threshold TIac. The motor current threshold TIac is a value determined in advance through testing or the like and is stored in the memory 43 or the like. The motor current threshold TIac is set to a current value at which the motor switch 87 can be cut off. For example, the motor current threshold TIac is set to a value corresponding to the rated current of the motor switch 87.

[0197] If the motor current Iac, which is the abnormal current, is reduced to the motor current threshold value TIac as a result of the motor shutdown processing, the flight control device 40 proceeds to step S1203. In step S1203, the flight control device 40 performs motor shutdown execution processing. In the motor shutdown execution processing, the motor switch 87 is switched to the shutdown state. After the motor current Iac has been reduced by the inverter shutdown processing, the flight control device 40 shuts off the motor current Iac using the motor switch 87. The function of the flight control device 40 that executes the processing of step S1203 corresponds to the motor reduction shutdown unit.

[0198] For example, consider a comparative example in which, unlike the present embodiment, the flight control device 40 performs a motor shutdown execution process without performing an inverter shutdown process. In this comparative example, a situation may easily arise in which the motor switch 87 shuts off the motor current Iac when the motor current Iac, which is the abnormal current, is greater than the motor current threshold value TIac. In this situation, even if the motor switch 87 is switched to the shutdown state, there is a concern that the motor current Iac may not be shut off due to an arc discharge occurring in the motor switch 87. In contrast, in the present embodiment, the motor current Iac is reduced to the motor current threshold value TIac, making it easier for the motor switch 87 to shut off the motor current Iac.

[0199] If the motor current Iac is not equal to or less than the motor current threshold value TIac, the flight control device 40 proceeds to step S1202, where it determines whether the inverter time Tinv has reached the inverter time threshold value TTinv, similar to step S202 in the first embodiment described above.

[0200] When the inverter time Tinv reaches the inverter time threshold TTinv, the flight control device 40 proceeds to step S1203 and performs motor cutoff execution processing. When the inverter time Tinv reaches the inverter time threshold TTinv, the flight control device 40 cuts off the motor current Iac using the motor switch 87. The function of the flight control device 40 that executes the processing of step S1203 corresponds to the motor current cutoff unit.

[0201] For example, consider a comparative example in which, unlike the present embodiment, the flight control device 40 performs the motor shutdown execution process without waiting after the inverter shutdown process. In this comparative example, the motor switch 87 is likely to shut off the abnormal current when a large surge voltage is generated due to the inverter circuit 85 shutting off the abnormal current. In this situation, there is a concern that when the motor switch 87 is switched to the shut-off state, the surge voltage may damage the motor switch 87, causing an abnormality in the motor switch 87. In contrast, in the present embodiment, the motor switch 87 shuts off the abnormal current when the surge voltage has been reduced, making it less likely that an abnormality in the motor switch 87 will occur due to the surge voltage.

[0202] 17, in step S1104, the flight control device 40 performs power-off processing similar to step S108 in the first embodiment. The function of the flight control device 40 that executes the processing of step S1104 corresponds to the power-off unit.

[0203] In step S1105, the flight control device 40 performs a circuit discharge process. The circuit discharge process is a process for releasing the residual power in the smoothing capacitor 114 to the discharge circuit 141. In the smoothing capacitor 114, the residual charge flows to the discharge circuit 141 as a discharge current, and the residual power is discharged by the discharge circuit 141. The flight control device 40 switches the discharge switch 142 to a conductive state so that the discharge current flows to the discharge circuit 141. In the circuit discharge process, the residual power remaining in the supply path 130 is discharged by the discharge circuit 141.

[0204] If no abnormality has occurred in the power supply path 131 in step S1101, the flight control device 40 proceeds to step S1106. In step S1106, the flight control device 40 determines whether an abnormality has occurred in the motor path 132 as an EPU abnormality. An abnormality in the motor path 132 may be a short circuit or a ground fault in the motor path 132. An example of a short circuit in the motor path 132 is a short circuit in the inverter circuit 85 or the motor 61.

[0205] The flight control device 40 uses the sensor values ​​of the motor voltage sensor 126 and the motor current sensor 122 to determine whether an abnormality has occurred in the motor path 132. Examples of cases in which a short circuit has occurred in the motor path 132 include when the sensor value of the motor current sensor 122 detects an overcurrent in the motor path 132, or when the sensor value of the motor voltage sensor 126 detects a low voltage in the motor path 132.

[0206] If an abnormality occurs in the motor path 132, the flight control device 40 performs motor multi-shutdown processing in steps S1107 to S1110. In the motor multi-shutdown processing, the supply path 130 is shut off at multiple locations. If an abnormality occurs in the motor path 132, there is a concern that the motor current Iac may become an overcurrent in the abnormal current event, which is greater than the possibility that the power supply current Idc may become an overcurrent. For example, if a dead short occurs in the motor path 132, there is a concern that the motor current Iac may flow as a large current through the output line 113. In response to this, the motor multi-shutdown processing switches the inverter circuit 85 and the power switch 86 to a shutoff state to reduce the motor current Iac. In the motor multi-shutdown processing, the power supply path 131 is shut off by the power switch 86, and then the motor path 132 is shut off by the motor switch 87. The function of the flight control device 40 that executes the processing in steps S1107 to S1110 corresponds to a motor trailing shutoff unit.

[0207] In step S1107 of the motor multi-shutdown process, the flight control device 40 performs inverter shutdown processing in the same manner as in step S1102 above. The functions of the flight control device 40 that execute the processing of step S1107 correspond to the current reduction unit and the selective reduction unit.

[0208] In step S1108, the flight control device 40 performs a power-off process similar to step S1104. The function of the flight control device 40 that executes the process of step S1108 corresponds to the power-off unit.

[0209] In step S1109, the flight control device 40 performs motor discharge processing, similar to step S603 in the first embodiment. In step S1110, the flight control device 40 performs motor shutdown processing, similar to step S1103 above. The function of the flight control device 40 that executes the processing of step S1110 corresponds to the motor shutdown unit. Note that if the motor discharge processing has been completed after the inverter shutdown processing, surge voltage is less likely to occur when the motor shutdown processing is performed. Therefore, the standby determination in step S1202 does not need to be performed in this motor shutdown processing.

[0210] 16 , after step S1001, the flight control device 40 proceeds to step S110 to perform an abnormality notification process. In this abnormality notification process, an EPU abnormality such as an abnormality in the power supply path 131 or an abnormality in the motor path 132 is notified. If there are multiple abnormal EPUs, the flight control device 40 may perform the multi-shutdown process of step S1001 in step S111 as a multi-shutdown process for the first abnormal EPU.

[0211] In steps S102 and S112, if the eVTOL 10 is not in flight and a ground inspection is to be performed, the flight control device 40 proceeds to step S1002. In step S1002, the flight control device 40 performs a ground inspection process. In this ground inspection process, it is confirmed that the power switch 86 and arm switches 116 and 117 are operating normally, as well as that the motor switch 87 is operating normally. The function of the flight control device 40 that executes the process of step S1002 corresponds to the switch inspection unit.

[0212] The ground inspection process will be described with reference to the flowchart in FIG. 19. In the ground inspection process, the flight control device 40 performs steps S501 to S513 in the same manner as in the first embodiment. In steps S502, S503, and S1301, the flight control device 40 sets the supply path 130 to its initial state. In step S1301, the flight control device 40 sets the motor switch 87 to the cut-off state. If the power supply voltage is normal in step S507, the flight control device 40 proceeds to S1302 and switches the motor switch 87 to the energized state. This allows the flight control device 40 to confirm that the motor switch 87 has normally transitioned from the cut-off state to the energized state. After step S1302, the flight control device 40 performs the inverter energization process in step S508.

[0213] The flight control device 40 may also confirm whether the motor switch 87 can normally interrupt the current flowing through the motor path 132. For example, after the motor energization process of step S1302 and the inverter energization process of step S508, the motor interruption process of step S1301 and the normality determination of the sensor value of step S505 may be performed again. If the sensor value is determined to be normal in step S505, it is confirmed that the motor switch 87 can normally interrupt the current.

[0214] In the normal notification process of step S511, the flight control device 40 notifies that the power switch 86 and the inverter circuit 85 are operating normally, and also notifies that the motor switch 87 is operating normally. In addition, in the abnormality notification process of step S513, the flight control device 40 can notify that the power switch 86 and the inverter circuit 85 are not operating normally, and also notifies that the motor switch 87 is not operating normally.

[0215] 16, after steps S101 to S105, S110 to S112, S1001, and S1002, the flight control device 40 proceeds to step S1003. In step S1003, the flight control device 40 performs a discharge inspection process. In this discharge inspection process, the discharge of the smoothing capacitor 114 is used to confirm that the power switch 86 and arm switches 116 and 117 are operating normally, as well as that the motor switch 87 is operating normally. The function of the flight control device 40 that executes the process of step S1003 corresponds to the switch inspection unit.

[0216] The discharge inspection process will be described with reference to the flowchart in FIG. 20 . In the discharge inspection process, the flight control device 40 performs steps S601 to S608 in the same manner as in the first embodiment. After step S603, the flight control device 40 proceeds to step S1401 to perform motor energization process. In the motor energization process, processing is performed to switch the motor switch 87 to an energized state. In steps S603 and S1401, the flight control device 40 drives the inverter circuit 85 and the motor switch 87 so that the residual power in the smoothing capacitor 114 is discharged to the motor 61 via the inverter circuit 85 and the motor switch 87. This causes a discharge current to flow through the inverter circuit 85 and the motor switch 87.

[0217] After step S607, the flight control device 40 performs processing to confirm that the motor switch 87 is operating normally in steps S1402 to S1406. In step S1402, the flight control device 40 performs inverter energization processing, similar to step S603 above. In step S1403, the flight control device 40 performs motor shutdown processing, similar to step S1103 above.

[0218] In supply path 130, inverter circuit 85 is switched to a conducting state in step S1402, causing motor discharging to occur in smoothing capacitor 114. However, motor switch 87 cuts off motor path 132 in step S1403, causing motor discharging to be stopped by motor switch 87. That is, the discharge current is cut off by motor switch 87.

[0219] In step S1404, the flight control device 40 determines whether the discharge current Idis is smaller than the third discharge threshold TIdis3. The third discharge threshold TIdis3 is a value determined in advance through testing or the like and stored in the memory 43 or the like. The third discharge threshold TIdis3 is set to a value that indicates that motor discharge has been stopped by the motor switch 87. If the discharge current Idis becomes smaller than the third discharge threshold TIdis3 as a result of the motor cut-off process, the flight control device 40 determines that the motor switch 87 has successfully cut off the discharge current Idis. On the other hand, if the discharge current Idis does not become smaller than the third discharge threshold TIdis3 despite the motor cut-off process being performed, the flight control device 40 determines that the motor switch 87 has not successfully cut off the discharge current Idis.

[0220] If the discharge current Idis is smaller than the third discharge threshold TIdis3, the flight control device 40 proceeds to step S1405. In step S1405, the flight control device 40 performs motor switch normal processing. The motor switch normal processing notifies the user that the motor switch 87 is operating normally. A normal motor switch 87 normally conducts and cuts off the discharge current Idis.

[0221] If the discharge current Idis is not less than the third discharge threshold TIdis3, the flight control device 40 proceeds to step S1406. In step S1406, the flight control device 40 performs motor switch abnormality processing. The motor switch abnormality processing notifies the user that the motor switch 87 is not operating normally. If the motor switch 87 does not normally conduct or cut off at least one of the discharge current Idis, the motor switch 87 is not normal.

[0222] Note that when the motor shut-off process of step S1403 is performed, the discharge of the smoothing capacitor 114 may be stopped midway. Therefore, the flight control device 40 may perform the motor energization process again after determining whether the discharge current Idis is smaller than the third discharge threshold TIdis3. For example, after steps S1405 and S1406, the flight control device 40 may perform the motor energization process until the discharge of the smoothing capacitor 114 is complete.

[0223] According to the present embodiment, when an abnormality occurs in the motor 61, the flight control device 40 shuts off the supply path 130 by at least one of the power switch 86, the arm switches 116, 117, and the motor switch 87 in a manner that corresponds to the state of the abnormality. With this configuration, by driving the arm switches 116, 117 to reduce the power supply current Idc and the motor current Iac, it is possible to cause the power switch 86 and the motor switch 87 to shut off the reduced power supply current Idc and the motor current Iac. This prevents a situation in which the power supply current Idc and the motor current Iac are too large, causing the power switch 86 and the motor switch 87 to be unable to shut off the power supply current Idc and the motor current Iac, resulting in a reduction in the safety of the eVTOL 10.

[0224] According to this embodiment, the flight control device 40 cuts off the motor current Iac using the motor switch 87 after the arm switches 116, 117 start reducing the motor current Iac. With this configuration, the motor current Iac reduced by the arm switches 116, 117 can be cut off by the motor switch 87. Therefore, compared to a configuration in which the arm switches 116, 117 do not reduce the motor current Iac, unlike this embodiment, even if the motor switch 87 is made lighter and its cutting performance is reduced, the motor current Iac can still be cut off by the motor switch 87. Therefore, the motor switch 87 can be made lighter.

[0225] For example, unlike the present embodiment, a configuration is assumed in which motor switch 87 cuts off motor current Iac before it has been reduced by arm switches 116 and 117. In this configuration, motor switch 87 cuts off motor current Iac while it remains a large current, which can easily place a heavy burden on motor switch 87 and supply path 130 when the current is cut off.

[0226] In contrast, according to this embodiment, the flight control device 40 cuts off the motor current Iac using the motor switch 87 after the motor current Iac is reduced by the arm switches 116 and 117. This configuration eliminates the need for the motor switch 87 to cut off the motor current Iac while it remains a large current. This reduces the burden on the motor switch 87 and the supply path 130 when the motor switch 87 cuts off the motor current Iac. In other words, it is possible to avoid the risk of the motor switch 87 cutting off a large current. Furthermore, because the motor current Iac is reduced by the arm switches 116 and 117, arc discharge is less likely to occur when the motor switch 87 physically cuts off the supply path 130. This allows the motor switch 87 to reliably cut off the motor current Iac.

[0227] According to this embodiment, the flight control device 40 cuts off the motor current Iac using the motor switch 87 after the inverter time Tinv reaches the inverter time threshold TTinv. With this configuration, even if a surge voltage occurs as the arm switches 116 and 117 reduce the motor current Iac, the motor switch 87 can wait for the surge voltage to reduce before cutting off the motor current Iac. This prevents the motor switch 87 and the supply path 130 from being burdened by the surge voltage when the motor switch 87 cuts off the motor current Iac. In other words, this reduces the burden on the power switch 86 and the supply path 130 when the motor switch 87 cuts off the motor current Iac.

[0228] According to this embodiment, if an abnormality occurs in the power supply path 131, the flight control device 40 first cuts off the motor path 132 with the motor switch 87, and then cuts off the power supply path 131 with the power switch 86. With this configuration, the power supply current Idc reduced by the motor switch 87 can be cut off with the power switch 86. In this way, by adjusting the relative timing at which the power switch 86 and the motor switch 87 are cut off, the weight of the power switch 86 can be reduced.

[0229] When an abnormality occurs in the power supply path 131, there is a concern that the abnormal current flowing through the power supply path 131 will be larger than when an abnormality occurs in the motor path 132. Therefore, when an abnormality occurs in the power supply path 131, from the viewpoint of reliably cutting off the power supply current Idc by the power switch 86, it is preferable to cut off the motor current Iac by the motor switch 87 at a timing when the power supply current Idc is likely to decrease. Furthermore, from the viewpoint of reliably cutting off the abnormal current in the supply path 130, it is preferable to first cut off the switch between the power supply switch 86 and the motor switch 87, whichever is closer to the location where the abnormality, such as a short circuit, has occurred.

[0230] According to this embodiment, if an abnormality occurs in the motor path 132, the flight control device 40 first cuts off the power path 131 with the power switch 86, and then cuts off the motor path 132 with the motor switch 87. With this configuration, the motor current Iac, which has been reduced by the power switch 86, can be cut off with the motor switch 87. In this way, by adjusting the relative timing at which the motor switch 87 and the power switch 86 are cut off, the weight of the motor switch 87 can be reduced.

[0231] When an abnormality occurs in motor path 132, there is a concern that the abnormal current flowing through motor path 132 will be larger than when an abnormality occurs in power supply path 131. Therefore, when an abnormality occurs in motor path 132, from the viewpoint of reliably cutting off motor current Iac by motor switch 87, it is preferable to cut off power supply current Idc by power supply switch 86 at a timing when motor current Iac is likely to decrease.

[0232] According to this embodiment, the motor switch 87 is provided in the supply path 130 between the inverter circuit 85 and the motor 61. In this configuration, if an abnormality occurs in the motor path 132, the motor switch 87 can prevent the abnormality from spreading or progressing in the abnormal EPU. For example, even if an abnormality such as a coil short circuit occurs in the motor 61, the motor switch 87 can prevent the influence of the abnormality from extending to the power supply path 131.

[0233] In this embodiment, the arm switches 116 and 117, the power switch 86, and the motor switch 87 can each individually cut off the supply path 130. In this configuration, even if an abnormality occurs in any of the arm switches 116 and 117, the power switch 86, and the motor switch 87, the switch that is not abnormal can cut off the supply path 130. Therefore, redundancy of the safety devices, namely the arm switches 116 and 117, the power switch 86, and the motor switch 87, can be ensured.

[0234] In this embodiment, the motor switch 87 has a mechanical contact. In this configuration, the motor switch 87 physically cuts off the supply path 130. This allows for a configuration in which the motor switch 87 reliably cuts off the current flowing through the supply path 130 in the event of an abnormality. Furthermore, in this embodiment, even if an abnormality such as welding occurs in the motor switch 87, the arm switches 116 and 117 can cut off the supply path 130.

[0235] In this embodiment, when an abnormality occurs in the motor 61, the arm switches 116 and 117, which are semiconductor switches, are turned off, and then the motor switch 87, which is a mechanical switch, is turned off. Therefore, the load on the motor switch 87 when turning off the motor current Iac can be reduced by the semiconductor switch.

[0236] Eighth Embodiment In the seventh embodiment, when the motor switch 87 interrupts the abnormal current, it is determined whether or not the inverter time Tinv has reached the inverter time threshold value TTinv. In contrast, in the eighth embodiment, when the motor switch 87 interrupts the power supply path 131, it is not determined whether or not the inverter time Tinv has reached the inverter time threshold value TTinv. Configurations, actions, and effects that are not particularly described in the eighth embodiment are the same as those in the seventh embodiment. The eighth embodiment will be described mainly focusing on differences from the seventh embodiment.

[0237] In this embodiment, the power supply shutdown process will be described with reference to the flowchart in FIG. 21. In step S1201 shown in FIG. 21, the flight control device 40 determines whether the motor current Iac is equal to or less than the motor current threshold Tlac, as in the seventh embodiment. If the motor current Iac is equal to or less than the motor current threshold Tlac, the flight control device 40 proceeds to step S1204 and performs motor shutdown execution processing, as in step S1203 in the seventh embodiment. The function of the flight control device 40 that executes the processing of step S1204 corresponds to the motor reduced shutdown unit. On the other hand, if the motor current Iac is not equal to or less than the motor current threshold Tlac, the flight control device 40 immediately ends this power supply shutdown process regardless of the inverter time Tinv.

[0238] Ninth Embodiment In the seventh embodiment, when the motor switch 87 interrupts the abnormal current, it is determined whether the motor current Iac is equal to or less than the motor current threshold value TIac. In contrast, in the ninth embodiment, when the motor switch 87 interrupts the motor path 132, it is not determined whether the motor current Iac is equal to or less than the motor current threshold value TIac. Configurations, actions, and effects that are not particularly described in the ninth embodiment are the same as those in the seventh embodiment. The ninth embodiment will be described mainly focusing on differences from the seventh embodiment.

[0239] In this embodiment, the motor shutdown process will be described with reference to the flowchart in FIG. 22 . In step S1202 shown in FIG. 22 , the flight control device 40 determines whether the inverter time Tinv has reached the inverter time threshold TTinv, as in the seventh embodiment. If the inverter time Tinv has reached the inverter time threshold TTinv, the flight control device 40 proceeds to step S1205 and performs motor shutdown execution processing, as in step S1203 in the seventh embodiment. The function of the flight control device 40 that executes the processing of step S1205 corresponds to the motor elapsed shutdown unit. On the other hand, if the inverter time Tinv has not reached the inverter time threshold TTinv, the flight control device 40 ends this power shutdown process immediately, regardless of whether the motor current Iac increases or decreases.

[0240] Tenth Embodiment In the first embodiment, one propulsion device 100 has only one inverter device 80. In contrast, in the tenth embodiment, one propulsion device 100 has a plurality of inverter devices 80. Configurations, actions, and effects that are not specifically described in the tenth embodiment are the same as those in the first embodiment. The tenth embodiment will be described mainly focusing on the differences from the first embodiment.

[0241] As shown in Figure 23, one propulsion device 100 has one motor device 60 and multiple inverter devices 80. In the propulsion device 100, each of the multiple inverter devices 80 controls a motor 61. In each of the multiple inverter devices 80, an inverter circuit 85 supplies power to the motor stator 62. In each of the multiple inverter devices 80, an inverter control unit 81 controls the motor.

[0242] For example, one propulsion device 100 has m inverter devices 80 and m×n-phase motors 61, where m and n are natural numbers. In this propulsion device 100, each of the m inverter devices 80 drives an n-phase motor 61. For example, the stator coil 62a is an m×n-phase coil. Each of the m inverter devices 80 supplies power to the n-phase stator coil 62a.

[0243] In the propulsion system 30, a plurality of batteries 31 are provided for one propulsion device 100. In one propulsion device 100, a plurality of inverter devices 80 are connected to separate batteries 31 so as to be electrically connected thereto. For example, the propulsion system 30 has two batteries 31. In one propulsion device 100, a power switch 86 is provided individually for each of the plurality of inverter devices 80.

[0244] In this embodiment, the flight control processing will be described with reference to the flowchart in Figure 24. The flight control device 40 performs the same processing as in the first embodiment in steps S101 to S105 and S110 to S112 shown in Figure 24. If there is one abnormal EPU in step S105, the flight control device 40 proceeds to step S1501 and performs multi-inverter processing. In multi-inverter processing, the operation of at least one inverter device 80 in the abnormal EPU is stopped.

[0245] The multi-inverter processing will be described with reference to the flowchart in Figure 25. In step S1601 of the multi-inverter processing, the flight control device 40 determines whether an abnormality has occurred in the first inverter device of the abnormal EPU. The flight control device 40 designates one of the multiple inverter devices 80 in the abnormal EPU as the first inverter device. The flight control device 40 determines whether an abnormality has occurred in the first inverter device by, for example, determining whether the sensor value of the first inverter device is abnormal.

[0246] For example, the flight control device 40 sets the inverter device 80 that is most likely to have an abnormality among the multiple inverter devices 80 in the abnormal EPU as the first inverter device. The flight control device 40 acquires sensor values ​​for each of the multiple inverter devices 80 in the abnormal EPU and uses these sensor values ​​to estimate the possibility of an abnormality occurring for each of the multiple inverter devices 80.

[0247] If an abnormality occurs in the first inverter device, the flight control device 40 proceeds to step S1602. In step S1602, the flight control device 40 determines whether an abnormality has occurred in all other inverter devices. The flight control device 40 defines all inverter devices 80 other than the first inverter device among the multiple inverter devices 80 in the abnormal EPU as other inverter devices. The other inverter device is at least one inverter device 80. The flight control device 40 determines whether an abnormality has occurred in the other inverter device by, for example, determining whether the sensor value of the other inverter device is abnormal.

[0248] If no abnormality has occurred in the other inverter devices, the flight control device 40 proceeds to step S1603. In step S1603, the flight control device 40 performs multi-shutdown processing for the first inverter device. In this multi-shutdown processing, the same processing as steps S106 to S109 in the first embodiment is performed for the first inverter device. In other words, in this multi-shutdown processing, the drive of the first inverter device is stopped. The function in the flight control device 40 that executes the processing of step S1603 corresponds to the abnormality shutdown unit.

[0249] In step S1604, the flight control device 40 determines whether the EPU abnormality that occurred in the abnormal EPU has been resolved. With the drive of the first inverter device stopped, the flight control device 40 determines whether the EPU abnormality has been resolved for the abnormal EPU using sensor values, etc. If the EPU abnormality in the abnormal EPU has been resolved, the flight control device 40 simply ends this multi-inverter processing. In this case, the drive of the other inverter devices continues, and the drive of the abnormal EPU continues.

[0250] If the EPU abnormality occurring in the abnormal EPU is not resolved, the flight control device 40 proceeds to step S1605. In step S1605, the flight control device 40 performs abnormal EPU shutdown processing. In the abnormal EPU shutdown processing, processing is performed to shut down the abnormal EPU. For example, the flight control device 40 performs multi-shutdown processing for all other inverter devices. In this multi-shutdown processing, processing similar to steps S106 to S109 in the first embodiment is performed for all other inverter devices. In other words, in this multi-shutdown processing, the operation of all other inverter devices is stopped.

[0251] In step S1602, if an abnormality occurs in the other inverter device, the flight control device 40 proceeds to step S1605 and performs abnormal EPU shutdown processing. In this case, the flight control device 40 determines that an abnormality has occurred in each of the first inverter device and the other inverter device, and stops driving the abnormal EPU. For example, if an abnormality occurs in at least one other inverter device, the flight control device 40 stops driving the abnormal EPU.

[0252] If no abnormality has occurred in at least one of the other inverter devices in step S1602, the flight control device 40 may continue driving the abnormal EPU by continuing to drive the other inverter devices that are not abnormal. In this case, the flight control device 40 stops driving the other inverter device in which the abnormality has occurred, resolves the EPU abnormality in the abnormal EPU, and then continues driving the abnormal EPU.

[0253] The flight control device 40 also repeatedly performs multi-inverter processing so that all inverter devices 80 are sequentially set as the first inverter device. For example, the flight control device 40 sets the first inverter device 80 as the first inverter device in step S1601 during the current multi-inverter processing. Then, the flight control device 40 sequentially sets the second and subsequent inverter devices 80 as the first inverter device in step S1601 during the next and subsequent multi-inverter processing.

[0254] 24 , after step S1501, the flight control device 40 proceeds to step S110 to perform abnormality notification processing. In this abnormality notification processing, EPU abnormalities such as an abnormality in the first inverter device or the halting of operation of the abnormal EPU are notified. Furthermore, if there are multiple abnormal EPUs, the flight control device 40 may perform multi-inverter processing on the first abnormal EPU in step S111.

[0255] In this embodiment, the number of inverter devices 80 to be stopped in the abnormal EPU is set according to the state of the EPU abnormality. In this configuration, in the abnormal EPU, stopping the operation of all inverter devices 80 or stopping the operation of specific inverter devices 80 is selected depending on the state of the abnormality related to the motor 61. That is, stopping the abnormal EPU or continuing to operate the abnormal EPU is selected. This prevents a situation in which all inverter devices 80 are stopped and the abnormal EPU loses its output completely, even though normal inverter devices 80 exist in the abnormal EPU. Furthermore, if no normal inverter devices 80 exist in the abnormal EPU, stopping the operation of all inverter devices 80 can prioritize preventing the spread and progression of the abnormality in the abnormal EPU. In this way, selecting the inverter devices 80 to be stopped according to the state of the abnormality prevents insufficient output from the EPU 50 while ensuring the safety of the eVTOL 10.

[0256] In this embodiment, if the EPU abnormality is not resolved even after the first inverter device is stopped, the abnormal EPU is stopped. In this configuration, the other inverter devices continue to be driven, thereby preventing the abnormality from spreading or progressing in the abnormal EPU. In addition, this configuration prevents the EPU abnormality in the abnormal EPU from spreading to other EPUs 50.

[0257] It is preferable to apply the seventh embodiment to this embodiment. That is, in this embodiment, it is preferable to provide a motor switch 87 in the motor path 132. In this embodiment, when the EPU abnormality is resolved by stopping the drive of the first inverter device, the drive of the EPU 50 is continued by the other inverter device. In this case, the motor 61 is driven by the other inverter device, and regenerative power generated by the rotation of the motor rotor 63 is supplied to the first inverter device. In the first inverter device, there is a concern that the regenerative current will flow through the arm switches 116, 117 or the smoothing capacitor 114, causing the abnormality to spread or progress.

[0258] In contrast, by applying the configuration of the seventh embodiment to this embodiment, the motor path 132 in the first inverter device is cut off by the motor switch 87. In this configuration, the supply of regenerative power from the motor 61 to the first inverter device is cut off by the motor switch 87. Therefore, in the first inverter device, it is possible to prevent the regenerative current from accelerating the spread and progression of the abnormality.

[0259] Eleventh Embodiment In the first embodiment, inverter shutdown processing is performed in the multi-shutdown processing. In contrast, in the eleventh embodiment, one of multi-shutdown processing and inverter shutdown processing is performed. Configurations, actions, and effects that are not specifically described in the eleventh embodiment are the same as those in the first embodiment. In the eleventh embodiment, differences from the first embodiment will be mainly described.

[0260] In this embodiment, the flight control processing will be described with reference to the flowchart in Figure 26. The flight control device 40 performs the same processing as in the first embodiment in steps S101 to S105 and S110 to S112 shown in Figure 26. If there is one abnormal EPU in step S105, the flight control device 40 proceeds to step S1701 and performs shutdown setting processing. In the shutdown setting processing, the supply path 130 is shut off by at least one of the arm switches 116, 117 and the power switch 86 in a manner corresponding to the EPU abnormality state. The function of the flight control device 40 that executes the processing of step S1701 corresponds to the abnormality shutdown unit.

[0261] The shutdown setting process will be described with reference to the flowchart in Figure 27. In step S1801 shown in Figure 27, the flight control device 40 determines whether a dead short has occurred as an abnormality related to the motor 61. By determining whether a dead short has occurred, the flight control device 40 determines whether to perform multi-shutdown processing or inverter shutdown processing. The flight control device 40 selects either multi-shutdown processing or inverter shutdown processing depending on the state of the abnormality related to the motor 61. The function in the flight control device 40 that executes the processing of step S1801 corresponds to the shutdown selection unit.

[0262] If a dead short occurs, the flight control device 40 determines that multi-shutdown processing must be performed. Note that the type of short circuit, such as a dead short circuit, or the location of the short circuit in the supply path 130 may be used as the condition that requires multi-shutdown processing for an abnormality related to the motor 61.

[0263] If a dead short occurs, the flight control device 40 performs multi-shutdown processing in steps S1802 and S1803. The flight control device 40 performs inverter shutdown processing in step S1802 and power shutdown processing in S1803. That is, the flight control device 40 shuts off the supply path 130 using both the arm switches 116 and 117 and the power switch 86 in steps S1802 and S1803. The function in the flight control device 40 that executes the processing in steps S1802 and S1803 corresponds to a dual shutdown unit. Furthermore, the function in the flight control device 40 that executes the processing in step S1802 corresponds to a current reduction unit. Furthermore, the function in the flight control device 40 that executes the processing in step S1803 corresponds to a power shutdown unit.

[0264] If the abnormality related to the motor 61 does not include a dead short, the flight control device 40 performs inverter shutdown processing in step S1804. In this case, the flight control device 40 does not perform power shutdown processing. The flight control device 40 shuts off the supply path 130 using only the arm switches 116 and 117 out of the arm switches 116 and 117 and the power switch 86. The function of the flight control device 40 that executes the processing of step S1804 corresponds to the conversion shutdown unit.

[0265] 26, after step S1701, the flight control device 40 proceeds to step S110 and performs an abnormality notification process. This abnormality notification process notifies the user that only the multi-shutdown process or only the inverter shutdown process has been performed. Furthermore, if there are multiple abnormal EPUs, the flight control device 40 may perform a shutdown setting process for the first EPU in step S111.

[0266] According to this embodiment, the flight control device 40 selects one of the multi-shutdown processing and the inverter shutdown processing depending on the abnormality state related to the motor 61. With this configuration, the multi-shutdown processing can be performed only when the abnormality state related to the motor 61 requires the power switch 86 to shut off the abnormality current. This prevents the multi-shutdown processing from being omitted even when the power switch 86 needs to shut off the abnormality current. This prevents the safety of the eVTOL 10 from being reduced by the multi-shutdown processing. Furthermore, it prevents the multi-shutdown processing from being performed in a situation where the power switch 86 does not necessarily need to shut off the abnormality current. This reduces the frequency of operation of the power switch 86, which is a mechanical switch, thereby reducing the load on the power switch 86. As described above, the load on the power switch 86 can be managed while improving the safety of the eVTOL 10.

[0267] <Twelfth Embodiment> In the eleventh embodiment, the configuration in which one of the multi-shutdown processing and the inverter shutdown processing is performed is applied to the first embodiment. In contrast, in the twelfth embodiment, the configuration in which one of the multi-shutdown processing and the inverter shutdown processing is performed is applied to the seventh embodiment. Configurations, actions, and effects that are not specifically described in the twelfth embodiment are the same as those in the seventh embodiment. The twelfth embodiment will be described mainly focusing on the differences from the seventh embodiment.

[0268] The flight control device 40 performs the cutoff setting process in step S1701, as in the eleventh embodiment. In this embodiment, the cutoff setting process will be described with reference to the flowchart in Fig. 28. In step S1901 shown in Fig. 28, the flight control device 40 determines whether a dead short has occurred, as in step S1801 in the eleventh embodiment. The function in the flight control device 40 that executes the process of step S1901 corresponds to the cutoff selection unit.

[0269] If a dead short occurs, the flight control device 40 performs multi-shutdown processing in steps S1902 to S1904. The flight control device 40 performs inverter shutdown processing in step S1902, power supply shutdown processing in step S1903, and motor shutdown processing in step S1904. The flight control device 40 shuts off the supply path 130 using all of the arm switches 116 and 117, the power switch 86, and the motor switch 87. Note that the flight control device 40 may perform one of the power supply shutdown processing and the motor shutdown processing after the other, or may perform both simultaneously.

[0270] The functions in the flight control device 40 that execute the processing of steps S1902 and S1903 correspond to both the cutoff unit. The function in the flight control device 40 that executes the processing of step S1902 corresponds to the current reduction unit. The function in the flight control device 40 that executes the processing of step S1903 corresponds to the power cutoff unit.

[0271] If the abnormality related to the motor 61 does not include a dead short, the flight control device 40 performs inverter shutdown processing in step S1905. In this case, the flight control device 40 does not perform power shutdown processing or inverter shutdown processing. The flight control device 40 shuts off the supply path 130 only using the arm switches 116 and 117 out of the arm switches 116 and 117, the power switch 86, and the motor switch 87. The function in the flight control device 40 that executes the processing of step S1905 corresponds to the conversion shutdown unit.

[0272] <Thirteenth Embodiment> In the thirteenth embodiment, when a short circuit occurs in the arm switches 116, 117 as an abnormality related to the motor 61, the power switch 86 is shut off. The configurations, actions, and effects not specifically described in the thirteenth embodiment are the same as those in the first embodiment. The thirteenth embodiment will be described mainly focusing on the differences from the first embodiment.

[0273] In this embodiment, the flight control process will be described with reference to the flowchart of Fig. 29. The flight control device 40 performs the same processes as in the first embodiment in steps S101 to S105 and S110 to S114 shown in Fig. 29.

[0274] In step S105, if there is one abnormal EPU, the flight control device 40 proceeds to step S2001 and performs short-circuit response processing. In the short-circuit response processing, if a short circuit occurs in the arm switches 116, 117, processing is performed to prevent the occurrence of an abnormality such as a secondary failure in the inverter circuit 85, etc., due to the short circuit in the arm switches 116, 117.

[0275] The short circuit response processing will be described with reference to the flowchart in Figure 30. In step S2101 of the short circuit response processing, the flight control device 40 determines whether a short circuit has occurred in the arm switches 116, 117. For example, the flight control device 40 determines whether a short circuit has occurred in each of the multiple arm switches 116, 117 using detection signals from various sensors such as the voltage sensors 125, 126.

[0276] The inverter device 80 has a terminal voltage sensor for detecting the terminal voltage of the arm switches 116, 117. For example, a terminal voltage sensor is provided for each of the upper arm switch 116 and the lower arm switch 117 (not shown). The flight control device 40 detects the terminal voltage of the arm switches 116, 117 using the detection signal of the terminal voltage sensor. The flight control device 40 then detects a short circuit of the arm switches 116, 117 using the terminal voltage of the arm switches 116, 117 and the switch drive voltage. The terminal voltage is the voltage between the input terminal and the output terminal of the arm switches 116, 117. For example, in a MOSFET, the drain-source voltage is the terminal voltage, and the gate voltage is the switch drive voltage.

[0277] The flight control device 40 also identifies the arm switch 116, 117 in which the short circuit has occurred. For example, the flight control device 40 determines in which phase the short circuit has occurred, and in which of the upper arm switch 116 and the lower arm switch 117 the short circuit has occurred. The upper arm switch 116 is connected to the P line 111 and is therefore located on the high potential side of the inverter circuit 85. The lower arm switch 117 is connected to the N line 112 and is therefore located on the low potential side of the inverter circuit 85. In each of the multiple phases, the upper arm switch 116 and the lower arm switch 117 are connected in series.

[0278] When a short circuit occurs in the arm switches 116 and 117, the arm switches 116 and 117 include a short-circuit switch SW1 and a normal switch SW2. The short-circuit switch SW1 is the arm switch in which the short circuit occurs. The normal switch SW2 is the arm switch in which the short circuit does not occur.

[0279] The normal switches SW2 include a horizontal switch SW2a, a first series switch SW2b, and a second series switch SW2c. The horizontal switch SW2a is provided next to the short-circuit switch SW1 in the inverter circuit 85. The horizontal switch SW2a is an arm switch, of the upper arm switch 116 and the lower arm switch 117, that is on the same potential side as the short-circuit switch SW1. The first series switch SW2b is an arm switch connected in series to the short-circuit switch SW1. The second series switch SW2c is an arm switch connected in series to the horizontal switch SW2a.

[0280] The horizontal switch SW2a and the second series switch SW2c are connected in parallel to the short-circuit switch SW1. The horizontal switch SW2a and the second series switch SW2c are provided in a phase different from the short-circuit switch SW1 among the multiple phases, and are therefore arranged in parallel with the short-circuit switch SW1. The horizontal switch SW2a and the second series switch SW2c correspond to parallel switches.

[0281] 31, if a short circuit occurs in the lower arm switch 117 of the U phase, the lower arm switch 117 of the U phase is the short-circuit switch SW1. In this case, the upper arm switch 116 of the U phase is the first series switch SW2b. In the V and W phases, each lower arm switch 117 is the horizontal switch SW2a, and each upper arm switch 116 is the second series switch SW2c.

[0282] If a short circuit occurs in the arm switches 116, 117, the flight control device 40 proceeds to step S2102. In step S2102, the flight control device 40 performs power shutdown processing, similar to step S108 in the first embodiment. Note that, before performing the power shutdown processing, the flight control device 40 may perform inverter shutdown processing in step S106 and a power shutdown request determination in step S107, similar to the first embodiment.

[0283] The flight control device 40 performs current distribution processing in steps S2103 to S2108. In current distribution processing, when a regenerative current is generated in the motor 61, the arm switches 116, 117 are controlled so that the regenerative current is distributed to each of the arm switches 116, 117 for multiple phases. For example, the flight control device 40 controls the normal switch SW2 so that the regenerative current is distributed to the short-circuit switch SW1 and the side-by-side switch SW2a.

[0284] In step S2103, the flight control device 40 determines whether a short circuit has occurred in the upper arm switch 116. If a short circuit has occurred in the upper arm switch 116, at least one of the multiple upper arm switches 116 is the short-circuit switch SW1. In this case, the horizontal switch SW2a is one of the multiple upper arm switches 116. Furthermore, the series switches SW2b and SW2c are one of the multiple lower arm switches 117.

[0285] If a short circuit occurs in the upper arm switch 116, the flight control device 40 proceeds to step S2104. In step S2104, the flight control device 40 cuts off the lower arm switch 117, which is connected in series to the short-circuit switch SW1 and the horizontal switch SW2a, among the multiple normal switches SW2. That is, the flight control device 40 cuts off the series switches SW2b and SW2c included in the multiple lower arm switches 117. For example, in the inverter circuit 85, all lower arm switches 117 are turned off. The function of the flight control device 40 that executes the processing of step S2104 corresponds to the series cutoff unit.

[0286] In step S2105, the flight control device 40 energizes the upper arm switch 116, which is connected in parallel to the short-circuit switch SW1, among the multiple normal switches SW2. That is, the flight control device 40 energizes the horizontally arranged switch SW2a included in the multiple upper arm switches 116. The multiple upper arm switches 116 include at least one horizontally arranged switch SW2a. For example, in the inverter circuit 85, all upper arm switches 116 except for the short-circuit switch SW1 are turned on. The function of the flight control device 40 that executes the processing of step S2105 corresponds to the parallel energization unit.

[0287] When at least one upper arm switch 116 becomes the short-circuit switch SW1, the flight control device 40 may output an ON signal to the short-circuit switch SW1 in addition to the horizontal switch SW2a to turn on the short-circuit switch SW1. For example, the flight control device 40 may apply a switch drive voltage to the short-circuit switch SW1 to turn on the short-circuit switch SW1. With this configuration, for example, if the short-circuit state of the short-circuit switch SW1 is unintentionally released, the switch that was the short-circuit switch SW1 can be turned on together with the horizontal switch SW2a. In this case, it is possible to avoid a situation where the current balance in the upper and lower arm circuits 115 of multiple phases is disrupted by the horizontal switch SW2a being turned on while the switch that was the short-circuit switch SW1 is turned off.

[0288] If no short circuit has occurred in the upper arm switch 116, the flight control device 40 proceeds to step S2106. In step S2106, the flight control device 40 determines whether or not a short circuit has occurred in the lower arm switch 117. If a short circuit has occurred in the lower arm switch 117, at least one of the multiple lower arm switches 117 is the short-circuit switch SW1. In this case, the horizontal switch SW2a is one of the multiple lower arm switches 117. Furthermore, the series switches SW2b and SW2c are one of the multiple upper arm switches 116.

[0289] If a short circuit has occurred in the lower arm switch 117, the flight control device 40 proceeds to step S2107. In step S2107, the flight control device 40 cuts off the upper arm switch 116, which is connected in series to the short-circuit switch SW1 and the horizontal switch SW2a, among the multiple normal switches SW2. That is, the flight control device 40 cuts off the series switches SW2b and SW2c included in the multiple upper arm switches 116. For example, in the inverter circuit 85, all upper arm switches 116 are turned off. The function of the flight control device 40 that executes the processing of step S2107 corresponds to the series cutoff unit.

[0290] In step S2108, the flight control device 40 energizes the lower arm switch 117, which is connected in parallel to the short-circuit switch SW1, among the multiple normal switches SW2. That is, the flight control device 40 energizes the horizontally arranged switch SW2a included in the multiple lower arm switches 117. The multiple lower arm switches 117 include at least one horizontally arranged switch SW2a. For example, in the inverter circuit 85, all lower arm switches 117 except for the short-circuit switch SW1 are turned on. The function of the flight control device 40 that executes the processing of step S2108 corresponds to the parallel energization unit.

[0291] In addition, when at least one lower arm switch 117 becomes the short-circuit switch SW1, the flight control device 40 may output an on signal to the short-circuit switch SW1, in the same way as when at least one upper arm switch 116 becomes the short-circuit switch SW1.

[0292] 31, if one short-circuit switch SW1 trips, the flight control device 40 turns on all of the horizontal switches SW2a and turns off all of the series switches SW2b and SW2c. In this case, the regenerative current Ir generated by the motor 61 flows not only through the short-circuit switch SW1 but also through the multiple horizontal switches SW2a. In the propulsion system 30, even if the power switch 86 is turned off, the regenerative current Ir generated by the rotation of the propeller 20 may flow from the motor 61 to the short-circuit switch SW1.

[0293] For example, unlike the present embodiment, assume a configuration in which, when one short-circuit switch SW1 is turned off, all of the horizontal switches SW2a and all of the series switches SW2b and SW2c are turned off. In this configuration, the regenerative current Ir generated by the motor 61 tends to flow only through the one short-circuit switch SW1. Therefore, the regenerative current Ir flowing through the short-circuit switch SW1 tends to become large. In contrast, in the present embodiment, the regenerative current Ir is distributed between the short-circuit switch SW1 and the horizontal switch SW2a, so the regenerative current Ir flowing through the short-circuit switch SW1 is less likely to become large.

[0294] According to this embodiment, when the short-circuit switch SW1 is tripped, the flight control device 40 energizes at least one of the parallel switches, the horizontal switch SW2a. In this case, even if the power supply from the battery 31 to the motor 61 is interrupted by the power switch 86 and a regenerative current Ir is generated in the motor 61, the regenerative current Ir flows so as to be distributed between the short-circuit switch SW1 and the horizontal switch SW2a. This reduces the regenerative current Ir flowing through the short-circuit switch SW1. For example, the peak value of the regenerative current Ir flowing through the short-circuit switch SW1 can be reduced. This prevents a large regenerative current Ir from flowing through the short-circuit switch SW1, causing an abnormality such as a secondary failure in the short-circuit switch SW1, the inverter circuit 85, or the inverter device 80. For example, a secondary failure in the inverter circuit 85 may occur when the large regenerative current Ir passing through the short-circuit switch SW1 causes the normal switch SW2 or the normal diodes 116a and 117a to malfunction.

[0295] According to this embodiment, when the short-circuit switch SW1 is activated, the flight control device 40 energizes the horizontal switch SW2a, which is on the same potential side as the short-circuit switch SW1, of the upper arm switch 116 and the lower arm switch 117. In this case, the regenerative current Ir can flow only to one of the high potential side, which is the upper arm switch 116 side, and the low potential side, which is the lower arm switch 117 side. Therefore, while managing the flow destination of the regenerative current Ir, the horizontal switch SW2a can prevent a large regenerative current Ir from flowing through the short-circuit switch SW1.

[0296] In this embodiment, if a short circuit occurs in the arm switches 116 and 117, the presence of the short-circuit switch SW1 prevents the current flowing through the inverter circuit 85 from being completely cut off even if all arm switches 116 and 117 other than the short-circuit switch SW1 are turned off. Furthermore, even if the power supply from the battery 31 to the motor 61 is cut off by the power switch 86, the propeller 20 does not suddenly stop. Therefore, in a configuration such as this embodiment that does not have a motor switch 87 that cuts off the motor 61 and the inverter circuit 85, there is a concern that the rotation of the propeller 20 generates electromotive force as regenerative power, causing a large current to flow through the short-circuited part, the short-circuited part, the short-circuit switch SW1. Therefore, in this embodiment, the arm switches 116 and 117 that are different from the short-circuited part, such as the short-circuit switch SW1, are also turned on, thereby dispersing the regenerative current Ir flowing through the inverter circuit 85 and protecting the short-circuit switch SW1.

[0297] According to this embodiment, when the short-circuit switch SW1 is tripped, the flight control device 40 switches off both the first series switch SW2b connected in series to the short-circuit switch SW1 and the second series switch SW2c connected in series to the side-by-side switch SW2a. In this configuration, the series switches SW2b and SW2c prevent the P line 111 and the N line 112 from being short-circuited by the arm switches 116 and 117. Therefore, the series switches SW2b and SW2c can prevent abnormalities from occurring in the inverter device 80 or the like due to a short-circuit between the P line 111 and the N line 112.

[0298] <Fourteenth Embodiment> In a fourteenth embodiment, when a short circuit occurs in the arm switches 116, 117, the horizontal switch SW2a may be turned on depending on the generation state of the regenerative current Ir. The configurations, actions, and effects not specifically described in the fourteenth embodiment are the same as those of the thirteenth embodiment. The fourteenth embodiment will be described mainly focusing on the differences from the thirteenth embodiment.

[0299] In this embodiment, the short circuit response processing will be described with reference to the flowchart of Fig. 32. The flight control device 40 performs the same processing as in the thirteenth embodiment in steps S2101 to S2108 shown in Fig. 32.

[0300] After performing power shutdown processing in step S2102, the flight control device 40 proceeds to step S2201. In step S2201, the flight control device 40 determines whether the regenerative current Ir is equal to or greater than the regenerative current threshold JIr. For example, the flight control device 40 determines whether the regenerative current Ir flowing through the short-circuit switch SW1 without distributing the regenerative current Ir between the short-circuit switch SW1 and the horizontal switch SW2a is equal to or greater than the regenerative current threshold JIr. The flight control device 40 calculates the regenerative current Ir flowing through the short-circuit switch SW1 using a detection signal from the motor current sensor 122 or the like. The regenerative current threshold JIr is a value determined in advance through testing or the like and is stored in the memory 43 or the like. The regenerative current threshold JIr is set to a small value that makes it unlikely that a secondary failure of the inverter circuit 85 or the like will occur even if the regenerative current Ir flows through the short-circuit switch SW1.

[0301] If the regenerative current Ir is not equal to or greater than the regenerative current threshold JIr, the flight control device 40 proceeds to step S2202. In step S2202, the flight control device 40 switches the normal switch SW2 to the off state. The flight control device 40 switches the lateral switch SW2a, the first series switch SW2b, and the second series switch SW2c as the normal switch SW2 to the off state. For example, in the inverter circuit 85, all of the normal switches SW2 are turned off.

[0302] If the regenerative current Ir is equal to or greater than the regenerative current threshold JIr, the flight control device 40 performs steps S2103 to S2108, as in the thirteenth embodiment. That is, if the regenerative current Ir is large enough to cause an abnormality such as a secondary fault in the short-circuit switch SW1, the flight control device 40 performs processing to distribute the regenerative current Ir between the short-circuit switch SW1 and the horizontal switch SW2a.

[0303] According to this embodiment, when an abnormality occurs in the arm switches 116, 117 and the regenerative current Ir is not equal to or greater than the regenerative current threshold JIr, all of the normal switches SW2 are turned off. In this configuration, even if the short-circuit switch SW1 is turned on, as long as the regenerative current Ir flowing through the short-circuit switch SW1 is sufficiently small, priority can be given to preventing an abnormality in the inverter circuit 85 that would otherwise occur if the horizontal switch SW2 a is turned on.

[0304] In this embodiment, the flight control device 40 may turn off the normal switch SW2 in step S2202 if the regenerative current Ir in each of the multiple phases is not equal to or greater than the regenerative current threshold JIr. In this configuration, the flight control device 40 may perform processing in steps S2103 to S2108 to distribute the regenerative current Ir to the short-circuit switch SW1 and the lateral switch SW2a if the regenerative current Ir in at least one phase is equal to or greater than the regenerative current threshold JIr.

[0305] In this embodiment, the temperatures of the arm switches 116 and 117 may be used to determine whether the regenerative current Ir is sufficiently small in step S2201. For example, the flight control device 40 calculates the temperatures of the short-circuit switch SW1, the horizontal switch SW2a, and the second series switch SW2c using detection signals from various sensors, and determines whether the regenerative current Ir is sufficiently small using the temperatures of these switches SW1, SW2a, and SW2c. Examples of cases in which the regenerative current Ir is sufficiently small include when the temperature of the short-circuit switch SW1 is lower than a predetermined temperature, when the temperature of the horizontal switch SW2a is lower than a predetermined temperature, or when the temperature of the second series switch SW2c is lower than a predetermined temperature. Furthermore, the regenerative current Ir is likely to be sufficiently small when the temperature difference between the short-circuit switch SW1 and the horizontal switch SW2a or the second series switch SW2c is smaller than a predetermined temperature difference.

[0306] In this embodiment, the regenerative current Ir does not have to be used to determine whether the regenerative current Ir is sufficiently small in step S2201. For example, the flight control device 40 may determine whether the regenerative current Ir is sufficiently small using the rotation speed of the propeller 20 or the motor 61. The flight control device 40 calculates the rotation speed of the propeller 20 or the motor 61 using detection signals from various sensors, and determines whether the rotation speed of the propeller 20 or the motor 61 is equal to or greater than a predetermined rotation speed threshold. The flight control device 40 may turn off the normal switch SW2 if the rotation speed is less than the rotation speed threshold. If the rotation speed is equal to or greater than the rotation speed threshold, the flight control device 40 may perform processing to distribute the regenerative current Ir to the short-circuit switch SW1 and the horizontal switch SW2a.

[0307] Fifteenth Embodiment In a fifteenth embodiment, one motor 61 may be driven by a plurality of inverter circuits 85. Configurations, actions, and effects not specifically described in the fifteenth embodiment are the same as those in the first embodiment. In the fifteenth embodiment, differences from the first embodiment will be mainly described.

[0308] As in the tenth embodiment, the propulsion system 30 has a plurality of inverter devices 80. For example, as shown in Fig. 33 , the propulsion system 30 has a first inverter device 80A and a second inverter device 80B. The propulsion system 30 has devices, parts, etc. associated with each of the first inverter device 80A and the second inverter device 80B.

[0309] The names of devices and parts related to the first inverter device 80A have the "1" added to them, and the "A" added to their reference symbols. For example, the propulsion system 30 has a first battery 31A, a first power switch 86A, a first supply path 130A, a first power path 131A, and a first motor path 132A. The first inverter device 80A has a first inverter circuit 85A. The first inverter circuit 85A corresponds to a first power conversion unit.

[0310] The "2" is added to the names of devices and parts related to the second inverter device 80B, and the "B" is added to the reference numerals. For example, the propulsion system 30 has a second battery 31B, a second power switch 86B, a second supply path 130B, a second power path 131B, and a second motor path 132B. The second inverter device 80B has a second inverter circuit 85B. The second inverter circuit 85B corresponds to a second power conversion unit.

[0311] 33, the first battery 31A is shown as BAT1, the first inverter device 80A as MCU1, and the first inverter circuit 85A as INV1. The second battery 31B is shown as BAT2, the second inverter device 80B as MCU2, and the second inverter circuit 85B as INV2. The gear 51 is shown as Gear.

[0312] The motor 61 is a six-phase motor. The motor 61 has two three-phase stator coils 62a. The motor 61 has a first stator coil 62aA and a second stator coil 62aB. Power is supplied to the first stator coil 62aA from the first battery 31A via a first inverter circuit 85A. The first stator coil 62aA is included in a first motor path 132A. Power is supplied to the second stator coil 62aB from the second battery 31B via a second inverter circuit 85B. The second stator coil 62aB is included in a second motor path 132B.

[0313] The first inverter circuit 85A and the second inverter circuit 85B can independently drive the motor 61. When both the first inverter circuit 85A and the second inverter circuit 85B drive the motor 61, the motor 61 is driven in six phases as a six-phase motor. When only one of the first inverter circuit 85A and the second inverter circuit 85B drives the motor 61, the motor 61 is driven in three phases as a three-phase motor.

[0314] The EPU 50 has a gear 51. The gear 51 mechanically connects the motor 61 and the propeller 20. The gear 51 transmits the drive of the motor 61 to the propeller 20. The gear 51 is provided between the motor 61 and the propeller 20. The gear 51 is configured to include a reducer. The gear 51 is sometimes referred to as a gear box or a gear device.

[0315] Next, the flight control process will be described with reference to the flowchart of Fig. 34. The flight control device 40 performs the same processes as in the first embodiment in steps S101 to S105 and S110 to S114 shown in Fig. 34.

[0316] In step S105, if one EPU is abnormal, the flight control device 40 proceeds to step S2301 and performs propeller stop processing. In the propeller stop processing, if a short circuit occurs in the arm switches 116 and 117, processing is performed to stop the rotation of the propeller 20 by stopping the drive of the motor 61.

[0317] The propeller stopping process will be described with reference to the flowchart in Figure 35. In step S2401 of the propeller stopping process, the flight control device 40 determines whether a short circuit has occurred in the arm switches 116, 117 in each of the first inverter circuit 85A and the second inverter circuit 85B.

[0318] The flight control device 40 also determines whether the arm switches 116, 117 have been shorted in the first inverter circuit 85A or the second inverter circuit 85B. The flight control device 40 identifies the inverter circuit in which the arm switches 116, 117 have been shorted, either the first inverter circuit 85A or the second inverter circuit 85B, as the short circuit IC1. In other words, the flight control device 40 identifies the inverter circuit in which the arm switches 116, 117 have not been shorted, either the first inverter circuit 85A or the second inverter circuit 85B, as the normal circuit IC2. The short circuit switch SW1 is included in the short circuit IC1, but is not included in the normal circuit IC2. The short circuit IC1 corresponds to a short conversion unit.

[0319] In step S2402, the flight control device 40 performs power shutdown processing on the short circuit IC1, similar to step S2102 in the thirteenth embodiment. By performing power shutdown processing on the short circuit IC1, the flight control device 40 stops driving the motor 61 by the short circuit IC1. After performing power shutdown processing on the short circuit IC1, the flight control device 40 drives the motor 61 as a three-phase motor using the normal circuit IC2. In step S2403, the flight control device 40 performs current dispersion processing on the short circuit IC1, similar to steps S2103 to S2108 in the thirteenth embodiment.

[0320] In step S2404, the flight control device 40 performs propeller deceleration processing on the normal circuit IC2. In the propeller deceleration processing, the normal circuit IC2 drives the motor 61 so that the rotation of the propeller 20 decelerates. The flight control device 40 controls the normal circuit IC2 so that the rotation speed of the propeller 20 gradually decreases. The flight control device 40 decelerates the rotation of the motor 61, thereby decelerating the rotation of the propeller 20. In the propulsion system 30, the flight control device 40 decelerates the rotation of the propeller 20, thereby limiting the rotation of the motor 61. The function of the flight control device 40 that executes the processing of step S2404 corresponds to the rotation limiting unit.

[0321] In step S2405, the flight control device 40 determines whether the rotation speed Rn is equal to or less than the rotation speed threshold JRn. The rotation speed Rn is the rotation speed of the propeller 20 and the motor 61. The flight control device 40 calculates the rotation speed Rn using detection signals from various sensors. The rotation speed threshold JRn is a value determined in advance through testing or the like, and is stored in the memory 43 or the like. The rotation speed threshold JRn is a value that indicates that the rotation speed Rn is sufficiently small to lock the propeller 20. When the propeller 20 is locked, the propeller 20 is held at a predetermined angle so as not to rotate.

[0322] If the rotation speed Rn is not equal to or less than the rotation speed threshold JRn, the flight control device 40 terminates the propeller stopping process without locking the propeller 20. The flight control device 40 repeats the processes of steps S2401 to S2404 until the rotation speed Rn becomes equal to or less than the rotation speed threshold JRn.

[0323] If the rotation speed Rn is equal to or less than the rotation speed threshold JRn, the flight control device 40 proceeds to step S2406. In step S2406, the flight control device 40 performs propeller lock processing on the normal circuit IC2. In the propeller lock processing, processing to lock the propeller 20 is performed. For example, the flight control device 40 drives the normal circuit IC2 so that the propeller 20 is maintained at a predetermined angle. The normal circuit IC2 drives the normal circuit IC2 to maintain the rotation speed Rn at zero. For example, the normal circuit IC2 drives the normal circuit IC2 so that a force is generated between the motor stator 62 and the motor rotor 63 that maintains the angle of the motor rotor 63 relative to the motor stator 62 at a predetermined angle. The flight control device 40 locks the propeller 20 using electrical energy. In the propulsion system 30, the flight control device 40 locks the propeller 20, thereby limiting the rotation of the motor 61. The function of the flight control device 40 that executes the processing of step S2406 corresponds to the rotation limiting unit.

[0324] According to this embodiment, when a short circuit occurs in the arm switches 116, 117 in the short circuit IC1, the flight control device 40 drives the normal circuit IC2 to limit the rotation of the motor 61. With this configuration, when a short circuit occurs in the arm switches 116, 117, the rotation of the motor 61 is limited, thereby limiting the generation of the regenerative current Ir in the short circuit IC1. This prevents the regenerative current Ir from flowing as a large current through the short circuit switch SW1 in the short circuit IC1. Therefore, the restriction of the rotation of the motor 61 by the normal circuit IC2 can prevent the regenerative current Ir from flowing through the short switch SW1, which would otherwise cause an abnormality such as a secondary fault in the inverter circuit 85, etc.

[0325] In this embodiment, the flight control device 40 may lock the propeller 20 using mechanical energy. For example, the EPU 50 may have a locking member such as a pin that locks the propeller 20 using mechanical energy. The locking member is movable between an engaged position and an released position. When in the engaged position, the locking member restricts the rotation of the motor 61 by hooking onto the motor rotor 63 or a receiving portion of the motor shaft. In this case, the locking member inhibits the rotation of the propeller 20. When in the released position, the locking member is released from the receiving portion and allows the rotation of the motor 61. In this case, the locking member does not inhibit the rotation of the propeller 20.

[0326] <16th embodiment> In a 16th embodiment, a motor switch 87 may be provided in at least one of the first motor path 132A and the second motor path 132B. Configurations, actions, and effects not specifically described in the 16th embodiment are the same as those in the 15th embodiment. The 16th embodiment will be described mainly focusing on differences from the 15th embodiment.

[0327] In this embodiment, similar to the seventh embodiment, a motor switch 87 is provided in the supply path 130. For example, a motor switch 87 is provided in each of the first motor path 132A and the second motor path 132B. As shown in FIG. 36 , the propulsion system 30 has a first motor switch 87A and a second motor switch 87B. The first motor switch 87A is the motor switch 87 provided in the first motor path 132A. The second motor switch 87B is the motor switch 87 provided in the second motor path 132B.

[0328] Next, the flight control process will be described with reference to the flowchart of Fig. 37. The flight control device 40 performs the same processes as in the first embodiment in steps S101 to S105 and S110 to S114 shown in Fig. 37.

[0329] In step S105, if one EPU is abnormal, the flight control device 40 proceeds to step S2501 and performs a propeller rotation continuation process. In the propeller rotation continuation process, if a short circuit occurs in the arm switches 116 and 117, a process is performed to continue the rotation of the propeller 20 by the motor 61.

[0330] Next, the propeller rotation continuation processing will be described with reference to the flowchart in Figure 38. In step S2601 shown in Figure 38, the flight control device 40 determines whether a short circuit has occurred, similar to step S2401 in the fifteenth embodiment. In step S2602, the flight control device 40 performs power cutoff processing on short-circuit IC1, similar to step S2402 in the fifteenth embodiment. The function in the flight control device 40 that executes the processing of step S2602 corresponds to the short-circuit power cutoff unit.

[0331] In step S2603, the flight control device 40 performs motor shutoff processing on short-circuit IC1 in the same manner as in step S1103 of the seventh embodiment. The flight control device 40 shuts off the supply path 130 on short-circuit IC1 using the power switch 86, and then shuts off the supply path 130 using the motor switch 87. The function of the flight control device 40 that executes the processing of step S2603 corresponds to the short-circuit motor shutoff unit.

[0332] In step S2604, the flight control device 40 switches the normal switch SW2 to the off state for the short circuit IC1. For example, the flight control device 40 performs inverter shutdown processing for the short circuit IC1, similar to step S106 in the first embodiment. In step S2605, the flight control device 40 performs motor drive processing for the normal circuit IC2. In the motor drive processing, processing is performed to drive the motor 61 as a three-phase motor using the normal circuit IC2. In the propulsion system 30, with the motor switch 87 electrically disconnecting the short circuit IC1 from the motor 61, the normal circuit IC2 drives the motor 61 in three phases. Therefore, even if a short circuit occurs in the arm switches 116 and 117, it is possible to continue driving the motor 61 using the normal circuit IC2.

[0333] According to this embodiment, the flight control device 40 targets the short circuit IC1, first cutting off the supply path 130 with the power switch 86, and then cutting off the supply path 130 with the motor switch 87. For example, the flight control device 40 targets the short circuit IC1, first cutting off the power path 131 with the power switch 86, and then cutting off the motor path 132 with the motor switch 87. With this configuration, the regenerative current Ir flowing from the motor 61 to the short circuit IC1 can be reliably cut off by the motor switch 87.

[0334] <Seventeenth Embodiment> In a seventeenth embodiment, a plurality of motors 61 may rotate one propeller 20. Configurations, actions, and effects that are not specifically described in the seventeenth embodiment are the same as those in the fifteenth embodiment. The fifteenth embodiment will be described mainly focusing on the differences from the fifteenth embodiment.

[0335] The propulsion system 30 has a plurality of motors 61. For example, as shown in FIG. 39 , the propulsion system 30 has a first motor device 60A and a second motor device 60B. The first motor device 60A has a first motor 61A as its motor 61. The first motor 61A has a first stator coil 62aA. The first motor 61A is driven by a first inverter circuit 85A. The second motor device 60B has a second motor 61B as its motor 61. The second motor 61B has a second stator coil 62aB. The second motor 61B is driven by a second inverter circuit 85B. In FIG. 39 , the first motor device 60A is illustrated as MOT1, and the second motor device 60B is illustrated as MOT2.

[0336] The first motor 61A and the second motor 61B are each a three-phase motor. When both the first motor 61A and the second motor 61B are driven, the gear 51 can rotate the propeller 20 by both the first motor 61A and the second motor 61B. In this case, the propeller 20 is rotated by two three-phase motors. When only one of the first motor 61A and the second motor 61B is driven, the gear 51 can rotate the propeller 20 by only one of the first motor 61A and the second motor 61B. In this case, the propeller 20 is rotated by one three-phase motor.

[0337] For example, the gear 51 is configured to include a one-way clutch or an electromagnetic clutch. The gear 51 has a power interruption function that interrupts the transmission of power from either the first motor 61A or the second motor 61B, whichever is stopped, to the propeller 20. Note that in a configuration in which the gear 51 does not have a power interruption function, it is preferable that the flight control device 40 perform processing to disperse the regenerative current Ir or processing to stop the rotation of the propeller 20, as in the fifteenth embodiment.

[0338] In this embodiment, if a short circuit occurs in the arm switches 116, 117, the drive of either the first motor 61A or the second motor 61B, whichever is connected to the short circuit IC1, is stopped. In this case, the drive of the motor connected to the normal circuit IC2 continues, thereby allowing the propeller 20 to continue rotating.

[0339] The first motor device 60A and the second motor device 60B are arranged side by side along the propeller axis. The first motor device 60A and the second motor device 60B are arranged side by side with respect to the gear 51 along the propeller axis.

[0340] The first inverter device 80A and the second inverter device 80B may be arranged along the propeller axis. The first inverter device 80A may be arranged along the propeller axis with respect to the first motor device 60A, or may be arranged in a direction perpendicular to the propeller axis with respect to the first motor device 60A. The second inverter device 80B may be arranged along the propeller axis with respect to the second motor device 60B, or may be arranged in a direction perpendicular to the propeller axis with respect to the second motor device 60B.

[0341] In the present embodiment, as a modified example 17-1, the first motor device 60A and the second motor device 60B may be arranged in a direction perpendicular to the propeller axis, as shown in Fig. 40. In this configuration, the gear 51 may be provided so as to span between the first motor device 60A and the second motor device 60B in the direction perpendicular to the propeller axis.

[0342] <Other Embodiments> The disclosure of this specification is not limited to the exemplified embodiments. The disclosure encompasses the exemplified embodiments and modifications thereto by those skilled in the art. For example, the disclosure is not limited to the combinations of parts and elements shown in the embodiments, and can be implemented in various modifications. The disclosure can be implemented in various combinations. The disclosure can have additional parts that can be added to the embodiments. The disclosure encompasses the omission of parts and elements from the embodiments. The disclosure encompasses the substitution or combination of parts and elements between one embodiment and another embodiment. The disclosed technical scope is not limited to the description of the embodiments. The disclosed technical scope is defined by the claims, and should be interpreted as including all modifications within the meaning and scope equivalent to the claims.

[0343] In each of the above embodiments, it is sufficient that at least one of the power switch 86 and the motor switch 87 is provided in the supply path 130. For example, in the seventh embodiment, of the power switch 86 and the motor switch 87, only the motor switch 87 may be provided.

[0344] In each of the above embodiments, the power switch 86 may be provided collectively for a plurality of propulsion devices 100. For example, in the first embodiment, the power switch 86 may be provided in the common path 35.

[0345] In each of the above embodiments, the power switch 86 and the motor switch 87 do not have to have mechanical contacts. For example, in the first embodiment, the power switch 86 may be formed by a semiconductor switch. Also, in the seventh embodiment, the motor switch 87 may be formed by a semiconductor switch. A configuration in which semiconductor switches are used for the power switch 86 and the motor switch 87 has the advantage of reducing weight, the risk of welding, and costs compared to a configuration in which mechanical switches are used for the power switch 86 and the motor switch 87.

[0346] In each of the above embodiments, the power switch 86 and the motor switch 87 may be formed by a switch that does not return from the cut-off state to the power-on state after transitioning from a conductive state to a cut-off state. For example, the power switch 86 and the motor switch 87 may be formed by a fuse serving as a switch. In the power switch 86 and the motor switch 87, the fuse melts and cuts off the supply path 130 when the abnormal current becomes too large, such as when it reaches a predetermined value. Furthermore, the fuse melts and cuts off the supply path 130 when the temperature of the fuse becomes too high, such as when it reaches a predetermined value, due to the abnormal current. In the propulsion system 30, using a fuse as the power switch 86 and the motor switch 87 contributes to reducing the weight of the propulsion device 100.

[0347] However, if the supply path 130 is interrupted by the fuse, the fuse must be replaced. Furthermore, a commercially available general-purpose fuse may be used, or a dedicated fuse manufactured for the power switch 86 or the motor switch 87 may be used. The type of switch used as the power switch 86 or the motor switch 87 is preferably selected in accordance with the concept of the aircraft design.

[0348] In each of the above embodiments, the power switch 86 and the motor switch 87 may be switched to the cut-off state at the same time that the arm switches 116 and 117 are switched to the reduced power state. Alternatively, the power switch 86 and the motor switch 87 may be switched to the cut-off state before the arm switches 116 and 117 are switched to the reduced power state. Furthermore, one of the power switch 86 and the motor switch 87 may be switched to the cut-off state after the other is switched to the cut-off state, or both may be switched to the cut-off state simultaneously.

[0349] In each of the above embodiments, the flight control device 40 may conduct at least one of the parallel switches, the lateral switch SW2a and the second series switch SW2c, when a short circuit occurs in the arm switches 116, 117. For example, in the thirteenth embodiment, when the short-circuit switch SW1 occurs, the flight control device 40 may conduct the second series switch SW2c and cut off the lateral switch SW2a. In this case, the regenerative current Ir flows so as to be distributed between the short-circuit switch SW1 and the second series switch SW2c.

[0350] In each of the above embodiments, when a short circuit occurs in the arm switches 116, 117, the flight control device 40 may limit the rotation of the motor 61 in any way using the normal circuit IC2. For example, in the above fifteenth embodiment, the flight control device 40 may perform a number-limiting process on the rotation of the motor 61, and may perform at least one of a process to slow down the rotation of the propeller 20 and a process to lock the propeller 20.

[0351] In each of the above embodiments, at least a part of the programs stored in the memories 43 and 83 may be rewritten via wireless communication such as OTA. OTA is an abbreviation for Over the Air.

[0352] In each of the above embodiments, flight control processing may be performed by at least one of the inverter control unit 81 and the flight control device 40. In this configuration, at least one of the inverter control unit 81 and the flight control device 40 corresponds to the propulsion control device. For example, in a configuration in which the inverter control unit 81 performs flight control processing, at least the inverter control unit 81 corresponds to the propulsion control device.

[0353] The propulsion control program may be included in at least one of the programs 44 and 84. Furthermore, at least one processing unit that executes the propulsion control program may include at least one of the processors 42 and 82.

[0354] In each of the above embodiments, the vertical take-off and landing aircraft on which the flight control device 40 is mounted may be an electrically operated vertical take-off and landing aircraft in which at least one EPU 50 drives at least one propeller 20. For example, a configuration in which one propeller 20 is driven by multiple EPUs 50, or a configuration in which one EPU 50 drives multiple propellers 20, may be used.

[0355] In each of the above embodiments, the air vehicle on which EPU 50 is mounted does not have to be a vertical take-off and landing aircraft as long as it is electrically powered. For example, the air vehicle may be an electric aircraft capable of take-off and landing with a taxiing motion. Furthermore, the air vehicle may be a rotary-wing aircraft or a fixed-wing aircraft. The air vehicle may also be an unmanned air vehicle without a crew member on board. An unmanned air vehicle may or may not have a crew member cabin 14. A pilot may also remotely operate the air vehicle. eVTOL 10 may be referred to as a manned air vehicle as long as it is capable of carrying a person.

[0356] In each of the above embodiments, the moving body on which the EPU 50 is mounted does not have to be an aircraft as long as it can move by rotation of a rotating body. For example, the moving body may be a vehicle, a ship, a construction machine, or an agricultural machine. For example, if the moving body is a vehicle or a construction machine, the rotating body may be a wheel for movement, and the output shaft may be an axle. If the moving body is a ship, the rotating body may be a screw propeller for propulsion, and the output shaft may be a propeller shaft.

[0357] In each of the above embodiments, the flight control device 40 and the inverter control unit 81 are provided by a control system including at least one computer. The control system includes at least one processor that is hardware. If this processor is referred to as a hardware processor, the hardware processor can be provided by the following (i), (ii), or (iii):

[0358] (i) A hardware processor may be a hardware logic circuit. In this case, the computer is provided by a digital circuit including a large number of programmed logic units (gate circuits). The digital circuit may include a memory that stores at least one of a program and data. The computer may be provided by an analog circuit. The computer may be provided by a combination of a digital circuit and an analog circuit.

[0359] (ii) The hardware processor may be at least one processor core that executes a program stored in at least one memory. In this case, a computer is provided by at least one memory and at least one processor core. The processor core is referred to as a CPU, for example. The memory is also referred to as a storage medium. The memory is a non-transitory, tangible storage medium that non-temporarily stores "at least one of a program and data" that can be read by the processor.

[0360] (iii) The hardware processor may be a combination of (i) above and (ii) above, where (i) and (ii) are located on different chips or on a common chip.

[0361] That is, at least one of the means and functions provided by the flight control device 40 and the inverter control unit 81 can be provided by hardware only, software only, or a combination thereof.

[0362] (Disclosure of Technical Ideas) This specification discloses multiple technical ideas described in the following multiple clauses. Some clauses may be described in a multiple dependent form, with the subsequent clause alternatively referring to the preceding clause. Furthermore, some clauses may be described in a multiple dependent form, with the subsequent clause referring to another multiple dependent clause. These multiple dependent clauses define multiple technical ideas.

[0363] (Technical Idea 1) A propulsion system (30) for propelling an aircraft (10), comprising: a motor (61) driven by power supplied from a power supply unit (31) to propel the aircraft; a power conversion unit (85) having a conversion switch (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor, and converting the power supplied from the power supply unit to the motor by driving the conversion switch; a power switch (86) provided in the supply path between the power supply unit and the power conversion unit, and cutting off the supply path; and an abnormality cutoff unit (S106 to S109, S402, S702, S802, S1001, S1603, S1701) that, when an abnormality related to the motor occurs, cuts off the supply path by at least one of the conversion switch and the power switch in a manner corresponding to the state of the abnormality.

[0364] (Technical Idea 2) The propulsion system according to Technical Idea 1, wherein the abnormality cut-off unit comprises: a current reduction unit (S106, S1102, S1107, S1802, S1902) that reduces the abnormality current (Idc, Iac) flowing through the supply path using the conversion switch when an abnormality related to the motor occurs; and a power cut-off unit (S108, S1104, S1108, S1803, S1903) that cuts off the abnormality current using the power switch after the timing at which the current reduction unit starts reducing the abnormality current.

[0365] (Technical Idea 3) The propulsion system according to Technical Idea 2, wherein the power cutoff unit has a power reduction cutoff unit (S203, S205, S206) that cuts off the abnormal current using the power switch after the abnormal current has been reduced by the current reduction unit.

[0366] (Technical Idea 4) A propulsion system according to Technical Idea 2 or 3, wherein the power cutoff unit has a power cutoff section (S203, S207) that cuts off the abnormal current using the power switch after a predetermined time has elapsed since the current reduction unit started to reduce the abnormal current.

[0367] (Technical Idea 5) A propulsion system according to any one of Technical Ideas 1 to 4, wherein the abnormality cut-off unit has: a dual cut-off unit (S1802, S1803, S1902, S1903) that cuts off the supply path by both the conversion switch and the power switch; a conversion cut-off unit (S1804, S1905) that cuts off the supply path by only the conversion switch out of the conversion switch and the power switch; and a cut-off selection unit (S1901) that selects either the dual cut-off unit or the conversion cut-off unit depending on the state of the abnormality.

[0368] (Technical Idea 6) A propulsion system according to any one of Technical Ideas 1 to 5, comprising: a motor switch (87) provided in the supply path between the power conversion unit and the motor, for cutting off the supply path; and a selective cut-off unit (S1001) for cutting off the supply path using at least one of the conversion switch, the power switch, and the motor switch in response to the state of the abnormality when an abnormality occurs in the motor.

[0369] (Technical Idea 7) A propulsion system according to Technical Idea 6, wherein the selective cutoff unit comprises: a selective reduction unit (S1102, S1107) that reduces the abnormal current (Idc, Iac) flowing through the supply path using the conversion switch when an abnormality occurs in the motor; and a motor cutoff unit (S1103, S1110) that cuts off the abnormal current using the motor switch after the timing at which the selective reduction unit starts reducing the abnormal current.

[0370] (Technical Idea 8) A propulsion system according to Technical Idea 7, wherein the motor cutoff unit has a motor reduction cutoff unit (S1203, S1204) that cuts off the abnormal current with the motor switch after the abnormal current has been reduced by the selective reduction unit.

[0371] (Technical Idea 9) A propulsion system according to Technical Idea 7 or 8, wherein the motor cutoff unit has a motor transient cutoff unit (S1203, S1205) that cuts off the abnormal current using the motor switch after a predetermined time has elapsed since the selective reduction unit started reducing the abnormal current.

[0372] (Technical Idea 10) A propulsion system described in any one of Technical Ideas 6 to 9, wherein the supply path includes a power supply path (131) provided with the power switch and supplying power from the power supply unit to the power conversion unit, and a motor path (132) provided with the motor switch and supplying power from the power conversion unit to the motor, and the selective cut-off unit includes a power subsequent cut-off unit (S1102 to S1105) that, when an abnormality related to the power supply path occurs as an abnormality related to the motor, cuts off the motor path with the motor switch and then cuts off the power supply path with the power switch.

[0373] (Technical Idea 11) A propulsion system described in any one of Technical Ideas 6 to 10, wherein the supply path includes a power supply path (131) provided with the power switch and supplying power from the power supply unit to the power conversion unit, and a motor path (132) provided with the motor switch and supplying power from the power conversion unit to the motor, and the selective cut-off unit includes a motor trailing cut-off unit (S1107 to S1110) that, when an abnormality related to the motor path occurs as an abnormality related to the motor, cuts off the power supply path with the power switch and then cuts off the motor path with the motor switch.

[0374] (Technical Idea 12) A propulsion system according to any one of Technical Ideas 1 to 11, further comprising a switch inspection unit (S113, S114, S1002, S1003) for confirming that the conversion switch and the power switch operate normally.

[0375] (Technical Idea 13) A propulsion system according to any one of Technical Ideas 1 to 12, comprising: a parallel energization unit (S2105, S2108) that energizes at least one parallel switch (SW2a, SW2c) connected in parallel to a short-circuit switch (SW1) among the plurality of conversion switches when a short circuit occurs in the conversion switch as an abnormality related to the motor.

[0376] (Technical Idea 14) A propulsion system according to Technical Idea 13, wherein the plurality of conversion switches include an upper arm switch (116) on a high potential side and a lower arm switch (117) on a low potential side connected in series to the upper arm switch, and when the short-circuit switch is one of the upper arm switch and the lower arm switch, the parallel energization unit energizes the horizontally arranged switch (SW2a) of the upper arm switch and the lower arm switch that is on the same potential side as the short-circuit switch as the parallel switch when the short-circuit switch is one of the upper arm switch and the lower arm switch.

[0377] (Technical Idea 15) A propulsion system according to Technical Idea 14, comprising: a series interruption unit (S2104, S2107) that, when the horizontal switch is energized by the parallel energization unit, switches to an interrupted state a first series switch (SW2b) connected in series to the short-circuit switch and a second series switch (SW2c) that is the parallel switch connected in series to the horizontal switch, among the plurality of conversion switches.

[0378] (Technical Idea 16) A propulsion system according to any one of Technical Ideas 1 to 15, comprising: a first power conversion unit (85A) which is the power conversion unit; a second power conversion unit (85B) which is the power conversion unit, connected in parallel to the first power conversion unit, and capable of driving the motor independently of the first power conversion unit; and a rotation limiting unit (S2404, S2406) which, when an abnormality occurs in the conversion switch of one of the first power conversion unit and the second power conversion unit as an abnormality related to the motor, drives the other one so that rotation of the motor is limited.

[0379] (Technical Idea 17) A propulsion system according to any one of Technical Ideas 1 to 16, comprising: a motor switch (87) provided in the supply path between the power conversion unit and the motor, the motor switch cutting off the supply path; a first power conversion unit (85A) that is the power conversion unit; a second power conversion unit (85B) that is the power conversion unit, connected in parallel to the first power conversion unit, and capable of driving the motor independently of the first power conversion unit; a short-circuit power supply cut-off unit (S2602) that cuts off the supply path by the power switch provided between the power supply unit and a short-circuit conversion unit (IC1) of the first power conversion unit or the second power conversion unit in which the conversion switch has been short-circuited, when a short-circuit occurs in the conversion switch of one of the first power conversion unit or the second power conversion unit as an abnormality related to the motor; and a short-circuit motor cut-off unit (S2603) that cuts off the supply path by the motor switch provided between the short-circuit conversion unit and the motor after the short-circuit power supply cut-off unit has cut off the supply path by the power switch.

[0380] (Technical Idea 18) A propulsion system (30) for propelling an aircraft (10), comprising: a motor (61) driven by power supplied from a power supply unit (31) to propel the aircraft; a power conversion unit (85) having a conversion switch (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor, and converting the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch (86) provided in the supply path between the power supply unit and the power conversion unit, for cutting off the supply path.

[0381] (Technical Concept 19) The propulsion system according to Technical Concept 18, further comprising a motor switch (87) provided in the supply path between the power conversion unit and the motor, for cutting off the supply path.

[0382] (Technical Idea 20) A propulsion control device (40) for controlling a propulsion system (30) having: a motor (61) that drives to propel an aircraft (10) with power supplied from a power supply unit (31); a power conversion unit (85) having a conversion switch (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor and that converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch (86) provided in the supply path between the power supply unit and the power conversion unit and that cuts off the supply path, the propulsion control device comprising: an abnormality determination unit (S103) that determines whether an abnormality related to the motor has occurred; and an abnormality cutoff unit (S106 to S109, S402, S702, S802, S1001, S1603, S1701) that, when an abnormality related to the motor has occurred, cuts off the supply path by at least one of the conversion switch and the power switch in a manner corresponding to the state of the abnormality.

[0383] (Technical Idea 21) A propulsion control program (44) for causing at least one processor (42) to execute control of a propulsion system (30) having: a motor (61) that drives to propel an aircraft (10) with power supplied from a power supply unit (31); a power conversion unit (85) having conversion switches (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor and that converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch (86) provided in the supply path between the power supply unit and the power conversion unit and that cuts off the supply path, the program comprising: a process (S103) for determining whether an abnormality has occurred in the motor; and a propulsion control program for causing at least one of the processors to execute a process (S106 to S109, S402, S702, S802, S1001, S1603, S1701) in which, when an abnormality occurs in the motor, the supply path is cut off by at least one of the conversion switch and the power switch in a manner corresponding to the abnormality state.

Claims

1. A propulsion system (30) for propelling an aircraft (10), comprising: a motor (61) driven by power supplied from a power supply unit (31) to propel the aircraft; a power conversion unit (85) having a conversion switch (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor, and converting the power supplied from the power supply unit to the motor by driving the conversion switch; a power switch (86) provided in the supply path between the power supply unit and the power conversion unit, and cutting off the supply path; and an abnormality cut-off unit (S106 to S109, S402, S702, S802, S1001, S1603, S1701) that, when an abnormality related to the motor occurs, cuts off the supply path by at least one of the conversion switch and the power switch in a manner corresponding to the state of the abnormality.

2. The propulsion system according to claim 1, wherein the abnormality cut-off unit comprises: a current reduction unit (S106, S1102, S1107, S1802, S1902) which reduces the abnormality current (Idc, Iac) flowing through the supply path using the conversion switch when an abnormality related to the motor occurs; and a power cut-off unit (S108, S1104, S1108, S1803, S1903) which cuts off the abnormality current using the power switch after the current reduction unit starts to reduce the abnormality current.

3. A propulsion system as described in claim 2, wherein the power supply cut-off unit has a power supply reduction cut-off unit (S203, S205, S206) which cuts off the abnormal current by the power switch after the abnormal current has been reduced by the current reduction unit.

4. A propulsion system as described in claim 2, wherein the power supply cut-off unit has a power supply lapsed cut-off unit (S203, S207) which cuts off the abnormal current by the power switch a predetermined time after the current reduction unit starts reducing the abnormal current.

5. A propulsion system as described in any one of claims 1 to 4, wherein the abnormality cut-off unit has: a dual cut-off unit (S1802, S1803, S1902, S1903) that cuts off the supply path by both the conversion switch and the power switch; a conversion cut-off unit (S1804, S1905) that cuts off the supply path by only the conversion switch of the conversion switch and the power switch; and a cut-off selection unit (S1901) that selects either the dual cut-off unit or the conversion cut-off unit depending on the abnormality state.

6. A propulsion system as described in claim 1, further comprising: a motor switch (87) provided in the supply path between the power conversion unit and the motor, for cutting off the supply path; and a selective cut-off unit (S1001) for cutting off the supply path by at least one of the conversion switch, the power switch and the motor switch in response to the state of the abnormality when an abnormality occurs in the motor.

7. The propulsion system of claim 6, wherein the selective cut-off unit comprises: a selective reduction unit (S1102, S1107) which reduces the abnormal current (Idc, Iac) flowing through the supply path using the conversion switch when an abnormality occurs related to the motor; and a motor cut-off unit (S1103, S1110) which cuts off the abnormal current using the motor switch after the selective reduction unit starts to reduce the abnormal current.

8. A propulsion system as described in claim 7, wherein the motor cut-off unit has a motor reduction cut-off unit (S1203, S1204) which cuts off the abnormal current with the motor switch after the abnormal current has been reduced by the selective reduction unit.

9. A propulsion system as described in claim 7, wherein the motor cut-off unit has a motor progress cut-off unit (S1203, S1205) which cuts off the abnormal current by the motor switch a predetermined time after the selective reduction unit starts reducing the abnormal current.

10. A propulsion system as described in claim 6, wherein the supply path includes a power supply path (131) in which the power switch is provided and which supplies power from the power supply unit to the power conversion unit, and a motor path (132) in which the motor switch is provided and which supplies power from the power conversion unit to the motor, and the selective cut-off unit includes a power subsequent cut-off unit (S1102-S1105) which, when an abnormality related to the power supply path occurs as an abnormality related to the motor, cuts off the motor path with the motor switch, and then cuts off the power supply path with the power switch.

11. A propulsion system as described in claim 6, wherein the supply path includes a power supply path (131) in which the power switch is provided and which supplies power from the power supply unit to the power conversion unit, and a motor path (132) in which the motor switch is provided and which supplies power from the power conversion unit to the motor, and the selective cut-off unit includes a motor trailing cut-off unit (S1107-S1110) which, when an abnormality related to the motor path occurs as an abnormality related to the motor, cuts off the power supply path with the power switch and then cuts off the motor path with the motor switch.

12. A propulsion system as claimed in claim 1 or 6, further comprising a switch inspection section (S113, S114, S1002, S1003) for checking that the conversion switch and the power switch operate normally.

13. A propulsion system as described in any one of claims 1 to 4, further comprising a parallel energization unit (S2105, S2108) that, when a short circuit occurs in the conversion switch as an abnormality related to the motor, energizes at least one parallel switch (SW2a, SW2c) that is connected in parallel to the short-circuit switch (SW1) among the multiple conversion switches in which a short circuit has occurred.

14. A propulsion system as described in claim 13, wherein the plurality of conversion switches include an upper arm switch (116) on the high potential side and a lower arm switch (117) on the low potential side connected in series to the upper arm switch, and when the short-circuit switch is one of the upper arm switch and the lower arm switch, the parallel energization unit energizes, as the parallel switch, a horizontally arranged switch (SW2a) of the upper arm switch and the lower arm switch that is on the same potential side as the short-circuit switch.

15. A propulsion system as described in claim 14, further comprising a series interruption unit (S2104, S2107) that, when the horizontal switch is energized by the parallel energization unit, switches to an interrupted state each of a first series switch (SW2b) connected in series with the short-circuit switch and a second series switch (SW2c) which is the parallel switch connected in series with the horizontal switch, among the plurality of conversion switches.

16. A propulsion system as claimed in any one of claims 1 to 4, comprising: a first power conversion unit (85A) which is the power conversion unit; a second power conversion unit (85B) which is the power conversion unit, connected in parallel to the first power conversion unit and capable of driving the motor independent of the first power conversion unit; and a rotation limiting unit (S2404, S2406) which, when an abnormality occurs in the conversion switch of one of the first power conversion unit or the second power conversion unit as an abnormality related to the motor, drives the other one so that rotation of the motor is limited.

17. A propulsion system as claimed in any one of claims 1 to 4, comprising: a motor switch (87) provided in the supply path between the power conversion unit and the motor, for cutting off the supply path; a first power conversion unit (85A) which is the power conversion unit; a second power conversion unit (85B) which is the power conversion unit, connected in parallel to the first power conversion unit and capable of driving the motor independent of the first power conversion unit; a short-circuit power supply cut-off unit (S2602) which, when a short-circuit occurs in the conversion switch of one of the first power conversion unit or the second power conversion unit as an abnormality related to the motor, cuts off the supply path by the power switch provided between the power supply unit and a short-circuit conversion unit (IC1) of the first power conversion unit or the second power conversion unit in which the conversion switch has been short-circuited; and a short-circuit motor cut-off unit (S2603) which cuts off the supply path by the motor switch provided between the short-circuit conversion unit and the motor after the short-circuit power supply cut-off unit has cut off the supply path by the power switch.

18. A propulsion system (30) for propelling an aircraft (10), comprising: a motor (61) that is driven to propel the aircraft with power supplied from a power supply unit (31); a power conversion unit (85) having a conversion switch (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor, and which converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch (86) provided in the supply path between the power supply unit and the power conversion unit, for cutting off the supply path.

19. A propulsion system according to claim 18, further comprising a motor switch (87) provided in the supply path between the power conversion unit and the motor for cutting off the supply path.

20. A propulsion control device (40) for controlling a propulsion system (30) having: a motor (61) that drives an aircraft (10) with power supplied from a power supply unit (31); a power conversion unit (85) having a conversion switch (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor and that converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch (86) provided in the supply path between the power supply unit and the power conversion unit and that cuts off the supply path, the propulsion control device comprising: an abnormality determination unit (S103) that determines whether an abnormality has occurred with respect to the motor; and an abnormality cut-off unit (S106-S109, S402, S702, S802, S1001, S1603, S1701) that cuts off the supply path with at least one of the conversion switch and the power switch in a manner corresponding to the state of the abnormality when an abnormality has occurred with respect to the motor.

21. A propulsion control program (44) for causing at least one processor (42) to execute control of a propulsion system (30) having: a motor (61) that is driven to propel an aircraft (10) with power supplied from a power supply unit (31); a power conversion unit (85) having a conversion switch (116, 117) provided in a supply path (130) that supplies power from the power supply unit to the motor and that converts the power supplied from the power supply unit to the motor by driving the conversion switch; and a power switch (86) provided in the supply path between the power supply unit and the power conversion unit and that cuts off the supply path, the propulsion control program (44) comprising: a process (S103) for determining whether or not an abnormality has occurred with respect to the motor; and, when an abnormality has occurred with respect to the motor, a process (S106 to S109, S402, S702, S802, S1001, S1603, S1701) for cutting off the supply path by at least one of the conversion switch and the power switch in a manner corresponding to the state of the abnormality; A propulsion control program for causing at least one of the processors to execute the above.

Images