Systems, methods, and circuits for redundant, intelligent, and fault tolerant battery control

Abstract

A system for controlling high voltage power comprises: a first controller configured to: receive first sensor data, determine a first circuitry state based on the first sensor data, and output a first signal indicative of the first circuitry state; a second controller configured to: receive second sensor data, determine a second circuitry state based on the second sensor data, and output a second signal indicative of the second circuitry state; and circuitry configured to: receive the first signal and the second signal, maintain a state of a high voltage control device when the first signal and the second signal indicate a different value, and change a state of the high voltage control device when the first signal and the second signal indicate the same value.

Description

SYSTEMS, METHODS, AND CIRCUITS FOR REDUNDANT, INTELLIGENT, AND FAULT TOLERANT BATTERY CONTROLCROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to U.S. Provisional Application No. 63 / 616,316, titled “BATTERY MANAGEMENT SYSTEM,” filed December 29, 2023. The entire contents of the aforementioned application are incorporated by reference herein for all purposes.TECHNICAL FIELD

[0002] This disclosure relates generally to the field of battery packs and high voltage components and associated circuitry operations for powered vehicles. More particularly, and without limitation, the present disclosure relates to innovations in an aircraft’s battery management system and high voltage system. Certain aspects of the present disclosure generally relate to innovations in battery management hardware, fuse blowing sequencing, isolation monitoring, and testing of high voltage components.BACKGROUND

[0003] The present disclosure generally relates to managing battery packs and high voltage components, as well as associated circuitry operations. Maintaining the supply of high voltage electricity to an electric or hybrid-electric aircraft is critical to the control and stability of the aircraft.SUMMARY

[0004] The present disclosure generally relates to battery packs and high voltage components and associated circuitry operations, including battery management hardware, fuse blowing sequencing, isolation monitoring, and testing of high voltage components. The inventors have recognized several problems associated with powering an aircraft that uses electric or hybridelectric propulsion systems. For example, they have recognized there is a need for a redundant and fault tolerant battery management system to ensure power is controlled appropriately. The present disclosure provides redundancy in sensor reading, logic, and / or associated control of high voltage power. More particularly, and without limitation, the present disclosure provides a battery management system with multiple controllers and logic circuitry that provide redundant confirmation on a circuitry state prior to enabling or disabling power to critical systems.

[0005] The present disclosure provides a battery management system that may sequence disconnections of portions of high voltage circuitry based on detecting a faulty condition, thereby reducing an impact of a fault on the supply of high voltage power.

[0006] The present disclosure provides for isolation monitoring to ensure that individuals such as passengers and technicians are protected from high voltage current (e.g., current flowing based on a high voltage or high voltage difference) even in conditions where portions of the high voltage circuitry are disconnected. Further, the present disclosure allows for safe monitoring and testing of aircraft components that prevent accidentally energizing an electric propulsion unit while on the ground or removing power to an energized electric propulsion unit while in the air.

[0007] One aspect of the present disclosure is directed to a system for controlling high voltage power (e.g., power sourced from high voltage). In one embodiment, the system may comprise: a first controller configured to: receive first sensor data, determine a first circuitry state based on the first sensor data, and output at least one first signal indicative of the first circuitry state determined by the first controller.

[0008] In accordance with further embodiments, the system may further comprise second controller configured to: receive second sensor data, determine a second circuitry state based on the second sensor data, and output a second signal indicative of the second circuitry state determined by the second controller.

[0009] In accordance with further embodiments, the system may further comprise verification circuitry configured to: receive at least one first signal and the at least one second signal, maintain a state of a high voltage control device in response to the at least one first signal and the at least one second signal indicating a different value, and change a state of the high voltage control device when the at least one first signal and the at least one second signal indicate the same value.

[0010] Another aspect of the present disclosure is directed to another system for controlling high voltage power. In one embodiment, the system may comprise: a first logic controller, a second logic controller, a first monitoring controller, a second monitoring controller, and verification circuitry.

[0011] In accordance with further embodiments, the first logic controller may be configured to: receive first sensor data, determine a first circuitry state based on the first sensor data, and output at least one first signal indicative of the first circuitry state determined by the first logic controller.

[0012] In accordance with further embodiments, the second logic controller may be configured to: receive second sensor data, determine a second circuitry state based on the second sensor data, and output at least one second signal indicative of the second circuitry state determined by the second logic controller.

[0013] In accordance with further embodiments, the first monitoring controller may be configured to: receive the first sensor data, and output at least one third signal indicative of a third circuitry state.

[0014] In accordance with further embodiments, the second monitoring controller may be configured to: receive the second sensor data, and output at least one fourth signal indicative of a fourth circuitry state.

[0015] In accordance with further embodiments, the verification circuitry may be configured to: receive at least one first signal and the at least one second signal, use the at least one first signal and the at least one second signal to determine whether to maintain or change a state of a high voltage control device, and override the determination of whether to maintain or change a state of the high voltage control device when the at least one third signal and the at least one fourth signal agree.

[0016] Another aspect of the present disclosure is directed to a method for controlling high voltage power for multiple battery packs, which may comprise: receiving a first current measurement of a first circuit, triggering a first fuse in response to a first trigger condition being met and a first time delay expiring, receiving a second current measurement of a second circuit, and triggering the second fuse in response to a second trigger condition being met and a second time delay expiring.

[0017] In accordance with further embodiments, the first circuit may be configured to provide power from a first battery pack to at least one electric propulsion unit, and may comprise a first fuse configured to disable current in the first circuit upon being triggered.

[0018] In accordance with further embodiments, the second circuit may be configured to allow the first battery pack to provide backup power for a second battery pack and may comprise a second fuse configured to disable current in the second circuit upon being triggered.

[0019] In accordance with further embodiments, the first time delay may be different from the second time delay.

[0020] Another aspect of the present disclosure is directed to a method for high voltage isolation resistance monitoring, which may comprise: monitoring a state of a high voltage circuit connecting a first battery pack and a second battery pack electrically connected inparallel via a high voltage wire on a positive side of the first battery pack and a high voltage wire on a negative side of the first battery pack; detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted; and in response to the detecting, engaging at least one of a first isolation resistance monitoring circuit associated with a first battery pack or a second isolation resistance monitoring circuit associated with the second battery pack.

[0021] Yet another aspect of the present disclosure is directed to a method for battery pack testing, which may comprise: detecting a wakeup command; determining whether the wakeup command was initiated by a communication signal or a timer; determining, in response to determining the wakeup command was initiated by the communication signal or the timer, whether at least one electrically-activatable switching device is open or closed; and

[0022] in response to determining the at least one electrically-activatable switching device is closed: maintaining, by the at least one hardware processor, the at least one electrically- activatable switching device closed, and disregarding, by the at least one hardware processor, commands to open the at least one electrically-activatable switching device.BRIEF DESCRIPTIONS OF FIGURES

[0023] Figures 1A and IB illustrate exemplary wiring connections for an aircraft, consistent with disclosed embodiments.

[0024] Figures 2A and 2B illustrate exemplary wiring diagrams for a battery pack of an aircraft, consistent with disclosed embodiments.

[0025] Figures 3A, 3B, and 3C illustrate exemplary control architecture and communication for a battery management system of an aircraft, consistent with disclosed embodiments.

[0026] Figures 4A, 4B, 4C, 4D, 4E, 4F, 4G, and 4H illustrate exemplary control components and logic for a battery management system, consistent with disclosed embodiments.

[0027] Figures 5A, 5B, 5C, 5D, and 5E illustrate exemplary connections between current monitoring resistors and associated fuses that can be blown based on detecting a triggering condition, consistent with disclosed embodiments.

[0028] Figures 6A, 6B, 6C, and 6D illustrate exemplary isolation monitoring circuitry and states of high voltage wiring in which isolation monitoring is performed, consistent with disclosed embodiments.

[0029] Figure 7 illustrates an exemplary isolation monitoring control sequence for a high voltage wiring system, consistent with disclosed embodiments.

[0030] Figure 8 illustrates an exemplary control sequence to test high voltage components, consistent with disclosed embodiments.

[0031] Figure 9 illustrates an exemplary flowchart of a fuse triggering sequence process, consistent with disclosed embodiments.

[0032] Figure 10 illustrates an exemplary flowchart of an isolation monitoring process, consistent with disclosed embodiments.DETAILED DESCRIPTION

[0033] The present disclosure provides a system to ensure redundant and fault tolerant control of high voltage power for an electric or hybrid-electric aircraft. High voltage (HV) may be voltage that is above a predetermined threshold and / or is higher than another voltage used by another system or subsystem. Additionally or alternatively, high voltage may be at least 50 volts (V) or higher, at least 100V, at least 120V, at least 200V, or at least 400V. Additionally or alternatively, low voltage (LV) may be 100V or lower, 50V or lower, or 12V or lower. A high voltage load may be a load configured to operate using a high voltage. A high voltage power supply, such as a battery, may be configured to supply power at a high voltage. A low voltage load may be a load configured to operate using a low voltage. A low voltage power supply, such as a battery, may be configured to supply power at a low voltage. The aircraft may be an aircraft with a pilot, an aircraft without a pilot (e.g., an unmanned aerial vehicle (UAV)), a drone, a helicopter, a hovercraft, and / or an airplane. An aircraft includes a physical body and one or more components (e.g., a wing, a tail, a propeller) configured to allow the aircraft to fly. In some embodiments, the aircraft is driven by one or more electric propulsion units (hereinafter referred to in the singular as “EPU” and in the plural as “EPUs”), which may include at least one engine, at least one rotor, at least one propeller, or any combination thereof. The EPUs may be powered by an electric energy source (e.g., a battery pack). High voltage power to EPUs may be provided by an aircraft energy source (e.g., battery packs). Improper monitoring and / or control of high voltage power may impact the thrust provided by the aircraft’s EPUs and thereby the stability and / or controllability of the aircraft. Further, it may create safety risks to maintenance personnel when the aircraft is on the ground. The disclosed embodiments provide hardware components, circuitry layouts, and / or control processes that improve the safety and reliability of an aircraft’s high voltage power supply.

[0034] For example, disclosed embodiments may provide multiple controllers and associated circuitry to monitor one or more sensor(s) detecting conditions of high voltage components. Further, disclosed embodiments provide control logic and communication betweencontrollers to confirm a state of an aircraft and / or high voltage power prior to taking an action to control electric power (e.g., HV or LV power). Disclosed systems also prevent a single point of failure and increase the reliability that the appropriate response will be taken.

[0035] Further, disclosed embodiments may sequence disconnections of portions of high voltage circuitry based on detecting a faulty or diminished condition, thereby reducing an impact of a fault on the supply of high voltage power. As described below, the disconnections may be sequenced in a manner that is most likely to address the faulty or diminished condition while minimizing an impact to control and / or stability of the aircraft.

[0036] Further, disclosed embodiments may provide for isolation monitoring to prevent aircraft personnel from being shocked by electrification of the chassis or other aircraft components. The isolation monitoring circuitry and control may provide for effective high voltage isolation even as conditions of the high voltage wiring connections change (e.g., based on a disconnection between one or more wires to a shared battery pack). Therefore, safety of maintenance personnel may be maintained regardless of the state of high voltage wiring.

[0037] Finally, disclosed embodiments may provide for safe monitoring and testing of aircraft components that prevent accidentally energizing an EPU while on ground or removing power to an energized EPU while in the air.

[0038] Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. The following description refers to the accompanying drawings in which the same numbers in different drawings represent the same or similar elements unless otherwise represented. The implementations set forth in the following description of exemplary embodiments do not represent all implementations consistent with the disclosure. Instead, they are merely examples of apparatuses and methods consistent with aspects related to the subject matter recited in the appended claims.

[0039] Figures 1A and IB illustrate exemplary wiring connections for an aircraft, consistent with disclosed embodiments. As shown in Figure 1 A, in some embodiments, the distributed electrical propulsion system of the aircraft 100 may include twelve EPUs 110 (e.g., electric engines, fans, turbines etc.), which may be mounted on booms forward (e.g., closer to a front edge) and aft (e.g., closer to a read edge) of wings of the aircraft 100. The forward EPUs 110 may be tiltable (e.g., during flight) between a horizontally oriented position (e.g., to generate forward thrust) and a vertically oriented position (e.g., to generate vertical thrust). Any or each of the forward EPUs 110 may be of a clockwise type or counterclockwise type in terms of direction of propeller rotation. Any or each of the aft EPUs 110 may be fixed in avertically oriented position (e.g., to generate vertical thrust), and may also be of a clockwise type or counterclockwise type in terms of direction of propeller rotation. As used herein, the term “electric aircraft” may refer to an aircraft that uses at least one electric-based energy source and may include fully electric aircraft as well as hybrid aircraft that uses electricity in addition to another fuel source.

[0040] The aircraft 100 may possess various combinations of forward and aft EPUs 110. For example, in some embodiments, the aircraft 100 may possess six forward EPUs 110 and six aft EPUs 110. In some other embodiments, the aircraft 100 may include four forward EPUs and four aft EPUs, or any other combination of forward and aft EPUs 110. In some other embodiments, the number of forward EPUs 110 and aft EPUs 110 are not equivalent.

[0041] In some embodiments, for a vertical takeoff and landing (VTOL) mission, the forward EPUs 110 as well as aft EPUs 110 may provide vertical thrust during takeoff and landing. During flight phases where the aircraft 100 is in forward flight, the forward EPUs 110 may provide forward thrust (e.g., in a horizontal direction), while the propellers of the aft EPUs 110 may be stowed at a fixed position (e.g., with their propeller blades orientated parallel or near parallel to a front-back axis of the aircraft) in order to minimize drag. The aft EPUs may be actively stowed with position monitoring.

[0042] In some embodiments, in a conventional takeoff and landing (CTOL) mission, the forward EPUs 110 may provide forward thrust for wing-borne take-off, cruise, and landing. In some embodiments, the aft EPUs 110 may not be used for generating thrust during a CTOL mission and the aft propellers may be stowed in place.

[0043] Transition from vertical flight to forward flight and vice-versa may be accomplished via a tilt propeller subsystem. The tilt propeller subsystem may redirect thrust between a primarily vertical direction during vertical flight phase to a mostly horizontal direction during forward-flight phase. A variable pitch mechanism may change the forward electric engine’s propeller-hub assembly blade collective angles for operation during the hover-phase, transition phase, and cruise-phase.

[0044] As shown in Figure 1A, a high voltage power system (HVPS) of the aircraft 100 may include a power source, such as battery packs 120 (further differentiated as Pl, P2, P3, P4, P5, and P6), which supply high voltage power to be converted into, among other possible uses, mechanical shaft power to rotate rotors and / or propellers of the EPUs 110. The amount of thrust each EPU 110 generates may be governed by a torque command from the Flight Control System (FCS) over a digital communication interface to each EPU 110.

[0045] In some embodiments, the aircraft includes six battery packs 120, which may be installed within the battery bays in the wing of the aircraft 100. In some embodiments, six battery packs 120 may have an identical design to simplify design, manufacturing, and logistics. It should be understood that in some embodiments, different battery packs 120 may have different designs. The battery packs 120 may power one or more EPUs 110. While six battery packs 120 are shown, the aircraft 100 may have any number of battery packs 120. In some embodiments, battery packs 120 may comprise battery packs cells (e.g., a cell stack configured to power EPUs 110). A battery pack cell may include at least one of a cathode, an anode, an electrolyte, or any component or material configured to store and / or permit flow of electrical energy. In some embodiments, battery packs 120 may comprise sensors, such as current sensors, voltage sensors, and / or temperature sensors to measure a state of one or more battery pack cells and / or wiring associated with the battery pack(s) 120, as described below. In some embodiments, battery packs 120 may include one or more of contactor(s), relay (s), transistor(s), controller(s), and / or any other device(s) capable of controlling flow of (e.g., switching on and off) electricity from battery pack(s) 120, as described below. In some embodiments, battery packs 120 may comprise processor(s), controlled s), logic circuitry, logic devices, and / or communication wiring associated with monitoring and / or control of the battery pack(s) 120, as described below.

[0046] In some embodiments, a single battery pack 120 may be electrically connected to, and power, multiple EPUs. For example, in some embodiments, a battery pack 120 may power an EPU 110 on either side of a longitudinal axis running through the center of the aircraft fuselage. In some embodiments a battery pack 120 may power an EPU 110 on either side of a horizontal axis running through the wing. In some embodiments, as shown in Figure 1A (as shown in the different dashed lines between battery packs and EPUs), a battery pack 120 may power two diagonally opposing EPUs. Therefore, based on a loss of a battery pack 120, the impact to roll or pitch moments can be reduced because the loss of lift is balanced. In some embodiments, battery packs 120 may power different arrangements of EPUs to reduce roll, pitch, or yaw moments that may be caused by a loss of the battery pack 120. For example, in some embodiments, battery packs 120 may be connected to EPUs in any manner that balances lift and / or forward thrust across the longitudinal and horizontal axis of the aircraft.

[0047] Further, the exemplary HVPS system includes a cross-link 130 (three of which are depicted between the open dots) possessing at least one fuse allowing for pairing of two or more battery packs 120 (e.g., parallel connections between battery packs). Through the crosslink 130, power for the EPUs can be shared among the paired battery packs 120. While in theexample of Figure 1A, battery packs 120 are connected in pairs using three separate crosslinks 130, it is appreciated that any number of battery packs may be connected using crosslinks (e.g., pairs, triplets, quadruplets, or a combination thereof) and / or that some or even all batteries may not be connected using any cross-link. Thus, in some embodiments, multiple battery packs 120 may simultaneously power multiple EPUs. This arrangement provides for redundancy and avoids a single point of failure because each paired battery 120 may act as a power backup for the other(s), based on failure of a battery pack 120, one or more connected battery packs 120 may continue powering the failed battery pack’s connected EPUs.

[0048] Figure IB illustrates an exemplary embodiment whereby the battery packs may also power a tilt propeller system of the EPUs. For example, the battery packs may power linear and / or rotary actuators to change the orientation of a propulsion system during operation. In some embodiments, the pitch of the propulsion system may be changed as a function of the orientation of the propulsion system. In some embodiments, a rotary actuator may include a motor, inverter, and gearbox. In some embodiments, as shown, each battery pack 120 powers a tilt propeller system (e.g., T1-T6) that corresponds to an EPU being powered by the battery pack. As described above, the aircraft may include a different number and / or combination of battery pack and propulsion system arrangements (with corresponding tilt propeller systems). In some embodiments, each of the arrangements described with reference to Figure 1 A may further include a tilt actuator being powered by the battery pack powering the EPU whose tilt is controlled. While in the example shown in Figure IB only the forward EPUs 110 are tiltable, in other embodiments the aft EPUs 110 are also tiltable and high voltage power similarly runs from the battery packs 120 to the aft EPUs 110.

[0049] Figures 2A and 2B illustrate exemplary wiring diagrams for a battery pack of an aircraft, consistent with disclosed embodiments. In some embodiments the aircraft may include one or more battery packs. As shown in Figure 2A, each battery pack may include a high voltage junction box (HVJB) which is electrically connected to the high-voltage loads (HV loads) to provide high voltage power. Specifically, the power storage element BT1 (e.g., battery cells connected in parallel and / or in series) can be used to provide the high voltage power. The power storage element BT1 is connected to each of the HV loads through precharge resistor(s) used during a pre-charge operation (e.g., resistor R1 and R7), current sensing resistor(s) (e.g., resistors R2-R6), which may or may not be used during a pre-charge operation, and / or high voltage control device(s). In some embodiments, a pre-charge resistor and a current sensing resistor may have different electrical resistivities. A resistor mayinclude a shunt resistor, a chip resistor, or a variable resistor. For example, “current shunt” may be a shunt resistor configured to measure current.

[0050] A high voltage control device may be an electrical component configured to influence or change operation of a high voltage component, such as by allowing or preventing current flow to a high voltage component. For example, a high voltage control device may include at least one of one or more switching devices (e.g. K1-K7), one or more drivers, or one or more fuses. A fuse (e.g., F1-F8) may be at least one of an active fuse, a passive fuse, and / or a pyrofuse. A high voltage control device may may protect against various failure or problem conditions (e.g., overcurrent, short-circuit etc.). A switching device, such as K1-K7, may include or be at least one of a contactor (e.g., a high-side or a low-side contactor), a relay, a transistor, a controller, a mechanical switch, or any device capable of controlling flow of (e.g., switching on and off) electricity. A switching device may also be referred to as a “switch.” A switching device may be an electrically-activatable switching device, as opposed to, for example, a mechanically-activatable switching device.

[0051] In some embodiments, the high voltage control device may include a contactor configured to isolate one electrical component from another. A contactor may isolate one electrical component from another by opening (also referred to as having an open state), which may sever and electrical connection.

[0052] For example, the high voltage control device may include a contactor configured to isolate at least one electric propulsion unit (EPU) from a power supply provided by a battery pack. The high voltage control device may include a contactor configured to isolate a battery pack from a plurality electric propulsion units. The high voltage control device may include any of switching devices K1-K5 and K7, for example.

[0053] In some embodiments, the high voltage control device may include a fuse configured to isolate one electrical component from another. A fuse may isolate one electrical component from another by blowing, which may sever and electrical connection.

[0054] For example, the high voltage control device may include a fuse configured to isolate at least one electric propulsion unit from a power supply provided by a battery pack. The high voltage control device may include any of fuses Fl - F3, for example.

[0055] In some embodiments, at least one switching device and / or at least one fuse may be controllable by at least one processing device (e.g., a battery management unit, or BMU, a flight control computer, or FCC, or a combination thereof). For example, a BMU may transmit a command signal to cause a switching device to open or close. Additionally or alternatively, a BMU may transmit a command signal to cause a fuse to blow. In someembodiments, a different configuration of active and passive fuses may protect against failure or problem conditions. For example, a single active fuse may be included on the cross-link between battery packs.

[0056] While certain elements are shown within the HVJB, it is appreciated that elements depicted in the HVJB may exist outside of an HVJB (e.g., no HVJB may be present) and that a different combination of elements, including all or a subset of the elements in Figure 2A, may be included as part of an HVJB.

[0057] In some embodiments, switching devices K6-K7 may control whether battery pack(s) receive a charge from a charging bus. Switching devices K1-K5 may control whether high voltage power flows to the EPU(s) (e.g., electric engines), tilt actuator(s), direct current to direct current (DC / DC) converter(s), and / or environmental conditioning system (ECS) equipment (pumps, condensers etc.). In some embodiments, K1-K7 are all contactors, while in other embodiments K3 and K5 are semiconductor devices (e.g., MOSFET devices) and the remaining switching devices are contactors. In some embodiments, one or more of the fuses F1-F8 may be pyrofuses (e.g., all of fuses F1-F8 are pyrofuses).

[0058] As shown, circuitry to EPUs 110 (e.g., electric engines) and / or tilt actuators may be pre-charged through closing pre-charge switching device K5 to enable current through precharge resistor R7 (e.g., a resistor connected in series) and / or closing K2, which may enable current through resistor R2. Further, as shown, R1 and K3 (e.g., first pre-charge circuit) may be connected in parallel with R7 and K5 (e.g., second pre-charge circuit) to pre-charge circuitry to non-propulsion loads. In some embodiments, R1 and / or R7 are positive- temperature-coefficient (PTC) resistors (e.g., thermistors) whose resistance increases with an increase in temperature. In some embodiments, one battery pack 120 may pre-charge part or all of the circuitry associated with another battery pack. The arrangement of circuitry and switching devices associated with (e.g., in the high voltage junction box of) each battery pack provides for flexibility in energizing certain aircraft components while keeping other components deenergized.

[0059] A battery management unit (BMU) 201 of the battery pack may monitor conditions of the power storage element BT1 and high voltage wiring. In some embodiments, such as shown in the depiction of Figure 2A, the BMU 201 is powered by the power storage element BT1 via a DC / DC converter 201a that steps down high voltage to a lower high voltage or to a low voltage. Additionally or alternatively, a fuse (e.g., F8) may isolate HV wiring (e.g., by blowing, such as in response to a command from a processing device) feeding the BMU 201 from the other HV circuitry based on detection of a faulty or diminished condition (e.g.,operating condition that does not satisfy a performance metric). Some embodiments may include an energy reserve capacitor and associated diode (not depicted) that may allow the DC / DC converter 201a to continue to power the BMU 201 based on a loss of power until a faulty or diminished condition is remedied.

[0060] The BMU 201 may monitor various conditions of the high voltage circuitry. Monitoring may include accessing, detecting, receiving, and / or determining circuitry information (e.g., measurements, such as current, voltage, power, and / or temperature measurements), comparing circuitry information (e.g., to one or more thresholds), analyzing circuitry information (e.g., determining temporal circuitry information, such as by integrating current measurements over time), and / or performing a responsive operation (e.g., changing at least one switch state and / or blowing at least one fuse), consistent with disclosed embodiments. For example, the BMU 201 may measure current associated with a cell stack (e.g., using a resistor R2), EPUs (e.g., electric engines), resistors wired in series with EPUs (R3-R4), non-propulsion loads (R5), and / or a cross-link (current flow between paired packs) (R6). Additionally or alternatively, the BMU 201 may measure a cell stack voltage (across points V3), bus (e.g., main bus) voltage (load side of main bus contactors) (across points V2), propulsion bus voltage (load side of propulsion contactor) (across points V2), and / or charge bus voltage (load side of charge contactors) (across points V4) to measure the associated voltage of these loads. Additionally or alternatively, the BMU 201 may measure temperature (T) and / or current measurement(s) (I of the cell stack. As further detailed below, based on these measurements, the BMU 201 may perform diagnostics to determine the state(s) of the high voltage distribution system. The BMU 201 may control one or more switching devices and / or fuses based on the measurements to isolate (e.g., electrically isolate) a battery pack (e.g., determined to be faulty, such as based on a determination that monitored information exceeds a threshold) and / or associated high voltage wiring from other aircraft components (e.g., other battery pack(s) and / or other high voltage wiring).

[0061] In some embodiments, the BMU 201 may report state(s) of the high voltage distribution system (e.g., to a flight control system), based upon which at least one processor (e.g., an FCC, a BMU, an MCU, etc.) may take at least one action. A state of the high voltage distribution system may be based on and / or include sensor data received from one or more sensors associated with high voltage wiring and / or battery pack(s) 120, a state of one or more switching devices (e.g., open or closed), a state of one or more fuses (e.g., blown or not blown), a state of a battery pack and / or associated cells (e.g., battery pack state oftemperature (SOT), state of charge (SOC), state of power (SOP), state of energy (SOE), capacity, impedance, and / or any other battery pack state).

[0062] As used herein, information described as “pack-level” or “pack level” means that the information is expressed with respect to one or more battery packs. For example, a pack-level temperature may be a temperature of, or a temperature representation of, one or more battery packs. Additionally, as used herein, information described as “cell-level” or “cell level” means that the information is expressed with respect to one or more battery cells, such as a single battery cell or group of battery cells forming a subset of the battery cells in a battery pack. For example, a cell-level voltage may be a voltage of, or a voltage representation of, one or more battery packs.

[0063] A state of temperature (SOT) may include or indicate a temperature of at least a portion of a battery cell (e.g., at least one active material of the battery cell, the battery cell itself, multiple battery cells, a battery pack, etc.). For example, an SOT may indicate a core or inner temperature of a battery cell, a temperature of the top of the battery cell, a temperature of the middle of the battery cell, and / or the temperature of the bottom of the battery cell. In some embodiments, an SOT may be based on a measured temperature value (e.g., measured by a temperature sensor adjacent to or on a battery cell). In some embodiments, an SOT may be based on a measured temperature value (e.g., measured by a temperature sensor adjacent to or on a battery cell). An SOT may be estimated using temperature measurements, which may be associated with the at least a portion of a battery cell, such as individual battery cells. For example, an SOT may be estimated using the measured temperature value (e.g., using a model relating an outer measured temperature to an inner temperature).

[0064] As another example, an SOT may be a pack-level temperature based on (e.g., calculated using) multiple battery cell SOTs. In some embodiments, an SOT may be based on a measurement (e.g., direct measurement), an estimation (e.g., based on a direct measurement), or a combination of both. An SOT may be expressed as an absolute value of degrees (e.g., in Fahrenheit, Celsius, or Kelvin) and / or a ratio (e.g., with respect to rated limit, safety limit, etc.). In some embodiments, an SOT may be based on an SOH, as discussed further herein. In some embodiments, an SOT may be used to determine an SOC, as discussed further herein. Measurements used for SOT may be taken at a battery cell level and / or derived from measurements taken for multiple cells, such as pack-level measurements. Additionally or alternatively, the SOT of the battery pack may be equal to a combination (e.g., average, weighted average) of SOT of one or more (e.g., each) battery cells. Additionally, or alternatively, SOT of cells in a battery pack may be extrapolated from theSOT of the battery pack. For example, by applying the rationale that SOT of the battery pack estimated using pack-level measurements should be equal approximately the average of SOT of cells in the battery pack, SOT of cells in the battery pack can be estimated.

[0065] In some embodiments, an SOC may indicate an ability of at least a battery cell (e.g., the battery cell itself, multiple battery cells, a battery pack, multiple battery packs, etc.) at a particular instant of time to store (or provide) charge. State of charge may be expressed as an absolute number (e.g., Coulombs or Amp-hrs Ah) or as a ratio or percentage relative to a maximum ability of the at least a battery cell to store (or provide) charge. In some embodiments, a state of charge may refer to an available battery pack capacity relative to the battery pack’s rated capacity. Additionally or alternatively, in some embodiments, state of charge may refer to an available battery cell capacity relative to the battery cell’s rated capacity.

[0066] In some embodiments, an SOC may be based on a measured charge or voltage value (e.g., measured by a temperature sensor adjacent to or on a battery cell). An SOC may be estimated using charge or voltage measurements, which may be associated with the at least a portion of a battery cell, such as individual battery cells. Measurements used for SOC may be taken at a battery cell level and / or derived from measurements taken for multiple cells, such as pack-level measurements. Further, in some embodiments, a state of charge of a battery pack may be based on one or more states of charge of one or more battery cells. For example, a battery pack SOC may be a combination (e.g., summation, weighted summation) of each battery cell SOC. Additionally or alternatively, the SOC of the battery pack may be equal to a combination (e.g., average, weighted average) of states of charge of one or more (e.g., each) battery cells. Additionally, or alternatively, SOC of cells in a battery pack may be extrapolated from the SOC of the battery pack. For example, by applying the rationale that SOC of the battery pack estimated using pack-level measurements should be equal approximately the average of SOC of cells in the battery pack, SOC of cells in the battery pack can be estimated.

[0067] In some embodiments, state of power (SOP) may indicate an available power that can be provided by the battery pack over a time horizon, e.g., without exceeding at least one system constraint (such as a battery pack voltage constraint, battery cell temperature constraint, HV wiring current carrying constraint, etc.). SOP may be expressed as an absolute number (e.g., kW, W) or as a ratio or percentage relative to a maximum rated power (e.g., a maximum rated system power).

[0068] In some embodiments, an SOP may be based on a measured charge, temperature, voltage, power, impedance, and / or other value(s) of battery cell characteristic (physical, electrical, and / or chemical) (e.g., measured by a sensor adjacent to or on a battery cell, such as a voltage sensor). An SOP may be estimated using charge or voltage measurements, which may be associated with the at least a portion of a battery cell, such as individual battery cells. Measurements used for SOP may be taken at a battery cell level and / or derived from measurements taken for multiple cells, such as pack-level measurements. Further, in some embodiments, an SOP of a battery pack may be based on one or more SOPs of one or more battery cells. For example, a battery pack SOP may be a combination (e.g., summation, weighted summation) of each battery cell SOP. Additionally or alternatively, the SOP of the battery pack may be equal to a combination (e.g., average, weighted average) of states of charge of one or more (e.g., each) battery cells. Additionally, or alternatively, SOP of cells in a battery pack may be extrapolated from the SOP of the battery pack. For example, by applying the rationale that SOP of the battery pack estimated using pack-level measurements should be equal approximately the average of SOP of cells in the battery pack, SOC of cells in the battery pack can be estimated.

[0069] A state of energy (SOE) may indicate a predicted amount of energy remaining in at least one battery cell (e.g., a single battery cell, multiple battery cells, a battery pack, multiple battery packs, etc.) at a particular time. In some embodiments, an SOE may be based on (e.g., calculated using) an expected future power demand from the at least one battery cell (e.g., demanded by a system, such as a vehicle or aircraft). Additionally or alternatively, an SOE may include or may be based on one or more of an estimated range (e.g., flight range of an aircraft), an amount of useful energy, or an amount of usable energy. In some embodiments, a state of energy may be based on past use of the at least one battery cell (e.g., based on past flights). Additionally or alternatively, an SOE may include or be based on a total energy in a cell, which may be calculated by determining an area under an open circuit voltage-SOC curve. Additionally or alternatively, an SOE may include or be based on the expression of Vnom * Q, where the Vnom is the nominal voltage of a cell or battery, and Q is a charge capacity (e.g., expressed in Ah). In some embodiments, an SOE may include available discharge energy in a battery cell such that when an assumed power demand is realized, a system constraint is reached at the conclusion of the demand. For example, a system constraint may include a minimum cell voltage, a maximum cell temperature, and / or a minimum voltage of one or more connected loads (e.g., EPU). In some embodiments, an SOE may be based on a measured charge, temperature, voltage, impedance, and / or other value(s)of battery cell characteristic (physical, electrical, and / or chemical) (e.g., measured by a sensor adjacent to or on a battery cell, such as a voltage sensor). An SOE may be estimated using charge, temperature, and / or voltage measurements, which may be associated with the at least a portion of a battery cell, such as individual battery cells. Measurements used for SOE may be taken at a battery cell level and / or derived from measurements taken for multiple cells, such as pack-level measurements. Additionally or alternatively, the SOE of the battery pack may be equal to a combination (e.g., average, weighted average) of states of energy of one or more (e.g., each) battery cells. Additionally, or alternatively, SOE of cells in a battery pack may be extrapolated from the SOE of the battery pack. For example, by applying the rationale that SOE of the battery pack estimated using pack-level measurements should be equal approximately the average of SOE of cells in the battery pack, SOE of cells in the battery pack can be estimated.

[0070] A state of health (SOH) may indicate a performance capability and / or performance loss of at least a battery cell (e.g., the battery cell itself, multiple battery cells, a battery pack, multiple battery packs, etc.). For example, the SOH may indicate an amount of degradation experienced by, or performance capability of, the battery cell, which may be expressed relative to an initial (e.g., original) capability of the battery cell. The performance of the battery cell may be based on or relate to one or more of: charge capacity, energy storage, energy output, power storage, power output, a cell state, a battery state, an electrical component state, or a system state. In some embodiments, an SOH may be based on one or more of a power fade (e.g., impedance growth) or a capacity fade of the at least one battery cell.

[0071] In some embodiments, a SOH of a battery pack may be defined by the SOH of one or more battery cells of the battery pack. For example, the SOH of the battery pack may be equal to the worst SOH of a battery cell (e.g., highest impedance growth, largest capacity fade). In some embodiments, at least one processor may determine an SOH of a battery cell or a battery pack based on measurements from one or more corresponding sensors. For example, an SOH of a battery pack may be determined based on battery pack-level signals acquired by one or more pack-level sensors. Further, an SOH of a battery cell may be determined based on battery cell-level signals acquired by one or more cell-level sensors. In some embodiments, an SOH may be based on a measured charge, temperature, and / or voltage value (e.g., measured by a voltage sensor adjacent to or on a battery cell). In some embodiments, an SOH may be based on a measured charge, temperature, voltage, impedance, or other value(s) of battery cell characteristics (physical, electrical, and / or chemical) (e.g.,measured by a sensor adjacent to or on a battery cell, such as a voltage sensor). An SOH may be estimated using charge, temperature and / or voltage measurements, which may be associated with the at least a portion of a battery cell, such as individual battery cells. Measurements used for SOH may be taken at a battery cell level and / or derived from measurements taken for multiple cells, such as pack-level measurements. Additionally or alternatively, the SOH of the battery pack may be equal to a combination (e.g., average, weighted average) of states of health of one or more (e.g., each) battery cells. Additionally, or alternatively, SOH of cells in a battery pack may be extrapolated from the SOH of the battery pack. For example, by applying the rationale that SOH of the battery pack estimated using pack-level measurements should be equal approximately the average of SOH of cells in the battery pack, SOH of cells in the battery pack can be estimated. In some embodiments, thermistors may be placed adjacent to (e.g., in series with, as a next component along a wire, etc.) pre-charge switching devices (e.g., K3 and K5) and the pre-charge resistor(s) (e.g., R1 and R7). In some embodiments, the BMU 201 may monitor the temperature of one or more of these components to determine whether they are within a threshold (e.g., safe) temperature range to begin or continue with the pre-charge process. For example, the BMU 201 may compare the temperature of one or more of these components to one or more temperature thresholds (e.g., a threshold above which there is a risk of damage) and prevent pre-charging when the threshold is exceeded. Pre-charging, as used herein, may be or include raising a voltage of an electrical component and / or portion of a circuit to a first voltage prior to raising the electrical component and / or portion of a circuit to a second voltage that is higher than the first voltage.

[0072] Figure 2B illustrates an exemplary wiring diagram of another battery pack of an aircraft. For example, relative to the wiring shown in Figure 2A, in some embodiments, in addition to or in lieu of the separate pre-charge resistors R1 and R7, a single pre-charge resistor RIA may be shared between two or more pre-charge circuits, reducing the overall weight of the battery pack. In some embodiments, RIA may be a PTC resistor whose resistance increases as heat (e.g., generated by current) causes the temperature of the resistor to increase. Therefore, high current associated with an overcurrent condition will heat the resistor RIA causing an increase in resistance and limiting the overcurrent condition. PTC resistors may be smaller than traditional resistors configured to provide similar resistance in the overcurrent conditions, thereby decreasing weight of the battery pack.

[0073] Further, in some embodiments, one or more fuses may be included as part of precharge circuitry (e.g., portion of high voltage circuitry through which current flows duringpre-charge). In some embodiments, pre-charge circuits that pre-charge different portions of high voltage circuitry may share a single fuse (as shown by fuse F8a), while in other embodiments two or more pre-charge circuits may include separate fuses (e.g., separate fuses for main bus and propulsion bus pre-charge circuitry). The fuse(s) may be dedicated to the pre-charge circuitry or shared between pre-charge circuits and other components. For example, in some embodiments (as shown in Figure 2B) the fuse F8a may be shared between the pre-charge circuitry and BMU circuitry (e.g., portion of high voltage circuitry powering the BMU).

[0074] In some embodiments, the pre-charge circuitry may further include diodes that are part of separate pre-charge circuits. For example, the pre-charge circuitry may include a first diode DI as part of a pre-charge circuit feeding a bus (e.g., a main bus feeding a DC / DC for low voltage systems, ECS equipment, and / or paired battery pack(s)) and a second diode D2 as part of the pre-charge circuit feeding the propulsion bus (e.g., bus providing current to at least one EPU 110). Therefore, if there is a difference in potential between the propulsion bus and another bus (e.g., the main bus), the diodes may prevent reverse current flow between the circuits.

[0075] As in Figure 2A, in some embodiments, thermistors may be placed adjacent to (e.g., in series with, as a next component along a wire, etc.) one or more pre-charge switching devices (e.g., K3 and K5) and the pre-charge resistor(s) (e.g., Ria) In some embodiments, BMU 201 may monitor the temperature of these components to determine whether they are within a threshold (e.g., safe) temperature range to begin or continue with the pre-charge process. For example, BMU 201 may compare the temperature of one or more of these components to one or more temperature thresholds (e.g., a threshold above which there is a risk of damage) and prevent pre-charging when the threshold is exceeded.

[0076] Figures 3A, 3B, and 3C illustrate exemplary control architecture and communication pathways for a battery management system of an aircraft, consistent with disclosed embodiments.

[0077] Figures 3A and 3B illustrate exemplary control architecture for a battery management system of an aircraft, consistent with disclosed embodiments. Figure 3A illustrates that the battery management unit (BMU) 201 may include one or more controllers, such as at least one microcontroller unit (MCU) (e.g., two controllers, such as Control MCU 301 and Estimation MCU 302) to provide redundancy in monitoring and controlling high voltage components. For example, each controller may include at least one processor (e.g., at least one microprocessor-based controller) configured to execute software code stored in a storagemedium (e.g., a computer-readable medium, a non-transitory computer-readable medium) to implement any combination of the functions described herein.

[0078] Control MCU 301 (e.g., a first controller) may execute (e.g., based on instructions in at least one storage medium) one or more algorithms 301a configured to make determinations and manage the battery pack and / or associated circuitry state of high voltage wiring, consistent with disclosed embodiments. For example, Control MCU 301 may execute (e.g., based on instructions in at least one storage medium) one or more algorithms configured to control switching devices in various modes and states of the aircraft (e.g., switching device management). For example, the Control MCU 301 may receive a signal regarding (e.g., indicating) a pilot selected mode (e.g., flight mode, ground mode, powered-off) and / or a detected state (e.g. detecting a charger connection, which may indicate whether one or more components of the aircraft are actively charging) of the aircraft and may control switching devices according to the selected mode and / or state. A state of the aircraft may a combination of one or more states of aircraft components (e.g., circuitry states and / or battery pack states) and / or one or more measurements (e.g., airspeed, altitude, etc.) made by aircraft sensors.

[0079] Further, the Control MCU 301 may execute (e.g., based on instructions in at least one storage medium) one or more algorithms 301a configured to determine and / or control a circuitry state. For example, determining a circuitry state may include determining one or more states of one or more components (e.g., a switch being open or closed, a voltage at a part of a circuit, a current at a part of a circuit, a fuse being intact or blown) and controlling a circuitry state may include one or more blowing fuses (e.g., F1-F8) and / or controlling one or more switching devices (e.g., K1-K7) based on a state of the battery pack, state of circuitry, and / or a load (e.g., fuse management and / or fault manager), which may be connected to a circuit whose voltages or currents the Control MCU 301 can at least partially control. A circuitry state may include a combination of switching device states (e.g., open or closed) and / or fuse states (e.g., blown or not blown) and / or one or more measured values of circuitry, consistent with disclosed embodiments. A state of a battery pack may include a battery pack temperature, battery pack voltage, battery pack current, battery pack state of temperature, battery pack state of charge, battery pack state of power, battery pack state of energy, battery pack state of health, battery pack capacity, battery pack impedance, and / or any other determined condition of the battery pack . A state of circuitry may include a temperature, voltage, health, connectivity, and / or current condition of high voltage circuitry. Additionally or alternatively, a state of circuitry may include whether circuitry is in an operational configuration satisfying at least one performance criterion. For example, a circuitry state mayinclude whether an overvoltage condition (e.g., voltage exceeding a threshold value) is present in one or more places of the circuitry.

[0080] Control MCU 301 may receive sensor data (e.g., first sensor data) from one or more sensors (e.g., first sensors). Sensors may include voltage sensors, current sensors, resistivity sensors, and / or heat sensors, which may be placed within or near an electrical system to detect measurements about electrical components. Sensor data may include a voltage measurement, current measurement, resistivity measurement, heat measurement, or any combination thereof. In some embodiments, control MCU 301 may derive additional information from the sensor data, which may be used to supplement the sensor data. For example, the Control MCU 301 may receive information on the state of the battery pack and / or circuitry (e.g. a battery pack or circuitry voltage, current, and / or temperature, as described above). In some embodiments, the first sensor data may be received from and / or measured by at least one of a current sensor or a voltage sensor.

[0081] In some embodiments, Control MCU 301 may determine a circuitry state (e.g., as discussed above) based on the sensor data (e.g., a first circuitry state based on first sensor data). In some embodiments, the circuitry state may be represented by one or more state values (e.g., corresponding to one or more switching device states, fuse states, and / or measurements).

[0082] In some embodiments, Control MCU 301 may output a signal indicative of the circuitry state determination. In some embodiments, Control MCU 301 may output the signal to Estimation MCU 302, a BMU, an FCC, any device with at least one processor, or any circuitry capable of outputting a response based on the signal.

[0083] In some embodiments, Control MCU 301 may take an action (e.g., control a circuitry state, such as by transmitting a command to a component to open, close, or blow) based on the received information. In some embodiments, the Control MCU 301 may blow a fuse of the battery pack and / or a fuse of an associated load based on detecting an electrical issue (e.g., overcurrent condition, overtemperature condition, short circuit, operating condition that does not satisfy a performance metric, etc.).

[0084] An electrical issue may include any malfunction or underperformance by an electrical component. For example, an electrical issue may include an overcurrent condition, overheated short circuit, overheat condition, fault, software bug, software glitch, and / or another operating condition of an electrical component and / or circuitry configured to be powered a battery pack does not meet a performance metric.

[0085] The electrical issue may be detected when a value exceeds a threshold (e.g., a voltage exceeds a threshold voltage), as discussed above. In some embodiments the Control MCU 301 will verify whether an Estimation MCU 302 (e.g., second controller) also detects an electrical issue prior to blowing one or more fuses and / or prior to disconnecting one or more switching devices. In some embodiments, the Control MCU 301 may perform isolation monitoring which may include estimating an amount of isolation of at least one electrical component, estimating an amount of resistivity of at least one electrical component, monitoring resistance between at least one electrical component and ground, and / or taking one or more responsive actions. In some embodiments, the Control MCU 301 may detect connection to a charging port and perform charging control.

[0086] Control MCU 301 may execute (e.g., based on instructions in at least one storage medium) one or more algorithms for detecting a battery pack state of temperature (SOT), state of charge (SOC), state of power (SOP), state of energy (SOE), state of health (SOH), and / or any other battery pack state.

[0087] Estimation MCU 302 may also receive sensor data (e.g., second sensor data) from one or more sensors which may be the same as, partially overlap with, or not include any of the sensors from which Control MCU 301 receives or received data. The sensors may be placed within or near an electrical system to detect measurements about electrical components. Sensor data may include a voltage measurement, current measurement, resistivity measurement, heat measurement, or any combination thereof. In some embodiments, estimation MCU 302 may derive additional information from the sensor data, which may be used to supplement the sensor data. In some embodiments, the second sensor data may be received from and / or measured by at least one of a current sensor or a voltage sensor.

[0088] Estimation MCU 302 may also execute (e.g., based on instructions in at least one storage medium) one or more algorithms 302a to make determinations and manage the battery pack and / or a circuitry state of associated high voltage wiring. For example, Estimation MCU 302 may execute one or more algorithms for detecting a battery pack state of temperature (SOT), state of charge (SOC), state of power (SOP), state of energy (SOE), capacity, impedance, and / or any other battery pack or circuitry state. For example, the Estimation MCU 302 may receive information from various sensing devices (e.g., voltage, current, and / or temperature sensors) and / or other aircraft components to determine the battery pack state. In some embodiments, Estimation MCU 302 may receive sensing information from the battery pack cell stack (e.g., through cell management units and / or sensing devices)and / or through sensors associated with the high voltage wiring connecting the battery pack to various loads.

[0089] In some embodiments, the battery pack states detected by Control MCU 301 may be based on the same and / or different sensing devices and / or aircraft components upon which the battery pack states detected by Estimation MCU 302 were determined. In some embodiments, the inputs and algorithms used by the Estimation MCU 302 to determine one or more battery pack states may vary from the inputs and algorithms used by the Control MCU 301 to determine the one or more battery pack states.

[0090] Alternatively, a single device (e.g., only the Control MCU 301 or only the Estimation MCU 302) may use combinations of inputs and / or algorithms, which may be different from those used by just the Control MCU 301 or just the Estimation MCU 302. For example, the single device may include inputs and / or algorithms used by both the Control MCU 301 and the Estimation MCU 302. In some embodiments, a device, such as an MCU, circuit, controller, watchdog, FCC, BMU, or at least one processor, may compare battery pack states (e.g., differently calculated battery pack states) and determine a more accurate estimate, which may be provided (e.g. to a flight control system). Further, in some embodiments, separate sensing devices and / or associated circuitry may be used for each of the Control MCU 301 and Estimation MCU 302 to provide for redundancy and more accurate estimation of a circuitry state, which helps to ensure that system components are operating as expected and to detect errors when they occur.

[0091] In some embodiments, Estimation MCU 302 may determine a circuitry state. For example, determining a circuitry state may include determining one or more states of one or more components (e.g., a switch being open or closed, a voltage at a part of a circuit, a current at a part of a circuit, a fuse being intact or blown) and controlling a circuitry state may include blowing one or more fuses (e.g., F1-F8) and / or controlling one or more switching devices (e.g., K1-K7) based on a state of the battery pack, state of circuitry, and / or an associated load (e.g., fuse management and / or fault manager). In some embodiments, Estimation MCU 302 may determine the circuitry state based on the sensor data (e.g., a second circuitry state based on second sensor data).

[0092] In some embodiments, Estimation MCU 302 may execute (e.g., based on instructions in at least one storage medium) one or more algorithms for contactor latch management (e.g., controlling a contactor latch to set, hold or maintain, or release a state that may indicate a value). In some embodiments, Estimation MCU 302 may execute one or more algorithms for performing battery cell balancing (e.g., balancing of voltage or charge) among the cells in thebattery pack (e.g., balancing). For example, in some embodiments, the battery pack cells may be actively balanced, while in other embodiments the battery pack cells may be passively balanced.

[0093] The Control MCU 301 and / or Estimation MCU 302 may further include other hardware and / or software components. For example, Control MCU 301 and / or Estimation MCU 302 may include hardware and / or software to manage inputs and outputs (e.g., Estimation MCU input / output manager 302b, Control MCU input / output manager 301b), perform service and diagnostics of the battery management system and associated high voltage wiring (e.g., 302c, 301c), and perform monitoring and control of high voltage wiring and components (e.g., 302d, 301d). Further, the Control MCU 301 and / or Estimation MCU 302 may include platform-level components, such as drivers, memory loader(s), bootloader(s) etc. (e.g., platform-level component 302e, platform-level component 301e).

[0094] Further, the Control MCU 301 and / or the Estimation MCU 302 may communicate with a flight control system of the aircraft, e.g., via an FCS controller area network (FCS CAN). For example, the Control MCU 301 and / or Estimation MCU 302 may communicate information on state of temperature, state of charge, state of power, state of energy, state of health, capacity, impedance, and / or any other determined condition of the battery pack. In some embodiments, the flight control system (FCS) may receive information from the Control MCU 301 and / or Estimation MCU 302 and, based on this information, perform an action. For example, the FCS may receive one of the above states and determine that it is outside a tolerable range of aircraft operation and adjust control of the aircraft to reduce a use of battery pack(s) outside the tolerable range. Further, in some embodiments, Control MCU 301 and / or the Estimation MCU 302 may communicate with another battery management system and / or other aircraft components (e.g., via a separate CAN line, not shown).

[0095] Figure 3B illustrates exemplary Estimation MCU and Control MCU connections, consistent with embodiments of the present disclosure. In some embodiments, the Estimation MCU 302 hardware and Control MCU 301 hardware are both located on a same board (e.g. a logic board), while in other embodiments each one is on a different board.

[0096] The Estimation MCU 302 may receive cell information from one or more cell management units of the battery pack cells (e.g. CMU 304a and / or CMU 304b), such as a chip, microchip, and / or processor configured to measure characteristics indicative of a state of one or more battery pack cells within a battery pack (and, in some embodiments, generate corresponding data describing the measured characteristics). In some embodiments, the Estimation MCU 302 may determine an overvoltage condition (e.g., indication that aparticular voltage level exceeds an operational threshold, such as a safety threshold) based on one or more readings from one or more individual battery pack cells (e.g., via CMUs). Therefore, the Estimation MCU 302 may take corresponding actions (e.g., open contactor and / or blow a fuse) even if measurements at a battery pack level have not indicated the overvoltage condition. Similarly, the Estimation MCU 302 may determine an overtemperature condition based on readings from one or more individual battery pack cells (e.g., via CMUs). Therefore, the Estimation MCU 302 may take corresponding actions (e.g., open contactor and / or blow a fuse) even if the pack level measurements haven’t detected the overtemperature condition (e.g., indication that a particular temperature exceeds an operational threshold, such as a safety threshold). In some embodiments, the Estimation MCU 302 may send an indication of the over-voltage and / or over-temperature conditions to the Control MCU 301, which may take one or more responsive actions (e.g., open a contactor and / or blow a fuse), with or without confirming the condition.

[0097] In some embodiments, the Estimation MCU 302 may determine a pack-level voltage measurement by aggregating the cell voltages. The Control MCU 301 may also measure a pack-level voltage (e.g., main bus voltage, which may be determined via link monitor 305c,). Therefore, in some embodiments, either the Estimation MCU 302 or Control MCU 301 may detect an over-voltage condition at the pack-level and take a responsive action (e.g., open a contactor and / or blow a fuse). In some embodiments, both the Estimation MCU 302 or Control MCU 301 must detect the over-voltage condition prior to taking the action.

[0098] As shown, Estimation MCU 302 and Control MCU 301 may be connected to one or more link monitors (e.g., sensor monitoring controllers, voltage sensors, etc.), such as link monitors 305a-305e. Link monitors may be connected to sensors to measure a state of high voltage wiring between the battery pack and one or more loads powered by the battery pack. A state of high voltage wiring may include a combination of switch states of one or more components connected by the high voltage wiring. A switch state may include a status of a switch with respect to current flow (e.g., open with no current flowing, partially closed with inconsistent current flowing, or closed with current flowing). A switching device state may be considered a switch state of a switching device.

[0099] In some embodiments, the link monitors may receive sensor measurements and provide an analog output(s) over one or more channels (e.g., four channels) based on the measurements.

[0100] Estimation MCU 302 may receive information on a battery cell stack current, temperature of at least one current shunt (e.g., R2, R3, R4, and / or R6), and / or DC / DC current(e.g., current provided to DC / DC 201a). Further, Control MCU 301 may also receive information indicating a cell stack current and / or a current shunt temperature. Control MCU 301 may receive information indicating a battery cell stack voltage, an isolation measurement, a cross-link current (e.g., current at 130), temperature(s) (e.g., temperature(s) of at least one current shunt), a voltage on a bus (e.g., vl may be a voltage on a main bus), a charge bus voltage (e.g., measured across points V4), a current to EPU(s), and / or voltage on a propulsion bus (e.g., measured across points V2). The Estimation MCU 302 and / or Control MCU 301 may determine overcurrent conditions, over-voltage conditions, and / or other electrical faults based on the various current sensing devices (e.g., via link monitors). In some embodiments, as further described below, the link monitors (305a-305e) may also directly control the fuses and contactors based on their own detections (e.g., detection of an overcurrent condition).

[0101] In some embodiments, the Control MCU 301 performs an action based on receiving information from the Estimation MCU 302. For example, Estimation MCU 302 may send current, voltage, and / or temperature measurements and / or may send an action to be taken by the Control MCU 301. In some embodiments, both the Estimation MCU 302 and Control MCU 301 may be capable of taking an action. For example, the Estimation MCU 302 and Control MCU 301 may each be configured to open a contactor and / or blow a fuse based on an overcurrent condition.

[0102] In some embodiments, Estimation MCU 302 and / or Control MCU 301 may include other hardware components and connections 303 to store information, perform power management, convert and / or transmit signals, and / or otherwise communicate with other aircraft components.

[0103] Figure 3C illustrates an example of communication coordination between the Estimation MCU 302 and the Control MCU 301, consistent with disclosed embodiments. In some embodiments one of the Estimation MCU 302 or Control MCU 301 may double check the circuitry state and / or commands (e.g., open / close contactor commands or command to blow fuse) determined by the other MCU. For example, as shown, each of the Estimation MCU 302 and Control MCU 301 may receive a flight state signal from a flight control system (FCS) 307 (e.g., one or more flight control computers) indicating whether or not the aircraft is in flight. Each of the Estimation MCU 302 and Control MCU 301 may further receive a validity signal from the FCS 307 that may be used to determine whether the flight state signal is valid. For example, the validity signal may indicate whether there is an issue with the hardware or software of a flight control computer of the flight control system. Thesesignals may be verified (e.g., through comparison, as discussed below) between the controllers prior to taking a corresponding action.

[0104] As one example, Control MCU 301 may determine to close at least one contactor (e.g., K1-K7) and / or blow at least one fuse (e.g., F1-F8). For example, Control MCU 301 may receive a signal indicating a flight change mode (e.g., from flying mode with EPUs 110 powered on to a non-flying mode with EPUs 110 powered off) from the flight control system. The signal may trigger a contactor state to be changed (e.g., open K4). Additionally or alternatively, the Control MCU 301 may determine, such as based on the signal that there is a state of a battery pack and / or circuitry (e.g., over-current, over-voltage, over-temperature) that triggers a fuse to be blown. The Control MCU 301 may determine (e.g., based on signals from FCS 307) that the aircraft is in a safe flight state to perform the action (e.g., via at least one flight control signal) and may confirm the validity of the flight control signal. In some embodiments, such as after (e.g., based on, when, and / or in response to) making these determinations, the Control MCU 301 may send a control signal to fuse driver 308 to perform the action. For example, the Control MCU 301 may determine the aircraft is not in flight (e.g., Control MCU 301 detects a valid ground mode signal) and a battery pack fuse (e.g., Fl) may be blown. In some embodiments, the Control MCU 301 may first confirm that the Estimation MCU 302 has also received the valid flight control signal, which may indicate a safe flight state and / or cause the Control MCU or other processing component to allow a requested action to proceed (e.g., changing of modes, powering of one or more components, pre-charging of one or more components).

[0105] Further, in some embodiments, the Control MCU 301 may send a command indicating the contactor whose state should be changed or a particular fuse to be blown to the Estimation MCU 302. The Estimation MCU 302 may perform certain determinations to ensure the command is safe. For example, the Estimation MCU 302 may confirm (e.g., based on signals from the flight control system) that the aircraft is in a safe flight state (e.g., not in flight, EPUs powered down below a threshold, etc.) to perform the action and may confirm the validity of the flight control signal.

[0106] In some embodiments, the Estimation MCU 302 may further evaluate electrical conditions in order to determine if the command is safe. For example, the Estimation MCU 302 may confirm that temperature and / or voltage (e.g., of battery cells and / or other components) is within a predetermined range to perform the respective command. Based on making these determinations and confirmations, the Estimation MCU 302 may send a controlsignal to the contactor or fuse driver 308 (e.g., K1-K7, Fl-8, and / or associated drivers) to perform the action.

[0107] In some embodiments, the control signals from the Estimation MCU 302 and the Control MCU 301 must agree prior to taking a corresponding action. For example, both the Estimation MCU 302 and the Control MCU 301 must agree on which component to control (e.g., fuse F1-F8 and / or switching devices K1-K7) and what action should be taken (e.g., open, close, blow fuse etc.). For example, Estimation MCU 302 may not transmit an instruction for a contactor to open or for a fuse to blow unless it has verified, based on one or more communications with Control MCU 301, (1) an identification of at least one switch and / or fuse, and / or (2) that one or more conditions for controlling the at least one switch and / or fuse are satisfied. Additionally or alternatively, Control MCU 301 may transmit instructions based on verification from the Estimation MCU 302. Additionally or alternatively, another processing device may transmit instructions based on verification from the Control MCU 301 and / or Estimation MCU 302. In some embodiments, the confirmation of agreement between the Estimation MCU 301 and Control MCU 302 may be implemented by logic circuitry, as further detailed in the figures below.

[0108] Figures 4A, 4B, 4C, 4D, and 4E illustrate exemplary control components and logic for a battery management system, consistent with disclosed embodiments.

[0109] Figure 4A illustrates exemplary controller logic for switching devices, such as KI and K2 detailed in Figures 2 A and 2B above. As shown, Control MCU 301 and Estimation MCU 302 may make a determination to open or close switching device(s) KI and / or K2. In some embodiments, the determination to open or close a switching device may be based on one or more sensed measurements (e.g., current, voltage, and / or temperature exceeding a respective threshold) and / or determined battery pack states detailed above with respect to Figures 3A and 3B.

[0110] In some embodiments, the determination to open or close a contactor may be based on a communication received from a separate component of the aircraft (e.g., a flight control system or pilot input device). As detailed below, in some embodiments, neither controller (Estimation MCU 302 or Control MCU 301) may unilaterally decide to change a state of the switching device(s) KI and / or K2 because each controller’s control is limited and there must be agreement between the controller signals to change a switching device state.

[0111] Based on their determination to open or close switching device(s) KI and / or K2, each controller may each send at least one signal indicative of the commanded state to an inverter device 401a.

[0112] In some embodiments, at least one of the at least one first signal and the at least one second signal may indicate two values, which may be separate values that are the same (e.g., “1” and “1”) or different (e.g., “0” and “1”). For example, the at least one first signal may include two first signals (e.g., CMCU_A and CMCU_B), each of which may indicate a respective value. As another example, the at least one second signal may include two second signals (e.g., EMCU A and EMCU B), each of which may indicate a respective value. In some embodiments, each controller may output two signals indicative of the battery pack state. For example, a commanded open state may be represented by a 0 on signal line A (e.g., CMCU A and EMCU A) and 1 on signal line B (e.g., CMCU B and EMCU B) and a commanded close state may be represented by a 1 on signal line A (e.g., CMCU A and EMCU A) and 0 on signal line B (e.g., CMCU B and EMCU B).

[0113] In some embodiments, the two values (or more) may be binary. For example, each value indicates either “0” or “1,” “A” or “B,” or any one of two defined binary states.

[0114] In some embodiments, the first controller may be configured to output at least one third signal indicative of the circuitry state determination made by the first controller. The at least one third signal may share characteristics with the at least one first signal.

[0115] Also, the second controller may be configured to output at least one fourth signal indicative of the circuitry state determination made by the second controller. The at least one fourth signal may share characteristics with the at least one second signal.

[0116] In some embodiments, the at least one third signal and / or the at least one fourth signal may be transmitted to the verification circuitry or another verification circuitry. As a nonexclusive example, Control MCU 301 may transmit at least one third signal to the lower logic gate device 402a shown in Figure 4A. As another non-exclusive example, Estimation ECU 302 may transmit at least one fourth signal to the lower logic gate device 402a shown in Figure 4A.

[0117] In some embodiments, the verification circuitry may include an inverter configured to invert one of the two values and not invert the other of the two values. For example, inverter device 401a may receive the signals and invert one of them (e.g., change a digital signal from a “0” to a “1” or vice versa) prior to sending the signals to logic gate device 402a. Therefore, a controller that inadvertently sends a default signal (e.g., two value Is) would not affect the state of the switching device (KI and / or K2).

[0118] In some embodiments, a system may include a controller monitoring device, which may include a controller or other processing device configured to analyze behavior of one or more circuit components. For example, watchdog block 403 (e.g., a controller monitoringdevice), which may be at least one controller and / or processor) may determine whether both controllers are functioning properly (e.g., functioning within a threshold of at least one designed and / or established criterion and / or meeting a performance metric) based on signal(s) received from the controller(s). For example, watchdog block 403 may determine whether it is receiving a signal continuously or at a predetermined interval from Control MCU 301 and Estimation MCU 302.

[0119] In some embodiments, the verification circuitry may be configured to maintain a state of the high voltage control device when, or in response to, at least one of the first controller or second controller does not provide a signal to the controller monitoring device in accordance with at least one set timing criterion. For example, if watchdog block 403 does not receive a signal in accordance with at least one timing criterion (e.g., within a predetermined time period, with a threshold frequency, in response to a prompt), the watchdog and / or other components in the circuit may maintain a state of the high voltage control device. For example, if watchdog block 403 does not receive a signal and / or does not receive signal(s) at the correct pulse timing and / or in accordance with another timing criterion, it may determine a failure of the respective controller (e.g., Control MCU 301 and / or Estimation MCU 302). Based on determining that at least one controller has failed, watchdog block 403 may cause (e.g., instruct, transmit a command to, provide a hardware block to) the contactors to maintain their present state, which can prevent either a loss of power or the sourcing of uncontrolled (unmanaged) power. The watchdog functionality may be implemented as hardware only or a combination of hardware and software. In some embodiments, a first timing criterion may be applied to the first controller and a second timing criterion may be applied to the second controller.

[0120] In some embodiments, the controller monitoring device may configured to receive at least one third signal from the first controller and at least one fourth signal from the second controller, consistent with disclosed embodiments. Also, the verification circuitry may be configured to maintain a state of the high voltage control device when, or in response to, at least one of the first controller or the second controller does not provide the at least one third signal or the at least one fourth signal, respectively, according to the at least one set timing criterion, which may be the same as, or different from, the at least one set timing criterion for the at least one first signal and the at least one second signal. In some embodiments, this may be in further response to criteria related to other signals, for example as discussed above with respect to at least one first signal and at least one second signal.

[0121] In some embodiments, control components for a battery management system may include circuitry which is configured to receive at least one first signal and / or at least one second signal, and which may be labeled as verification circuitry. The at least one first signal may be output from a first controller to the verification circuitry, and the at least one second signal may be output from a second controller to the verification circuitry. For example, the at least one first signal may be output from a control MCU to the verification circuitry and the at least one second signal may be output from an estimation MCU to the verification circuitry. In some embodiments, the verification circuitry may receive multiple signals from the first controller and / or multiple signals from the second controller.

[0122] In some embodiments, the verification circuitry may include logic gate device 402a (e.g., combination of logic gates, which may be digital circuits) may be configured to receive the signals (e.g., at least one first signal and the at least one second signal) from the controllers and / or watchdog block 403. Signals may include digital signals or analog signals, that indicate a value (e.g., a “0” or a “1,” “high” or “low”) to a circuit. The verification circuitry may be configured to interpret a value from a signal.

[0123] In some embodiments, the verification circuitry may be configured to determine whether both controllers are commanding the same state (open or close), which may be indicated by both controllers sending a same value. For example, the verification circuitry may receive at least one first signal and a second signal and interpret a first value indicated by the at least one first signal and a second value indicated by the at least one second signal. The verification circuitry may also be configured to compare the values indicated by the at least one first signal and the at least one second signal to determine if they match (e.g., both indicate “1,” both indicate “0,” are within a threshold voltage of each other, etc.). The verification circuitry may configured to maintain a state of the high voltage control device when the inverted value does not match the other value (e.g., value of two values that is not inverted).

[0124] In some embodiments, the verification circuitry may be configured to maintain a state of a high voltage control device when the signals (e.g., at least one first signal and the at least one second signal) indicate a different value. Maintaining a state of a high voltage control device may include issuing or maintaining a command signal to the high voltage control device instructing it to maintain its switch state (e.g., open or closed). For example, maintaining a state of a high voltage control device may include at least one of: not blowing a fuse or not changing a contactor state between open and closed.

[0125] In some embodiments, the verification circuitry may be configured to change a state of the high voltage control device when the at least one first signal and the at least one second signal indicate the same value. For example, the verification circuitry may be configured to change a state of the high voltage control device in response to determining that the at least one first signal and the at least one second signal indicate the same value In some embodiments, the verification circuitry may be configured to change a state of the high voltage control device by using the at least one first signal and the at least one second signal in one or more logic gates or a processing component. Changing a state of a high voltage control device may include transmitting a command signal to the high voltage control device instructing it to switch its switch state (e.g., from open to closed, or from closed to open).

[0126] Additionally or alternatively, the verification circuitry may be configured to determine if the controllers are healthy, which also may be based on the verification circuitry determining that both controllers sending a same value. A controller may be considered healthy if it is operating in compliance with one or more operational criteria (e.g., receiving power, outputting signals, outputting error-free signals, operating according to a predetermined frequency, etc.). In some embodiments, if a controller is not healthy, a signal from the “no” block of the watchdog block 403 may be set to high and sent to logic gate device 402a. If both controllers are healthy and commanding the same state, logic gate device 402a may provide a signal indicative of the commanded state to a control device. For example, at least one logic gate device 402a may provide the commanded state to a first and second latching device 404 to control the high side and low side drivers of at least one switching device (e.g., contactors KI and / or K2).

[0127] Feedback block 405 (e.g., testing controller) may verify whether contactor components are healthy (e.g., functioning within a threshold of at least one designed and / or established criterion and / or meeting a performance metric). For example, on startup of the aircraft, which may generate a startup signal, feedback block 405 (e.g., circuitry included in a combination of estimation MCU 302 and control MCU 304) may toggle the switching device (e.g., compactor components), such as by commanding the high side driver and low side drivers to open and / or close the switching device(s) (e.g., contactors KI and / or K2) and feedback block 405 may determine if an appropriate response is represented by a feedback signal. If a switching device does not respond appropriately, one or both controllers (e.g., Control MCU 301 and / or Estimation MCU 302) may report the issue to a separate component of the aircraft (e.g., a flight control system and / or display screen). For example, the controller(s) may indicate which battery pack and associated switching device is failing tomeet at least one operational criterion (e.g., is faulty). Further, if the switching device (e.g., contactor) does not respond appropriately, the aircraft may be prevented from flying. For example, the controller(s) and / or flight control system may prohibit a transition into flight mode and / or powering of the EPUs. Feedback block 405 may be implemented as hardware only or a combination of hardware and software. While shown in Figure 4A with respect to the switching devices (KI and / or K2), one or more feedback blocks may be used to verify the functionality of other aircraft switching device(s), such as EPU switching device K4. In some embodiments, the verification circuitry may include feedback block 405.

[0128] Figure 4B illustrates exemplary control logic for a propulsion switching device, such as propulsion switching device K4 (e.g., a contactor) detailed in Figure 2B above. As shown, the logic for the propulsion switching devices may be similar to that of the switching devices KI and / or K2. For example, based on their determination to open or close propulsion switching device(s) (e.g., K4), each controller may send one or more signals to an inverter device 401a indicative of the commanded state for the propulsion switching device(s). The inverter device 401a may receive the signals and invert at least one of them (e.g., only one of the two signals) prior to sending the signals to logic gate(s) 402b.

[0129] The logic gate(s) 402b may receive the signals from the controllers (e.g., one of which may be inverted) verify whether both controllers are commanding the same state (open or close). If both controllers are commanding the same state, logic gate(s) 402b may provide a signal indicative of the commanded state to components of the propulsion switching device K4 (e.g., high side and low side drivers).

[0130] Figure 4C illustrates exemplary control logic for a battery pack fuse (e.g., Fl), consistent with disclosed embodiments. As shown below, either hardware monitoring components (e.g., link monitors) or controllers must provide the same fuse signal for a battery pack fuse to be blown. In some embodiments, multiple link monitors (e.g., 305a and 305b) may monitor a current of a battery pack using a current shunt resistor, such as R2. Each link monitor may determine whether the measured current meets the requirements to blow a fuse, such as fuse Fl (e.g., a pyrofuse) shown in Figure 2B. For example, each link monitor may store a threshold (e.g., a threshold indicative of an overcurrent condition) and may determine to blow a fuse when the measured current exceeds the stored threshold. While current measurements are used as an example, in other embodiments different sensed conditions may trigger the fuse, such as voltage and / or temperature conditions and associated threshold(s).

[0131] Logic block 407, which may include one or more “AND” gates (e.g., digital circuit gate), may receive signals from the first and second link monitors (e.g., post-inversion for one or more of the signals) and command the fuse to be blown if both signals from the first and second link monitors match. Similarly, separate controllers (e.g., Control MCU 301 and Estimation MCU 302) may receive signals from the first and second link monitors and command the fuse to be blown if the signals from the first and second link monitors match. At “OR” block 408 (e.g., digital circuit gate), if either the controllers or the link monitors command the fuse to be blown, the drivers will be commanded to take the action (e.g., blow the fuse).

[0132] In some embodiments, the verification circuitry (a logic block, logic gate) or monitoring circuitry (such as a link monitor) may be configured to use the at least one first signal and the at least one second signal to determine whether to maintain or change a state of the high voltage control device, for example as discussed above with respect to logic gate device 402a and logic gate(s) 402b. In some embodiments, however, the verification circuitry or monitoring circuitry may be configured to override the determination of whether to maintain or change a state of the high voltage control device when the at least one third signal and the at least one fourth signal agree. For example, the monitoring circuitry may override a determination of the verification circuitry, or the verification circuitry may override a determination of itself.

[0133] For example, if the link monitors command the fuse to be blown, the drivers will be commanded accordingly, regardless of signals received from the controllers. Similarly, if the controllers command the fuse to be blown, the drivers will be commanded accordingly, regardless of the signals received from the link monitors.

[0134] In some embodiments, the verification circuitry may be configured to maintain a state of the high voltage control device based on at least in part on functionality testing, which may be performed by a testing controller. For example, in addition to or instead of other conditions on maintaining switching states as discussed herein, the verification circuitry may be configured to maintain a state of the high voltage control device based on (e.g., further based on, further in response to) functionality testing. The functionality testing may indicate one or more operating conditions of the high voltage control device that do and / or do not satisfy a performance metric. Functionality testing may include transmitting one or more prompts, signals, requests, and / or instructions to the high voltage control device and determining if a response or detected behavior corresponds to an expected response or behavior based on the transmission. For example, driver test and diagnostic circuitcomponent 409 (e.g., testing controller) may provide signals to test the functionality of the fuse and / or associated components (e.g., functionality testing), to determine whether one or more operating conditions of a high voltage control device satisfy at least one performance metric. For example, driver test and diagnostic circuit component 409 may transmit a signal to toggle a high side driver and / or a low side driver. Additionally or alternatively, a small current may be run through the fuse to ensure it is appropriately connected. In some embodiments, testing the fuse and / or associated components may be performed based on aircraft startup.

[0135] If a controller of the BMU 201 (or other system component) determines that the fuse is not appropriately connected, the BMU 201 may provide a warning signal (e.g., to the flight control system and / or another aircraft component) to a flight control system (FCS), which may indicate the aircraft may not be started up (e.g., FCS may not change a flight mode and / or power EPU(s)) and / or indicating the fuse needs replacement. The BMU 201 (or other system component) may provide the warning signal based on determining the one or more operating conditions of the high voltage control device that do not satisfy the performance metric. In some embodiments, the warning signal may indicate to an FCS that it should maintain a flight mode and / or that it should not power one or more electric propulsion units.

[0136] Figure 4D illustrates another example of control logic for a battery pack fuse, consistent with the disclosed embodiments. As shown, Figure 4D is similar to the logic shown in Figure 4C, however it includes a tunable delay circuit 410. The tunable delay circuit 410 delays a time until a fuse is triggered after the sensed current meets a set condition (e.g., cell stack shunt current exceeding a threshold). For example, tunable delay circuit 410 may cause a delay between when the sensed current is determined to meet the set condition and when the fuse is triggered. Therefore, as further detailed below with respect to Figures 5A- 5E, different fuses within the high voltage circuitry may be blown at different times. By sequencing the blowing of fuses, an electrical issue (e.g., overcurrent condition, overtemperature condition, short circuit, operating condition that does not satisfy a performance metric, etc.) may be resolved by blowing a fuse which disconnects a portion of the high voltage circuitry without disconnecting the battery pack from all high voltage circuitry. While shown with respect to current measured by resistor R2 and corresponding battery pack cell stack fuse Fl, the tunable delay circuit 410 may be implemented by different combinations of current measurements and fuses, as described below.

[0137] Figure 4E illustrates an example of a tunable delay circuit, consistent with disclosed embodiments. As shown in Figure 4E, the tunable delay circuit may receive a binary signal asinput which may go high (e.g., read as a “1”) and the circuitry may require it to stay high for a set period of time before the output signal is generated. The tunable delay circuit may include a timer circuit 410a that generates a slowly increasing analog voltage based on the binary signal as the plus input to the comparator. The tunable delay circuit may include a discharge circuit (e.g., resistor in series with diode) 410b that allows for rapid discharge of the input to the comparator based on receiving a low binary signal input. The resistor value may be set lower than that of timer circuit. Therefore, the tunable delay circuit may be rapidly reset.

[0138] The tunable delay circuit may include a comparator 410c with a digital-to-analog converter (DAC) that maintains a signal for comparison. In some embodiments, the voltage signal held by the DAC may be configurable (e.g., by one or more controllers, such as Estimation and / or Control MCU and / or another aircraft component, such as a flight control system). Once the voltage on the plus side exceeds the comparison voltage, the output binary signal may go high (e.g., reaches a value corresponding to a logical “1”) and / or otherwise provide a signal for a fuse to be blown (e.g., transmit a signal to one or more drivers). Therefore, a longer delay may be achieved by setting a larger voltage for comparison at the comparator 410c.

[0139] Figure 4F illustrates another example of a tunable delay circuit, consistent with disclosed embodiments. Similar to Figure 4E above, the tunable delay circuit may receive a binary signal as input which may go high (e.g., read as a “1”) and the circuitry may require it to stay high for a set period of time before the output signal is generated. Similar to Figure 4E above, the tunable delay circuit may also include a comparator 411a, that outputs a signal for a fuse to be blown once the input voltage signal exceeds a comparison signal.

[0140] In some embodiments, the comparison signal may be a digital-to-analog converter (DAC) setpoint 411b, which may be transmitted by and received from a DAC and / or by a hard-coded resistors 41 Id (e.g., resistor circuit that is not controlled by software) connected in parallel to the input signal circuit. DAC setpoint 411b may be a value from a register of the DAC, which may be used, for example, to determine how long to hold a signal and / or to serve as a time delay. In some embodiments, at least one processor (e.g., a processor of BMU 201) may control one or more switching devices (e.g., contactor(s), relay(s), transistor(s), controller(s), and / or any other device(s) capable of controlling current flow) to enable one or more of a DAC (which sets DAC setpoint 411b) and hard-coded resistors 41 Id to provide the comparison signal. For example, in some embodiments, the at least one processor may close switching device 41 le to enable a DAC to provide the comparison signal. In someembodiments, the at least one processor may close switching device 41 If to enable hard- coded resistors 41 Id to provide the comparison voltage. In some embodiments, the comparison signal provided the DAC may be configured by user input (e.g., during aircraft testing). For example, a user may input (e.g., via computer code) one or more comparison signals to at least one processor (e.g., a processor of BMU 201 and / or a processor of a flight control system) and the at least one processor may transmit a signal indicating the one or more comparison signals to the DAC. In some embodiments, the comparison signal provided by DAC is automatically determined (e.g., based on a flight phase), as further described below with respect to Figures 5A-5E. In some embodiments, the comparison signal provided by hard-coded resistors 41 Id is configured (e.g., based on testing and / or experimental data) to address a faulty or diminished condition (e.g., blow a fuse when needed to isolate certain components) while minimizing an impact to control and / or stability of the aircraft in all flight phases (e.g., only blowing a fuse when truly necessary, so as to minimize impact to aircraft capability).

[0141] Similar to Figure 4E above, an output of comparator 411a may provide an output signal for a fuse to be blown 411g (e.g., transmit a signal to one or more drivers). In some embodiments, latch 411c (e.g., a memory associated with BMU 201 and / or another aircraft component) may store the output signal. Therefore, aircraft systems (e.g., BMU 201 and / or a flight control system) can recognize that the fuse has been commanded to blow and respond accordingly (e.g., update logic in the fuse sequence, as further described below).

[0142] Figure 4G further illustrates a configuration of circuitry on the output side of a comparator, consistent with disclosed embodiments. As shown in Figure 4G, in some embodiments, the output signal of comparator 41 la may provide a signal for a fuse to be blown 411g (e.g., transmit a signal to one or more drivers) and the output signal may be transmitted to latch 411c. For example, latch 411c may receive the signal at input S and output it (e.g., a value indicative of the signal) at output Q to a memory (e.g., a memory associated with BMU 201 and / or another aircraft component, represented by MCU 41 Ih). Latch 411c may receive a signal at input R to reset the stored value (e.g., via at least one processor associated with BMU 201 and / or another aircraft component, represented by MCU 41 li).

[0143] Figure 4H further illustrates a configuration of circuitry on the output side of a comparator, consistent with disclosed embodiments. As shown in Figure 4H, in some embodiments, the output signal of comparator 41 la may be transmitted to latch 411c which may receive the signal at input S and store it in a memory via output Q (e.g., store in MCU411). Additionally or alternatively, the output Q may provide a signal for a fuse to be blown 411g (e.g., transmit a signal to one or more drivers).

[0144] Figures 5A, 5B, 5C, 5D, and 5E illustrate exemplary connections between current monitoring resistors and associated fuses that are blown based on (e.g., when, after, and / or in response to) detecting a triggering condition (e.g., overcurrent condition, measured value exceeding a threshold, an error, an operational malfunction, an operational underperformance), consistent with disclosed embodiments. As detailed above with respect to Figures 4D-4E, in some embodiments, a delay may be included between the detection of a triggering event and a blowing of a fuse. A triggering event may include a current measurement exceeding a threshold associated with an overcurrent condition for the respective portion of circuitry being monitored and controlled. Different timing delays may be included to sequentially disconnect different portions of the high voltage circuitry. In some embodiments, the timing of the delays may be based on: where the electrical issue is more likely to occur (e.g., based on testing results, risk metrics of one or more electrical components, and / or a placement of one electrical component to another aircraft component), the current sensors that would detect it, the fuse(s) that would need to be blown to remove the electrical issue, and / or the risks associated with losing the associated portion of the high voltage circuitry. In some embodiments, at least one timing delay may be based on experimental data and / or modeling.

[0145] In some embodiments, as shown in Figure 5A, high voltage circuitry powering one or more EPU(s) may include a combination of current resistors (e.g., R2, R3, R4, R6), such as shunt resistors and / or fuses (e.g., fuses F1-F7).

[0146] In some embodiments, as shown in Figures 5B-5C, fuse F3 may be blown based on current sensing at R3 and fuse F2 may be blown based on current sensing at R4. In some embodiments, as shown in Figure 5D, fuse F4 and / or F6 may be blown based on current sensing at R6. In some embodiments, as shown in Figure 5E, fuse Fl may be blown based on current sensing at R2.

[0147] In some embodiments, a first fuse, such as a fuse associated with an EPU (e.g., F2 and / or F3 associated with R3 and / or R4) may have a shorter delay than a second fuse, such as a fuse associated with a cross-link (e.g., F4 and / or F6 associated with R4, shown in Figure 5D) and / or a battery pack fuse (e.g., Fl associated with R2, shown in Figure 5E). In some embodiments, a fuse associated with an inboard EPU may be blown before a fuse associated with an outboard EPU (e.g., based on a delay configuration, circuitry configuration, timer, trigger condition, etc.). Further, in some embodiments, a fuse associated with a cross-link(e.g., F4 and / or F6 associated with R6) may have a shorter delay than a battery pack fuse (e.g., Fl associated with R2).

[0148] While the above embodiments disclose a timing delay to implement a sequence of blowing fuses, in other embodiments the fuses may have different temperature trigger points. The fuses may be selected such that the temperature trigger points provide the same delay between the various fuses described above. For example, different fuses with different temperature trigger points may be selected based on determining the resulting time delay through experimentation and monitoring.

[0149] In some embodiments, the sequence of fuse blowing may be based on a phase of flight of the aircraft. For example, the timing delay may be dynamically adjusted based on a phase of flight. For example, a phase of flight (e.g., hover, cruise, forward flight, takeoff, landing, transition) may be defined by a combination flight conditions (e.g., a combination of flight conditions within particular ranges), which may include one or more of an airspeed, altitude, pitch angle (e.g., of the aircraft), tilt angle (e.g., of one or more propellers), roll angle, rotation speed (e.g., of a propeller), torque value, pilot command, or any other value indicating a current or requested (e.g., commanded) state of at least part of the aircraft.

[0150] A flight control system of the aircraft may directly adjust the timing and / or send information on the flight phase and / or timing to BMU(s) 201 to perform the adjustment. In some embodiments, during vertical or short takeoff and vertical landing, a first fuse, such as a fuse associated with one or more EPUs (e.g., F2 and / or F3 based on current sensing at R3 or R4, shown in Figures 5B-5C) may have a longer delay than a second fuse associated with another component, such as a fuse associated with a cross-link (e.g., F4 and / or F6 associated with R4, shown in Figure 5D) and / or a battery pack fuse (e.g., Fl associated with R2, shown in Figure 5E). For example, controlled s) of BMU 201 may receive an indication of a flight phase and adjust delays for blowing the fuses accordingly (e.g., according to a pre-stored scheme).

[0151] In some embodiments, the direction of current flow may also be considered in determining which fuse needs to be triggered to blow a fuse. For example, based on experimental data and modeling, logic (e.g., logic table or code) may be established to determine a sequence of fuse blowing based on a detected current flow direction (e.g., detected by one or more current sensors) in order to remedy an electrical issue (e.g., an overcurrent condition, over-voltage condition, overtemperature condition, short circuit, operating condition that does not satisfy a performance metric, etc.). Further, the sequence for blowing a fuse may update based on which fuse(s) have been blown and changes in currentmeasurements. A flight control system and / or BMU 201 of the aircraft may store sequence(s), logic for updating the sequence(s), and respond accordingly.

[0152] Figures 6A, 6B, 6C, and 6D illustrate exemplary isolation monitoring circuitry and states of high voltage wiring in which isolation monitoring is performed, consistent with disclosed embodiments. In some embodiments, at least one BMU 201 associated with a battery pack, may include at least one processor (e.g., at least one microprocessor-based controller) configured to execute software code stored in a storage medium (e.g., a computer- readable medium, a non-transitory computer-readable medium) to perform the isolation monitoring calculations based on one or more measurements, as described below. In some embodiments, one or more steps of isolation monitoring may be performed by at least one processor and memory associated with a different aircraft component.

[0153] Figure 6A illustrates exemplary isolation monitoring circuitry for a high voltage wiring system, consistent with disclosed embodiments. As shown, the isolation monitoring circuitry uses a bridge method to measure the isolation at each terminal by measuring the voltage 603a and voltage 603b across known bridge resistance 601a and bridge resistance 601b to determine a magnitude of the leakage current in the circuit. In some embodiments, the isolation monitoring (e.g., performed by the isolation monitoring circuitry) may be performed using a preset time interval, for example according to the counting down of a timer. For example, a voltage may be monitored by taking one or more measurements at certain intervals. For example, voltage measurements may be taken after (e.g., based on, when, and / or in response to) the capacitance of Y_cap_p 602a and Y cap p 602b have settled (e.g., are not fluctuating above a predetermined threshold). For example, the voltage measurements may be taken in intervals of 15 seconds (and / or an interval set in the range of 1-30 seconds) and the isolation resistance may be measured at the end of each interval. Isolation resistance monitoring may be controlled by the BMU 201 associated with the battery pack through the opening and closing of switches 604a and 604b. Positive isolation resistance (RiS0p) and negative isolation resistance may be calculated as follows:Rsense may be a measured resistance, Vceiistack may be a voltage measured across a cell stack in a battery pack, VisoMeasPos may be a measurement of isolation voltage for a positive (or “high side”) electrical channel, VisoMeasNegs may be a measurement of isolation voltage for anegative (or “low side”) electrical channel, and Rbridge may be a bridge resistance (e.g., a total resistance in a bridge circuit, resistance of a bus, components on a bus, resistance being a measuring device and a circuit component being measured, etc.).

[0154] Figures 6B, 6C, and 6D illustrate different exemplary conditions in which isolation monitoring is performed, consistent with disclosed embodiments. As detailed above with respect to Figure 1 A and Figures 2A-2B, battery packs 120 may be connected through a cross-link 130, which may include one or more fuses (e.g., F4 and F6 in Figures 2A-2B). As mentioned above, while in some embodiments two battery packs are described as linked through a cross-link, it is appreciated that other numbers of battery packs (e.g., three, four, six, etc.) may also be linked through one or more cross-links.

[0155] When both battery packs are connected and no cross-link fuse(s) are blown, as illustrated in Figure 6A, either battery pack (e.g., a BMU 201 and associated isolation circuitry) may perform isolation monitoring. For example, a cross-link may include a high side (HS) cross-link pyrofuse and a low side (LS) cross-link pyrofuse, such as an HS crosslink pyrofuse 601, 602, or 603, or a HS cross-link pyrofuse 604, 605, or 606, respectively. In some embodiments, simultaneous monitoring by both battery packs (e.g., their respective BMUs) may cause interference with both attempts at monitoring, and accordingly a single battery pack may be selected to perform the monitoring.

[0156] A battery pack may be selected by a variety of different means. For example, a battery pack may be selected to perform isolation monitoring based on a location identifier. A location identifier may include a value or other information indicating one or more of a position of a battery pack within an aircraft, a position of a battery pack with respect to at least one other battery pack, or a unique identification of the battery pack within a group of battery packs. A location identifier may be used to select the battery pack to perform isolation monitoring based on it being a battery pack configured to perform pre-charge, based on determining another battery pack (e.g., a single paired battery pack) is experiencing an electrical issue, and / or another preset condition. When one of the cross-link fuses are blown (e.g., F4 or F6), as illustrated in Figure 6D (with the upper cross-link pyrofuse 603 being blown and the lower cross-link pyrofuse 606 being intact), the battery packs alternate monitoring a portion of a circuit (e.g., circuitry connected to the one or more battery packs) because one circuit performing isolation monitoring simultaneously with another connected circuit may cause interference with both isolation monitoring processes. For example, a control unit or computer may, based on determining a cross-link fuse to be blown (e.g., based on transmitting an instruction to blow a cross-link fuse), transmit one or more commands toone or more battery packs to alternate monitoring a portion of the circuit. When both crosslink fuses are blown (e.g., F4 and F6), as illustrated in Figure 6C, both battery packs may perform their own isolation monitoring.

[0157] In some embodiments, the battery packs (e.g., BMU(s) 201) may each monitor a state of cross-link 130, such as whether a high voltage on a positive side and / or negative side of the cross-link is disrupted and / or interrupted (e.g., falls below a threshold, reaches zero, and / or falls below a threshold for a predetermined amount of time). For example, each BMU 201 may store a state of the fuse(s) (e.g., F4 and / or F6) and / or may measure a current or voltage across the cross-link 130 to determine whether the cross-link is connected. In some embodiments, the paired battery packs (e.g., BMU(s) 201) may communicate with each other which battery pack they selected to perform the isolation monitoring based on the state of the cross-link 130. In some embodiments, a battery pack may proceed (e.g., may only proceed) with performing isolation monitoring based on determining a paired battery pack agreed with the selection.

[0158] Figure 7 illustrates an exemplary isolation monitoring control sequence 700 for a high voltage wiring system, consistent with disclosed embodiments. In some embodiments, the control sequence may be performed by at least one processor of each BMU 201 in a paired battery pack. For example, each BMU 201 may include at least one processor (e.g., at least one microprocessor-based controller) configured to execute software code stored in a storage medium (e.g., a computer-readable medium, a non-transitory computer-readable medium) to perform the control sequence process. In some embodiments, at least one processor of a different aircraft component may perform the control sequence process. In some embodiments, a BMU 201 may be paired with (e.g., electrically and / or communicably connected to) multiple battery packs. Additionally or alternatively, all or part of isolation monitoring control sequence 700 may be performed by a non-BMU device, such as an FCC.

[0159] At step 701, the at least one processor may determine whether any of the isolation monitoring switches (e.g., 604a and 604b) are stuck in an open or closed position. For example, the isolation monitoring switches may be commanded open and / or closed and measurements (e.g., voltage, current etc.) may be read to determine whether the isolation monitoring switches have responded by correctly following one or more commands. In some embodiments, the at least one processor may initiate the determining of step 701 based on receiving a start-up signal (e.g., from a flight control system).

[0160] At step 702, based on determining no fault, the at least one processor may determine whether valid one or more measurements were received. For example, the at least oneprocessor may determine that measurements (e.g., cell stack voltage(s), positive isolation voltage, and / or negative isolation voltage) were read and converted without a timeout, short- to-ground, and / or any electrical issue. While not shown, in some embodiments, at step 701 and / or 702, the at least one processor may determine whether a charger is connected (e.g., based on information from a charge control unit and / or state of switching devices, such as K6 or K7) and may proceed to step 702 and / or 703 only based on (e.g., after, when, and / or in response to) determining no charger is connected.

[0161] At step 703, based on determining valid measurements are read, the at least one processor may activate isolation monitoring. In some embodiments, depending on the state of the switching devices (e.g., KI and / or K2), the isolation switches (e.g., 604a and / or 604b) may be toggled on-off at different speeds. For example, when the switching devices (e.g., KI and / or K2) are open the isolation monitoring switches may be toggled at a faster state than when the contactors (e.g., KI and / or K2) are closed. In some embodiments, when the at least one processor determines that contactors are changing state (e.g., from open to closed or closed to open), then isolation monitoring is paused for a set period of time to avoid a false positive due to the incorrect voltages. In some embodiments, once the at least one processor determines the switching devices (e.g., KI and / or K2) have completed the change of state, then the isolation monitoring switch toggling is resumed.

[0162] In some embodiments, at step 702 and / or 703, the at least one processor may determine a connection state with a paired battery pack (e.g., a battery pack connected through cross-link 130). The at least one processor may determine whether the battery packs are connected on one or both of a positive side or negative side of the battery packs and coordinate which battery pack performs the isolation monitoring based on this determination, as described above with respect to Figs. 6B-6D. In some embodiments, the at least one processor may determine whether the battery packs are connected based on monitoring current, voltage, contactor state, and / or fuse state across a positive and negative side of a cross-link (e.g., 130 in Figure IB).

[0163] The at least one processor may determine the isolation resistance of the high voltage circuit (e.g., resistance between the high voltage circuit and a non- electrical system of the aircraft, such as the chassis). Determining the isolation resistance may include applying one or more test signals, voltages, or currents to one or more parts of a circuit and analyzing circuit resistivity. The at least one processor may also disconnect high voltage power (e.g., open KI and / or K2) provided by at least one of the paired battery packs (e.g., a battery pack affected by the lack of isolation resistance) based on determining the isolation resistanceindicates failure of an isolation condition. Failure of an isolation condition may include, for example, a resistance or one or more circuit components not meeting a threshold (e.g., during a test). An isolation condition may be considered met if one or more circuit components (e.g., all tested components and / or circuits) meet a threshold (e.g., during a test). In some embodiments, the at least one processor may determine (e.g., based on a state received from a flight control system) that the aircraft is not in flight prior to disconnecting the battery pack(s).

[0164] In some embodiments, the at least one processor may provide a notification based on determining a failure of an isolation condition. The at least one processor may provide the notification as a visual on a display interface, as an audible alert, and / or by turning on a light. The notification may be provided to a flight control system, another aircraft component, and / or a ground device. In some embodiments, the notification may provide (e.g., include) an indication of a battery pack or circuitry experiencing the failure of the isolation condition (e.g., a battery pack identifier, an identification of a battery pack or circuitry relative to an aircraft system or the aircraft as a whole).

[0165] In some embodiments, the at least one processor may allow start up to continue based on determining the isolation resistance does not indicate a failure of an isolation condition. For example, the at least one processor may close switching devices (e.g., KI, K2, K4) to power high voltage circuitry.

[0166] At step 704, the at least one processor may not proceed to activate isolation monitoring and / or may pause isolation monitoring based on determining an invalid measurement and / or one of the isolation monitoring switches (e.g., 604a and 604b) are stuck in an open or closed position. In some embodiments, the at least one processor may provide a notification to a flight control system and / or another aircraft component indicating the stuck condition and / or validity issue. In some embodiments, the at least one processor may select a battery pack of the paired battery packs to perform isolation monitoring based on determining a fault. For example, the at least one processor may select a different battery pack in a pair of battery packs to perform isolation monitoring based on detecting an isolation monitoring switch (e.g., 604a and 604b) of the instant battery pack is stuck open. In some embodiments, the at least one processor may monitor whether the fault or validity issue is resolved and may proceed to step 702 based on determining the issue is resolved.

[0167] Figure 8 illustrates an exemplary control sequence process 800 to test high voltage components, consistent with disclosed embodiments. In some embodiments, the control sequence may be performed by at least one processor of each BMU 201 in a battery pack. Forexample, at least one BMU 201 (e.g., each BMU) may include at least one processor (e.g., at least one microprocessor-based controller) configured to execute software code stored in a storage medium (e.g., a computer-readable medium, a non-transitory computer-readable medium) to perform the control sequence process. In some embodiments, at least one processor of a different aircraft component may perform the control sequence process.

[0168] At step 801, at least one processor may detect a wakeup command. A wakeup command may be a signal sent by a device (e.g., an electrical communication device such as an input device, a user interface, an FCC) to another device (e.g., a BMU) to prompt it to receive power and / or perform one or more operations.

[0169] In some embodiments, the at least one processor may determine a source of BMU 201 wakeup. A source of BMU wakeup may include a device or component prompting BMU 201 to wake up. Determining the source of BMU wakeup may include identifying a device or component prompting BMU 201 to wake up, identifying a type of wakeup signal, and / or analyzing a received signal.

[0170] In some embodiments, step 801, 802, and / or 814 may include determining whether the wakeup command was initiated by a communication signal or a timer, which constitute determining a source of BMU wakeup.

[0171] In some embodiments, this step may be performed based on an initialization of the BMU 201 (e.g., a software initialization) that confirms communication connect! on(s) are functional, sensor measurement(s) are received, and / or other start-up conditions are met. In some embodiments, the source of BMU 201 wakeup may be determined to be a battery communication wakeup (e.g., signal configured to wake up a battery and / or cause it to supply power) when a signal is received over a communication line (e.g., a CAN communication line). In some embodiments, the signal over the communication line may be a result of a selected flight mode, as described above. A type of wakeup signal may also be determined at other steps.

[0172] Additionally or alternatively, the source of BMU 201 wakeup may be determined to be based on a timer. For example, the source of BMU 201 wakeup may be a determined to be a real time clock wakeup based on an internal alarm clock signaling to BMU 201 to wake up (e.g., begin initialization operations). The real time clock and / or associated memory may store time period(s) for BMU 201 to be asleep or awake and signal wakeup of BMU 201 based on these time period(s). In some embodiments, at step 801 the at least one processor may, based on determining the wake source, power on one or more controllers and / or access information loaded in memory, which may be indicative of past switching device states etc.

[0173] At step 802, at least one processor may determine if a source or type of wakeup is a battery communication wakeup. If it determines that the source or type of wakeup is a battery communication wakeup, it may proceed to step 804. If it determines that the source or type of wakeup is not a battery communication wakeup, it may proceed to step 814.

[0174] At step 814, at least one processor may determine if a source or type of wakeup is a real-time clock (RTC) wakeup. If it determines that the source or type of wakeup is a realtime clock (RTC) wakeup, it may proceed to step 815. If it determines that the source or type of wakeup is not a real-time clock (RTC) wakeup, it may proceed to step 804.

[0175] At step 804, which may be considered part of testing a battery pack, the at least one processor may determine the states of one or more switching devices (e.g., KI, K2, K4, and / or any other switching device configured to control current to one or more electric propulsion units) using measurements from one or more sensors and / or memory. For example, the at least one processor may determine at least one of (i) feedback voltage from the switching device(s), (ii) at least one last stored state of the switching device(s) (e.g., information stored in memory indicating whether a switching device is open or closed), (iii) at least one latch state (e.g., status of hardware pins of the contactor) of the switching device(s), or (iv) a current passing through a coil of at least one switching device. A feedback voltage may be a low voltage signal value transmitted by a switching device from a circuit of the switching device that is configured to make its own determination as to whether the switching device is closed. For example, the switching device may transmit a signal corresponding to “0” (e.g., 0V) if it believes it is in an open switch state and / or may may transmit a signal corresponding to “1” (e.g., IV, 2, 5V, 10V) if it believes it is in a closed switch state. Based on at least one of these four pieces of information, the at least one processor may determine whether power is being provided from the battery pack to one or more loads (e.g., a DC / DC for low voltage systems, ECS equipment, and / or paired battery pack(s)).

[0176] In some embodiments, the at least one processor may determine whether at least one switching device is open or closed. Determining whether at least one switching device is open or closed may include comparing a measured voltage across the at least one switching device to a threshold and / or comparing a measured current across the at least one switching device to a threshold. For example, the at least one processor may determine that a switching device is closed if the measured voltage across the at least one switching device is below a threshold. As another example, the at least one processor may determine that a switchingdevice is closed if the measured current running through the at least one switching device is above a threshold.

[0177] In some embodiments, at least one switching device, whose state may be determined at step 804, may configured to control current provided by the battery pack to one or more electric propulsion units. For example, the at least one switching device may include any or all of K1-K5, described with respect to figures above.

[0178] Step 804, or another step of process 800, may include determining if one or more switching devices are functioning correctly, such as by sending open and / or close commands to the one or more switching devices and determining if the one or more switching devices followed the sent commands, as discussed above with respect to step 804, and with other examples being discussed with respect to Figure 4C and steps 703. In some embodiments, for example, process 800 may include sending a signal to close at least one switching device and determining the at least one switching device closes in response to the signal. In some embodiments, testing of the battery pack may include sending a signal to close the at least one switching device and determining the at least one switching device closes in response to the signal.

[0179] In some embodiments, the at least one processor may determine that power is not being provided from the battery pack based on determining current is below a threshold (e.g., a threshold set in a range of 30-90 mAmps) and the state of the latch is open (e.g., a prestored state in memory and / or measured state).

[0180] Further, in some embodiments, the at least one processor may analyze received electrical component information for one or more electrical issues (e.g., short circuit, overcurrent, over-temperature, over-voltage conditions, invalid position ID, incomplete or violated start-up checks, etc.).

[0181] In some embodiments, process 800 may include sending one or more signals to one or more switching devices to test them without energizing a bus. For example, in some configurations, multiple switching device may need to be in a closed state in order to complete an electrical circuit to energize a bus, consistent with disclosed embodiments. Because testing may lead to a switching device moving to a closed switch state, testing could inadvertently close multiple switching devices and energize a bus during testing. Process 800, however, may send a signal to close the at least one first switching device while keeping at least one second switching device open to avoid energizing a bus, which may be configured to be powered by the battery pack.

[0182] In some embodiments, process 800 may include sending a signal to a first switching device instructing it to close, testing the first switching device, sending a signal to a first switching device instructing it to open, and then repeating that process with one or more other switching devices.

[0183] In some embodiments, the at least one processor may determine a reason for a reset (e.g., based on received instructions and / or sensed conditions), and may optionally store information related to the reason for future troubleshooting or analytics.

[0184] At step 805, if the at least one processor determines that power is not being provided from a battery pack (e.g., at least one current is below a threshold, at least one last pre-stored state indicates open switching device(s), at least one latch state is open, and / or at least one feedback voltage is below a threshold), the at least one processor may determine that a cause of reset is that the battery pack was woken from a sleep state (e.g., as opposed to the wakeup command being triggered by an electrical issue, such as a faulty or deteriorated condition of the BMU 201 and / or in HV circuitry powered by the battery pack), and / or there are no detected issues, the process may proceed to step 806. If the at least one processor determines that power is not being provided from a battery pack and / or that the battery pack is experiencing an electrical issue, the process may proceed to step 819.

[0185] At step 806, the at least one processor may perform testing on BMU 201 (e.g., controllers) and / or associated circuitry (e.g., switching devices, fuses, high voltage integrity loop(s) etc.). In some embodiments, testing may include opening and / or closing at least one switching device (e.g., one at a time to avoid energizing the circuit) and / or determining that at least one switching device is responding as expected to opening and / or closing commands.

[0186] In some embodiments, the testing may include functionality testing, discussed further above with respect to Figure 4C.

[0187] In some embodiments, the at least one processor may test the battery pack based on determining the at least one switching device is open. By only proceeding with testing the associated circuitry based on determining that power is not being provided by a battery pack, the process can ensure that power from the battery pack is not removed during flight.

[0188] At step 809, the at least one processor may receive a watchdog status. In addition to or instead of occurring at step 806, at step 809 the at least one processor may perform testing on BMU 201 and / or circuitry with BMU 201. After finishing step 809, the process may proceed to step 810.

[0189] At step 810, the at least one processor may determine whether the aircraft is in flight. For example, the at least one processor may determine the aircraft is not in flight based on atleast one of (i) receiving a signal from a flight control computer of the aircraft (e.g., a high- integrity signal) indicating that the aircraft is not in flight or (ii) receiving a signal from a flight control computer to de-energize EPU(s) 110. Additionally, the at least one processor may determine if an MCU is in a failsafe state or override state and / or if a tier 1 fault has occurred.

[0190] The at least one processor may further determine whether a tier 1 fault has occurred (e.g., a fault designated within a specific tier called “tier 1,” where some possible faults may be part of another tier). A tier 1 fault may indicate a condition where the battery pack risks damage (e.g., to battery pack cells) due to a high temperature or voltage condition. For example, a tier 1 fault may be detected based on determining that a temperature or voltage exceeds a threshold (e.g., via one or more temperature and / or voltage sensors associated with the battery pack and / or cells). In some embodiments, a tier 1 fault may indicate a condition where the battery pack risks thermal runaway.

[0191] If the at least one processor determines that (i) the aircraft is in flight, (ii) an MCU is in a failsafe state or an override state, or (iii) a tier 1 fault has occurred, it may cause the process to proceed to step 831. If the at least one processor determines that (i) the aircraft is not in flight, (ii) an MCU is not in a failsafe state or an override state, and / or (iii) no tier 1 fault has occurred, it may cause the process to proceed to step 811. For example, if the at least one processor determines that the aircraft is not in flight and no tier 1 fault has occurred, it may cause the process to proceed to step 811.

[0192] At step 831, the at least one processor may determine if one or more components are responding to commands, as discussed above with respect to step 806. Additionally or alternatively, Step 831 may also include, based on completing testing, monitoring (e.g., continually or intermittently) controllers (e.g., Estimation MCU 301 and Control MCU 302) and respond to commands (e.g., commands to open or close switching devices).

[0193] At step 819, the at least one processor may avoid performing testing on BMU 201 and / or may maintain the state of the switching devices (e.g., KI, K2, and / or K4). In some embodiments, based on entering step 819, the at least one processor may disregard any commands to a change a switching device state until condition(s) at step 820 are met. For example, the at least one processor may maintain, based on determining the at least one switching device is closed (e.g., at step 804), the at least one switching device as closed and disregard commands to open the at least one switching device.

[0194] At step 820, the at least one processor may continue to maintain the state of switching devices (e.g., KI, K2, and / or K4) until the at least one processor determines that (i) theaircraft is not in flight, (ii) an MCU is not in a failsafe state or an override state, and / or (iii) a tier 1 fault has not occurred. For example, the at least one processor may continue to maintain the state of switching devices (e.g., KI, K2, and / or K4) until the at least one processor determines that the aircraft is not in flight and a tier 1 fault has not occurred. In some embodiments, the at least one processor may determine the aircraft is not in flight based on receiving a signal from a flight control computer of the aircraft (e.g., a high-integrity signal) indicating that the aircraft is not in flight and / or receiving a signal from a flight control computer to de-energize EPU(s) 110. The at least one processor may further determine whether a tier 1 fault has occurred, as described above. If the at least one processor determines that determines that (i) the aircraft is not in flight, (ii) an MCU is not in a failsafe state or an override state, and / or (iii) a tier 1 fault has not occurred, the process may proceed to step 811. For example, if the at least one processor determines that determines that the aircraft is not in flight and a tier 1 fault has not occurred, the process may proceed to step 811.

[0195] Additionally or alternatively, the at least one processor may may cease to disregard commands to open the at least one switching device based on determining that at least one of a voltage or temperature of the battery pack has exceeded a threshold. In some embodiments, ceasing to disregard the commands to open the at least one switching device may override other conditions of step 820 (e.g., that (i) the aircraft is not in flight, (ii) an MCU is not in a failsafe state or an override state, and / or (iii) a tier 1 fault has not occurred).

[0196] At step 811, the at least one processor may control BMU 201 to cause it resume normal operations. For example, BMU 201 may respond to commands indicating a change in at least one switching device state and may monitor controllers. As another example, BMU 201 may cease to disregard commands to open or close a switching device, consistent with disclosed embodiments.

[0197] At step 812, the at least one processor may determine whether it has received a command to deenergize a bus (e.g., a main bus feeding a DC / DC for low voltage systems, ECS equipment, and / or paired battery pack(s)) and whether switching devices (e.g., KI, K2, and K4) are open (e.g., based on feedback voltage, last pre-stored state, latch state (e.g., state of hardware pins of the contactor), and / or coil current). If the at least one processor determines that it has received a command to deenergize the bus (e.g., main bus) and the switching devices are open, the process proceeds to step 813.

[0198] At step 815, based on determining a real time clock wakeup (e.g., timer wakeup), the at least one processor may perform monitoring of the battery pack. In some embodiments, theat least one processor may take measurements of one or more cells of the battery pack to determine whether they exceed one or more thresholds (e.g., thresholds required for battery pack operation designated as expected, typical, normal, etc.). For example, the at least one processor may determine whether the battery pack is outside a temperature range (e.g., an upper and / or lower temperature threshold) and / or outside a voltage range (e.g., an overvoltage condition). If the battery pack is not outside of the threshold(s), the process may proceed to step 816. If one or more of the measured conditions are outside the threshold(s), the at least one processor may proceed to step 813 and BMU 201 may enter a shutdown state.

[0199] At step 816, the at least one processor may perform diagnostics for the battery pack. Performing diagnostics may include collecting electrical component information from one or more devices and / or sensors. For example, the at least one processor may collect information associated the battery pack, such as voltage (e.g., pack voltage and / or voltage of one or more cells), and temperature (pack temperature and / or temperature of one or more cells). In some embodiments, the at least one processor may access a memory (e.g., a memory of BMU 201) and collect any information established by the memory (e.g., diagnostic requirements uploaded by a user).

[0200] At step 817, the at least one processor may determine whether it has collected a preset amount diagnostic information, which may include diagnostic information from multiple informational categories. If the at least one processor has collected the preset amount of diagnostic information, the process may proceed to step 818.

[0201] At step 818, the at least one processor may determine whether it has received a battery communication wake, as described above. If the at least one processor has received a battery communication wake, it may proceed to step 804. If the at least one processor has not received a battery communication wake, the process may proceed to step 813.

[0202] At step 813, the at least one processor may cause BMU 201 to enter a shutdown state. In some embodiments, the at least one processor may store information about the battery pack and / or associated circuitry (e.g., battery states, current, voltage, and / or temperature measurements). In some embodiments, BMU 201 may store received commands and / or electrical issues (e.g., switching device(s) stuck open or closed). In some embodiments, BMU 201 may set a real time clock alarm to trigger the next BMU wakeup.

[0203] Figure 9 is a flowchart of an example fuse triggering sequence process 900. In some implementations, one or more process blocks of Figure 9 may be performed by at least one processor, such as a BMU, an MCU, a controller, an FCC, or any electrical component configured to control one or more modifiable circuitry components. Steps or operationsdescribed with respect to process 900 may be performed by, for example, one or more components or circuits described with respect to Figs. 4D-5E. In some embodiments, the process may be performed by at least one processor of each BMU 201 in a battery pack. For example, at least one BMU 201 (e.g., each BMU) may include at least one processor (e.g., at least one microprocessor-based controller) configured to execute software code stored in a storage medium (e.g., a computer-readable medium, a non-transitory computer-readable medium) to perform the process. In some embodiments, at least one processor of a different aircraft component may perform the control sequence process.

[0204] As shown in Figure 9, process 900 may include receiving a first current measurement of a first circuit configured to provide power from a first battery pack to at least one electric propulsion unit (block 902). The first circuit may include wiring connecting the first battery pack to the at least one EPU. The first circuit may also include a first fuse (e.g., one or fuses F1-F7) configured to disable current in the first circuit upon being triggered. Triggering a fuse may include transmitting a signal (also referred to as a triggering signal) to the fuse that causes it to blow, which may sever an electrical connection. In some embodiments, the first current measurement may be measured using a first current sensing resistor of the first circuit. For example, process 900 may receive a first current measurement of the first circuit at a current resistor, as discussed above with respect to Figs. 5A-5E.

[0205] As also shown in Figure 9, process 900 may include triggering a first fuse based on a first trigger condition being met and a first time delay expiring (block 904). A trigger condition may include an overcurrent condition, a measured value (e.g., measured voltage, current, or temperature value) exceeding a threshold, an error, an operational malfunction, an operational underperformance, or receipt of a trigger signal, which may be based on any of the foregoing. For example, a trigger condition may include a current measurement exceeding a current threshold indicative of an overcurrent condition or short circuit condition in a circuit. A time delay may include a predetermined amount of time (e.g., 1ms, 5ms, 20ms, 100ms, 500ms, 1 second, 5 seconds), which may be elapsed by a timer until it expires.

[0206] As further shown in Figure 9, process 900 may include receiving a second current measurement of a second circuit (block 906). The second circuit may be configured to allow the first battery pack to provide backup power for a second battery pack and / or may have a second fuse configured to disable current in the second circuit upon being triggered. In some embodiments, the second current measurement may be measured using a second current sensing resistor of the second circuit. For example, process 900 may receive a second currentmeasurement of the second circuit at a current resistor, as discussed above with respect to Figs. 5A-5E.

[0207] Backup power for a second battery pack may include power received in an indirect, secondary, or unpreferred circuitry configuration. For example, backup power for a second battery pack may power supplied from at least one battery pack across a cross-link to the second battery pack.

[0208] As also shown in Figure 9, process 900 may include triggering a second fuse based on a second trigger condition being met and a second time delay expiring (block 908). In some embodiments, the first time delay may be different from the second time delay. For example, the first time delay and the second time delay may be set by separate tunable delay circuits, for example as discussed with respect to Figs. 4D-4F. In some embodiments, the first time delay may be shorter than the second time delay. Alternatively, the first time delay may be longer than the second time delay. Alternatively, the first time delay may be the same as the second time delay. A trigger condition and time delay are discussed above with respect to block 904.

[0209] In some embodiments, process 900 may also include receiving a third current measurement of a third circuit and triggering a third fuse based on a third trigger condition being met and a third time delay expiring. A trigger condition and time delay are discussed above with respect to block 1004.

[0210] The third circuit may be configured to provide power from the first battery pack to the at least one electric propulsion unit and the second battery pack. Additionally or alternatively, the third circuit may include a third fuse, which may configured to disable current in the third circuit upon being triggered.

[0211] In some embodiments, the third time delay may be different from at least one of the first time delay or the second time delay. For example, the third time delay may be longer than the first time delay. As another example, the third time delay may be longer than the first and the second time delays.

[0212] In some embodiments, process 900 may include setting one or more time delays, such as by using one or more time tunable delay circuits, described with respect to Figs. 4D-4F. For example, process 900 may include setting the first time delay by adjusting a voltage of a first comparator. Additionally or alternatively, process 900 may include setting the second time delay by adjusting a voltage of a second comparator.

[0213] In some embodiments, process 900 may include dynamically adjusting at least one of the first or second time delays based on a flight phase. As a non-exclusive example, process900 may use a first combination of first and second time delays based on determining that the aircraft is stationary on the ground with EPUs powered below a threshold. As another nonexclusive example, process 900 may use a second combination of first and second time delays based on determining that the aircraft is hovering, which may occur when lift is predominantly provided by EPUs. As another non-exclusive example, process 900 may use a third combination of first and second time delays based on determining that the aircraft is in a transition stage (e.g., from hovering to forward flight or vice versa). As another nonexclusive example, process 900 may use a fourth combination of first and second time delays based on determining that the aircraft is in a forward flight mode, which may occur when lift is predominantly provided by wings. In some embodiments, process 900 may include adjusting the first time delay to be longer than the second time delay based on the flight phase being a takeoff or landing phase.

[0214] Figure 10 is a flowchart of an example isolation monitoring process 1000. In some implementations, one or more process blocks of Figure 10 may be performed by at least one processor, such as a BMU, an MCU, a controller, an FCC, or any electrical component configured to control one or more modifiable circuitry components. Process 1000 may include one or more operations of isolation monitoring control sequence 700, discussed above. Additionally or alternatively, process 1000 may use circuitry described with respect to Figs. 6A-6D. In some embodiments, the process may be performed by at least one processor of each BMU 201 in a battery pack. For example, at least one BMU 201 (e.g., each BMU) may include at least one processor (e.g., at least one microprocessor-based controller) configured to execute software code stored in a storage medium (e.g., a computer-readable medium, a non-transitory computer-readable medium) to perform the process. In some embodiments, at least one processor of a different aircraft component may perform the control sequence process.

[0215] As shown in Figure 10, process 1000 may include monitoring a state of a high voltage circuit (block 1002), which may include, for example, aspects discussed above with respect to step 702 and / or 703. The high voltage circuit may electrically connect a first battery pack and a second battery pack in parallel via a wire (which may be referred to as a high voltage wire and / or configured to carry high voltage) on a positive side of the first battery pack and a wire (which may be referred to as a high voltage wire and / or configured to carry high voltage)on a negative side of the first battery pack.

[0216] As also shown in Figure 10, process 1000 may include detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side areuninterrupted (block 1004). In some embodiments, detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted may include detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted, an exemplary situation of which is depicted in Fig. 6B. In some embodiments, detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted may include detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are interrupted, an exemplary situation of which is depicted in Fig. 6C. In some embodiments, detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted may include detecting the high voltage wire on the positive side is interrupted and the high voltage wire on the negative side is uninterrupted, an exemplary situation of which is depicted in Fig. 6D.

[0217] As also shown in Figure 10, process 1000 may include engaging, based on (e.g., in response to) the detecting, at least one of a first isolation resistance monitoring circuit associated with a first battery pack or a second isolation resistance monitoring circuit associated with the second battery pack (block 1006).

[0218] For example, engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit may include engaging a first isolation resistance monitoring circuit associated with a first battery pack and disengaging a second isolation resistance monitoring circuit associated with the second battery pack. This engaging may be performed based on (e.g., in response to) detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted, an exemplary situation of which is depicted in Fig. 6B.

[0219] As another example, engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit may include engaging the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack. This engaging may be performed based on (e.g., in response to) detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are interrupted, an exemplary situation of which is depicted in Fig. 6C.

[0220] As yet another example, engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit may include alternating engaging the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack. Thisengaging may be performed based on (e.g., in response to) detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are interrupted, an exemplary situation of which is depicted in Fig. 6C.

[0221] As also shown in Figure 10, process 1000 may include engaging a first isolation resistance monitoring circuit associated with a first battery pack and / or disengaging a second isolation resistance monitoring circuit associated with the second battery pack. In some embodiments, process 1000 may, based on detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted, engage the first isolation resistance monitoring circuit and disengage the second isolation resistance monitoring circuit (block 1004).

[0222] As further shown in Figure 10, process 1000 may include engaging the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack. In some embodiments, process 1000 may, based on detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are interrupted, engage the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack (block 1006).

[0223] Engaging an isolation resistance monitoring circuit may include closing at least one switch, relay, and / or contact. For example, engaging the first isolation resistance monitoring circuit associated with a first battery pack may include closing at least one switch included in the first isolation resistance monitoring circuit. As another example, engaging the second isolation resistance monitoring circuit associated with the second battery pack may include closing at least one switch included in the second isolation resistance monitoring circuit.

[0224] Engaging an isolation resistance monitoring circuit may include selecting an isolation resistance monitoring circuit to engage from a plurality of isolation resistance monitoring circuits. For example, engaging the first isolation resistance monitoring circuit may include selecting, for example based on an identifier or fault state, the first isolation resistance monitoring circuit to engage from a plurality of isolation resistance monitoring circuits.

[0225] In some embodiments, the high voltage circuit may include a first fuse on the high voltage wire on the positive side, and detecting the high voltage wire on the positive side is interrupted may include detecting the first fuse has been blown. A fuse may include any fuse discussed above, for example F4 and / or F6.

[0226] As also shown in Figure 10, process 1000 may include alternating engaging the first isolation resistance monitoring circuit associated with the first battery pack and the secondisolation resistance monitoring circuit associated with the second battery pack (block 1008). In some embodiments, process 1000 may, based on detecting the high voltage wire on the positive side is interrupted and the high voltage wire on the negative side is uninterrupted, alternate engaging the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack.

[0227] Process 1000 may also include determining an isolation resistance of the high voltage circuit, as discussed above with respect to Figure 7, for example. Process 1000 may also include disconnecting high voltage power provided by at least one of the first or second battery pack based on determining the isolation resistance indicates failure of an isolation condition. Process 1000 may also include determining an aircraft is not in flight prior to disconnecting the high voltage power provided by at least one of the first or second battery pack.

[0228] Process 1000 may also include providing a signal to initiate a notification based on determining the isolation resistance indicates failure of an isolation condition. For example, process 1000 may include transmitting a signal to cause a notification to generate at an interface or other output device. In some embodiments, the notification may include at least one of a notification on a display interface, an audible alert, or a light turning on.Additionally or alternatively, the notification may provide an indication of a battery pack or circuitry experiencing the failure of the isolation condition.

[0229] Process 1000 may also include receiving a startup signal to provide power by the first and second battery packs. A startup signal may be generated and / or transmitted by and / or based on an action taken at an input device, for example by a pilot.

[0230] Process 1000 may also include providing power by the first and second battery packs based on determining that the isolation resistance indicates isolation satisfying the isolation condition. An isolation condition may include aspects discussed above with respect to, for example, Figure 7.

[0231] Process 1000 may also include monitoring a voltage at a preset time interval. For example, a voltage may be monitored at a preset time interval based on engaging at least one of the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit. A preset time interval is also discussed above with respect to, for example, Figure 6A.

[0232] Process 1000 may also include testing whether a switch associated with the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit isfaulty. Testing whether the switch is faulty may include performing one or more testing operations, such as those discussed above with respect to Figure 7. For example, Engaging the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit, for example as discussed above, may be performed based on determining the switch is not faulty (e.g., whose functioning satisfies one or more operational performance criteria).

[0233] Process 1000 may also include detecting whether a charger is connected. A charger may include a charging cord, a charging power source, or any electrical device or system configured to provide charge to one or more batteries (e.g., of an aircraft). Engaging the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit, for example as discussed above, may be performed based on determining the charger is not connected. For example, in response to determining that the charger is not connected, process 1000 may engage at least one of the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit.

[0234] Additional aspects of the present disclosure may be further described via the following clauses:1. A system for controlling high voltage power, comprising: a first controller configured to: receive first sensor data, determine a first circuitry state based on the first sensor data, and output at least one first signal indicative of the first circuitry state determined by the first controller; and a second controller configured to: receive second sensor data, determine a second circuitry state based on the second sensor data, and output at least one second signal indicative of the second circuitry state determined by the second controller; and verification circuitry configured to: receive at least one first signal and the at least one second signal, maintain a state of a high voltage control device in response to the at least one first signal and the at least one second signal indicating a different value, and change a state of the high voltage control device when the at least one first signal and the at least one second signal indicate the same value.e system of clause 1, wherein the first or second sensor data is received from at least one of: a current sensor or a voltage sensor. e system of any of clauses 1-2, wherein: the first sensor data indicates a state of one or more battery pack cells within a battery pack; and the second sensor data indicates a state of high voltage wiring between the battery pack and one or more loads powered by the battery pack. e system of any of clauses 1-3, wherein the high voltage control device comprises at least one of a contactor or pyrofuse. e system of any of clauses 1-4, wherein the high voltage control device comprises a contactor configured to isolate at least one electric propulsion unit from a power supply provided by a battery pack. e system of any of clauses 1-5, wherein the high voltage control device comprises a contactor configured to isolate a battery pack from a plurality of electric propulsion units. e system of any of clauses 1-6, wherein the high voltage control device comprises a fuse configured to isolate at least one electric propulsion unit from a power supply provided by a battery pack. e system of clause 7, wherein the fuse is a pyrofuse. e system of any of clauses 1-8, wherein: at least one of the at least one first signal and the at least one second signal indicates two binary values; and the verification circuitry comprises an inverter that inverts only one of the two binary values and does not invert the other of the two binary values.he system of clause 9, wherein the verification circuitry is configured to maintain a state of the high voltage control device when the inverted value does not match the value of the two binary values that are not inverted. he system of any of clauses 1-10, wherein: the system further comprises a controller monitoring device; and the verification circuitry is configured to maintain a state of the high voltage control device when at least one of the first controller or second controller does not provide a signal to the controller monitoring device in accordance with at least one set timing criterion. he system of clause 11, wherein:the controller monitoring device is configured to receive at least one third signal from the first controller and at least one fourth signal from the second controller; and the verification circuitry is configured to maintain a state of the high voltage control device further in response to at least one of the first controller or the second controller does not provide the at least one third signal or the at least one fourth signal, respectively, according to the at least one set timing criterion. he system of any of clauses 1-12, wherein the system further comprises a testing controller configured to test functionality of the high voltage control device. he system of clause 13, wherein the maintaining of the state of the high voltage control device based on the functionality testing performed by the testing controller, the functionality testing indicating one or more operating conditions of the high voltage control device that do not satisfy a performance metric. he system of clause 14, wherein the system is configured to provide a warning signal to a flight control system based on determining the one or more operating conditions of the high voltage control device that do not satisfy the performance metric. he system of clause 15, wherein the warning signal indicates to a flight control system to maintain a flight mode or to not power one or more electric propulsion units. he system of clause 13, wherein the high voltage control device comprises a contactor and the testing controller is configured to test the contactor by toggling it open and closed. he system of clause 13, wherein the high voltage control device is a pyrofuse and the testing controller tests the pyrofuse by running a current through the pyrofuse. he system of any of clauses 1-18, further comprising a first monitoring controller and a second monitoring controller; wherein the first sensor data is received by the first monitoring controller and the second sensor data is received by the second monitoring controller. system for controlling high voltage power, comprising: a first logic controller configured to: receive first sensor data, determine a first circuitry state based on the first sensor data, andoutput at least one first signal indicative of the first circuitry state determined by the first logic controller; a second logic controller configured to: receive second sensor data, determine a second circuitry state based on the second sensor data, and output at least one second signal indicative of the second circuitry state determined by the second logic controller; a first monitoring controller configured to: receive the first sensor data, and output at least one third signal indicative of a third circuitry state; a second monitoring controller configured to: receive the second sensor data, and output at least one fourth signal indicative of a fourth circuitry state; and verification circuitry configured to: receive at least one first signal and the at least one second signal, use the at least one first signal and the at least one second signal to determine whether to maintain or change a state of a high voltage control device, override the determination of whether to maintain or change a state of the high voltage control device when the at least one third signal and the at least one fourth signal agree. system of any of clauses 1-20, wherein maintaining a state of a high voltage control device comprises at least one of: not blowing a fuse or not changing a contactor state between open and closed. aircraft comprising: a first sensor; a second sensor; one or more electric propulsion units;high voltage wiring configured to power the one or more electric propulsion units; and the system of any of clauses 1-21. ethod for controlling high voltage power for multiple battery packs, comprising: receiving, using at least one hardware processor, a first current measurement of a first circuit, wherein the first circuit: is configured to provide power from a first battery pack to at least one electric propulsion unit, and comprises a first fuse configured to disable current in the first circuit upon being triggered; triggering, using the at least one hardware processor, a first fuse in response to a first trigger condition being met and a first time delay expiring; receiving, using the at least one hardware processor, a second current measurement of a second circuit, wherein the second circuit: is configured to allow the first battery pack to provide backup power for a second battery pack, and comprises a second fuse configured to disable current in the second circuit upon being triggered; and triggering, using the at least one hardware processor, the second fuse in response to a second trigger condition being met and a second time delay expiring, wherein the first time delay is different from the second time delay. method of clause 23, wherein the first current measurement is measured using a first current sensing resistor of the first circuit. method of any of clauses 23-24, wherein the second current measurement is measured using a second current sensing resistor of the second circuit. method of any of clauses 23-25, wherein the first trigger condition comprises the first current measurement exceeding a first current threshold indicative of an overcurrent condition or short circuit condition in the first circuit. method of any of clauses 23-26, wherein the second trigger condition comprises the second current measurement exceeding a second current threshold indicative of an overcurrent condition or short circuit condition in the second circuit.method of any of clauses 23-26, wherein the first time delay is shorter than the second time delay. method of any of clauses 23-28, further comprising: dynamically adjusting, using the at least one hardware processor, the first and second time delays based on a flight phase. method of clause 29, further comprising: adjusting, using the at least one hardware processor, the first time delay to be longer than the second time delay based on the flight phase being a takeoff or landing phase. method of any of clauses 23-30, further comprising: setting, using the at least one hardware processor, the first time delay by adjusting a voltage of a first comparator; and setting, using the at least one hardware processor, the second time delay by adjusting a voltage of a second comparator. method of any of clauses 23-31, further comprising: receiving, using the at least one hardware processor, a third current measurement of a third circuit and triggering a third fuse in response to a third condition being met and a third time delay expiring, wherein the third circuit is configured to provide power from the first battery pack to the at least one electric propulsion unit and the second battery pack, the third circuit comprising the third fuse configured to disable current in the third circuit upon being triggered; and wherein the third time delay is different from the first time delay and the second time delay. method of clauses 32, wherein the third condition comprises the third current measurement exceeding a third current threshold indicative of an overcurrent or short circuit condition in the third circuit. method of clauses 33, wherein the third time delay is longer than the first time delay. method of clause 33, wherein the third time delay is longer than the first and the second time delays. stem for controlling high voltage power for multiple battery packs comprising at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of clauses 23-35.omputer-readable storage medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform the method of any of clauses 23-35. aircraft, comprising: a first battery pack; a second battery pack; at least one electric propulsion unit; and at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of claims 23-35. ethod for high voltage isolation resistance monitoring, comprising: monitoring, using at least one hardware processor, a state of a high voltage circuit connecting a first battery pack and a second battery pack electrically connected in parallel via a high voltage wire on a positive side of the first battery pack and a high voltage wire on a negative side of the first battery pack; detecting, using the at least one hardware processor, whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted; and in response to the detecting, engaging, using the at least one hardware processor, at least one of a first isolation resistance monitoring circuit associated with a first battery pack or a second isolation resistance monitoring circuit associated with the second battery pack. method of clause 39, wherein: detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises detecting, using the at least one hardware processor, that both the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted; and engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit comprises engaging, using the at least one hardware processor, a first isolation resistance monitoring circuit associated with a first battery pack and disengaginga second isolation resistance monitoring circuit associated with the second battery pack. of clause 39, wherein: detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises detecting, using the at least one hardware processor, that both the high voltage wire on the positive side and the high voltage wire on the negative side are interrupted, and engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit comprises engaging, using the at least one hardware processor, the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack. of clause 39, wherein: detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises detecting, using the at least one hardware processor, the high voltage wire on the positive side is interrupted and the high voltage wire on the negative side is uninterrupted; and engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit comprises alternating engaging, using the at least one hardware processor, the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack. of clause 40, wherein: the high voltage circuit comprises a first fuse on the high voltage wire on the positive side; and detecting the high voltage wire on the positive side is interrupted comprises detecting, using the at least one hardware processor, the first fuse has been blown. of any of clauses 39-43, wherein:the high voltage circuit comprises a second fuse on the high voltage wire on the negative side; and detecting the high voltage wire on the negative side is interrupted comprises detecting, using the at least one hardware processor, the second fuse has been blown. method of any of clauses 39-44, wherein engaging the first isolation resistance monitoring circuit associated with a first battery pack comprises closing, using the at least one hardware processor, at least one switch included in the first isolation resistance monitoring circuit. method of any of clauses 39-45, wherein engaging the second isolation resistance monitoring circuit associated with the second battery pack comprises closing, using the at least one hardware processor, at least one switch included in the second isolation resistance monitoring circuit. method of any of clauses 39-46, further comprising: determining, using the at least one hardware processor, the isolation resistance of the high voltage circuit; and disconnecting, using the at least one hardware processor, high voltage power provided by at least one of the first or second battery pack based on determining the isolation resistance indicates failure of an isolation condition. method of clause 47, further comprising: determining, using the at least one hardware processor, an aircraft is not in flight prior to disconnecting the high voltage power provided by at least one of the first or second battery pack. method of any of clauses 39-47, further comprising: determining, using the at least one hardware processor, the isolation resistance of the high voltage circuit; and providing, using the at least one hardware processor, a signal to initiate a notification based on determining the isolation resistance indicates failure of an isolation condition. method of clause 49, wherein the notification comprises: a notification on a display interface, an audible alert, or a light turning on. method of clause 49, wherein the notification provides an indication of a battery pack or circuitry experiencing the failure of the isolation condition. method of any of clauses 39-51, further comprising:receiving, using the at least one hardware processor, a startup signal to provide power by the first and second battery packs; and providing, using the at least one hardware processor, power by the first and second battery packs based on determining that the isolation resistance indicates isolation satisfying the isolation condition. method of any of clauses 39-52, further comprising: monitoring, using the at least one hardware processor, a voltage at a preset time interval based on engaging at least one of the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit. method of any of clauses 39-53, further comprising: testing, using the at least one hardware processor, whether a switch associated with the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit is faulty; wherein engaging the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit is performed in response to determining the switch is not faulty. method of any of clauses 39-54, further comprising: detecting, using the at least one hardware processor, whether a charger is connected; wherein engaging the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit is performed in response to determining the charger is not connected. method of any of clauses 39-55, wherein engaging the first isolation resistance monitoring circuit associated with the first battery pack based on detecting, using the at least one hardware processor, that both the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises: selecting, using the at least one hardware processor, based on an identifier or fault state, the first isolation resistance monitoring circuit to engage from a plurality of isolation resistance monitoring circuits. stem for high voltage isolation resistance monitoring comprising at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of clauses 39-56.omputer-readable storage medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform the method of any of clauses 39-56. aircraft, comprising: a first battery pack; a second battery pack; at least one electric propulsion unit powered by at least one of the first battery pack or the second battery pack; and at least one processor configured to execute instructions to cause the at least one processor to perform the method any of clauses 39-53. ethod for battery pack testing, comprising: detecting, using the at least one hardware processor, a wakeup command; determining, using the at least one hardware processor, whether the wakeup command was initiated by a communication signal or a timer; determining, using the at least one hardware processor, in response to determining the wakeup command was initiated by the communication signal or the timer, whether at least one switching device is open or closed; and in response to determining the at least one electrically-activatable switching device is closed: maintaining, by the at least one hardware processor, the at least one electrically-activatable switching device closed, and disregarding, by the at least one hardware processor, commands to open the at least one electrically-activatable switching device. method of clause 60, wherein the at least one switching device is configured to control current provided by the battery pack to one or more electric propulsion units. method of clauses 60 or 61, wherein determining whether the at least one switching device is open or closed comprises at least one of: comparing, using the at least one hardware processor, a voltage across the at least one switching device to a threshold or comparing, using the at least one hardware processor, a current across the at least one switching device to a threshold.method of any of clauses 60-62, wherein the maintaining of the at least one electrically-activatable switching device closed and the disregarding of the commands to open the at least one electrically-activatable switching device are based on determining the wakeup command was triggered by an electrical issue. method of any of clauses 60-63, further comprising ceasing, by the at least one hardware processor, to disregard commands to open the at least one switching device based on receiving, by the at least one hardware processor, a signal indicating that an aircraft comprising the at least one switching device is not in flight. method of clauses 64, wherein the signal indicating that the aircraft is not in flight is received from a flight control system of the aircraft. method of any of claims 60-63, further comprising ceasing, by the at least one hardware processor, to disregard commands to open the at least one switching device based on determining, by the at least one hardware processor, that at least one of a voltage or temperature of the battery pack has exceeded a threshold. method of any of clauses 60-66, further comprising testing, by the at least one hardware processor, of the battery pack based on determining the at least one switching device is open. method of clause 67, wherein testing of the battery pack comprises sending, by the at least one hardware processor, a signal to close the at least one switching device and determining the at least one switching device closes in response to the signal. method of clause 67, wherein testing the battery pack comprises sending, by the at least one hardware processor, a signal to close the at least one switching device while keeping another switching device open to avoid energizing a bus configured to be powered by the battery pack. stem for battery pack testing comprising at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of clauses 60-69. omputer-readable storage medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform the method of any of clauses 60-69. aircraft, comprising: a battery pack; at least one electric propulsion unit powered by the battery pack; andat least one processor configured to execute instructions to cause the at least one processor to perform the method of any of clauses 57-66.

[0235] The features and advantages of the disclosure are apparent from the detailed specification, and thus, it is intended that the appended clauses cover all systems and methods falling within the true spirit and scope of the disclosure. As used herein, the indefinite articles “a” and “an” mean “one or more.” Similarly, the use of a plural term does not necessarily denote a plurality unless it is unambiguous in the given context. Words such as “and” or “or” mean “and / or” unless specifically directed otherwise. Also, words such as “be” or “is” or “are” may refer to “include” or “includes” unless specifically directed otherwise. As used herein, unless specifically stated otherwise, being “based on” may include being dependent on, being interdependent with, being derived from (e.g., using), being associated with, being defined at least in part by, being influenced by, occurring upon, occurring after, and / or being responsive to. As used herein, “related to” or “relating to” may include being inclusive of, being expressed by, being indicated by, or being based on. Further, since numerous modifications and variations will readily occur from studying the present disclosure, it is not desired to limit the disclosure to the exact construction and operation illustrated and described, and accordingly, all suitable modifications and equivalents may be resorted to, falling within the scope of the disclosure.

[0236] Other embodiments will be apparent to those skilled in the art from consideration of the specification and practice of the implementations disclosed herein. It is intended that the architectures and circuit arrangements shown in figures are only for illustrative purposes and are not intended to be limited to the specific arrangements and circuit arrangements as described and shown in the figures. It is also intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the invention being indicated by the following clauses. The foregoing description has been presented for purposes of illustration. It is not exhaustive and does not limit the invention to the precise forms or embodiments disclosed. Modifications and adaptations of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the disclosed embodiments of the inventions disclosed herein. It is also intended that the sequence of steps shown in figures is only for illustrative purposes and is not intended to be limited to any particular sequence of steps. As such, those skilled in the art can appreciate that these steps can be performed in a different order, only a subset of the steps may be performed, and / or one or more steps may be repeated while implementing the same method. Moreover, while the steps or blocks may be described as performed by a particular entity, such as at least oneprocessor or a process, it is appreciated that all steps may be performed by at least one processor, such as a computer. For example, at least one processor may be configured to execute the steps or blocks as expressed in instructions stored in a storage medium.

Claims

CLAIMS1. A system for controlling high voltage power, comprising: a first controller configured to: receive first sensor data, determine a first circuitry state based on the first sensor data, and output at least one first signal indicative of the first circuitry state determined by the first controller; and a second controller configured to: receive second sensor data, determine a second circuitry state based on the second sensor data, and output at least one second signal indicative of the second circuitry state determined by the second controller; and verification circuitry configured to: receive at least one first signal and the at least one second signal, maintain a state of a high voltage control device in response to the at least one first signal and the at least one second signal indicating a different value, and change a state of the high voltage control device when the at least one first signal and the at least one second signal indicate the same value.

2. The system of claim 1, wherein the first or second sensor data is received from at least one of: a current sensor or a voltage sensor.

3. The system of any of claims 1-2, wherein: the first sensor data indicates a state of one or more battery pack cells within a battery pack; and the second sensor data indicates a state of high voltage wiring between the battery pack and one or more loads powered by the battery pack.

4. The system of any of claims 1-3, wherein the high voltage control device comprises at least one of a contactor or pyrofuse.

5. The system of any of claims 1-4, wherein the high voltage control device comprises a contactor configured to isolate at least one electric propulsion unit from a power supply provided by a battery pack.

6. The system of any of claims 1-5, wherein the high voltage control device comprises a contactor configured to isolate a battery pack from a plurality of electric propulsion units.

7. The system of any of claims 1-6, wherein the high voltage control device comprises a fuse configured to isolate at least one electric propulsion unit from a power supply provided by a battery pack.

8. The system of claim 7, wherein the fuse is a pyrofuse.

9. The system of any of claims 1-8, wherein: at least one of the at least one first signal and the at least one second signal indicates two binary values; and the verification circuitry comprises an inverter that inverts only one of the two binary values and does not invert the other of the two binary values.

10. The system of claim 9, wherein the verification circuitry is configured to maintain a state of the high voltage control device when the inverted value does not match the value of the two binary values that are not inverted.

11. The system of any of claims 1-10, wherein: the system further comprises a controller monitoring device; and the verification circuitry is configured to maintain a state of the high voltage control device when at least one of the first controller or second controller does not provide a signal to the controller monitoring device in accordance with at least one set timing criterion.

12. The system of claim 11, wherein: the controller monitoring device is configured to receive at least one third signal from the first controller and at least one fourth signal from the second controller; and the verification circuitry is configured to maintain a state of the high voltage control device further in response to at least one of the first controller or the second controller does not provide the at least one third signal or the at least one fourth signal, respectively, according to the at least one set timing criterion.

13. The system of any of claims 1-12, wherein the system further comprises a testing controller configured to test functionality of the high voltage control device.

14. The system of claim 13, wherein the maintaining of the state of the high voltage control device based on the functionality testing performed by the testing controller, the functionality testing indicating one or more operating conditions of the high voltage control device that do not satisfy a performance metric.

15. The system of claim 14, wherein the system is configured to provide a warning signal to a flight control system based on determining the one or more operating conditions of the high voltage control device that do not satisfy the performance metric.

16. The system of claim 15, wherein the warning signal indicates to a flight control system to maintain a flight mode or to not power one or more electric propulsion units.

17. The system of claim 13, wherein the high voltage control device comprises a contactor and the testing controller is configured to test the contactor by toggling it open and closed.

18. The system of claim 13, wherein the high voltage control device is a pyrofuse and the testing controller tests the pyrofuse by running a current through the pyrofuse.

19. The system of any of claims 1-18, further comprising a first monitoring controller and a second monitoring controller; wherein the first sensor data is received by the first monitoring controller and the second sensor data is received by the second monitoring controller.

20. A system for controlling high voltage power, comprising: a first logic controller configured to: receive first sensor data, determine a first circuitry state based on the first sensor data, and output at least one first signal indicative of the first circuitry state determined by the first logic controller; a second logic controller configured to: receive second sensor data, determine a second circuitry state based on the second sensor data, and output at least one second signal indicative of the second circuitry state determined by the second logic controller; a first monitoring controller configured to: receive the first sensor data, andoutput at least one third signal indicative of a third circuitry state; a second monitoring controller configured to: receive the second sensor data, and output at least one fourth signal indicative of a fourth circuitry state; and verification circuitry configured to: receive at least one first signal and the at least one second signal, use the at least one first signal and the at least one second signal to determine whether to maintain or change a state of a high voltage control device, override the determination of whether to maintain or change a state of the high voltage control device when the at least one third signal and the at least one fourth signal agree.

21. The system of any of claims 1-20, wherein maintaining a state of a high voltage control device comprises at least one of: not blowing a fuse or not changing a contactor state between open and closed.

22. An aircraft comprising: a first sensor; a second sensor; one or more electric propulsion units; high voltage wiring configured to power the one or more electric propulsion units; and the system of any of claims 1-21.

23. A method for controlling high voltage power for multiple battery packs, comprising: receiving a first current measurement of a first circuit, wherein the first circuit: is configured to provide power from a first battery pack to at least one electric propulsion unit, and comprises a first fuse configured to disable current in the first circuit upon being triggered; triggering a first fuse in response to a first trigger condition being met and a first time delay expiring;receiving a second current measurement of a second circuit, wherein the second circuit: is configured to allow the first battery pack to provide backup power for a second battery pack, and comprises a second fuse configured to disable current in the second circuit upon being triggered; and triggering the second fuse in response to a second trigger condition being met and a second time delay expiring, wherein the first time delay is different from the second time delay.

24. The method of claim 23, wherein the first current measurement is measured using a first current sensing resistor of the first circuit.

25. The method of any of claims 23-24, wherein the second current measurement is measured using a second current sensing resistor of the second circuit.

26. The method of any of claims 23-25, wherein the first trigger condition comprises the first current measurement exceeding a first current threshold indicative of an overcurrent condition or short circuit condition in the first circuit.

27. The method of any of claims 23-26, wherein the second trigger condition comprises the second current measurement exceeding a second current threshold indicative of an overcurrent condition or short circuit condition in the second circuit.

28. The method of any of claims 23-26, wherein the first time delay is shorter than the second time delay.

29. The method of any of claims 23-28, further comprising: dynamically adjusting the first and second time delays based on a flight phase.

30. The method of claim 29, further comprising: adjusting the first time delay to be longer than the second time delay based on the flight phase being a takeoff or landing phase.

31. The method of any of claims 23-30, further comprising: setting the first time delay by adjusting a voltage of a first comparator; and setting the second time delay by adjusting a voltage of a second comparator.

32. The method of any of claims 23-31, further comprising: receiving a third current measurement of a third circuit and triggering a third fuse in response to a third condition being met and a third time delay expiring, wherein the third circuit is configured to provide power from the first battery pack to the at least one electric propulsion unit and the second batterypack, the third circuit comprising the third fuse configured to disable current in the third circuit upon being triggered; and wherein the third time delay is different from the first time delay and the second time delay.

33. The method of claim 32, wherein the third condition comprises the third current measurement exceeding a third current threshold indicative of an overcurrent or short circuit condition in the third circuit.

34. The method of claim 33, wherein the third time delay is longer than the first time delay.

35. The method of claim 33, wherein the third time delay is longer than the first and the second time delays.

36. A system for controlling high voltage power for multiple battery packs comprising at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of claims 23-35.

37. A computer-readable storage medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform the method of any of claims 23-35.

38. An aircraft, comprising: a first battery pack; a second battery pack; at least one electric propulsion unit; and at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of claims 23-35.

39. A method for high voltage isolation resistance monitoring, comprising: monitoring a state of a high voltage circuit connecting a first battery pack and a second battery pack electrically connected in parallel via a high voltage wire on a positive side of the first battery pack and a high voltage wire on a negative side of the first battery pack; detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted; and in response to the detecting, engaging at least one of a first isolation resistance monitoring circuit associated with a first battery pack or a second isolation resistance monitoring circuit associated with the second battery pack.

40. The method of claim 39, wherein:detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted; and engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit comprises engaging a first isolation resistance monitoring circuit associated with a first battery pack and disengaging a second isolation resistance monitoring circuit associated with the second battery pack.

41. The method of claim 39, wherein: detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are interrupted, and engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit comprises engaging the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack.

42. The method of claim 39, wherein: detecting whether the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises detecting the high voltage wire on the positive side is interrupted and the high voltage wire on the negative side is uninterrupted; and engaging at least one of a first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit comprises alternating engaging the first isolation resistance monitoring circuit associated with the first battery pack and the second isolation resistance monitoring circuit associated with the second battery pack.

43. The method of claim 40, wherein: the high voltage circuit comprises a first fuse on the high voltage wire on the positive side; and detecting the high voltage wire on the positive side is interrupted comprises detecting the first fuse has been blown.

44. The method of any of claims 39-43, wherein: the high voltage circuit comprises a second fuse on the high voltage wire on the negative side; and detecting the high voltage wire on the negative side is interrupted comprises detecting the second fuse has been blown.

45. The method of any of claims 39-44, wherein engaging the first isolation resistance monitoring circuit associated with a first battery pack comprises closing at least one switch included in the first isolation resistance monitoring circuit.

46. The method of any of claims 39-45, wherein engaging the second isolation resistance monitoring circuit associated with the second battery pack comprises closing at least one switch included in the second isolation resistance monitoring circuit.

47. The method of any of claims 39-46, further comprising: determining the isolation resistance of the high voltage circuit; and disconnecting high voltage power provided by at least one of the first or second battery pack based on determining the isolation resistance indicates failure of an isolation condition.

48. The method of claim 47, further comprising: determining an aircraft is not in flight prior to disconnecting the high voltage power provided by at least one of the first or second battery pack.

49. The method of any of claims 39-47, further comprising: determining the isolation resistance of the high voltage circuit; and providing a signal to initiate a notification based on determining the isolation resistance indicates failure of an isolation condition.

50. The method of claim 49, wherein the notification comprises: a notification on a display interface, an audible alert, or a light turning on.

51. The method of claim 49, wherein the notification provides an indication of a battery pack or circuitry experiencing the failure of the isolation condition.

52. The method of any of claims 39-51, further comprising: receiving a startup signal to provide power by the first and second battery packs; and providing power by the first and second battery packs based on determining that the isolation resistance indicates isolation satisfying the isolation condition.

53. The method of any of claims 39-52, further comprising: monitoring a voltage at a preset time interval based on engaging at least one of the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit.

54. The method of any of claims 39-53, further comprising: testing whether a switch associated with the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit is faulty; wherein engaging the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit is performed in response to determining the switch is not faulty.

55. The method of any of claims 39-54, further comprising: detecting whether a charger is connected; wherein engaging the first isolation resistance monitoring circuit or the second isolation resistance monitoring circuit is performed in response to determining the charger is not connected.

56. The method of any of claims 39-55, wherein engaging the first isolation resistance monitoring circuit associated with the first battery pack based on detecting that both the high voltage wire on the positive side and the high voltage wire on the negative side are uninterrupted comprises: selecting, based on an identifier or fault state, the first isolation resistance monitoring circuit to engage from a plurality of isolation resistance monitoring circuits.

57. A system for high voltage isolation resistance monitoring comprising at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of claims 39-56.

58. A computer-readable storage medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform the method of any of claims 39-56.

59. An aircraft, comprising: a first battery pack; a second battery pack; at least one electric propulsion unit powered by at least one of the first battery pack or the second battery pack; and at least one processor configured to execute instructions to cause the at least one processor to perform the method any of claims 39-56.

60. A computer-implemented method for battery pack testing, comprising: detecting a wakeup command; determining whether the wakeup command was initiated by a communication signal or a timer; determining, in response to determining the wakeup command was initiated by the communication signal or the timer, whether at least one electrically-activatable switching device is open or closed; and in response to determining the at least one electrically-activatable switching device is closed: maintaining the at least one electrically-activatable switching device closed, and disregarding commands to open the at least one electrically- activatable switching device.

61. The computer-implemented method of claim 60, wherein the at least one electrically- activatable switching device is configured to control current provided by the battery pack to one or more electric propulsion units.

62. The computer-implemented method of claim 60 or 61, wherein determining whether the at least one electrically-activatable switching device is open or closed comprises at least one of: comparing a voltage across the at least one electrically-activatable switching device to a threshold or comparing a current across the at least one electrically-activatable switching device to a threshold.

63. The computer-implemented method of any of claims 60-62, wherein the maintaining of the at least one electrically-activatable switching device closed and the disregarding of the commands to open the at least one electrically-activatable switching device are based on determining the wakeup command was triggered by an electrical issue.

64. The computer-implemented method of any of claims 60-63, further comprising ceasing to disregard commands to open the at least one electrically-activatable switching device based on receiving a signal indicating that an aircraft comprising the at least one electrically-activatable switching device is not in flight.

65. The computer-implemented method of claim 64, wherein the signal indicating that the aircraft is not in flight is received from a flight control system of the aircraft.

66. The computer-implemented method of any of claims 60-63, further comprising ceasing to disregard commands to open the at least one electrically-activatable switching device based on determining that at least one of a voltage or temperature of the battery pack has exceeded a threshold.

67. The computer-implemented method of any of claims 60-66, further comprising testing of the battery pack based on determining the at least one electrically-activatable switching device is open.

68. The computer-implemented method of claim 67, wherein testing of the battery pack comprises sending a signal to close the at least one electrically-activatable switching device and determining the at least one electrically-activatable switching device closes in response to the signal.

69. The computer-implemented method of claim 67, wherein testing the battery pack comprises sending a signal to close the at least one electrically-activatable switching device while keeping another electrically-activatable switching device open to avoid energizing a bus configured to be powered by the battery pack.

70. A system for battery pack testing comprising at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of claims 60-69.

71. A computer-readable storage medium storing instructions which, when executed by at least one processor, cause the at least one processor to perform the method of any of claims 60-69.

72. An aircraft, comprising: a battery pack; at least one electric propulsion unit powered by the battery pack; and at least one processor configured to execute instructions to cause the at least one processor to perform the method of any of claims 60-69.

Images