CN112203892A

CN112203892A - Aircraft monitoring system and method for electric or hybrid aircraft

Info

Publication number: CN112203892A
Application number: CN201980030274.6A
Authority: CN
Inventors: B·达尼; S·德蒙特
Original assignee: H55 SA
Current assignee: H55 SA
Priority date: 2018-08-29
Filing date: 2019-06-18
Publication date: 2021-01-08
Anticipated expiration: 2039-06-18
Also published as: EP3844019A1; CN112203892B; WO2020044134A1; CN112623266A

Abstract

The present disclosure describes at least embodiments of an aircraft monitoring system for an electric or hybrid aircraft. The aircraft monitoring system may be configured to enable the electric or hybrid aircraft to pass certification requirements associated with the safety risk analysis. The aircraft monitoring system may have different subsystems for monitoring and warning of faults of components (e.g., battery packs, motor controllers, and/or motors). Faults that pose a greater safety risk may be monitored and indicated by one or more subsystems without the use of programmable components.

Description

Aircraft monitoring system and method for electric or hybrid aircraft

Technical Field

The invention relates to an aircraft monitoring system for monitoring at least one component in an electric or hybrid aircraft.

Background

Electric and hybrid vehicles have become increasingly important for the transportation of people and goods. Such vehicles may desirably provide energy efficiency advantages over combustion-powered vehicles and may cause less air pollution during operation than combustion-powered vehicles.

Although the technology of electric and hybrid vehicles has developed significantly in recent years, many innovations that enable the transition from combustion-powered vehicles to electric vehicles unfortunately cannot be directly applied to the development of electric or hybrid aircraft. The functionality of automobiles and aircraft differs significantly in many respects, such that many design elements of electric and hybrid aircraft must be uniquely developed separately from those of electric and hybrid automobiles.

Furthermore, any changes to the design of the aircraft (e.g., to enable electric or hybrid operation) also require careful development and testing to ensure safety and reliability. If the aircraft experiences a serious malfunction during flight, the potential loss and safety risk due to the malfunction can be very high, as the malfunction can lead to the aircraft crashing and pose a safety or property loss risk to passengers or cargo as well as to individuals or property on the ground.

The certification standards for electric or hybrid aircraft are more stringent due to the risks posed by new aircraft designs. Aircraft designers strive to find ways to meet certification standards and bring new electric or hybrid aircraft designs to the market.

In view of these challenges, attempts to make electric and hybrid aircraft commercially viable have been largely unsuccessful. Accordingly, new methods for making and operating electric and hybrid aircraft continue to be desirable.

Flying manned or unmanned aircraft (e.g., airplanes) can be dangerous. Problems with aircraft can result in injury or loss of life to passengers or individuals on the ground in the aircraft, as well as damage to cargo transported by the aircraft or other items surrounding the aircraft.

The reliability of the system can be improved with redundant subsystems. Various designs have been proposed to replace a failed subsystem with a spare subsystem. For example, in the context of electric objects or vehicles, US20171210229a1 and US20111254502a1 both describe a fault tolerant battery management system in which the status of battery cells is monitored and/or controlled by a redundant Battery Management System (BMS) such that an error in one BMS does not prevent the battery from operating as long as the redundant BMS performs correctly. However, if two BMS are the same, they are more likely to present the same error or conceptual problem, and are also more likely to fail at the same time or within a short interval. Moreover, those solutions have not been designed with the aim of certification of the aircraft; adding additional components increases the complexity of the system and makes authentication more difficult.

In an attempt to alleviate potential problems associated with aircraft, many organizations have developed certification standards for ensuring that aircraft design and operation meet threshold safety requirements. The authentication criteria may be strict and burdensome when the security risk level is high, and may be easier and more flexible when the security risk level is low.

As an example, FAA advisory announcement AC 25.1309-1 describes acceptable means for showing compliance with airworthiness requirements of US federal aviation regulations, defining different levels of fault conditions according to their severity:

fault conditions without safety impact.

Minor fault conditions.

A large fault condition.

Dangerous fault conditions must be less frequent than very rare (extreme Remote remove).

A catastrophic failure condition must be extremely unlikely.

While aircraft must be designed such that dangerous and catastrophic failure conditions are minimal or even extremely unlikely, those severe failure conditions must still be monitored such that warning signals are sent to pilots and drivers who may attempt to remedy the condition or try to land the aircraft. The monitoring and alarm system must be reliable and also require authentication.

Unfortunately, such certification standards have the effect of slowing down the commercial adoption and production of electric or hybrid aircraft. Electric hybrid aircraft may, for example, address operational differences of electric or hybrid aircraft from conventional aircraft with new aircraft designs relative to conventional aircraft designs. However, the new design may differ significantly from the conventional aircraft design. These differences may subject the new design to extensive testing prior to certification. The need for extensive testing can take many resources, time, and significantly increase the ultimate cost of the aircraft.

Compliance of the monitoring and alarm subsystem with the certification criteria depends on the severity of the fault condition being monitored. Thus, dangerous or catastrophic failure conditions require a strict level of certification for the monitoring and alarm system, while less failure conditions or conditions without any safety impact have lower safety requirements and require monitoring and alarm systems that are easy to certify or do not require certification.

Accordingly, there is a need for simplified but robust components and systems for electric aircraft that simplify and streamline certification requirements and reduce the cost and time required to produce commercially viable electric aircraft.

Disclosure of Invention

According to one aspect, these objects are achieved by an aircraft monitoring system for an electric or hybrid aircraft, having different subsystems for monitoring and warning of a fault of at least one component of the electric or hybrid aircraft, comprising:

a first subsystem configured to be supported by a housing configured to fly and propelled by an electric motor and consisting of a non-programmable component, wherein the non-programmable component is configured to monitor components supported by the housing and output a first visual or audible alert to notify any catastrophic or dangerous fault condition associated with the components; and

a second subsystem configured to be supported by the housing and comprising a processor and a communication bus, wherein the processor is configured to monitor the component and output a second visual or audible alert to notify other fault conditions associated with the component, including major and/or minor fault conditions.

This has the following advantages: a first redundant subsystem is provided for monitoring the components and outputting a first visual or audible warning in any event of a catastrophic or dangerous fault condition. This first subsystem is easier to verify, since its design is relatively simple and comprises only non-programmable electronic components.

The first subsystem is preferably a processor-less circuit and therefore does not include any processor or other software controlled components.

The first subsystem may preferably comprise only analog and/or combinational logic electronic components.

The first subsystem may include a flip-flop (flip-flop).

The first subsystem may be configured to process analog signals and/or binary signals.

The first subsystem preferably generates and processes only analog and/or binary signals, and does not generate and process multivalued digital signals. A multi-valued digital signal is a digital signal that can indicate more than two different values, for example a digital signal comprising a plurality of bits for representing a non-binary value.

The aircraft may be designed such that different subsystems of the aircraft are constructed to have robustness corresponding to their responsibilities and any associated certification criteria, and potentially corresponding to any subsystem redundancy. In situations where the potential failure of the responsibilities of the subsystems may be catastrophic (e.g., resulting in death of individuals not in the aircraft on the ground, such as when the aircraft suddenly loses altitude), the subsystems may be designed to be very simple and robust, and thus may be able to meet difficult certification criteria. For example, such a subsystem may be comprised of non-programmable, stateless components (e.g., analog or non-programmable combinational logic electronic components) rather than a processor. For example, the subsystem may activate an indicator such as a light rather than a more complex display. Thus, the first subsystem may be immune to software or programming errors, and may be less susceptible to external disturbances (e.g., voltage spikes, electromagnetic interference, or radiation) that may cause a fault.

On the other hand, in the event that (i) a second subsystem of the aircraft redundantly monitors parameters with a first subsystem of the aircraft (which consists of non-programmable, stateless components), or (ii) a potential failure of the second subsystem's responsibility may be less than catastrophic (e.g., resulting in a greater, lesser, or no safety impact), the second subsystem may be at least partially digital and designed to be more complex, feature-rich, and more easily updated and still be able to meet the associated certification criteria. The second subsystem may include, for example, programmable components or stateful components, such as a processor that outputs and presents information on a complex display. This may desirably enable the aircraft to maintain a feature-rich system without sacrificing a robust, easily certified safety system. While a programmable component or a stateful component may be difficult to safely and reliably update, and a programmable component may be more prone to failure due to voltage spikes, electromagnetic interference, or radiation than a non-programmable, stateless component, a programmable component or a stateful component may more easily provide functionality that may be difficult to provide with a non-programmable, stateless component.

The aircraft may be provided with a first subsystem responsible for determining the health of, for example, the battery assembly and for generating an alarm visual and/or audible alarm signal in the event of a fault. If the battery assembly overheats and catches fire, the aircraft will likely suffer catastrophic failure and rapid loss of altitude. Thus, the first subsystem may be composed entirely of non-programmable, stateless components. The first subsystem may include, for example, one or more temperature sensors that detect temperatures near one or more batteries in the aircraft and output a signal in response to detecting temperatures that exceed a threshold indicative of an unsafe condition. The first subsystem may include hard wiring connected to lights or speakers in the aircraft cockpit to indicate a temperature over-temperature condition to the pilot of the aircraft.

The second subsystem may be integrated with the aircraft to, for example, monitor battery life. This second monitoring subsystem may be responsible for monitoring and displaying the amount of energy remaining for powering the aircraft, and may be constituted by a processor outputting a graphical user interface or a speaker. The second subsystem need not be made of non-programmable, stateless components, at least because the aircraft includes the first battery monitoring subsystem, which also monitors the health of the battery assembly. Thus, a first monitoring subsystem may be comprised of non-programmable, stateless components (e.g., analog or non-programmable combinational logic electronic components) to monitor for catastrophic failure, while one or more feature-rich processors, sequential logic electronic components, or programmable combinational logic electronic components of another first monitoring system may provide redundant monitoring of the same conditions and/or additional monitoring of non-catastrophic or non-hazardous conditions.

A first redundant subsystem in an aircraft may desirably enable certain features of the aircraft to continue to be available even though a second subsystem primarily responsible for certain features may not be functional. Further, where a component primarily responsible for certain features does not provide status or control information to the redundant subsystem, the standby component may be secondarily responsible for those features. This may be beneficial, for example, in the event of a sudden failure of a primary component. The standby component can take over without requiring a switchover.

An aircraft according to the disclosure herein may include a plurality of circuits, each circuit being capable of performing the duties of one or more other circuits of the plurality of circuits. For example, a first circuit of the aircraft may be tasked to be primarily responsible for managing a first set of tasks of the aircraft, while a second circuit of the aircraft may be tasked to be secondarily responsible for the first set of tasks. Similarly, the second circuit may be tasked to be primarily responsible for a second set of tasks for the aircraft, while the first circuit may be tasked to be secondarily responsible for the second set of tasks. If one of the first or second circuits is inoperative, the other of the first or second circuits may take over the responsibilities of the inoperative subsystem. The shared recorder may additionally store data receivable by the first and second circuits from the one or more aircraft components such that the first and second circuits may take over primary responsibility for the one or more tasks based at least on the data stored to the shared recorder and without communication of status information or operational instructions between the first and second subsystems.

The motor of the aircraft may comprise a plurality of field coils. Each of the plurality of field coils may be used to drive the motor during different rotational phases of the motor. However, during use or during the lifetime of the motor, one or more of the individual field coils may fail, which may result in a significant reduction in the average power output by the motor.

The aircraft according to the disclosure may herein have features that improve the usability or operability of the aircraft.

An aircraft monitoring system for an electric or hybrid aircraft is disclosed. The aircraft monitoring system may be configured to enable the electric or hybrid aircraft to pass certification requirements associated with the safety risk analysis. The aircraft monitoring system may have different circuits for monitoring and warning of faults of components of an electric or hybrid aircraft, and faults causing greater safety risks may be monitored and indicated by at least one subsystem that does not rely on programmable components, so that the authentication of this subsystem will be easier. Even if a second subsystem using a programmable component (e.g., a processor or FPGA), for example, redundantly monitors or displays the same fault, the certification requirements for the second redundant subsystem will be mitigated since the second subsystem is redundant.

The aircraft monitoring system may include a first battery monitoring circuit and a second battery monitoring circuit. The second battery monitor may be supported by the housing and comprised of a non-programmable component. The housing may fly and be propelled by an electric motor. The non-programmable component may monitor a power source (such as a battery pack) supported by the housing and output a first alert to notify a first condition associated with the power source. The power source may power the electric motor, and the first condition may be imminent causing a disaster or damage to the housing. The first battery monitoring circuit may be supported by the housing and include a processor and a communication bus. The processor may monitor the power source from communications on the communication bus and output a second alert to notify a second condition associated with the power source.

The aircraft monitoring system of the preceding paragraph may include one or more of the following features: the non-programmable components may be comprised of analog or combinational logic electronic components. The non-programmable components may be comprised of stateless components. At least one subsystem supported by the housing and configured to notify of the catastrophic condition can monitor and notify of the catastrophic condition without using the programmable or stateful components, and the catastrophic condition is likely to be imminent causing a disaster or destruction of the housing. The non-programmable component may activate an indicator supported by the housing to output a first alert, and the indicator may remain inactive unless the indicator is outputting the first alert. The indicator may comprise a light or an audible alarm. The subsystem can handle analog and binary signals but not multi-valued digital signals. The monitoring subsystem may include a plurality of printed circuit boards, and at least a portion of the first subsystem and at least a portion of the second subsystem may be mounted on the plurality of printed circuit boards. The first subsystem may not communicate via the communication bus. The non-programmable component may monitor the component using a first output from a first sensor, and the processor may monitor the component using a second output from a second sensor different from the first sensor. The first sensor and the second sensor may detect a state of the monitored component. The first sensor and the second sensor may measure a temperature of the component. The first sensor and the second sensor may detect an under-voltage condition, an over-voltage condition, an under-current condition, an over-resistance condition, a low resistance condition, a high temperature condition, or a low temperature condition of the monitored component. The first sensor and the second sensor may detect that the monitored component is on fire. The non-programmable component may output a first alert to the processor or another processor supported by the housing, and the processor or another processor may activate the component supported by the housing to attempt to resolve the first condition. The non-programmable component may output a first warning to an electronic device remote from the housing. The non-programmable components and the processor may use a common output from the sensors to monitor the components.

The first monitoring and warning subsystem may include a warning panel (e.g., a light or speaker) configured to present a first warning to the pilot or driver. The first warning may indicate an impending collision of the housing.

The monitored component may include a battery pack. The first condition may be a failure or overheating of the battery pack. The first condition may be a power pack fire. The non-programmable components may include electronics configured to process analog signals.

The invention can be applied to monitoring and warning of different components of an electric or hybrid aircraft. For example, a first monitoring and alarm subsystem may be used to detect alarming catastrophic or dangerous fault conditions of a motor or motor controller, while a second subsystem may be used for redundant monitoring of those catastrophic or dangerous fault conditions, and/or for monitoring and alarming less severe fault conditions, such as greater, lesser, or no safety risk conditions of an electric motor or motor controller. The first monitoring and alarm subsystem may be comprised of non-programmable, stateless components and thus avoids the difficulties of software authentication, while the second monitoring and alarm subsystem may include a processor or other programmable components and output information to a complex display for presentation.

The monitored component may include a motor. The first monitoring and alarm subsystem may monitor various parameters of the motor including, for example, temperature, voltage, current, rotational frequency of the motor, and generate and display an alarm signal in the event of a fault condition of the motor. At least some of those parameters and/or additional parameters of the motor may be monitored by the second monitoring and alarm subsystem.

The monitored component may include a motor controller. The first monitoring and alarm subsystem may monitor various parameters of the motor controller including, for example, temperature, voltage, current, electrical frequency in the motor controller, and generate and display an alarm signal in the event of a fault condition of the motor controller. At least some of those parameters and/or additional parameters of the motor may be monitored by the second monitoring and alarm subsystem.

When a condition associated with a failed component has been detected, the first subsystem may deactivate the component. For example, the first subsystem may deactivate the component when a condition associated with the battery pack, battery cell, motor coil, complete motor, and/or motor controller has been detected.

The first subsystem may leave the deactivated component un-replaced. In other cases, the first subsystem may activate the standby component automatically and without human intervention when a condition related to the primary component has been detected. For example, when a condition associated with a primary counterpart component has been detected, the first subsystem may activate a replacement battery pack, a replacement battery cell, a replacement motor coil, and/or a replacement motor controller.

In the event of a failure of a primary counterpart component, the standby component that is activated may be simpler and less efficient than the primary component.

The standby component may be easier to authenticate than the primary component. The standby component may be processor-less.

A method of operating an aircraft monitoring system for an electric or hybrid aircraft is disclosed. The aircraft monitoring system may be configured to enable the electric or hybrid aircraft to pass certification requirements associated with the safety risk analysis. The method may include:

supporting a first subsystem by a housing, the first subsystem being comprised of non-programmable components, the housing being configured to fly and to be propelled by an electric motor;

monitoring a component supported by the housing with a first subsystem;

outputting, with the first subsystem, a first visual or audible alert to notify any catastrophic or dangerous fault condition associated with the component;

supporting a second subsystem by the housing, the second subsystem including a programmable component;

monitoring a component supported by the housing with a second subsystem;

a second warning is output with the second subsystem to notify of the same or other fault condition associated with the component.

The method of the preceding paragraph may include one or more of the following features: the method may include activating an indicator supported by the housing to output a first alert; disabling the indicator when the non-programmable component is not outputting the first warning; and presenting a second warning on a display supported by the housing.

The non-programmable component may monitor the component using a first output from the first sensor, and the processor may monitor the component using a second output from the second sensor.

The method may include detecting, by a first sensor and a second sensor, an under-voltage condition, an over-voltage condition, an under-current condition, an over-resistance condition, a low resistance condition, a high temperature condition, or a low temperature condition associated with a monitored component.

The method may include deactivating a component responsible for the fault condition in response to the first alert.

The method may include activating a backup assembly supported by the housing to attempt to address the first condition.

The control system of the preceding paragraph may include one or more of the following features: the controller may vary a rotational rate of a motor or a pitch (pitch) of a propeller supported by the housing to compensate for a failure of one or more of the plurality of field coils and maintain the power output despite the failure of the one or more of the plurality of field coils.

The present disclosure provides a plurality of components and systems that can be mixed and matched according to aircraft needs and requirements. Thus, although a number of different components are described below, the components or systems need not all be used together in a single embodiment. Rather, each component or system can be used independently of the other components or systems of the present disclosure.

A method of making or using the modular power system of the preceding three paragraphs is disclosed.

Drawings

FIG. 1A shows an aircraft, such as an electric or hybrid aircraft;

FIG. 1B shows a simplified block diagram of an aircraft;

FIG. 2 shows a management system for operating an aircraft;

FIG. 3 shows a battery monitoring system for an aircraft;

fig. 4 and 5 show an implementation of the battery monitoring circuit;

fig. 6 and 7 show an implementation of a main circuit for monitoring the battery monitoring circuit;

FIGS. 8, 9, 10, 11, 12, and 13 show schematic diagrams of implementations of power management systems;

fig. 14A and 14B show a battery module that can be used in an aircraft;

15A and 15B show a power source formed of a plurality of battery modules;

FIG. 16 shows a plurality of power sources arranged and connected for powering an aircraft;

17A and 17B illustrate a plurality of power sources located in an aircraft nose for powering an aircraft;

18A and 18B illustrate a plurality of power sources located in an aircraft wing for powering an aircraft;

figure 19 shows a motor with multiple field coils; and

fig. 20 shows a process for operating a motor to compensate for a failure of a field coil of the motor.

Fig. 21 shows an aircraft monitoring system for an electric or hybrid aircraft with different subsystems for monitoring and warning of faults of components of the electric or hybrid aircraft; and

fig. 22 shows a process for monitoring different parts of a component in an electric or hybrid aircraft, activating an alarm in case of a fault condition, deactivating a faulty component, and/or activating a backup component.

Detailed Description

Overview of the System

FIG. 1A illustrates an aircraft 100, such as an electric or hybrid aircraft, and FIG. 1B illustrates a simplified block diagram of the aircraft 100. The aircraft 100 includes a motor 110, a management system 120, and a power source 130. The motors 110 may be used to propel the aircraft 100 and fly and sail the aircraft 100. The management system 120 may control and monitor components (devices) of the aircraft 100, such as the motors 110 and the power source 130. The power source 130 may power the motor 110 to drive the aircraft 100 and the management system 120 to enable operation of the management system 120. The management system 120 may include one or more motor controllers and other electronic circuitry for controlling and monitoring various components of the aircraft 100.

FIG. 2 illustrates an assembly 200 of an aircraft, such as aircraft 100 of FIGS. 1A and 1B. The assembly 200 may include a power management system 210, a motor management system 220, and a recorder 230, as well as a first battery pack 212A, a second battery pack 212B, an alarm panel 214, a fuse and relay 216, a converter 217, a cockpit battery pack 218, a motor controller 222, one or more motors 224, and a throttle 226.

The power management system 210, the motor management system 220, and the logger 230 may monitor communications on a communication bus, such as a Controller Area Network (CAN) bus, and communicate via the communication bus. First battery pack 212A and second battery pack 212B may communicate, for example, over a communication bus, such that power management system 210 is able to monitor and control first battery pack 212A and second battery pack 212B. As another example, the motor controller 222 may communicate over a communication bus such that the motor management system 220 can monitor and control the motor controller 222.

Logger 230 may store some or all of the data transmitted over the communication bus (such as component status, temperature, or over/under voltage information from components or other sensors) to a memory device for later reference, such as for reference by power management system 210 or motor management system 220, or for troubleshooting or debugging by maintenance workers. The power management system 210 and the motor management system 220 may each output or include a user interface that presents status information and allows for system configuration. Power management system 210 may control a charging process (e.g., a charging timing, a current level, or a voltage level) of the aircraft when the aircraft is coupled to an external power source to charge a power source of the aircraft, such as first battery pack 212A or second battery pack 212B.

The alarm panel 214 may be a panel that alerts the pilot or another person or computer to a problem, such as a problem associated with a power source, such as the first battery pack 212A. A fuse and relay 216 may be associated with first battery pack 212A and second battery pack 212B and may be used to transfer power to a cockpit battery pack 218 through a converter 217 (e.g., a dc-dc converter). Fuse and relay 216 may protect one or more battery poles of first battery stack 212A and second battery stack 212B from short circuits or overcurrent. The cockpit battery pack 218 may supply power to the communication bus.

The motor management system 220 may provide control commands to a motor controller 222, which may in turn be used to operate one or more motors 224. The motor controller may include an inverter for generating the AC current required to operate the one or more motors. The motor controller 222 may further operate in accordance with instructions from the throttle 226, which may be controlled by the pilot of the aircraft. The one or more motors may comprise electric brushless motors.

The power management system 210 and the motor management system 220 may execute the same or similar software instructions and may perform the same or similar functions as each other. However, the power management system 210 may be primarily responsible for power management functions, while the motor management system 220 may be secondarily responsible for power management functions. Similarly, the motor management system 220 may be primarily responsible for motor management functions, while the power management system 210 may be secondarily responsible for motor management functions. For example, depending on the system configuration, such as one or more memory flags in memory indicating desired functions, the respective functions may be assigned to power management system 210 and motor management system 220. The power management system 210 and the motor management system 220 may include the same or similar computer hardware.

The power management system 210 may automatically perform the motor management function when the motor management system 220 is not operational (such as in the event of a restart or failure of the motor management system 220), and the motor management system 220 may automatically perform the power management function when the power management system 210 is not operational (such as in the event of a restart or failure of the power management system 210). Further, power management system 210 and motor management system 220 may take over functions from each other without communicating operational data, such as data about one or more of the components controlled or monitored by power management system 210 and motor management system 220. This may be because the power management system 210 and the motor management system 220 may monitor communications on the communication bus in unison to generate control information, but the control information may be used if the power management system 210 and the motor management system 220 have primary responsibility and may not be used if the power management system 210 and the motor management system 220 do not have primary responsibility. Additionally or alternatively, power management system 210 and motor management system 220 may also access data stored by recorder 230 to obtain information that may be used to take over primary responsibilities.

System architecture

Electric and hybrid aircraft (rather than aircraft powered by combustion during operation) have been designed and manufactured for decades. However, electric and hybrid aircraft are still not widely used for most transportation applications, such as carrying passengers or cargo.

This failure to be suitable may be due in large part to the fact that it may be very difficult to design an aircraft that is sufficiently secure to be certified by a certification authority. Furthermore, authentication of the prototype may not be sufficient to authenticate it as commercially viable. Instead, each individual aircraft and its components may need to be certified.

The present disclosure provides at least some methods for constructing an electric aircraft from components and systems that have been designed to pass certification requirements, such that the aircraft itself can pass certification requirements and enter into active commercial use.

The authentication requirements may be related to security risk analysis. A condition that may occur to an aircraft or a component thereof may be assigned to one of a plurality of security risk assessments, which in turn may be associated with a particular certification criterion. The condition may be, for example, catastrophic, dangerous, major, minor, or no safety impact. A catastrophic condition may refer to a condition that may result in multiple deaths or losses of the aircraft. A hazardous condition may reduce the ability of the aircraft or the ability of the operator to handle adverse conditions to the extent that there will be a substantial reduction in safety margin or functional capability, a physical distress/excessive workload on the flight crew such that the operator can no longer be relied upon to accurately or fully perform the required task, or a serious or fatal injury to a small number of aircraft occupants (other than the operator), or fatal injury to ground personnel or the general public. The prevailing conditions may reduce the aircraft or operator's ability to cope with adverse operating conditions to the extent that there will be a significant reduction in safety margin or functional capability, a significant increase in operator workload, conditions that impair operator efficiency or cause significant discomfort to aircraft occupants (other than the operator), which may include injury, major occupational disease, major environmental damage, or major property damage. Mild conditions may not significantly reduce system safety such that the action required by the operator is well within its capabilities, and may include a slight reduction in safety margin or functional capability, a slight increase in workload (such as daily flight plan changes), some physical discomfort to aircraft occupants (other than the operator), a slight occupational illness, slight environmental damage, or slight property damage. A condition of no security impact may refer to a condition of no impact on security.

The aircraft may be designed such that the different monitoring and alarm subsystems of the aircraft (such as the battery monitoring circuitry) are constructed to have robustness and potentially any subsystem redundancy corresponding to their responsibilities and any associated certification criteria.

In the event that a potential failure of the responsibilities of the monitoring and alarm subsystems may be catastrophic, the subsystems may be designed to be simple and robust, and thus may be able to meet difficult certification criteria. A subsystem (e.g., a battery, motor, or motor controller monitoring circuit) may be composed of non-programmable, stateless components (e.g., analog or non-programmable combinational logic electronic components) rather than programmable components (e.g., a processor, a Field Programmable Gate Array (FPGA), or a Complex Programmable Logic Device (CPLD)) or stateful components (e.g., sequential logic electronic components), and activates an indicator such as a light rather than a more complex display.

On the other hand, in the event that (i) a monitoring and alarm subsystem of the aircraft, such as a battery monitoring circuit, a motor monitoring circuit, or a motor controller monitoring circuit, redundantly monitors a parameter with another subsystem of the aircraft (which is comprised of non-programmable, stateless components), or (ii) a potential failure of responsibility of such a monitoring and alarm subsystem would likely be less catastrophic or less dangerous, the subsystem may be at least partially digital and designed to be complex, feature-rich, and more easily updatable, and still be able to meet associated certification criteria. Such subsystems may include, for example, a processor or other programmable component that outputs information to a complex display for presentation.

In some implementations, some or all of the catastrophic conditions monitored by the aircraft may be monitored with at least one monitoring and alert subsystem that does not include a programmable or stateful component, as certification of a programmable or stateful component may require statistical analysis of the responsible subsystem, which may be very expensive and complex to certify. Moreover, such implementation may be counterintuitive, at least because the electric or hybrid aerial vehicle may include one or more relatively advanced programmable or stateful components capable of operating the electric or hybrid aerial vehicle, it may be undesirable to include one or more subsystems that do not include any programmable components or any stateful components in the aerial vehicle, because one or more relatively advanced programmable or stateful components may be readily capable of implementing the functionality of one or more subsystems that do not include any programmable components or any stateful components.

An aircraft monitoring system may include a first monitoring and warning subsystem and a second monitoring and warning subsystem. A second subsystem (such as a second battery monitoring circuit) may be supported by the aircraft housing and include non-programmable, stateless components, such as analog or non-programmable combinational logic electronic components. The non-programmable, stateless component may monitor a component (such as a battery cell in a battery pack) supported by the aircraft housing and output a second alert to notify of a catastrophic condition associated with the component. The non-programmable, stateless component may, for example, activate an indicator or audible alarm to output a first warning to the occupant on the housing. The indicator or audible alarm may remain inactive unless the indicator outputs the first warning. Additionally or alternatively, the non-programmable, stateless component may output a second alert to a computer on or remote from the aircraft or an operator of the aircraft via the telemetry system (e.g., to automatically trigger an action to attempt to respond to or address the catastrophic condition, such as stopping charging or activating a fire extinguisher, parachute, or emergency landing procedure or other emergency response feature). Furthermore, a non-programmable, stateless component may not be able to control the component or at least not certain functions of the component, such as controlling a mode or triggering operation of the component.

A first subsystem (such as a first battery monitoring circuit) may be supported by the aircraft housing and include a processor (or another programmable or stateful component) and a communication bus. The processor may monitor the component based on communications on the communication bus and output a first alert to notify of a catastrophic condition or a next catastrophic condition associated with the component. The processor may, for example, activate an indicator or audible alarm to output a first warning to the occupant of the enclosure. Additionally or alternatively, the processor may output a first alert to a computer on or remote from the aircraft or an operator of the aircraft via the telemetry system (e.g., to automatically trigger an action in an attempt to address the catastrophic condition, such as activating a fire extinguisher, parachute, or emergency landing procedure). A processor may control the assembly. The non-programmable, stateless components of the first subsystem may no longer be able to communicate via the communication bus.

The non-programmable, stateless components of the second subsystem may otherwise be unable to communicate via the communication bus. It may not comprise any programmable communication circuitry for allowing communication via such a bus.

Examples of this design and its benefits are described next in the context of a battery management system. It is noted that the design may additionally or alternatively be applied to other systems of the vehicle that perform functions other than battery management, such as motor and motor control.

Battery management examples

Battery packs comprising a plurality of battery cells, such as lithium ion battery cells, may be used in electric automobiles, electric aircraft, and other electric self-powered vehicles. The cells may be connected in series or in parallel to deliver the appropriate voltage and current.

The battery cells in the battery pack may be managed and controlled by a Battery Management System (BMS). The BMS may be a circuit that manages the rechargeable battery cells by controlling charge and discharge cycles of the rechargeable battery cells, preventing them from operating outside their safe operating areas, balancing charge between cells, and the like. The BMS may also monitor battery parameters, such as the temperature, voltage, current, internal resistance, or pressure of the battery cells, and report an abnormality. The BMS may be provided as discrete electronic components by various manufacturers.

Damage to the battery cells can be a very serious accident that can lead to fire, explosion or interruption of the power supply circuit. Thus, any damage to a battery in a vehicle, such as an electric aircraft, is expected to be immediately and reliably reported to the pilot or pilot of the vehicle. Reliable monitoring of the battery cells by the BMS may be critical to the safety of the electric aircraft.

However, the BMS may rarely malfunction, which may cause problems with respect to the battery cells that are not correctly reported. For example, in some cases, an overvoltage or overtemperature condition affects not only the battery cells, but also their BMS, such that a failure of a battery cell is not detected or not correctly reported. Even if the BMS is operating correctly, the connection bus between the BMS and the cockpit can be defective and prevent the warning signal from being transmitted.

To prevent such a risk, the battery cells may be monitored using the second redundant BMS. If two BMSs are of the same type, a defect or conceptual defect affecting one BMS may also affect a redundant BMS such that the gain in reliability is limited. The present disclosure at least provides a method for improving reliability of battery cell fault detection in electric vehicles, such as electric aircraft. Redundant monitoring of each cell parameter may be performed using two different circuits. Since the second redundancy monitoring circuit may include non-programmable, stateless components instead of processors, sequential logic electronic components, or programmable combinational logic electronic components, its authentication may be easier and its reliability may be improved. For example, since the second redundant circuitry may be processor-less, may not include any sequential or programmable combinational logic electronic components, and may not be dependent on any software (e.g., executable program code executed by a processor), authentication thereof may be easier than if the second redundant circuitry was dependent on a processor, sequential or programmable combinational logic electronic components, or software.

The second redundant monitoring circuit may provide redundant monitoring of battery parameters and redundant transmission of those parameters, or provide an alarm signal dependent on those parameters. The second battery monitoring system may transmit an analog or binary signal rather than a multi-valued digital signal. The second battery monitoring circuit may provide monitoring of battery parameters and transmission of parameters or alarm signals, regardless of the charge and discharge of the battery cells. Thus, the second redundant battery monitoring circuit can be made simple, easily verifiable, and reliable.

Fig. 3 shows a battery monitoring system. The system may be used in electric vehicles, such as electric aircraft, large unmanned or unmanned aerial vehicles, electric cars, etc., to monitor the status of a battery cell 1 in one of a plurality of battery packs and report the status or generate an alarm signal in case of a fault.

The battery cells 1 may be connected in series or in parallel to deliver a desired voltage and current. Fig. 3 shows battery cells connected in series. In an electric aircraft, the total number of battery cells 1 may exceed 100 cells. Each of the battery cells 1 may be constituted by a plurality of basic battery cells connected in parallel.

The first battery monitoring circuit may control and monitor the state of each battery cell 1. The first battery management circuit may include a plurality of BMSs 2, each of which BMS2 manages and controls one of the battery cells 1. The BMS2 may be each composed of an integrated circuit (e.g., an application specific integrated circuit) mounted on one of the Printed Circuit Boards (PCBs) 20. One of the PCBs 20 may be used for each battery cell 1 or for a group of battery cells. Fig. 4 shows an exemplary assembly in one of the BMS 2.

The control of the battery cells may include control of their charge and discharge cycles, preventing the battery cells from operating outside their safe operating area, or balancing the charge between different cells.

Monitoring of one of the battery cells 1 by one of the BMSs 2 may include measuring a parameter of one of the battery cells 1 to detect and report its condition and possible dysfunction. The measurement of the parameters may be performed using cell parameter sensors, which may be integrated in one of the BMS2 or connected to one of the BMS 2. Examples of such parameter sensors may include a temperature sensor 21, a voltage sensor 22, or a current sensor. The analog-to-digital converter 23 may convert analog values measured by one or more parameter sensors into multi-valued digital values, such as 8 or 16 bit digital parameter values. The microcontroller 24, which may be part of each of the BMS2, may compare the value to a threshold to detect when the cell temperature, cell voltage, or cell current is out of range.

The BMS2 as the slave may be controlled by one of the plurality of first main circuits 5. In the example of fig. 3, each first main circuit 5 may control four BMSs 2. Each first main circuit 5 may control eight BMS2 or more than eight BMS 2. In other implementations, the first main circuit 5 may control more BMSs and more battery cells. The first main circuit 5 may be connected and communicate through a digital communication bus 55.

The first main circuit 5 may also be connected to a computer 9, which computer 9 collects various digital signals and data transmitted by the first main circuit 5 and may display information related to the battery state and alarm signals on a display 13, such as a matrix display. The display 13 may be mounted in the cockpit of the vehicle so as to be visible to the driver or pilot of the vehicle. Additionally or alternatively, the computer 9 may output information to a computer remote from the aircraft or control the operation of one or more components of the aircraft as described herein.

The BMS2 may be connected to the first main circuit 5 through a digital communication bus such as a CAN bus. The bus driver 25 may interface the microcontroller 24 with the digital communication bus and provide a first electrical isolation 59 between the PCB20 and the first main circuit 5. In one example, the bus drivers of the adjacent BMS2 may be daisy-chained. For example, as shown in fig. 4, the bus driver 25 is connected to the bus driver 27 of the previous BMS and the bus driver 28 of the next BMS.

Each BMS2 and their associated microcontroller may be restarted by switching its power voltage Vcc. The interruption of Vcc may be controlled by the first main circuit 5 through the digital communication bus and the power source 26.

Fig. 6 shows exemplary components of one of the first main circuits 5. One of the first main circuits 5 may include a first driver 51 for connecting one of the first main circuits 5 with one of the BMS2 through a digital communication bus, a microcontroller 50, and a second driver 52 for connecting the first main circuit 5 therebetween and with the computer 9 through a second digital communication bus 55 such as a second CAN bus. A second galvanic isolation 58 may be provided between the first and second main circuits 5, 7 and the computer 9. The second electrical isolation 58 may be, for example, 1500 VDC, 2500 Vrms, 3750 Vrms, or other isolation magnitude. The microcontroller 50, the first driver 51 and the second driver 52 may be powered by a power supply circuit 53 and may be mounted on a PCB 54, one such PCB being provided for each of the first main circuits 5.

Fig. 3 also shows a second battery monitoring circuit, which may be redundant to the first battery monitoring circuit. The second battery monitoring circuit may not manage the battery unit 1. For example, the second battery monitoring circuit may not control the charge or discharge cycle of the battery unit 1. The function of the second battery monitoring circuit may alternatively provide separate, redundant monitoring of each battery cell 1 in the battery pack and send those parameters or warning signals related to those parameters to a pilot or driver or a computer on-board or remote from the aircraft such as described herein. The second battery monitoring circuit is capable of monitoring the state of each of the battery cells 1 independently of the first battery monitoring circuit. The second battery monitoring circuit may comprise one of a plurality of cell monitoring circuits 3 for each battery cell. Furthermore, when one or more battery units may be fully charged and the aircraft's computer continues to charge one or more battery units, the parameter or alarm signal may be used, for example, by a second battery monitoring circuit to stop charging one or more battery units (e.g., by opening a relay to disconnect the power supply).

Fig. 5 shows exemplary components of one of the cell monitoring circuits 3. Each cell monitoring circuit 3 may include a plurality of

cell parameter sensors

30, 31, 32, 33 for measuring various parameters of one of the battery cells 1. The sensor 30 may measure a first temperature at a first location in one of the battery cells and detect an over-temperature condition; sensor 31 may measure a second temperature at a second location in the same battery cell and detect an over-temperature condition; sensor 32 may detect an under-voltage condition in the same battery cell; also, the sensor 33 may detect an overvoltage condition on the same battery cell. For example, an under-voltage condition may be detected when the voltage at the output of one battery cell is below 3.1 volts or another threshold. For example, an overvoltage condition may be detected when the voltage at the output of one battery cell is above 4.2 volts or another threshold. The threshold used may depend on, for example, the type of battery cell 1 or the number of elementary cells in the cell. Thus, each or some of the sensors 30-33 may include a sensor and an analog comparator for comparing the value delivered by the sensor with one or two threshold values and outputting a binary value in accordance with the comparison. In other implementations, other cell parameter sensors, such as over-current detection sensors, may also be used.

Various parameters associated with one of the battery cells 1 may be combined using a combinational logic circuit 35, such as an AND gate (AND). The combinational logic circuit 35 may not include programmable logic. In the example of fig. 5, the binary signals output by the sensors 30, 31 and 32 are combined into a single alarm signal by means of a boolean and gate, which can have a positive value (alarm signal) only in the case where the temperatures measured by the two temperature sensors exceed the temperature threshold and the voltage of the battery is lower than the voltage threshold. In the example of fig. 5, the detection of the overvoltage condition by the sensor 33 may not be combined with any other measures and may be used directly as an alarm signal.

The alarm signal delivered by the combination logic 35 or directly by the parameter sensors 30-33 can be transmitted to the second main circuit 7 through a line 76, which line 7 can be dedicated and distinct from the digital communication bus used by the first battery monitoring circuit. The

optocoupler

36, 37, 38 provides a third electrical isolation 60 between the component 30-38 and the second main circuit 7. The third electrical isolation 60 may provide the same isolation as the first electrical isolation 59, such as 30V isolation, or the third electrical isolation 60 may provide a different isolation than the first electrical isolation 59.

The sensors 30-33 and the combinational logic element 35 may be powered by a power supply circuit 34 that delivers a power voltage Vcc 2. The power supply circuit 34 can be reset from the second main circuit 7 using an ON/OFF (ON/OFF) signal transmitted ON the optocoupler 38.

The sensors 30-33 and the combinational logic element 35 may be mounted on a PCB. One such PCB may be provided for each battery cell 1. The sensors 30-33 and the combinational logic element 35 may be mounted on the same PCB20 as one of the BMS2 of the first battery monitoring circuit.

Fig. 7 shows exemplary components of one of the second main circuits 7. In the example of fig. 5, one of the second main circuits 7 may comprise a combinational logic element 72, which may not comprise programmable logic, for combining alarm signals from different battery cells, such as the over/under temperature alarm signals uv1, uv2, … … or the over voltage signals ov1, ov2, … …, into a combinational alarm signal, such as a total uv (under voltage condition in case of over temperature) alarm signal and a separate over voltage alarm signal ov. Those alarm signals uv, ov may be activated when any battery unit 1 monitored by one of the second main circuits 7 fails. They can be transmitted to the next and previous second

main circuits

74, 75 by means of optical couplers 70, 71 and lines 76 and to the warning display panel 11 in the cockpit of the vehicle for displaying a warning signal to the driver or pilot. The alarm display panel 11 may include a lamp, such as a Light Emitting Diode (LED), for displaying an alarm signal.

With the disclosed design of the cell monitoring circuit 3 and the second main circuit 7, it is possible that no sleep alarm may be detected. For example, if a cable may be broken or the power source is not activated, the alarm panel 11 may correctly show an alarm regardless of the broken cable or the inactive power source. This may be achieved, for example, by using inverting logic, such that the indicator may be activated if the alarm panel 11 does not receive a voltage or current on the alarm line, but deactivated if the alarm panel 11 receives a voltage or current on the alarm line.

One of the second main circuits 7 may be mounted on a PCB. One such PCB may be provided for each second main circuit 7. One of the second main circuits 7 may be mounted on the same PCB 54 as one of the first main circuits 5 of the first battery monitoring circuit.

As can be seen, the second battery monitoring circuit may include exclusively non-programmable, stateless components (such as analog components or non-programmable combinational logic components). The second battery monitoring circuit may be processor-less and may not include any sequential or programmable combinational logic. The second battery monitoring circuit may not run any computer code or be programmable. This simplicity may provide a very reliable second monitoring circuit and may provide simple authentication of the second battery monitoring circuit and the entire system including the second battery monitoring circuit.

The second battery monitoring circuit may be configured to cause any faulty line, component or power source to trigger an alarm. In one example, a "0" on a line that may be caused by the detection of a problem in a cell or by a defective sensor, line, or electronic component may be signaled as an alarm on an alarm panel; the alarm can only be deactivated if all monitored units and all monitoring components are functioning properly. For example, if a voltage comparator or temperature sensor is damaged, an alarm may be triggered.

The computer 9, the display 13 and the warning display panel 11 in the cockpit may be powered by a power source 15 in the cockpit, which power source 15 may be a cockpit battery and may be independent of other power sources used to power one or more other components.

Monitoring and warning about fault conditions in motors or motor controllers of electric and hybrid aircraft

As indicated, the aspects, blocks and circuits that have been described so far in the context of a battery monitoring system may be applied to monitoring and alerting of different components of an electric or hybrid aircraft. For example, a first monitoring and alarm subsystem may be used to detect alarming catastrophic or dangerous fault conditions of a motor or motor controller, while a second subsystem may be used for redundant monitoring of those catastrophic or dangerous fault conditions, and/or for monitoring and alarming with respect to less severe fault conditions, such as greater, lesser, or no safety risk conditions of the motor or motor controller. The first monitoring and alarm subsystem may be composed of non-programmable, stateless components and therefore easier to verify, while the second monitoring and alarm subsystem may include a processor or other programmable components and output information to a complex display 13 for presentation via the computer 9.

Fig. 21 shows an example of a system comprising at least one electric motor 94 for driving a propeller (generating thrust) or a rotor (generating lift) in order to move the aircraft. The at least one motor 94 is controlled by the first motor controller 93A or by the backup motor controller 93B in case of a failure of the first motor controller 93A. The motor controller converts the DC current from the power source 91 to an AC current for powering at least one motor phase.

Many failures of the motor 94 are catastrophic or dangerous conditions because an improperly working motor cannot drive the propeller, or may even damage the propeller or the aircraft. Therefore, there is a need to monitor any such fault condition and alert the pilot or driver. The system includes a first subsystem 300 (e.g., an analog monitoring and alarm subsystem that does not include any programmable components) to detect any such fault conditions. The first subsystem 300 may comprise at least one temperature sensor 304 for monitoring the temperature of the motor, and a position, speed and/or rotational speed sensor 303 for detecting the position, speed, rotational direction and/or rotational frequency of the shaft of the rotor or propeller of the motor. Any fault condition detected by the first subsystem will generate a visual and/or audible alarm through a light or speaker on an alarm display panel 11 in the cockpit, which alarm display panel 11 is connected to the first subsystem 130 through a line 130 (e.g., an analog line). The first subsystem 300 may be located at least partially within the motor controller or entirely external to the motor controller.

Other fault conditions that may be monitored by the first subsystem 300 include a catastrophic or fault condition of the at least one motor controller 93A. Accordingly, parameters of the motor controller(s), such as, for example, temperature, voltage, current, and/or electrical frequency, are monitored by at least one temperature sensor 304 and/or voltage, current, or frequency sensor 305. The first subsystem 300 monitors the signals provided by those sensors, determines if or when a catastrophic condition has occurred, and in the event that a condition has been detected, generates a visual and/or audible alert through a light or speaker on the alert display panel 11 in the cockpit, which is connected to the first subsystem 130 by a line 130 (e.g., an analog line).

By way of example, parameters that may lead to catastrophic failure include overspeed of the propeller or a wrong direction of rotation of the propeller. This may be determined by the first subsystem by determining the phase activation sequence. The speed of the propeller may be measured with a sensor or derived from the phase activation frequency or back emf signal.

The common first subsystem 300 may be used to monitor the at least one motor 94 and the at least one motor controller 93A. Alternatively, a separate first subsystem may be used for at least one motor and at least one motor controller, or for each motor and/or each motor controller.

A second monitoring and alarm subsystem (not shown) is used to redundantly monitor at least some of the above parameters of the motor(s) or motor controller(s), and to monitor other parameters of those motor(s) and motor controller(s). The second subsystem may include programmable components (e.g., a processor) and other programmable components (e.g., sensorless devices for detecting the position, speed, and/or frequency or other parameters of a motor). The second system redundantly monitors for catastrophic or dangerous conditions and monitors for less severe conditions in order to generate an alarm signal via a bus (e.g. a CAN bus) to the on-board computer 9, which displays the alarm signal to the pilot or driver.

In one embodiment, the second subsystem uses at least some of the components of the motor controller with its own sensing and monitoring components for driving the motor. The sensing component sends information and alarms on the digital communication bus and thus may perform at least some of the methods of the second subsystem.

When a condition associated with a failed component has been detected, the first subsystem 300 may deactivate the component. For example, the first subsystem may disable the component when conditions related to the battery pack, battery cell, motor coil, complete motor, and/or motor controller 93A have been detected. In the example of fig. 21, when a condition associated with the motor controller 93A has been detected, the first subsystem may turn off the motor controller via a power switch 302 controlled by line 301.

When a condition related to the primary component has been detected, the first subsystem 300 may activate the backup component. For example, when a condition related to a primary counterpart component has been detected, the first subsystem may activate a replacement battery pack, a replacement battery cell, a replacement motor coil, and/or a replacement motor controller 93A. In the example of fig. 21, the first subsystem may energize the backup motor controller 93B when a condition related to the primary motor controller 93A has been detected, and after the primary motor controller 93A is turned off.

A standby component that is activated in the event of a failure of a primary counterpart component may be simpler and less efficient than a primary component. For example, the backup motor controller 93B may be simpler than the primary motor controller it replaces in the event of a failure. In one example, the primary motor controller 93A operates in field-oriented control and controls the current of the electric motor 94 using vectors representing two orthogonal components of the current, while the backup replacement motor controller 93B uses scalar control of the current. The backup motor controller 93B is therefore less efficient, but it is also easier to validate because it does not require a microprocessor or any other programmable logic to calculate the currents applied to the different phases of the motor 94. Even if the backup motor controller has processors and sensing components, they can be made simpler and easier to verify than those of the primary motor controller.

FIG. 22 illustrates a possible method for monitoring a fault condition of at least one motor and at least one motor controller in the system of FIG. 21.

In step S303, the monitoring and alarm subsystem 300 monitors the rotational frequency (rotational speed) of one of the motors 94 by measuring the frequency of an electrical signal representing the rotational frequency, or the like, of that motor using, for example, an encoder 303 in the motor, on a shaft driven by the motor. In step 310, the rotation frequency is compared to a threshold value in order to detect when the rotation speed is too high.

At step S304A, the monitoring and alarm subsystem 300 determines the phase activation sequence and uses the result to determine when the motor is rotating in the wrong direction at step 311.

At step S305A, the monitoring and alarm subsystem 300 monitors at least one voltage, such as the voltage in the motor 94, the voltage on one of the cables connected to one phase of the motor, or the voltage in one of the motor controllers 93A. At step 312, the voltage is compared to a threshold value to detect when the voltage is too high or outside an expected range.

At step S305B, the monitoring and alarm subsystem 300 monitors at least one current, such as the current in the motor 94, the current in one of the cables connected to one phase of the motor, or the current in one of the motor controllers 93A. In step 313, the current is compared to a threshold to detect when the current is too high or outside an expected range.

In step S304B, the monitoring and alarm subsystem 300 monitors at least one temperature, such as the temperature in the motor 94 or the temperature in one of the motor controllers 93A. In step 314, the temperature is compared to a threshold value in order to detect when the temperature is too high.

Other parameters may be monitored by the first monitoring and alarm subsystem 300 or by another first monitoring and alarm subsystem.

If any of the monitored conditions are present at steps 310 through 314, then at step 315 the first monitoring and warning subsystem 300 generates and displays a visual and/or audible warning on the warning display panel 11 in the cockpit. Also, monitoring and alarms occur without any programmable components between the parameter sensors until the lights or speakers act as an alarm panel.

At step 316, the first monitoring and alarm subsystem 300 may deactivate the faulty component, i.e., the component in which the over-temperature, over-current, over-voltage, or other fault parameter has been detected. In the embodiment of fig. 21, when a controller related fault condition (e.g., over temperature, over current, over voltage, or wrong rotational direction) has been detected, the subsystem 300 may deactivate the failed primary motor controller 93A.

The deactivated component may or may not be replaced depending on the conditions that have been detected and/or depending on other parameters. For example, if an aircraft is able to land properly without a motor, it may be possible to deactivate an improperly functioning motor without replacement.

However, the first monitoring and alarm subsystem 300 may replace the failed component that was deactivated with a spare component at step 317. In the embodiment of fig. 21, the subsystem 300 may replace the disabled failed primary motor controller 93A with a backup motor controller 93B (e.g., a simpler, less efficient motor controller).

The first monitoring and alarm subsystem 300 may also disable the control board of the motor controller and enable the backup control board without software or with a simpler microcontroller with limited software.

Motor and battery system

In electrically driven aircraft, the battery pack may be selected to meet the electrical requirements of various flight modes. During short periods like take-off, the electric motor will utilize a relatively high power. During most of the time, such as in a standard flight mode, the electric motor may utilize relatively low power, but may consume high energy to enable long distance travel. Both of these power utilizations may be difficult to achieve for a single battery.

Using two battery packs with different power or energy characteristics may optimize the use of stored energy for different flight conditions. For example, the first battery pack may be used in standard flight conditions, where high power output may not be required, but high power output may be required. The second battery pack may be used alone or in addition to the first battery pack for flight conditions with high power output requirements, such as takeoff maneuvers.

The power supply system may charge the second battery pack from the first battery pack. This may allow the second battery pack to be recharged during flight after the second battery pack is used for flight conditions where high power output is required. Therefore, the second battery pack may be small, which may save space and weight. Furthermore, this may allow different battery packs to be used for different flight conditions, which optimizes the use of the battery packs.

The power supply system can also charge the second battery pack via at least one motor (which can also be referred to as a transducer, respectively) acting as a generator. This may allow the second battery pack to be recharged during flight or after the second battery pack has been used in flight conditions with high power output requirements. Therefore, the second battery pack may be small, which may save space and weight. Additionally, different battery packs may allow for regenerative braking energy. The braking energy recovered by the generator motor during landing or descent may generate high current that may not be recoverable by the battery pack for long distance travel. For example, by using the second battery pack adapted to receive high power output in a short time, more braking energy can be recovered via the second battery pack than the first battery pack.

The power supply system may further comprise a third battery pack comprising a super capacitor. Since the super capacitor can receive and output a large instantaneous power or high energy in a short duration, the third battery pack can further improve the power supply system in some cases. The supercapacitor may, for example, have a capacitance of 0.1F, 0.5F, 1F, 5F, 10F, 50F, 100F or more, or within a range defined by one of the aforementioned capacitance values.

Fig. 8 to 13 show a plurality of power supply systems.

Fig. 8 shows a power supply system comprising a first battery pack 91, a second battery pack 92, a circuit 90 and at least one motor 94.

The first battery pack 91 and the second battery pack 92 may each store electric energy for driving at least one motor 94. The first battery pack 91 and the second battery pack 92 may have different electrical characteristics. First battery pack 91 may have a higher energy capacity per kilogram than second battery pack 92, and first battery pack 91 may have a higher power capacity (watt-hours) than second battery pack 92. Furthermore, first battery pack 91 may have a lower maximum, rated or peak power than second battery pack 92; first battery pack 91 may have a lower maximum, rated, or peak current than second battery pack 92; alternatively, first battery pack 91 may have a lower maximum, nominal, or peak voltage than second battery pack 92, and more than one or even all of the electrical characteristics of first battery pack 91 and second battery pack 92 may be different. However, only one of the mentioned electrical characteristics may be different, or at least one other characteristic different from the mentioned electrical characteristic may be different. The first battery pack 91 and the second battery pack 92 may have the same electrical characteristics.

The types or material compositions of the battery cells of the first battery pack 91 and the second battery pack 92 may be different. The types or material compositions of the battery cells of the first battery pack 91 and the second battery pack 92 may be the same, but the amount of copper or the arrangement of conductors may be different. In one example, the first battery pack 91 or the second battery pack 92 may be a lithium ion (Li-ion) battery or a lithium-ion polymer (Li-Po) battery. Second battery pack 92 may include a supercapacitor (sometimes referred to as a supercapacitor, ultracapacitor, or Goldcap).

First battery pack 91 may include relatively high energy density battery cells that may store high amounts of watt-hours per kilogram. The first battery pack 91 may include low power battery cells. The first battery pack 91 may provide DC voltage/current/power or may be connected to the circuit 90 via a (two-phase or DC) power source line.

Second battery pack 92 may include relatively low energy density battery cells. The second battery pack 92 may include relatively high power battery cells. The second battery pack 92 may provide DC voltage/current/power or be connected to the circuit 90 via a (two-phase or DC) power source line.

The first battery pack 91 may form an integrated unit of mechanically coupled battery modules, or the first battery pack 91 may be an electrically connected first battery module. Similarly, the second battery pack 92 may form an integrated unit of mechanically coupled battery modules, or the second battery pack 92 may be a second set of electrically connected battery modules. Some or all of the battery modules of each of the first battery pack 91 or the second battery pack 92 may be stored in one or more regions of the aircraft housing, such as within the wing or nose of the aircraft.

The total energy capacity of first battery pack 91 may exceed the total energy capacity of second battery pack 92. For example, the ratio of the total energy capacity of first battery pack 91 to the total energy capacity of second battery pack 92 may be 2:1, 3:1, 4:1, 5:1, 10:1, 20:1, 40:1, or 100:1, or within a range defined by two of the aforementioned ratios.

The power supply system may comprise an external charging interface for charging the first battery pack 91 or the second battery pack 92 when the aircraft is on the ground and connected to a charging station external to the aircraft.

Each, some or one of the at least one motor may be an electric motor. The at least one motor 94 may be connected to the circuit 90. The at least one motor 94 may receive electrical energy/power from the first battery pack 91 or the second battery pack 92 via the electrical circuit 90 to drive the at least one motor 94. For example, the at least one motor 94 may be a three-phase motor, such as a brushless motor, that is connected to the circuit 90 via three-phase AC power lines. However, the at least one motor 94 may alternatively be a different type of motor, such as any type of DC motor or single phase AC motor. The at least one motor 94 may move a vehicle, such as an airborne vehicle, such as an aircraft. The at least one motor 94 may drive a propeller (generating thrust) or a rotor (generating lift). Furthermore, the at least one motor 94 may also function as a generator. As further described herein, the power supply system or at least one motor 94 may include two or more electric motors.

Different ones of the at least one motor 94 may have the same or different characteristics. The at least one motor 94 may be a motor having a first set of windings connected to a first controller 96 and a second set of windings connected to a second controller 97, as shown for example in fig. 12. This may allow the at least one motor 94 to be used as both a generator and a motor, or the at least one motor 94 may be powered from the first controller 96 and the second controller 97. The at least one motor 94 may include a first motor 98 and a second motor 99, as shown, for example, in fig. 11 and 13. The first and

second motors

98 and 99 may be mechanically connected such that the rotors of the first and

second motors

98 and 99 are mechanically coupled, for example, for powering the same propeller or both rotors (as shown in fig. 11 and 13). The first and

second motors

98 and 99 may, for example, drive the same shaft that rotates the propeller or rotor. However, the first and

second motors

98 and 99 may not be mechanically coupled and may drive two different propellers or rotors. The at least one motor 94 may include more than two motors M1, M2, … Mi connected to each other, or a plurality of interconnected motors.

The circuit 90 may be connected to a first battery pack 91, a second battery pack 92, and at least one motor 94.

The circuit 90 may include a controller 93 connected to a first battery pack 91, a second battery pack 92, and at least one motor 94. The controller 93 may be connected to the first battery pack 91 and the second battery pack 92, for example, via two phase or DC power supply lines, or to at least one motor 94 via a three phase power supply line. The controller 93 may convert, or control the power received from the first battery pack 91 or the second battery pack 92 into a motor driving signal for driving the at least one motor 94. The controller 93 may include a power converter (a power converter functioning as an inverter) for converting the DC current of the first battery pack 91 or the second battery pack 92 into a (three-phase) (AC) current for the at least one motor 94. The power converter may handle different input DC voltages (if first battery pack 91 and second battery pack 92 have different DC voltages). If the at least one motor 94 is used as a generator, the power converter may convert the current generated from each phase of the at least one motor 94 into a DC current for loading the first battery pack 91 or the second battery pack 92 (power converter used as a rectifier). The controller 93 may generate motor drive signals for the at least one motor 94 based on user input.

The controller 93 may include more than one controller. Controller 93 may include, for example, a first controller 96 for powering at least one motor 94 from at least one of first battery pack 91 and second battery pack 92, and a second controller 97 for powering at least one motor 94 from at least one of first battery pack 91 or second battery pack 92. The features described for the controller 93 may be applied to the first controller 96 or the second controller 97. Examples of such circuits are shown in fig. 10 to 13. In fig. 10 to 12, a first controller 96 supplies power from the first battery pack 91 to the at least one motor 94, and a second controller 97 supplies power from the second battery pack 92 to the at least one motor 94. The first and

second controllers

96, 97 may power at least one motor 94 as shown in fig. 10, or power at least one motor 94 with different drive windings (or poles) as shown in fig. 12.

As shown in fig. 11 and 13, the first controller 96 may drive the first motor 98, and the second controller 97 may drive the second motor 99. The first controller 96 and the second controller 97 may be flexible and, as shown in fig. 13, drive the first motor 98 or the second motor 99 according to the switching state of the switch 101. The first controller 96 and the second controller 97 may be different. For example, the input DC voltages from first controller 96 and second controller 97 of first battery pack 91 and second battery pack 92 may be different. However, the first controller 96 and the second controller 97 may alternatively be the same.

The circuit 90 may be selected from at least two of the following connection modes. In the first connection mode, the first battery pack 91 can be electrically connected with the at least one motor 94 through the controller 93, and the second battery pack 92 can be electrically disconnected from the at least one motor 94. In the first connection mode, power can flow between the at least one motor 94 and the first battery pack 91, but not between the at least one motor 94 and the second battery pack 92. In the second connection mode, the second battery pack 92 may be electrically connected with the at least one motor 94 through the controller 93, and the first battery pack 91 may be electrically disconnected from the at least one motor 94. In the second connection mode, power may flow between the at least one motor 94 and the second battery pack 92, but may not flow between the at least one motor 94 and the first battery pack 91. In the third connection mode, the first battery pack 91 and the second battery pack 92 can be electrically connected with the at least one motor 94 through the controller 93. In the third connection mode, power can flow between the at least one motor 94 and the first and second battery packs 91, 92. An electrical switch may be used to make this selection between the different connection modes, and the electrical switch may be between the controller 93 and the first and second battery packs 91, 92, in the controller 93, or between the controller 93 and the at least one motor 94. Additional modes of connection are possible if the at least one motor 94 has more than one motor. The first battery pack 91 can be connected to the first motor 98 instead of the second motor 99 (fourth connection mode), or to the second motor 99 instead of the first motor 98 (fifth connection mode), or to the first motor 98 and the second motor 99 (sixth connection mode). The second battery pack 92 can be connected to the first motor 98 instead of the second motor 99 (seventh connection mode), or to the second motor 99 instead of the first motor 98 (eighth connection mode), or to the first motor 98 and the second motor 99 (ninth connection state). The first battery pack 91 and the second battery pack 92 may be connected to the first motor 98 instead of the second motor 99 (tenth connection mode), or connected to the second motor 99 instead of the first motor 98 (eleventh connection mode), or connected to the first motor 98 and the second motor 99 (twelfth connection state). The number of connection modes can be arbitrarily selected. If a third battery pack is additionally available, there can be correspondingly more possible connection modes between the at least one motor and the three battery packs.

The circuit 90 may select from at least two of the following driving modes. In the first driving mode, the at least one motor 94 may be driven by the first battery pack 91 (without using the power of the second battery pack 92). In this first drive mode (which may be referred to as a standard drive mode), the circuit 90 may be in a first connection mode. Alternatively, in the first drive mode, the circuit 90 may also be in the third connected mode with no power flowing from the second battery pack 92 to the at least one motor 94. The standard drive mode may be used when the power consumption of the at least one motor 94 may be low, such as during a stable flight condition, taxi flight, or landing of the aircraft. In the second driving mode (which may be referred to as a high-energy driving mode), the at least one motor 94 may be driven by the second battery pack 92 (without using the power of the first battery pack 91). In this second drive mode, the circuit 90 may be in a second connection mode. Alternatively, in the second drive mode, the circuit 90 may also be in the third motor connection mode with no power flowing from the first battery pack 91 to the at least one motor 94. The second drive mode may be used when the power consumption of the at least one motor 94 may be high, such as during maneuvering, climb flight, or takeoff. In a third driving mode (which may be referred to as a very high energy driving mode), the at least one motor 94 may be driven by the first battery pack 91 and the second battery pack 92 simultaneously. In this third drive mode, the circuit 90 may be in a third connection mode. This third drive mode may be used when the power consumption of the at least one motor 94 may be high, such as during maneuvering, climb flight, or takeoff.

The circuit 90 may include a detector for detecting the power requirements of the current flight mode. The detection may be performed from user input or sensor measurements, such as by measuring the current in the motor input line. The circuit 90 may select the driving mode or the connection mode based on at least the detection result of the detector.

The selection between the connection modes may depend at least on the charge levels of the different battery packs. For example, when the charge amount of the high energy density battery pack is low, a high power battery pack may be used instead of the high energy density battery pack, or in addition to the high energy density battery pack.

The power supply system of fig. 8 to 13 may be configured such that the second battery pack 92 can be charged from the first battery pack 91 via, for example, the circuit 90. Further, the power supply system may be configured such that the second battery pack 92 may be charged from the first battery pack 91 while the first battery pack 91 powers or drives the at least one motor 94.

In fig. 9 to 11, the circuit 90 may electrically connect the first battery pack 91 and the second battery pack 92 for charging. This connection may be stable or may be achieved by a switch that switches between a first battery connection mode in which the first battery pack 91 and the second battery pack 92 are electrically connected and a second battery connection mode in which the first battery pack 91 and the second battery pack 92 are electrically disconnected. As further explained herein, the first battery connection mode may be achieved by connecting the first battery pack 91 and the second battery pack 92 via the charging circuit 95 or via the controller 93 or via one or more other controllers.

In fig. 9, the circuit 90 includes a charging circuit 95 for charging the second battery pack 92 from the first battery pack 91. Charging circuit 95 may control the flow of energy from first battery pack 91 to second battery pack 92 and may transfer energy without transferring energy through controller 93. The charging circuit 95 may include a switch (not shown) for connecting the first battery pack 91 and the second battery pack 92 for charging. Such a switch may have the advantage that the charging process may be controlled by a user or a microprocessor. For example, if full power of the first battery pack 91 is desired to power the at least one motor 94, the process of charging the second battery pack 92 may be automatically interrupted. However, the charging circuit 95 may instead operate without a switch, such that the charging process automatically starts when a certain electrical parameter, like the voltage or capacitance of the second battery pack 92, falls below a certain threshold.

If the voltages of the first battery pack 91 and the second battery pack 92 may be different, the charging circuit 95 may include a DC/DC converter for converting the DC voltage of the first battery pack 91 into the DC voltage of the second battery pack 92. The second battery pack 92 may be charged from the first battery pack 91 while the at least one motor 94 is driven by the first battery pack 91, or when the at least one motor 94 is not powered, such as by the first battery pack 91.

In fig. 10, the second battery pack 92 may be charged by the first controller 96 and the second controller 97. The first battery pack 91 may provide energy and power to the first controller 96, which may convert the energy and power into electrical drive signals for the at least one motor 94. To charge the second battery pack 92, the electrical drive signal from the first controller 96 may be converted by the second controller 97 into a charging signal (DC voltage) for the second battery pack 92. The electrical drive signal from the first controller 96 for the at least one motor 94 may be used simultaneously for charging the second battery pack 92 and for driving the at least one motor 94. This may allow the second battery pack 92 to be charged from the first battery pack 91 while the at least one motor 94 may be driven by an electrical drive signal from the first controller 96. However, the second battery pack 92 may alternatively be charged by the electrical drive signal without simultaneously powering the motor.

Instead of or in addition to electrically connecting the first battery pack 91 with the second battery pack 92 to transfer electrical energy from the first battery pack 91 to the second battery pack 92, the first battery pack 91 may be mechanically connected with the second battery pack 92 to transfer mechanical energy to charge the second battery pack 92 from the first battery pack 91.

In fig. 11, mechanical charging may be accomplished by driving a first motor 98 from a first battery pack 91 (via a first controller 96) and generating energy from a second motor 99 mechanically connected to the first motor 98 and operating as a generator. The energy generated by the second motor 99 may be used to charge the second battery pack 92 (by converting the motor signal generated by the second motor 99 into a charging signal (DC voltage) for the second battery pack 92 via the second controller 97). This may allow the second battery pack 92 to be charged from the first battery pack 91 while the at least one motor 94 is driven by energy from the first battery pack 91.

In fig. 12, mechanical charging may be accomplished by driving at least one motor 94 from a first battery pack 91 (such as by a first controller 96) with a first set of windings of the at least one motor 94 and generating energy from the at least one motor 94 with a second set of windings of the at least one motor 94 that may function as a generator. By converting the motor signal generated by the at least one motor 94 into a charging signal (DC voltage) for the second battery pack 92 via the second controller 97, the energy generated by the second set of windings can be used to charge the second battery pack 92, which can allow the second battery pack 92 to be charged from the first battery pack 91 while the at least one motor 94 is driven by energy from the first battery pack 91. Furthermore, this may enable the second battery pack 92 to be charged from the first battery pack 91 without utilizing a separate circuit, such as a DC/DC converter, that would add weight to the aircraft.

Fig. 13 shows a switch 101 that can be selected from different battery packs or connection modes, as described herein. This may allow the first battery pack 91 to be connected with the second battery pack 92 (first battery connection mode) to charge the second battery pack 92 directly from the first battery pack 91. This may allow first battery pack 91 to be connected to (i) one of first controller 96 or second controller 97, (ii) one of first motor 98 or second motor 99 and second battery pack 92 to be connected to the other of first controller 96 or second controller 97, or (iii) first motor 98 and second motor 99 to mechanically charge second battery pack 92. This may allow selection of the first motor 98 or the second motor 99 to be driven by the first battery pack 91 or the second battery pack 92.

The design of fig. 13 may provide flexibility in the choice of electrical or mechanical charging.

The second battery pack 92 may be charged by at least one motor 94 that may operate as a generator. When the at least one motor 94 operates as a generator, the generation of electricity may be driven by braking energy, such as during descent or landing of the aircraft. As a result, the second battery pack 92 can recover energy without affecting the function of the first battery pack 91 for long distances. When the at least one motor 94 can operate as a generator, the generation of electricity can be driven by the first battery pack 91 to charge the second battery pack 92. The second battery pack 92 may be charged by at least one motor 94 operating as a generator, while the same or another motor of the at least one motor 94 may be driven by energy from the first battery pack 91, such as described, for example, with respect to fig. 11, 12, and 13.

The power supply system may include a third battery pack (not shown). The second battery pack 92 and the third battery pack may have different electrical characteristics. The second battery pack 92 may, for example, have a higher energy capacity than the third battery pack. The second battery pack 92 may have a higher energy density than the third battery pack. Second battery pack 92 may have a lower maximum, rated, or peak power than the third battery pack. Second battery pack 92 may have a lower maximum, rated, or peak current than the third battery pack. Second battery pack 92 may have a lower maximum, nominal, or peak voltage than the third battery pack. The types or material compositions of the battery cells of the second battery pack 92 and the third battery pack may be different or the same. The third battery pack may include a super capacitor. The third battery pack may increase the maximum power that may be delivered or recovered by the power supply system. The power recovered from the braking action by the at least one motor 94 acting as a generator may be recovered immediately to a high recovered power level, for example, in the third battery pack. The third battery pack may be charged from the first battery pack 91 or the second battery pack 92, such as even when the at least one motor 94 may be driven by the power of the first battery pack 91 or the second battery pack 92.

Modular battery system

The power sources in the electric or hybrid aircraft may be modular and may be distributed to optimize weight distribution or to select the center of gravity of the electric or hybrid aircraft, as well as to maximize space usage in the aircraft. Furthermore, the batteries in electric or hybrid aircraft may desirably be designed to be positioned in place of the internal combustion engine so that the aircraft may maintain a similar shape or configuration as conventional combustion powered aircraft and may also be powered by batteries. In such a design, the weight of the battery may be distributed to match the weight of the internal combustion engine to enable the electric or hybrid aircraft to fly similar to a conventional combustion powered aircraft.

Fig. 14A illustrates a battery module 1400 that may be used in an aircraft, such as the aircraft 100 of fig. 1A and 1B. The battery module 1400 may include a lower battery module housing 1410, a middle battery module housing 1420, an upper battery module housing 1430, and a plurality of battery cells 1440. The plurality of battery cells 1440 may together provide output power for the battery module 1400. The lower, middle, or upper

battery module housings

1410, 1420, 1430 may include slots, such as the slot 1422, that may be used to mechanically couple the lower, middle, or upper

battery module housings

1410, 1420, 1430 to one another or to another battery module. A support, such as a support 1424 (e.g., a pin or lock), may be placed in the slot to lock the lower battery module housing 1410, the middle battery module housing 1420, or the upper battery module housing 1430 to each other or to another battery module.

The battery module 1400 may be configured such that the battery module 1400 is uniformly cooled by air. Plurality of battery cells 1440 may include a total of 16 battery cells, wherein the battery cells are each substantially shaped as a cylinder. The lower battery module housing 1410, the middle battery module housing 1420, or the upper battery module housing 1430 may be formed of or include plastic and, when coupled together, have an outer shape that is substantially a rectangular prism. The lower battery module case 1410, the middle battery module case 1420, or the upper battery module case 1430 may be designed together to prevent a fire in the plurality of battery cells 1440 from spreading outside of the battery module 1400.

Battery module 1400 may have a length L1, a width W, and a height H1. The length of L1, the width of W, or the height of H1 may each be 50 mm, 65 mm, 80 mm, 100 mm, 120 mm, 150 mm, 200 mm, 250 mm, or within a range defined by two of the foregoing values or another value that is greater or less than the foregoing values.

Fig. 14B shows an exploded view of the battery module 1400 of fig. 14A. In an exploded view, the board 1450 and circuit board assembly 1460 of the battery module 1400 are shown. Plate 1450 may be copper and may electrically connect multiple cells 1440 in parallel with one another. Plate 1450 may also distribute heat evenly across multiple cells 1440, such that multiple cells 1440 age at the same rate. Circuit board assembly 1460 may transfer power to or from the plurality of battery cells 1440 and includes one or more sensors for monitoring the voltage or temperature of one or more of the plurality of battery cells 1440. The circuit board assembly 1460 may or may not provide electrical isolation of the battery module 1400 from any components that may be electrically connected to the battery module 1400. Each of the plurality of battery cells 1440 may have a height of H2, such as 30 mm, 50 mm, 65 mm, 80 mm, 100 mm, 120 mm, 150 mm, or within a range defined by two of the above values or another value that is greater or less than the above value.

Fig. 15A shows a power source 1500A formed from a plurality of battery modules 1400 of fig. 14A and 14B. The plurality of battery modules 1400 of the power source 1500A may be mechanically coupled to each other. A first side of one battery module 1400 may be mechanically coupled to a first side of another battery module 1400, and a second side of one battery module 1400 opposite the first side may be mechanically coupled to a first side of yet another battery module 1400. The plurality of battery modules 1400 of the power source 1500A may be electrically connected in series with each other. As shown in fig. 15A, the power source 1500A may include seven battery modules 1400 connected to each other. The power source 1500A may have a maximum power output of, for example, between 1 kW and 60 kW during operation, a maximum voltage output of between 10V and 120V during operation, or a maximum current output of between 100A and 500A during operation.

The power source 1500A may include a power source housing 1510 mechanically coupled to at least one battery module. The power source housing 1510 may include an end cap 1512 covering one side of the power source housing 1510. The power source housing 1510 may have a length L2, such as 3 mm, 5 mm, 10 mm, 15 mm, 20 mm, 25 mm, 30 mm, 40 mm, 50 mm, or within a range defined by two of the above values or another value greater or less than the above value. The width and height of the power source housing 1510 may match the length of L1 and the width of W of the battery module 1400.

Power source 1500A may include a power source connector 1520. Power source connector 1520 may be used to electrically connect power source 1500A to another power source, such as another power source 1500A.

Fig. 15B shows a power source 1500B that is similar to the power source 1500A of fig. 15A, but with the end caps 1512 and upper battery module housing 1430 of the battery module 1400 removed. The circuit board assembly 1514 of the power source 1500B is now exposed because the end cap 1512 has been removed. The circuit board assembly 1514 can be electrically coupled to the battery module 1400. The circuit board assembly 1514 may additionally provide electrical isolation (e.g., 2500 Vrms) of the power source 1500B relative to any components that may be electrically connected to the power source 1500B. Including electrical isolation in this manner may, for example, enable grouping of the battery modules 1400 together such that isolation may be provided to a grouping of the battery modules 1400 rather than individual modules of the battery modules 1400 or a subset of the battery modules 1400. This approach may reduce construction costs because isolation may be expensive and a single isolation may be used for multiple battery modules 1400.

Fig. 16 shows a group 1600 of the plurality of power sources 1500A of fig. 15A arranged and connected for powering an aircraft, such as aircraft 100 of fig. 1A and 1B. The plurality of power sources 1500A of the group 1600 can be mechanically coupled or stacked with each other. The plurality of power sources 1500A of the cluster 1600 can be electrically connected to each other in series or in parallel, such as by a first connector 1610 or a second connector 1620 electrically connecting power source connectors 1520 of two of the plurality of power sources 1500A. As shown in fig. 16, a group 1600 may include 10 power sources (e.g., arranged in a 5 row by 2 column configuration). In other examples, a group may also include a lesser or greater number of power sources, such as 2, 3, 5, 7, 8, 12, 15, 17, 20, 25, 30, 35, or 40 power sources.

Grouping the multiple power sources 1500A to form the group 1600 or another different group may allow for flexible configuration of the multiple power sources 1500A to meet various space or power requirements. Furthermore, grouping the plurality of power sources 1500A to form the group 1600 or another different group may permit one or more of the plurality of power sources 1500A to be replaced relatively easily or inexpensively in the event of a failure or other problem.

Fig. 17A shows a perspective view of a nose 1700 of an aircraft, such as the aircraft 100 of fig. 1A and 1B, that includes a plurality of power sources 1710, such as ones of the power sources 1500A, for powering motors 1720 that operate propellers 1730 of the aircraft. Multiple power sources 1710 may be used to additionally or alternatively power other components of the aircraft. The plurality of power sources 1710 may be sized and arranged to optimize weight distribution and space usage around the handpiece 1700. The motor 1720 and the propeller 1730 may be attached to and supported by the frame of the aircraft by a support, which may be a steel tube, and connected by a plurality of fasteners, which are bolts with rubber dampers. Firewall 1740 may provide a barrier between the plurality of power sources 1710 and a rack of the aircraft with a first one of the plurality of power sources 1710. An enclosure constructed of fiberglass, metal, or mineral composite material may surround the plurality of power sources 1710 to protect against water, coolant, or fire.

Fig. 17B shows a side view of the handpiece 1700 of fig. 17A.

Fig. 18A shows a top view of a wing 1800 of an aircraft that includes a plurality of power sources 1810, such as a plurality of power sources 1500A, for powering one or more components of the aircraft. The plurality of power sources 1810 may be sized and arranged to optimize weight distribution and space usage around the wing 1800. For example, multiple power sources 1810 may be positioned within, between, or around a horizontal support beam 1820 or a vertical support beam 1830 of the wing 1800. The relay 1840 may be further positioned in the wing 1800 as shown and housed in a sealed enclosure. The relay 1840 may open if there is no threshold voltage on the circuit breaker panel or if the pilot opens the circuit breaker to shut down the plurality of power sources 1810.

Fig. 18B shows a perspective view of the wing 1800 of fig. 18A.

Multi-coil motor control

An electric or hybrid aircraft may be powered by a multi-coil motor, such as an electric motor, where different coils of the motor power different phases of the modulation cycle of the motor.

As can be seen in fig. 19, motor 1910 can include four different field coils (also sometimes referred to as coils) for generating torque on the rotors of motor 1910. The different field coils may include a first field coil 1902, a second field coil 1904, a third field coil 1906 and a fourth field coil 1908. Each of the different field coils may be independently powered by one or more controllers. The first field coil 1902, the second field coil 1904, the third field coil 1906 and the fourth field coil 1908 may be powered by a first controller 1912, a second controller 1914, a third controller 1916 and a fourth controller 1918, respectively. One or more of the first controller 1912, the second controller 1914, the third controller 1916, and the fourth controller 1918 may be the same controller.

The first controller 1912, the second controller 1914, the third controller 1916, and the fourth controller 1918 may vary the current provided to each of the first field coil 1902, the second field coil 1904, the third field coil 1906, and the fourth field coil 1908 to compensate for a failure of one or more of the field coils (such as one, two, or three). The first controller 1912, the second controller 1914, the third controller 1916, and the fourth controller 1918 may, for example, no longer provide current to coils that have failed and provide additional current to one or more coils that have not failed. The first controller 1912, the second controller 1914, the third controller 1916, and the fourth controller 1918 may attempt to maintain the power output of the motor (e.g., above a threshold) despite a failure of one or more of the field coils.

The first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may determine a failure of one or more of the field coils from one or more sensors monitoring the motor or one or more individual field coils, such as proximate to the motor or one or more individual field coils. The one or more sensors may include a temperature sensor, a current sensor, or a magnetic field sensor, among other types of sensors. For example, where the one or more sensors include at least one temperature sensor, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may determine a failure of one or more field coils from a change in temperature sensed by the temperature sensor (e.g., a decrease in temperature over time or in proximity to different field coils may correspond to a failure of a particular field coil or coils in the motor 1910). Further, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may attempt to operate the motor such that the sensed temperature remains constant within a tolerance. As another example, where the one or more sensors include at least one voltage sensor, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may determine a failure of one or more field coils from a change in voltage sensed by the voltage sensor (e.g., a voltage spike may correspond to a failure of a particular field coil or coils in the motor 1910). As yet another example, where the one or more sensors include at least one magnetic field sensor, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may determine a failure of the one or more field coils from a change in resonance sensed by the magnetic field sensor.

Fig. 20 shows a process 2000 for operating a motor, such as motor 1900, to compensate for a failure of a field coil of the motor. For convenience, the process 2000 is described as being performed by the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 of fig. 19. However, the process 2000 may additionally or alternatively be performed by another processor or electronic circuitry, such as described herein. Process 2000 may advantageously enable fast reaction (e.g., within a few seconds or even faster) to a failure of one or more failed field coils, such that operation of the motor may be quickly adjusted to maintain the power output of the motor despite the failure of one or more field coils.

At block 2002, a fault of a field coil of a motor may be detected. For example, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may detect a failure of one or more of the first field coil 1902, the second field coil 1904, the third field coil 1906, or the fourth field coil 1908 based on a change in electrical coil characteristics, a change in how the field coils are driven, feedback from the motor 1900 regarding its operation, a change in performance of the motor 1900, or an output from a sensor.

At block 2004, a parameter may be set to indicate a failure of the field coil. For example, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may set a parameter in a memory device that indicates a field coil failure.

At block 2006, the drive of the motor may be modulated according to the parameter. For example, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may adjust how to drive a field coil that has failed based on a stored indication that the field coil has failed. The first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may modulate the power input to the motor over time to compensate for a failure of the field coils and increase the power input to one or more of the active field coils during a modulation cycle of the motor to compensate for the failure.

The first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may provide current to all of the first field coil 1902, the second field coil 1904, the third field coil 1906, and the fourth field coil 1908 once in an order prior to providing current to any of the first field coil 1902, the second field coil 1904, the third field coil 1906, and the fourth field coil 1908 another time before a field coil failure. After a field coil failure, the first controller 1912, the second controller 1914, the third controller 1916, or the fourth controller 1918 may no longer provide current to the field coil that has failed, and may increase the current provided to one or more other field coils (such as to the field coil before the failed field coil and after the failed field coil) to compensate for the failure of the field coil.

Additionally or alternatively, the electric or hybrid aerial vehicle may change the rate of rotation of the motor (e.g., revolutions per minute) or the pitch of the propeller of the aerial vehicle (e.g., increase the pitch to increase power output) to compensate for a failure of one or more (such as one, two, or three) field coils, and attempt to maintain the power output of the motor despite the failure of one or more field coils.

Furthermore, the process 2000 may be adapted such that the drive of the motor may be modulated in response to the detection of a failure of the field coil and without storing or referring to the parameters.

Exemplary implementation

A battery monitoring system is disclosed for monitoring and transmitting a parameter related to the state of a battery pack to a driver or pilot of an electric vehicle. The battery monitoring system may include a first battery monitoring circuit and a second redundant battery monitoring circuit. The first battery monitoring circuit may include a plurality of Battery Management Systems (BMS). Each BMS may manage and monitor a different subset of the battery cells in the battery pack. The first battery monitoring circuit may include a digital communication bus to provide a first warning signal to a driver or pilot of the vehicle in the event of a battery pack dysfunction. The second battery monitoring circuit may redundantly monitor the battery pack to provide at least one second warning signal to a driver or pilot of the vehicle in the event of a malfunction of the battery pack. The second battery monitoring circuit may include only analog or combinational logic electronic components.

The battery monitoring system of the preceding paragraph may include one or more of the following features: the second battery monitoring circuit may be a processor-less circuit. The second battery monitoring circuit may include only analog or combinational logic electronic components. The second battery monitoring circuit may transmit only analog or binary signals. The second battery monitoring circuit may transmit signals to the driver or pilot via a communication line other than the digital communication bus. The second battery monitoring circuit may not manage charging and discharging of the battery cell. The first battery monitoring circuit may include a first electronic measurement component and the second battery monitoring circuit may include a second, different electronic measurement component. The first electronic measurement component may measure the temperature of the battery cell, and the second electronic measurement component may measure the temperature of the same battery cell. The first electronic measurement component may detect an under-voltage or over-voltage condition of a battery cell, and the second electronic measurement component may detect an under-voltage or over-voltage condition of the same battery cell. The first and second battery monitoring circuits may share a common set of electronic measurement components for measuring the state of the battery cells. The second battery monitoring circuit may include: a plurality of identical BMSs, each of which controls and monitors one battery cell in the battery pack; and a plurality of main circuits, each of which controls the plurality of BMSs and collects parameters monitored by the plurality of BMS circuits. Each master circuit may include a CAN bus driver circuit. The second battery monitoring circuit may include a plurality of parameter sensors, each sensor generating one or more digital binary parameters based on the state of one of the battery cells. The battery monitoring system may also include a plurality of combinational logic components for combining a plurality of binary parameters associated with one battery cell. The battery monitoring system may also include a plurality of combinational logic components for combining a plurality of binary parameters associated with the plurality of battery cells and generating at least one second alarm signal if one of the battery cells is defective. The battery monitoring system may further include a plurality of Printed Circuit Board (PCB) cards, and one main circuit and one combinational logic component may be mounted on each PCB card. The second battery monitoring circuit may be constructed such that any defective electronic measurement component triggers the second alarm signal.

An electrical power supply system is disclosed that may be used in an electric aircraft for powering a propeller that generates thrust or a rotor that generates lift. The power supply system may include: at least one motor; a first battery pack including high energy density, low power cells; a second battery pack including low energy density, high power cells; a circuit comprising a controller for powering the at least one motor from at least one of the battery packs and for generating a motor drive signal for driving the at least one motor; wherein the power supply system is configured to charge the second battery pack from the first battery pack.

The power supply system of the preceding paragraph may include one or more of the following features: the second battery pack may be charged from the first battery pack. The controller or circuit may transfer power from the first battery pack to the at least one motor at a first time and to the second battery pack, and optionally to the motor, at a second time. The controller or circuit may include a selector for selecting from only the first battery pack; from only the second battery pack; or to select the power supply of at least one motor from both the first and second battery packs. The circuit may include a DC-DC converter for converting current from the first battery pack to current for charging the second battery pack. The power supply system may further include: a first said motor and a second said motor; a first controller circuit for generating a motor drive signal for driving a first said motor; a second controller circuit for generating a motor drive signal for driving a second said motor. The power supply system may further include a switch module connected to the first battery pack, the second battery pack, the first controller, and the second controller for commutating current from the first battery pack to the second battery pack, the first controller, or the second controller at different times. The switching module may commutate current from the second battery pack to the first controller or the second controller at different times. At least one of the motors acts as a generator for charging one of the battery packs. The power supply system may further include a commutator for determining which of the first battery pack and the second battery pack is charged by the generator. The first battery pack and the second battery pack may include Li-ion or Li-Po cells. The power supply system may further comprise a super capacitor for powering said at least one motor, wherein said circuit is capable of powering said at least one motor from at least one of said first battery pack and said second battery pack or from said super capacitor and of charging said second battery pack from said first battery pack or from said super capacitor. At least one of the at least one motor is operable as a generator, the circuit being arranged to charge one of the first battery pack and the second battery pack from the generator when the generator is producing current. The power supply system may further comprise a motor arranged to operate at least at certain times as a motor powered by one battery pack and as a generator for charging another battery pack or supercapacitor. The power supply system may also have two said motors on a single shaft, so that at least at certain times one of the motors acts as a motor supplying power from one battery pack, while the other motor acts as a generator charging the other battery pack. An aircraft may include the power supply system.

An electrical power supply system is disclosed that may be used in an electric aircraft for powering a propeller that generates thrust or a rotor that generates lift. The power supply system may include: at least one motor; a first battery pack including high energy density, low power cells; a second battery pack including low energy density, high power cells; and a circuit comprising a controller for powering the at least one motor from at least one of the battery packs and for generating a motor drive signal for driving the at least one motor. The power supply system is configured to charge the first battery pack or the second battery pack from at least one of the at least one motor operating as a generator.

The power supply system of the preceding paragraph may include one or more of the following features: the power supply system may charge the second battery pack from at least one of the at least one motor operating as a generator. The controller may include: a first controller for supplying power from a first battery pack to the at least one motor and for generating a motor drive signal for driving the at least one motor; and a second controller for charging the second battery pack in accordance with a generator signal generated by one of the motors operating as a generator. The second controller may supply power to the at least one motor from the second battery pack and is configured to generate a motor drive signal for driving the at least one motor. The at least one motor may include an electric motor having a rotor, a first set of windings connected to the first controller to drive the rotor of the electric motor based on a signal from the first controller, and a second set of windings connected to the second controller to generate a generator signal from the rotor of the electric motor to charge a second battery pack. The at least one motor may include a first motor connected to the first controller for driving the first motor based on a signal from the first controller, and a second motor connected to the second controller for generating a generator signal from a second motor of the electric motor to charge the second battery pack. The first motor and the second motor may be mechanically coupled. The power supply system may simultaneously drive at least one motor based on a first battery pack and charge a second battery pack from the motor operating as a generator. The power supply system may also include an ultracapacitor, and the power supply system may charge the ultracapacitor from a motor operating as a generator. The circuit may drive the at least one motor in different drive modes, and the different drive modes may include a first drive mode in which the at least one motor is driven from energy of the first battery pack. The different driving modes may include at least one of: a drive mode in which the at least one motor is driven from the power of the first battery pack and the second battery pack; a drive mode in which the at least one motor is driven from the power of the second battery pack; a drive mode in which the at least one motor is driven from the power of the first battery pack, and in which the second battery pack is charged from the power generated by the motor operating as a generator; a drive mode in which the at least one motor is driven from the power of the first battery pack, and in which the second battery pack is charged from the power generated by the motor operating as a generator; a drive mode in which the first battery pack is charged by power generated by a motor operating as a generator; a drive mode in which the second battery pack is charged by power generated by a motor operating as a generator; a drive mode in which the first battery pack and the second battery pack are charged by power generated by a motor operating as a generator. The power supply system may further comprise a super capacitor, and the different driving modes may comprise at least one of: a drive mode in which the at least one motor is driven from the power of the supercapacitor; a drive mode in which the at least one motor is driven from the power of the supercapacitor and the first or second battery pack; a drive mode in which the at least one motor is driven from the power of the first battery pack or second battery pack, and in which the ultracapacitor is charged from the power generated by the motor operating as a generator; a drive mode in which the supercapacitor is charged by power generated by a motor operating as a generator; a drive mode in which the supercapacitor and the first battery pack or the second battery pack are charged by power generated by a motor operating as a generator. The second battery pack may be charged from the power of the first battery pack. An aircraft may include the power supply system. The motor, which operates as a generator, may be driven by the braking energy of the aircraft.

Additional features and terminology

Although the examples provided herein may be described in the context of an aircraft, such as an electric or hybrid aircraft, one or more features may further apply to other types of vehicles that may be used to transport passengers or cargo. For example, one or more features may be used to enhance the construction or operation of an automobile, truck, boat, submarine, spacecraft, hovercraft, or the like.

As used herein, the term "programmable component" may, in addition to having its ordinary meaning, refer to a component that may process executable instructions to perform operations or may be configured, after manufacture, to perform different operations in response to processing the same input to the component. As used herein, the term "non-programmable component" may refer, in addition to having its ordinary meaning, to a component that may not process executable instructions to perform operations and that may not be configured to perform different operations after manufacture in response to processing the same input to the component.

As used herein, the term "stateful component" may refer to a component that, in addition to having its ordinary meaning, can remember a previous state or event prior to a current state or event. The stateful component may therefore determine an output from the event history rather than just from the current conditions. As used herein, the term "stateless component" may refer to a component that may not remember a previous state or event prior to a current state or event, in addition to having its ordinary meaning. Thus, the stateless component may not determine an output based on the event history, but may determine an output based on the current conditions.

Many other variations in addition to those described herein will be apparent from the present disclosure. For example, some acts, events, or functions of any algorithm described herein can be performed in a different order, added, combined, or omitted entirely (e.g., not all described acts or events are necessary for the practice of the algorithm), according to embodiments. Further, in some embodiments, actions or events may be performed concurrently, rather than sequentially, through multi-threaded processing, interrupt processing, or multiple processors or processor cores, or on other parallel architectures, for example. In addition, different tasks or processes may be performed by different machines or computing systems that are capable of working together.

Unless indicated otherwise, the various illustrative logical blocks, modules, and algorithm steps described herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. The described functionality may be implemented in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

Unless otherwise specified, the various illustrative logical blocks and modules described in connection with the embodiments disclosed herein may be implemented or performed with a machine, microprocessor, state machine, Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A hardware processor may include circuitry configured to process computer-executable instructions or digital logic circuitry. In another embodiment, the processor comprises an FPGA or other programmable device that performs logic operations without processing computer-executable instructions. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. The computing environment may include any type of computer system, including but not limited to a microprocessor-based computer system, a mainframe computer, a digital signal processor, a portable computing device, a device controller, or a compute engine within an appliance, to name a few.

Unless otherwise specified, the steps of a method, process, or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module stored in one or more memory devices and executed by one or more processors, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of non-transitory computer-readable storage medium, media, or physical computer memory known in the art. An exemplary storage medium may be coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The storage medium may be volatile or non-volatile. The processor and the storage medium may reside in an ASIC.

Conditional language, such as, among others, "may," "might," "may," "for example," and the like, as used herein, is generally intended to convey that certain embodiments include certain features, elements, or states, and other embodiments do not include certain features, elements, or states, unless specifically stated otherwise, or otherwise understood in the context of the usage. Thus, such conditional language is not generally intended to imply that a feature, element, or state is in any way required by one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without originator input or prompting, whether such feature, element, or state is included or is to be performed in any particular embodiment. The terms "comprising," "including," "having," and the like, are synonymous and are used inclusively, in an open-ended fashion, and do not exclude additional elements, features, acts, operations, or the like. Furthermore, the term "or" is used in its inclusive sense (and not its exclusive sense) such that, when used in connection with a list of elements, for example, the term "or" indicates one, some, or all of the elements in the list. Further, the term "each," as used herein, in addition to having its ordinary meaning, can also mean any subset of the set of elements to which the term "each" applies.

Claims

1. An aircraft monitoring system for an electric or hybrid aircraft, the aircraft monitoring system having different subsystems for monitoring and warning of a failure of at least one component of the electric or hybrid aircraft, the aircraft monitoring system comprising:

a first subsystem (3 +7+ 11) configured to be supported by a housing configured to fly and propelled by an electric motor (94; 110) and consisting of non-programmable components, wherein the non-programmable components are configured to monitor the components supported by the housing and output a first visual or audible warning to notify any catastrophic or dangerous fault condition associated with the components; and

a second subsystem (2 +9+13+ 55) configured to be supported by the housing and comprising a processor and a communication bus, wherein the processor is configured to monitor the component and output a second visual or audible alert to notify the same and/or other fault conditions associated with the component.

2. The system of claim 1, the first subsystem being arranged to communicate said warning to a pilot or pilot of said aircraft via a circuit (3 +7+ 11) consisting of non-programmable components.

3. The system of any one of claims 1 or 2, the component being a battery pack, the second subsystem comprising at least one programmable battery monitoring system.

4. The system of claim 3, the first subsystem configured to monitor a temperature of battery cells in the battery pack.

5. The system of any one of claims 3 to 4, the first subsystem configured to monitor cells in the battery pack for an under-voltage, an over-voltage, an under-voltage condition, an over-voltage condition, under-current, over-current, excessive internal resistance, and/or high internal resistance condition.

6. The system of any one of claims 1 or 2, the assembly comprising a motor controller (93A) for controlling the electric motor (94).

7. The system of claim 6, the first subsystem being configured for monitoring an electrical frequency, a phase activation sequence, a back emf sequence, a voltage, and/or a current I in the motor controller (93A).

8. The system of any one of claims 6 to 7, the first subsystem being configured for monitoring a temperature in the motor controller (93A).

9. The system according to any one of claims 1 or 2, said assembly comprising one said electric motor (94).

10. The system of claim 9, the first subsystem being configured for monitoring the speed, direction of rotation and/or frequency of rotation and/or position of a rotor in the electric motor (94).

11. The system of any of claims 9 to 10, the first subsystem being configured for monitoring a temperature in the electric motor (94).

12. The system of any one of claims 1 to 11, the first subsystem and the second subsystem comprising a common set of electronic measurement components for measuring the status of the monitored components.

13. The system of any one of claims 1 to 11, the first subsystem comprising a first set of electronic measurement components for measuring a state of the monitored component, the second subsystem comprising a second set of electronic measurement components for measuring a state of the monitored component, the first and second sets being different.

14. The system according to one of claims 1 to 13, the first subsystem comprising only analog and/or combinational logic electronic components.

15. The system of one of claims 1 to 14, the first subsystem transmitting signals for the driver or pilot via a communication line (76) different from the communication bus (55).

16. The system according to one of claims 1 to 15, wherein the second subsystem (2) comprises:

-a plurality of identical component monitoring circuits (20), each circuit monitoring a subset of a set of components of the same type;

-a plurality of main circuits (5), each main circuit controlling a plurality of identical component monitoring circuits (2) and collecting parameters monitored by the plurality of identical component monitoring circuits;

each main circuit (5) comprises a CAN bus driver circuit (51, 52).

17. The system of one of claims 1 to 16, wherein the first subsystem further comprises:

-a plurality of parameter sensors (30-33), each sensor generating one or more digital binary parameters depending on the state of one monitored component.

18. The system according to claim 17, further comprising a plurality of combinational logic components (35) for combining a plurality of said binary parameters and for generating said at least one second alarm signal in case of a condition of one of said components.

19. System according to one of the claims 1 to 18, the first subsystem and/or the second subsystem being arranged for automatically deactivating components presenting a catastrophic or dangerous failure condition.

20. The system of claim 19, the first subsystem and/or the second subsystem being arranged for automatically activating a backup component to replace a deactivated component.

21. A method of operating an aircraft monitoring system of an electric or hybrid aircraft, the method comprising:

monitoring a component supported by the housing with the first subsystem;

outputting a first visual or audible alert with the first subsystem to notify any catastrophic or dangerous fault condition associated with the component;

supporting a second subsystem by the housing, the second subsystem comprising a programmable component;

monitoring the component supported by the housing with the second subsystem;

outputting, with the second subsystem, a second warning to notify other fault conditions associated with the component.