Battery2 and a Redundant BEC

Folks. Blew a BEC today and not sure why. Starting to formulate a theory and wanted to see if anyone could help me think through this before I blow another.

Below is a kindergartner’s drawing of the setup in question. My theory is that perhaps BEC 2 was blown (presumably Voltage Regulator) when BEC 1 was powered by Battery 1 but Battery 2 had not yet been connected. But I don’t believe it yet.

In that scenario, the servo rail would have had +5V from connection d, which would have then provided connection h with 5V even though BEC 2 was not on and running… perhaps some sort of reverse current flow? Although if that theory is correct and you aren’t able to do that safely… then I’m super confused how one would even provide the redundant rail power as described in the wiki with a Zener Diode because unless I wait to make connection h until Battery 2 is connected after Battery 1 then there will always be a chance of plugging one of the batteries in before the other and reverse-biasing (probably not right word forgive me) the output of a BEC.

What do you think? Would plugging in Battery 1 before battery 2 and causing the servo rail to go high before BEC2 is powered cause damage to BEC 2?

For reference, below are the reasons I’ve chosen each connection in the graphic:

-a & e: have to plug battery into power modules
-b: powers the Pixhawk and allows me to remotely monitor Battery 1 Volt/Curr through telemetry
-c: allows battery 1 to now power the ESC/BEC1 for flight (plane)
-d: ESC JR connector must go to servo rail (which then powers the entire rail and servos for PixHawk 2.1)
-f: allows me to remotely monitor Battery 2 Volt/Curr through telemetry, but also serves as a redundant power source in the event that Battery 1 or PowerModule 1 fail (I also have found scarce info online that this is as designed, but I can’t imagine why else there’d be a power2 port… yes I know in this failure mode I’d have no motor… assuming Power1 is priority over Power2 on PixHawk 2.1)
g: passes that battery2 voltage over to BEC 2 so BEC 2 can power a telemetry radio (not shown in graphic)
h: serves as redundancy in the event that Batt 1 or ESC/BEC 1 fail and the servo rail is no longer powered (i.e. without this redundancy if BEC1 fails I can’t manipulate control surfaces to attempt emergency landing)

For anyone stumbling upon this forum with a similar problem… I found the issue. I shouldn’t have applied two BECs to the servo rail without any sort of reverse current protection.

I should have read about the MBR1545CT under the “Advanced Power Supply Configuration” section of the ardupilot wiki linked below: