Fault-Tolerant Electrical Power System Architecture for Aircraft Electric Propulsion

Abstract

To improve the design of high-power electric propulsion systems for aircraft which address one or more of aerospace requirements.SOLUTION: A fault-tolerant design enables a system to continue its intended operation, possibly at a reduced level, rather than failing completely, when some part of the system fails. When a turn-to-turn fault in an AC motor is detected, a motor controller will short three top switches or three bottom switches in an inverter together (effectively shorting associated stator windings) to divert fault current from motor windings to the motor controller, where cooling is available. In addition, when a fault in a motor controller or at an input to the motor controller is detected, the motor controller cuts off power to the motor by issuing a command that causes an upstream contactor with a high-voltage DC bus input to open.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present disclosure generally relates to power conversion systems, and more particularly to power conversion systems for converting direct current (DC) to alternating current (AC). In particular, the present disclosure relates to methods and apparatus for converting DC power to AC power in an aircraft electric propulsion system.

Background Art

[0002] Aircraft having electric propulsion systems (hereinafter "electric aircraft") are equipped with electric motors that convert electrical power into mechanical power. For example, an electric motor can rotate one or more propellers on an aircraft to provide thrust. Electric aircraft can take various forms. For example, an electric aircraft can be an airplane, a rotorcraft, a helicopter, a quadcopter, an unmanned aerial vehicle, or other suitable type of aircraft. In the case of an electric aircraft, the battery is large and designed to supply a large amount of power for propulsion. In one implementation, the battery is connected to a high voltage direct current (HVDC) bus that is also supplied by a generator source. As used in the aerospace industry and herein, the term "high voltage" in the context of direct current means any DC voltage greater than 500V DC Higher DC voltages are typically obtained from the rectification of three-phase 230V AC Power.

[0003] Electric propulsion systems are common in the automotive industry. Many electric propulsion system architectures have been developed for ground vehicles such as electric or hybrid electric cars, buses, and trucks. Most electric propulsion system architectures for ground vehicles are simple and cost-effective, such as those having a single electric motor driven by a single motor controller. The electric propulsion systems of automobiles are often optimized for cost; thus, usually, there is no redundancy in the system. Furthermore, since the vehicle remains firmly positioned on the ground, a failure of the electric propulsion motor or motor controller results in a safe failure state, so redundancy and fault tolerance may not be required in automotive propulsion systems. The loss of propulsion power in a ground vehicle only results in the loss of the ability to accelerate or maintain the vehicle's speed. Therefore, an electric propulsion failure and the loss of an electric motor or motor controller are inherently safe in ground vehicle applications.

Summary of the Invention

Problems to be Solved by the Invention

[0004] Ground electric vehicle architectures are not suitable for aerospace electric propulsion systems for various reasons. These reasons include the much higher electric propulsion power requirements of aircraft compared to automobiles, more stringent vehicle safety requirements, fault tolerance, as well as high availability and reliability constraints. Therefore, it would be beneficial to improve the design of high-power electric propulsion systems for aircraft that address one or more of the above aerospace requirements.

Means for Solving the Problems

[0005] The subject matter disclosed in some detail below relates to a fault-tolerant power system architecture for aircraft electric propulsion. More specifically, systems and methods are disclosed for enabling fault-tolerant operation of an aircraft electric propulsion system. The architecture proposed herein also meets the high-power propulsion requirements against aircraft and aerospace requirements for system controllability and availability.

[0006] The fault-tolerant systems disclosed herein continue to operate in the event of a failure of some components (or one or more of them). The ability to maintain functionality when a part of the system fails is referred to herein as "degradation". Fault-tolerant design allows the system to continue its intended operation, not completely fail, and in some cases at a reduced level, when a part of the system fails.

[0007] The aircraft electric propulsion system disclosed herein includes a motor controller that converts direct current (DC) from a battery to alternating current (AC) to supply power to one or more electric motors. The motor controller includes multiple sets of inverters and respective controllers that control the switch states of the inverters. According to one proposed implementation, if a turn-to-turn fault in the stator winding of an AC motor is detected, the controller of the inverter that supplies power to that winding shorts three upper or three lower power switches of the inverter together (effectively shorting the associated stator winding) to divert the fault current from the motor winding to the motor controller where cooling is available. According to another proposed implementation, when a fault in the motor controller or at the input to the motor controller is detected, the protection circuit shuts off power to the motor by issuing a command to open an upstream contactor having a high-voltage DC bus input.

[0008] Various embodiments of systems and methods for enabling fault-tolerant operation of an aircraft electric propulsion system are described in some detail below, and one or more of those embodiments may be characterized by one or more of the following aspects.

[0009] One aspect of the subject matter disclosed in detail below is a method for fault-tolerant operation of an aircraft electric thruster, the method comprising detecting a turn-to-turn fault in one of the first, second, and third windings on a stator of an AC motor receiving an AC power signal having first, second, and third phases respectively from first, second, and third power switches of a motor controller; and in response to detection of the turn-to-turn fault, shorting the first, second, and third power switches together. According to one embodiment, the method further comprises reporting the turn-to-turn fault to an electronic propulsion controller configured to operate in a degraded mode by reconfiguring the motor controller, and reconfiguring the motor controller to operate in the degraded mode in response to the reporting.

[0010] Another aspect of the subject matter disclosed in detail below is a method for fault-tolerant operation of an aircraft electric thruster, the method comprising detecting a fault in or at an input of a motor controller configured and connected to convert DC power from a DC bus to AC power for the AC motor; and in response to detection of the fault, opening the first, second, and third power switches together. According to one embodiment, the method further comprises opening a contact disposed between the DC bus and the motor controller in response to detection of the fault.

[0011] Further aspects of the subject matter disclosed in detail below are methods for fault-tolerant operation of an aircraft electric propulsion unit, the methods comprising monitoring the operation of an AC motor and of a motor controller configured and connected to convert DC power from a DC bus into AC power for the AC motor; detecting a fault during the monitoring; in response to the detection of the fault, opening a contact disposed between the DC bus and the motor controller; determining the fault type of the fault; and commanding the inverter of the motor controller into a safety state mode depending on the fault type.

[0012] According to one embodiment of the method described in the immediately preceding paragraph, the fault type is a turn-to-turn fault in the stator windings of the AC motor, and the safety state mode is to short-circuit the first, second, and third power switches of the motor controller together. According to another embodiment, the fault type is a differential protection fault of the motor controller, and the safety state mode is to open the power switch of the motor controller.

[0013] Yet another aspect of the subject matter disclosed in detail below is a system comprising a DC power supply, a DC bus connected to receive DC power from the DC power supply, a motor controller connected to receive DC power from the DC bus, and an AC motor connected to receive AC power from the motor controller. The AC motor comprises a rotor, a stator, a first winding at a first angular position on the stator, a second winding at a second angular position on the stator different from the first angular position, and a third winding at a third angular position on the stator different from the first and second angular positions. The motor controller comprises an inverter connected to receive DC power from the DC bus and to supply AC power to the first, second, and third windings, and a controller that performs an operation including: (a) controlling first, second, and third switches in the inverter such that three-phase AC power is sequentially supplied to the first, second, and third windings during system operation; (b) detecting a turn-to-turn fault in one of the first, second, and third windings during system operation; and (c) in response to the detection of the turn-to-turn fault, shorting the first, second, and third power switches together.

[0014] Further aspects of the subject matter disclosed in detail below are an aircraft comprising a DC power source, a DC bus connected to receive DC power from the DC power source, and an electric propulsion unit connected to receive DC power from the DC bus. The electric propulsion unit comprises a motor controller connected to receive DC power from the DC bus, an AC motor connected to receive AC power from the motor controller, and a propeller having a shaft coupled to a rotor of the AC motor operably coupled to the AC motor. The AC motor comprises a rotor, a stator, a first winding at a first angular position on the stator, a second winding at a second angular position on the stator different from the first angular position, and a third winding at a third angular position on the stator different from the first and second angular positions. The motor controller comprises an inverter connected to receive DC power from the DC bus and connected to supply AC power to the first, second, and third windings, and a controller that performs operations including: (a) controlling first, second, and third switches in the inverter such that three-phase AC power is sequentially supplied to the first, second, and third windings during system operation; (b) detecting a fault in the motor controller or an input section to the motor controller during system operation; and (c) in response to detection of the fault, opening the first, second, and third power switches together.

[0015] Other aspects of systems and methods for enabling fault tolerant operation of aircraft electric propulsion systems are disclosed below.

[0016] The forms, functions, and advantages discussed in the previous section may be achieved independently in various embodiments or may be combined in still other embodiments. Various embodiments are described below with reference to the drawings for purposes of illustrating the above and other aspects.

Brief Description of the Drawings

[0017]

Figure 1A

Figure 1B

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

DETAILED DESCRIPTION OF THE INVENTION

[0018] In the following, reference is made to the drawings in which like elements are assigned the same reference numerals in different drawings.

[0019] Exemplary embodiments of systems and methods for enabling fault-tolerant operation of an aircraft electrical propulsion system are described in some detail below. However, not all forms of actual implementation are described in this specification. Those skilled in the art will recognize that in the development of such embodiments, numerous implementation-specific decisions may vary from implementation to implementation in order to achieve the developer's specific goals, such as compliance with system-related and business-related constraints. Further, such development efforts are complex and time-consuming, but will be understood to be routine work for those skilled in the art who benefit from this disclosure.

[0020] One type of power conversion system (hereinafter, "power conversion system") is a system of one or more devices used to convert direct current (DC) to alternating current (AC). In certain systems, a centralized power conversion system can be used to interface a DC power source with various DC and AC distribution buses. For example, an aircraft power generation and distribution system can use a centralized power conversion system to interface a low-voltage DC power source with various DC and AC distribution buses. The low-voltage DC power source can be, for example, a fuel cell, a battery pack, a solar panel, or some other type of power source.

[0021] The power conversion system can include, for example, a converter for increasing, i.e., boosting, the voltage level of a low-voltage DC power source to form a high-voltage DC (HVDC) power source. As used herein, a converter is an electrical or electromechanical device used to change the voltage level of a DC current power source. In the context of the aerospace industry and as used herein, the term "high voltage" in the context of direct current means any DC voltage greater than 500V DC and higher.

[0022] Next, the high-voltage DC current power supply formed by the converter can be supplied to the inverter of the power conversion system to form a high-voltage AC power supply. An inverter is a power electronic device or circuit that converts direct current to alternating current. In one simple inverter circuit, the DC power is connected to a transformer through the center tap of the primary winding. The switch is rapidly switched back and forth to allow current to flow back to the DC power supply by following two alternating paths through one end and then the other end of the primary winding. The alternation of the direction of the current in the primary winding of the transformer generates an alternating current in the secondary circuit. Transistors and other types of semiconductor switches can be incorporated into the inverter circuit design.

[0023] Inverters can take various forms including, but not limited to, single-phase inverters and three-phase inverters. Three-phase inverters (hereinafter referred to as "3-phase inverters") are used in high-power applications such as variable frequency drive applications and / or AC power transmission. A basic 3-phase inverter consists of three single-phase inverters, each of which consists of two switches in series with a center point connected to one of the three load terminals. In the most basic control method, the operation of the six switches of the three-phase leg is adjusted such that one switch operates at each 60-degree point of the basic output waveform. This creates a line-to-line output waveform with six steps. The six-step waveform has zero-voltage steps between the positive and negative parts of the square wave so that harmonics that are multiples of three are removed as described above. When carrier-based PWM technology is applied to the six-step waveform, the basic overall shape or envelope of the waveform is maintained such that the third harmonic and its multiples are canceled out. To construct an inverter with a higher power rating, two six-step three-phase inverters can be connected in parallel for a higher current rating or in series for a higher voltage rating. In either case, the output waveforms are phase-shifted to obtain a twelve-step waveform. When additional inverters are combined, an eighteen-step inverter can be obtained using three inverters, etc. Inverters are usually combined for the purpose of increasing the voltage or current rating, but the quality of the waveform is also improved.

[0024] The fault-tolerant power system architecture, which will be described in some detail below, can be employed in aircraft having different electric propulsion system configurations. For purposes of illustration, an example of an electric motor power system that can be adapted to incorporate the fault-tolerant form proposed herein will be described with reference to FIGS. 1A and 1B, which show a system for supplying power to a 3×3-phase AC motor having a particular stator winding configuration. However, it should be understood that the innovative fault-tolerant form disclosed herein may be incorporated into systems for supplying power to AC motors having other stator winding configurations.

[0025] FIGS. 1A and 1B are respective interconnected portions of a diagram representing a system that includes a motor controller 50 (seen in FIG. 1A) for supplying power to an AC motor 20 (seen in FIG. 1B). The motor controller 50 has three channels connected in parallel to a DC bus 38. Also, a DC power source 18 (e.g., a battery or other non-ideal DC power source) is connected to the DC bus 38. The system shown partially in FIGS. 1A and 1B can be used to drive the rotation of a propeller (not shown in FIGS. 1A and 1B).

[0026] As seen in FIG. 1A, the three channels of the motor controller 50 each include a respective controller 12a - 12c communicatively coupled to receive control signals from, and transmit feedback signals to, an electric propulsion controller 10 (hereinafter, “EPC10”). The EPC10 serves to oversee and regulate all of the controllers 12a - 12c. The operation of the DC power source 18 may be controlled and managed by a control and management system and may interact with the EPC10 (neither form is shown in FIG. 1A).

[0027] The three channels of the motor controller 50 further include respective front-end signal conditioning circuits 14a to 14c (hereinafter, "front-end circuits 14a to 14c") that receive DC power signals from the DC bus 38 via respective DC power lines 4. The front-end circuits 14a to 14c can include any one or a combination of two or more of a boost or buck converter, a filter network, a protection circuit, or a contactor-type device.

[0028] The three channels of the motor controller 50 further include respective three three-phase inverters 16a to 16c (hereinafter "inverters 16a to 16c") that receive the regulated DC power signals from the respective front-end circuits 14a to 14c. The front-end circuits 14a to 14c and the inverters 16a to 16c are connected in parallel to the 3×3-phase AC motor 20. The operation of the inverters 16a to 16c is respectively controlled by controllers 12a to 12c, and the controllers 12a to 12c transmit switch control signals to the inverters 16a to 16c via the switch signal lines 7 and receive switch state signals from the inverters 16a to 16c.

[0029] According to one proposed implementation, each of the inverters 16a to 16c includes a switch system, a set of inductors, a set of capacitors, and an electromagnetic interference filter. The switch system can include a different number of switches (hereinafter, "power switches") depending on the type of inverter. Each of the power switches can be implemented using, for example, but not limited to, a bipolar transistor device, a metal oxide semiconductor field effect transistor (MOSFET) device, an insulated gate bipolar transistor device, or some other type of semiconductor device or switching device.

[0030] In the embodiments shown in FIGS. 1A and 1B, the controllers 12a to 12c control the operations (switching) of the inverters 16a to 16c so that the switching in the inverters 16a to 16c is interleaved. The inverters 16a to 16c output respective sets of three AC power signals having respective phase angles that are 120 degrees different, and these sets of AC power signals have phase angles that are 40 degrees different. As a result, nine AC power signals are generated in which the respective phase angles are 40 degrees different. For example, the inverter 16a can generate AC power signals having respective phase angles of 0 degrees, 120 degrees, and 240 degrees, the inverter 16b can generate AC power signals having respective phase angles of 40 degrees, 160 degrees, and 280 degrees, and the inverter 16c can generate AC power signals having respective phase angles of 80 degrees, 200 degrees, and 320 degrees. As used herein, the modifier "interleaved" refers to the fact that the inverters 16a to 16c are switched in an alternating sequence to generate interleaved AC power signals in the following sequence: 1A→2A→3A→1B→2B→3B→1C→2C→3C (where the numbers 1, 2, and 3 respectively indicate the three inverters 16a to 16c, and the letters A, B, and C respectively indicate the respective phases of the designated inverters).

[0031] In the example shown in FIG. 1B, the AC motor 20 is a 3×3-phase AC motor. As can be seen in FIG. 1B, the AC motor 20 receives AC power from the inverters 16a - 16c via the AC power lines 6. The AC motor 20 includes a rotor 30 attached to a shaft 32 and a stator 36 separated from the rotor 30 by an air gap 28. The stator has an outer diameter 24 and an inner diameter 26. The stator 36 has a number of windings 22. More specifically, the windings 22 include three winding groups 21A - 21C arranged at respective angular positions on the stator 36. The rotor 30 has a number of windings (not shown) or a permanent magnet array, and this winding or permanent magnet array interacts with the magnetic field generated by the stator windings to generate a force to rotate the shaft 32. The AC motor 20 further includes a speed and position sensor 34 that detects the rotational speed and position of the rotor 30 and transmits speed and position signals 40 to the controllers 12a - 12c.

[0032] More specifically, each of the winding groups 21A - 21C includes first, second, and third windings that receive respective AC power signals having different phases from the respective inverters 16a - 16c. As can be seen in FIGS. 1A and 1B, the inverter 16a outputs three-phase AC power signals 1A, 1B, and 1C that are respectively supplied to each winding 22 of the winding group 21A via a first subset of the AC power lines 6; the inverter 16b outputs three-phase AC power signals 2A, 2B, and 2C that are respectively supplied to each winding 22 of the winding group 21B via a second subset of the AC power lines 6; and the inverter 16c outputs three-phase AC power signals 3A, 3B, and 3C that are respectively supplied to each winding 22 of the winding group 21C via a third subset of the AC power lines 6.

[0033] Referring again to FIG. 1A, the motor controller 50 further includes a plurality of pairs of sensors 5 that measure the voltages and currents of the three-phase AC power signals 1A-1C, 2A-2C, and 3A-3C respectively output by the inverters 16a-16c. A pair of sensors 5 includes a voltage sensor for measuring the voltage of the AC power signal and a current sensor for measuring the current of the AC power signal. Typical voltage sensors can include Hall effect sensors, resistive or capacitive voltage dividers, electronic sensors, etc.; typical current sensors can include Hall effect sensors, transformer types, resistor current sensors, electronic sensors, etc. The measured three-phase voltage and current signals representing the measured voltage and current of the AC power signal output by the inverter 16a are fed back to the controller 12a; the measured three-phase voltage and current signals representing the measured voltage and current of the AC power signal output by the inverter 16b are fed back to the controller 12b; the measured three-phase voltage and current signals representing the measured voltage and current of the AC power signal output by the inverter 16c are fed back to the controller 12c. Thus, each feedback signal of the controllers 12a-12c consists of three voltages and three currents. The controllers 12a-12c are configured to control the switching in the inverters 16a-16c according to an interleaved switching method that reduces current ripple.

[0034] FIGS. 1A and 1B show how the stator windings interact with the control system to perform an interleaved operation. However, the technology disclosed herein is not intended for use with a specific stator winding design. Each of the motor windings can represent n pairs of windings that are appropriately assigned, oriented, and distributed on the stator, where n≧1. The motor stator windings can be concentrated or distributed. By convention, each pair of three-phase stator windings is Y-connected.

[0035] The example of the AC motor 20 shown in FIG. 1B is in effect a nine-phase AC motor (nine AC phases having the same amplitude and sequentially shifted by 40 degrees each). The first group of windings 21A receives the modulated AC power signals 1A, 1B, and 1C, which are continuously separated by 120 degrees, in the same manner as a typical single three-phase AC motor. Although the windings distributed by the method disclosed herein can be applied, it should be noted that FIG. 1B shows only concentrated windings for convenience. The second group of windings 21B receives the modulated AC power signals 2A, 2B, and 2C; the third group of windings 21C receives the similarly modulated AC power signals 3A, 3B, and 3C. There is no physical phase shift (difference in angular position) in any one of the windings of the winding groups 21A - 21C.

[0036] The controllers 12a - 12c may be implemented using hardware or using hardware in combination with software. For example, the controllers 12a - 12c may be implemented using configurable hardware, a programmable device, or both. Configurable hardware can include hardware configurable to perform one or more functions of the controller. A programmable device can include any device programmable to perform one or more functions of the controller. For example, without limitation, a programmable device can include a programmable microcontroller or a digital signal processor. The programmable device may be configured to execute software or firmware in the form of program instructions to perform one or more functions of the controller. The program instructions may be stored in any suitable non-transitory tangible computer-readable storage medium for use by or transfer to the programmable device.

[0037] For aircraft electric propulsion, the present disclosure proposes an architecture that uses a single thruster equipped with an electric motor designed with redundant fault-tolerant windings (see, e.g., FIG. 2) or multiple motor controllers and multiple motors and thrusters (see, e.g., FIG. 3). In the latter case, multiple battery sources can also be used to improve the availability of the system.

[0038] FIG. 2 is a diagram representing an aerospace electric propulsion system architecture having a single thruster 15 according to one embodiment. The thruster 15, partially shown in FIG. 2, includes a motor controller 50, an AC motor 20 controlled by the motor controller 50, and a propeller 46 driven to rotate by the AC motor 20. The propeller 46 includes a propeller shaft 44 mechanically coupled to the AC motor 20 and a plurality of propeller blades 45. The motor controller 50 has three channels for supplying AC current to each set of stator windings in the AC motor 20 (e.g., an AC motor of the type shown in FIG. 1B). One of the channels of the motor controller 50 can be disabled in case of a fault, and the other channels continue to operate. Such a configuration is referred to herein as a degraded mode of operation of the electric propulsion system. As will be described in more detail below, each channel of the motor controller 50 includes a respective controller (see controllers 12a - 12c) and a respective inverter (see inverters 16a - 16c) having a power switch whose state is controlled by the respective controller.

[0039] In the embodiment shown in FIG. 2, the DC power source is the battery string 18a. The battery string 18a is connected to the DC bus 38 via the battery contact 9h and the DC power line 4. The three channels of the motor controller 50 are connected to the DC bus 38 via their respective motor controller contacts 9a-9c and their respective DC power lines 4. The motor controller 50 converts the DC power output by the battery string 18a into the AC power of the AC motor 20. More specifically, the polyphase AC currents from the inverters 16a-16c flow through their respective windings 22 of the AC motor 20.

[0040] A battery string or bank is composed of a plurality of cells / batteries connected in series and generates a battery or battery string having the required available voltage / potential. The operation of the battery string 18a is managed by the battery management system 48 (BMS 48 in FIG. 2). A plurality of parallel battery strings can provide redundancy in the event of an internal pack failure. The battery management system 48 may be configured to ensure redundant protection of the battery string, fail-safe operation, and selective shutdown. The battery management system 48 may be further configured to provide overcharge protection for the battery or to prevent other events or combinations of events that could lead to thermal runaway of the battery.

[0041] In the embodiment partially shown in FIG. 2, the motor controller 50 includes three inverters 16a-16c that receive DC power signals from the DC bus 38. The inverters 16a-16c are connected in parallel to the windings 22 of the AC motor 20. The operation of the inverters 16a-16c is respectively controlled by the controllers 12a-12c, and the controllers 12a-12c transmit switch control signals to the inverters 16a-16c via the switch signal lines and receive switch state signals from the inverters 16a-16c. The inverters 16a-16c convert the DC power from the DC bus 38 into polyphase AC power for the AC motor 20.

[0042] The three inverters 16a - 16c receive DC power signals from the DC bus 38 via their respective motor controller contacts 9a - 9c. Similarly, the DC bus 38 receives a DC power signal from the battery string 18a via the battery contact 9h. A contact is an electrically controlled switch used to switch an electrical circuit. Contacts are designed to be directly connected to high - current load devices. The switching states of the motor controller contacts 9a - 9c and the battery contact 9h are controlled by respective circuits (not shown in Figure 2) having a lower power level than the switching circuit.

[0043] As seen in Figure 2, the electric propulsion system further includes an EPC 10 that receives pilot thrust and pitch inputs from the thrust control lever 56 and the pitch control lever 57. (The control levers are also called "inceptors".) The EPC 10 monitors and adjusts the operation of the controllers 12a - 12c based on information from sensors and pilot inputs. The EPC 10a and 10b also interface with the battery management system 48. The EPC 10 sends a digital torque control signal to the motor controller 50 and an analog pitch control signal to the governor 42. The governor 42 may be a constant - speed propeller governor configured to keep the propeller rpm constant by changing the propeller blade pitch. A hydraulic governor achieves this by using a hydraulic valve 54 to control the flow of engine oil through a hydraulic mechanism within the propeller 46.

[0044] EPC10 has two channels A and B. Controllers 12a - 12c are communicatively coupled to receive a control signal from either channel A or channel B and send a feedback signal back to EPC10. More specifically, channels A and B of EPC10 may be redundant for some signals to improve availability, but may also transmit different or unique signals via each channel. The exact layout of the signal interfaces for each channel is not important for the innovative form described in the appended claims. The layout may be done differently and may depend on many factors. Generally, channels A and B do not need to be completely redundant, i.e., they do not need to carry exactly the same signals. They can carry different signals, but can optionally also be used for redundancy. For example, one signal representing speed A is available from the motor speed and position sensor 34 shown in FIG. 1B, and in the specific example shown in FIG. 2, another signal representing speed B is available from the propeller speed sensor 35. To improve availability, it is possible to read speed A via one channel and speed B via another channel. However, some other signals, such as an analog pitch control signal, may be transmitted only via channel A and not via channel B. Similarly, the signal for controlling the hydraulic valve 54 of the governor 42 may be transmitted via one channel but not via the other. The exact selection of which signals need to be redundant and which do not depends on the aircraft - level architecture (e.g., single or multiple engines) and the importance of each signal. These details are not necessary to understand the innovative fault - tolerant technology disclosed herein.

[0045] FIG. 3 is a diagram representing an aerospace electric propulsion system architecture having a plurality of distributed thrusters 15a and 15b according to another embodiment. Each of the thrusters 15a and 15b may have the same structure and function as the thruster 15 described above with reference to FIG. 2.

[0046] The thruster 15a includes a first battery string 18a, a first DC bus 38a electrically coupled to the first battery string 18a via a battery contact 9h and a DC power line 4, a first motor controller 50a having three channels electrically coupled in parallel to the first DC bus 38a via motor controller contacts 9a - 9c and a DC power line 4, a first AC motor 20a electrically coupled to the first motor controller 50a, and a first propeller 46a having a first propeller shaft 44a mechanically coupled to the first AC motor 20a. The motor controller 50a includes three inverters 16a - 16c that receive a DC power signal from the DC bus 38. The inverters 16a - 16c are connected in parallel to the windings 22 of the AC motor 20a. The operation of the inverters 16a - 16c is controlled by controllers 12a - 12c. The inverters 16a - 16c convert DC power from the DC bus 38a into polyphase AC power for the AC motor 20a. The thruster 15a further includes an EPC 10a that supervises and adjusts the operation of the controllers 12a - 12c based on information from sensors and pilot inputs. Also, the EPC 10a interfaces with a battery management system 48a.

[0047] Similarly, the thruster 15b includes a second battery string 18b, a second DC bus 38b electrically coupled to the second battery string 18b via a battery contactor 9i and a DC power line 4, a second motor controller 50b having three channels electrically coupled in parallel to the second DC bus 38b via motor controller contacts 9d-9f and the DC power line 4, a second AC motor 20b electrically coupled to the second motor controller 50b, and a second propeller 46b having a second propeller shaft 44b mechanically coupled to the second AC motor 20b. The motor controller 50b includes three inverters 16d-16f that receive a DC power signal from the DC bus 38b. The inverters 16d-16f are connected in parallel to the windings 22 of the AC motor 20b. The operation of the inverters 16d-16f is controlled by controllers 12d-12f. The inverters 16d-16f convert DC power from the DC bus 38b into polyphase AC power for the AC motor 20b. The thruster 15b further includes an EPC10b that supervises and adjusts the operation of the controllers 12d-12f based on information from sensors and pilot inputs. The EPC10b also interfaces with a battery management system 48b.

[0048] The first and second DC buses 38a and 38b are electrically coupled by a bus contactor 9g that can be opened to electrically couple the motor controller 50a to the battery string 18b or to electrically couple the motor controller 50b to the battery string 18a if one of the battery strings fails.

[0049] According to the architecture shown in FIGS. 2 and 3, system control is executed by an Electric Propulsion Controller (EPC). Referring to FIG. 2, the EPC 10 receives input from the pilot via the thrust and pitch control levers 56 and 57. For optimal operation of the propulsion system, the propeller speed needs to be maintained constant regardless of the thrust and pitch commands. The EPC 10 receives sensor data indicating the propeller speed from the speed sensor 35, compares the measured speed with a reference speed signal, and generates a torque command that is sent to the motor controller 50.

[0050] Another advantage of the electric propulsion system architecture proposed in FIGS. 2 and 3 includes the ability to operate multiple motor controllers in an interleaved fashion, thus improving the power quality of the system and reducing the battery current ripple. Reducing the current ripple extends the life of the battery string 18, reduces electromagnetic interference (EMI), thereby enabling a system design with reduced weight for using a lighter EMI filter.

[0051] FIG. 4 is a diagram representing an electric propulsion control architecture according to an embodiment. Only one controller 12 communicating with the EPC 10 is shown. However, it should be understood that each of the controllers 12a - 12f seen in FIG. 3 may be identical to the controller 12 seen in FIG. 4. The torque command is sent from the EPC 10 to the controller 12 via a Controller Area Network (CAN) bus or an equivalent communication data bus. The sensed speed signal is redundant and available from the controller 12 (via data bus communication) and an independent speed sensor. The EPC 10 may also be redundant to meet the availability of the system.

[0052] Figure 4 also shows various motor control functions that exist within the controller 12 according to the proposed implementation. These motor control functions include a field-oriented control function 78 with weak field weakening. Field-oriented control is a powerful control strategy for controlling the torque of a three-phase AC motor with high precision and high bandwidth. This can be implemented either in hardware or software. This motor control function requires information about the rotor position. This information can be obtained using a position sensor (e.g., a resolver). However, sensorless motor control can also be adopted as a variant. Sensorless control is the case where, instead of relying on a sensor for rotor position detection, a mathematical model or "observer" inside the motor controller is used to derive the rotor position from the motor current and voltage.

[0053] Another important function inside the controller 12 is pulse-width modulation (PWM) generation 80. This motor control function generates the reference current and voltage that need to be supplied to the AC motor to achieve an optimal mechanical torque output. These reference signals are modulated using the PWM generation function that generates commands sent to the gate drivers of the power switches in the inverter controlled by the controller 12.

[0054] Finally, there is a third independent channel protection function 82 inside the controller 12. The protection function consists of an independent hardware circuit that detects voltage, current, speed, and rotor position, filters those signals to remove measurement noise, processes those signals through an analog circuit and compares them with a predetermined protection threshold, and commands the motor controller to perform an operation regarding the state of the power switches when one or more of the thresholds are exceeded. The operation may be a motor controller "trip", which means opening all the power switches in the channel. Another operation may be to short-circuit three lower power switches or three upper power switches in the inverter, which corresponds to short-circuiting the AC motor 20.

[0055] Figure 4 also shows some details of the functions existing inside the EPC 10. The EPC 10 shown in FIG. 2 and the EPCs 10a and 10b shown in FIG. 3 may have the same functions. The main function of the EPC 10 is to execute the propeller speed control function 72. The EPC 10 receives rotational speed data from an independent sensor and generates a torque reference for the controller 12. There are various torque limiters 74 inside the EPC 10. The torque limiter 74 limits the generated torque reference so that the actual torque command sent to the controller 12 does not exceed the output, torque, and speed ratings of the AC motor 20 and the motor controller 50. For example, one function of the torque limiter 74 is that when the propeller speed is already at the nominal value but for some reason an incorrect large torque command is issued by the EPC 10, the torque limiter limits the torque or, in some cases, sets the torque to zero to avoid overspeed of the motor. It is important not to exceed the design speed. The torque limiter 74 and the speed controller 72 (which generates the torque reference) are implemented independently.

[0056] Finally, the system adjustment function 76 within the EPC 10 provides overall adjustment within the electric propulsion system. The system adjustment function 76 includes logic and event sequences for responding to various conditions. For example, this logic coordinates a series of events when the pilot presses the "engine start" button. In this case, the battery contact 9h closes (see FIG. 2), the liquid cooling system for the motor controller 50 and the AC motor 20 starts operating, the hydraulic pump for the governor 42 starts operating, the control power (28V DC ) is applied to the motor controller 50, power is supplied to all sensors, their readings are displayed on the pilot's computer, the motor controller 50 applies a minimum amount of torque to the AC motor 20 so that the rotor 30 (see FIG. 1B) starts spinning in an idle state, and the system is made ready to respond to the pilot's "thrust" command, which is the next step when the pilot advances the thrust control lever 56 (see FIG. 2).

[0057] Another example of the system adjustment function 76 is when there is a fault in the motor controller 50. Following the detection of the fault, the system adjustment function 76 determines all the steps to be executed at the system level. This depends on the type of fault. For example, when one of the controllers 12 trips upon the occurrence of an overcurrent fault, the controller 12 communicates information identifying that event to the EPC 10 (shown by arrow 84 in Figure 4). The EPC 10 also determines other sequences of the event. For example, the EPC 10 can also disconnect the motor controller 50 from the battery by instructing the battery contactor 9h to open. The EPC 10 also recalculates the maximum available power to the AC motor 20 and the motor controller 50. Since one channel of the motor controller 50 has tripped, one of the "stars" of the AC motor 20 is not active. Thus, the power available to the electric propulsion system is reduced. The EPC 10 recalculates the torque limiter setting and determines whether the propeller needs to be "feathered" for this particular fault. If the propeller needs to be "feathered", the EPC 10 instructs the governor 42 to do so by closing the hydraulic valve 54 (see Figure 2) in the hydraulic system.

[0058] The propulsion electric motor may be a permanent magnet motor. The permanent magnet motor has the advantages of high power density, high efficiency, and low weight. It is important to maintain the low weight of the electric aircraft. Therefore, high power density components are used in the system. However, the permanent magnet motor has certain undesirable fault modes that require special procedures and carefully designed fault isolation. One drawback of the permanent magnet motor during a fault is that since the field excitation is generated by the permanent magnets that always exist as part of the motor, the motor magnetic excitation cannot be removed. For example, if there is a turn-to-turn short circuit in the motor winding, simply removing power from the motor by turning off the motor controller is insufficient. The motor is still rotating, and due to the rotation of the magnets, the field excitation still exists, so current is still generated in the motor winding with the short circuit, continuing to supply the fault. The fault tolerant system proposed herein overcomes the aforementioned difficulties by performing special operations in response to fault detection.

[0059] FIG. 5 is a diagram showing fault modes, power flow, and control of a fault-tolerant version of an aerospace electric propulsion system such as the system partially shown in FIG. 2. The controllers 12a-12c identified in FIG. 5 can include the above-described channel protection function 82 identified in FIG. 4. Further, FIG. 5 shows a system in which each channel of the motor controller 50 includes respective independent protection circuits 11a-11c. The channel protection function 84 is software-based; the protection circuits 11a-11c are hardware-based. Software-based protection is slower and has a lower limit than hardware-based protection. Hardware-based protection is faster protection at a higher limit. The protection circuits 11a-11c are typically implemented by analog circuits. The hardware-based protection provided by the protection circuits 11a-11c is independent of the software-based protection provided by the controllers 12a-12c. The protection circuits 11a-11c can bypass the software control implemented in the controllers 12a-12c and issue commands to open and close the power switches 58a-58c, respectively, independent of the software-based protection in response to fault detection. The power switches 58a-58c are each incorporated into the inverters 16a-16c shown in FIG. 2, but in FIG. 5, the inverters are not shown to avoid cluttering the drawing.

[0060] In the embodiment shown in FIG. 5, both the controller 12a and the protection circuit 11a can independently open and close the power switch 58a or open the bus contact 9a. Similarly, both the controller 12b and the protection circuit 11b can independently open and close the power switch 58b or open the bus contact 9b. Similarly, both the controller 12c and the protection circuit 11c can independently open and close the power switch 58c or open the bus contact 9c. More specifically, both software-based and hardware-based protection techniques send low-power inputs to the gate drivers of the power switches. Hardware-based protection sends those signals directly, independent of software-based protection.

[0061] Figure 5 also shows the respective locations where each of the faults 13a and 13b can occur. Fault 13a may be a differential protection (DP) fault (hereinafter, "DP fault") detected based in part on the current information provided by a current sensor 5a that senses the current flowing through a DC power line 4 connected to a bus contactor 9a through the bus contactor 9a. Fault 13b may be a turn-to-turn fault of the winding 22 of the AC motor 20 (hereinafter, turn-to-turn fault 13b), and this turn-to-turn fault 13b is detected by a current sensor that senses the current flowing through an AC power line 6 connecting the winding 22 to a power switch 58a.

[0062] Differential protection (DP) is a unit type of protection for a specified zone or piece of equipment. This is based on the fact that the differential current (the difference between the input current and the output current) becomes high only when an internal fault in the zone occurs. A turn-to-turn fault in an internal winding usually results from an insulation fault in the internal winding. The resulting short circuit of several turns of the winding generates a large fault current in the short-circuit loop and relatively low current in the remaining part of the winding.

[0063] In the case of the fault-tolerant operation of the system shown in FIG. 5 when a turn-to-turn fault 13b occurs in the AC motor 20, the system performs the following operations. When a turn-to-turn fault 13b in the AC motor 20 is detected, the protection circuit 11a or the controller 12a shorts three lower power switches or three upper power switches together. In the exemplary scenario shown in FIG. 5, the three lower power switches are shorted together. This effectively causes a short circuit across all three phases of the affected winding 22. This operation is performed to divert the fault current from the winding 22 to the motor controller 50. Thereby, the risk of local heating in the winding 22 is eliminated, and the short-circuit current is redirected to the motor controller 50 where cooling is available. The motor controller 50 is designed to be able to continuously conduct the motor short-circuit current. The AC motor 20 is also designed not to generate a very high short-circuit current by selectively designing the number of turns of the winding and controlling the motor inductance. The short-circuit current of the AC motor 20 is approximately the same as the nominal (normal) operating current of the AC motor 20. In this way, the AC motor 20 and the motor controller 50 can operate indefinitely in the short-circuited state. Other motor windings and motor controllers without faults can still operate at their nominal capacity.

[0064] The AC motor 20 (see FIG. 1B) can be designed to have a high impedance (or high inductance) or a low impedance (low inductance). A low impedance motor generates a higher fault current, and a high impedance motor generates a low fault current. It is possible to design the motor such that the short-circuit fault current of the motor is the same as the motor rated operating current. When the motor is designed in this way, the motor controller power switch 58a and the AC motor 20 can handle the short-circuit fault current indefinitely. The greater the number of turns of the motor stator 36, the higher the inductance and the higher the impedance. However, more turns cause more losses in the AC motor 20, resulting in lower efficiency. Also, the motor becomes larger and heavier. The impedance or inductance of the motor also depends on the air gap 28 between the rotor 30 and the stator 36. The smaller the air gap, the lower the impedance (the higher the fault current), and the larger the air gap, the higher the impedance (the lower the fault current). However, if the air gap is large, magnetic flux leakage increases, reducing the efficiency of the magnet, and thus more magnets are required to obtain the same output. This results in greater motor losses, lower efficiency, and higher motor weight. This is generally why low impedance motors are more efficient, have lower weight and lower losses, but have higher fault currents. High impedance motors are inefficient, physically large (large diameter), have large losses, are heavy, but have low fault currents. To achieve any motor design, it is possible to control the number of turns in the motor stator 36 and the air gap 28. For example, a compromise between the fault current and the motor weight and efficiency is possible. It is possible to find a compromise where the motor is still efficient, lightweight, and has a fault current slightly higher than the rated current (1.2 to 1.5 times the rated value). Also, the power switches 58a to 58c in the motor controller 50 can be sized slightly larger, so that the switches can handle a fault current of 1.2 to 1.5 times the rated current.

[0065] In the case of a DP fault within the motor controller 50 or at the input of the motor controller (see, for example, DP fault 13a in FIG. 5), different fault removal operations are performed. When a fault is detected, the protection circuit 11a removes power from the AC motor 20 and sends a command to open the upstream bus contactor 9a. Alternatively, that command may be generated by the channel protection function 82 within the controller 12a. In either case, the motor winding 22 is not short-circuited by the power switch 58a. The other channels of the motor controller 50 still operate at their nominal capacity. The entire system operates at a degraded capacity due to the loss of one propulsion channel.

[0066] FIG. 6 is a flowchart identifying the steps of method 100 for fault tolerant operation of an aircraft electric propulsion system according to one embodiment. During system operation, the operation of the AC motor and the motor controller is monitored (step 102). In the exemplary scenario shown in FIG. 6, a determination is made as to whether a fault has been detected during monitoring (step 104). If it is determined in step 104 that no fault has been detected, monitoring of system operation continues (step 102). If it is determined in step 104 that a fault has been detected, the bus contactor disposed between the DC bus 38 and the motor controller 50 is opened in response to the detection of the fault (step 106), thereby disconnecting that channel of the motor controller 50 from the battery string 18. Next, a determination is made as to which type (category) of fault has been detected (step 108). Next, the inverter of the faulty channel of the motor controller 50 is commanded to a safe state mode that depends on the fault type (step 110). If the fault type is a turn-to-turn fault in the stator winding 22 of the AC motor 20, the safe state mode is to short-circuit the upper or lower set of three power switches in the inverter together. If the fault type is a differential protection fault, the safe state mode is to open the power switches in the inverter. Next, the fault in the particular channel (module) of the motor controller 50 (including the fault type) is reported to the EPC 10 (step 112). Next, in response to step 112, the EPC 10 reconfigures the motor controller 50 to operate in a degraded mode (step 114).

[0067] It is important to distinguish where each type of fault is detected. This is possible because each fault has its own unique signature. The motor controller 50 monitors all the necessary signals (input and output DC and AC voltages and currents, motor speed, rotor position, calculation of motor torque, etc.) and can distinguish which type of fault has been detected. Depending on that determination, the "safe state mode" is selected such that it is either a short or an open of the power switch within the faulty motor controller channel.

[0068] According to one proposed implementation, two fault removal operations (see steps 106 and 108 in FIG. 6) are performed in sequence. First, the bus contactor 9a is opened, and then the power switch 58a is opened or shorted. After the fault, there is no reason to keep this channel connected because this particular motor controller channel is damaged. Thus, the connection to the battery string 18 is removed. Then, the system can short or open the power switch depending on which operation is safer at the aircraft level according to the type of fault.

[0069] FIG. 7 is a block diagram identifying some components of a fault-tolerant electric motor control system architecture according to one embodiment. The fault-tolerant electric motor control system 90 includes a pair of redundant EPCs 10a and 10b. EPC 10a is communicatively coupled to controllers 12a-12c; EPC 10b is communicatively coupled to controllers 12d-12f. The fault-tolerant electric motor control system 90 further includes a router 52. The router 52, EPC 10a, and controllers 12a-12c are communicatively coupled by a data bus 92a; the router 52, EPC 10b, and controllers 12d-12f are communicatively coupled by a data bus 92b. During normal operation, EPC 10a communicates directly with and controls controllers 12a-12c via data bus 92a, and EPC 10b communicates directly with and controls controllers 12d-12f via data bus 92b. If a fault occurs in EPC 10a, EPC 10b can communicate indirectly with and control controllers 12a-12c via data bus92b, router 52, and data bus 92a. Conversely, if a fault occurs in EPC 10b, EPC 10a can communicate indirectly with and control controllers 12d-12f via data bus 92a, router 52, and data bus 92b.

[0070] Referring back to FIG. 5, the current generated by the AC motor 20 proceeds to the power switch 58a and circulates between the motor and the power switch. Typically, the power switch is a solid state device (e.g., a transistor) designed to handle large currents. The power switch is actively cooled by a coolant (oil, a mixture of water and propylene glycol, or any other medium), which is the most efficient way to remove the heat generated by fault currents flowing through the power device. The AC motor 20 is also actively cooled by a similar coolant. Thus, all the energy generated by the AC motor 20 is dissipated by losses in the motor and the power switch and then removed by the active cooling system.

[0071] FIG. 8 is a block diagram identifying some of the components of a cooling system 70 configured to remove heat from a motor stator 36 and from a power switch 58 using a coolant. The lines with arrows indicate the tubes that carry the coolant. The coolant is circulated by a pump 60. The coolant exits the pump 60 and enters a diverter 64. The diverter 64 divides the coolant into a portion that flows through the motor stator 36 and a portion that flows through a cold plate 62 that is thermally conductively coupled to the power switch 58. The flow through the motor stator 36 cools the windings (not shown in FIG. 8); the flow through the cold plate 62 cools the power switch 58. The hot coolant is then pumped through a mixer 66 and then through a heat exchanger 68. The hot coolant is cooled by ambient air (acting as a heat sink) as it flows through the heat exchanger 68. The cooled coolant then returns to the pump 60 to complete one circuit.

[0072] Systems and methods for enabling fault-tolerant operation of an aircraft electrical propulsion system have been described with reference to various embodiments, but it will be understood by those skilled in the art that various changes can be made without departing from the scope of the teachings herein and equivalents can be substituted for its elements. Further, many modifications can be made to adapt the teachings herein to a particular situation without departing from its scope. Accordingly, it is intended that the claims not be limited to the particular embodiments disclosed herein.

[0073] When used in the claims, the term "controller" should be construed broadly to include a system having at least one computer or processor and capable of having multiple computers or processors that communicate via a network or bus. As used in the previous sentence, the terms "computer" and "processor" both refer to a device having a processing unit (e.g., a central processing unit) and some form of memory (i.e., a computer-readable medium) for storing a program readable by the processing unit. For example, the term "controller" includes, but is not limited to, a small computer on an integrated circuit that includes a processor core, memory, and programmable input / output peripherals. The processor may be one of the following types, namely, a central processing unit, a microcontroller, a reduced instruction set computer processor, an application specific integrated circuit, a programmable logic circuit, a field programmable gate array, a digital signal processor, and / or any other circuit or processing device capable of performing the functions described herein. Also, structures corresponding to the term "switching means" recited in the appended claims include contacts, relays, and structural equivalents thereof.

[0074] The methods described herein can be encoded as executable instructions embodied in a non-transitory tangible computer-readable storage medium including, but not limited to, a storage device and / or a memory device. When such instructions are executed by a processing system or a computing system, they cause the system apparatus to perform at least a portion of the methods described herein.

[0075] The claims of the processes described below should not be construed to require that the steps recited therein be performed in the order recited, alphabetically (any alphabetical order in the claims is used solely for the purpose of reference to previously recited steps), or unless the language of the claim explicitly specifies or recites a condition indicating a particular order in which some or all of those steps are to be performed. Also, the claims of a process should not be construed to preclude the simultaneous or alternating performance of any portions of two or more steps, unless the language of the claim explicitly recites a condition precluding such an interpretation. For example, in the case of a turn-to-turn fault in a motor winding, the upstream bus contactor may be opened before or after the power switch 58a is shorted together.

[0076] In the following paragraphs, further aspects of the present disclosure will be described: A system comprising a DC power supply, a DC bus connected to receive DC power from the DC power supply, a motor controller connected to receive DC power from the DC bus, and an AC motor connected to receive AC power from the motor controller, wherein the AC motor comprises a rotor, a stator, a first winding at a first angular position on the stator, a second winding at a second angular position different from the first angular position on the stator, and a third winding at a third angular position different from the first and second angular positions on the stator, the motor controller comprises an inverter connected to receive DC power from the DC bus and to supply AC power to the first, second, and third windings, and the controller (a) controlling first, second, and third switches in the inverter such that three-phase AC power is sequentially supplied to the first, second, and third windings during system operation; and (b) detecting a turn-to-turn fault in one of the first, second, and third windings during system operation. (c) In response to detecting a turn-to-turn fault, shorting the first, second, and third power switches together; performing an operation including; a system.

[0077] The system according to paragraph A1, further comprising a propeller having a shaft coupled to the rotor of the A2.AC motor.

[0078] An aircraft comprising a DC power source, a DC bus connected to receive DC power from the DC power source, and an electric propulsion unit connected to receive DC power from the DC bus, wherein the electric propulsion unit comprises a motor controller connected to receive DC power from the DC bus, an AC motor connected to receive AC power from the motor controller, and a propeller having a shaft coupled to the rotor of the AC motor operably coupled to the AC motor, the AC motor comprising a rotor, a stator, a first winding at a first angular position on the stator, a second winding at a second angular position different from the first angular position on the stator, and a third winding at a third angular position different from the first and second angular positions on the stator, the motor controller comprising an inverter connected to receive DC power from the DC bus and connected to supply AC power to the first, second, and third windings, and the controller (a) controlling first, second, and third switches in the inverter such that three-phase AC power is sequentially supplied to the first, second, and third windings during system operation; (b) detecting a fault in the motor controller or an input section to the motor controller during system operation; (c) in response to detecting the fault, opening the first, second, and third power switches together; performing an operation including; an aircraft.

Description of Reference Numerals

[0079] 1 AC power signal 2 AC power signals 3 AC power signals 4 DC power line 5 Current sensor 6 AC power line 9 Battery contact 10 Electric propulsion controller 11 Protection circuit 12 Controller 14 Front-end circuit 15 Propeller 16 Inverter 18 DC power supply, battery string 20 AC motor 21 Coil group 22 Coil 24 Outer diameter 26 Inner diameter 28 Air gap 30 Rotor 32 Shaft 34 Speed and position sensor 36 Stator 38 DC bus 40 Speed and position signal 42 Governor 44 Propeller shaft 45 Propeller blade 46 Propeller 48 Battery management system 50 Motor controller 52 Router 54 Hydraulic valve 56 Thrust control lever 57 Pitch control lever 58 Power switch 60 Pump 62 Cold plate 64 Shunt 66 Mixer 68 Heat exchanger 70 Cooling system 72 Speed controller 74 Torque limiter 78 Magnetic field orientation control function 80 Pulse width modulation generation 82 Channel protection function 84 Channel protection function 90 Fault tolerant electric motor control system 92 Data bus

Claims

1. A method for fault-tolerant operation of an aircraft electric propulsion system, the method comprising: detecting a turn-to-turn fault in one of the first, second, and third windings on a stator of an AC motor that receives AC power signals having first, second, and third phases respectively from first, second, and third power switches of a motor controller, wherein the first, second, and third windings are included in a first winding group of a plurality of winding groups of the stator; in response to detecting the turn-to-turn fault, shorting the first, second, and third power switches together to create a short circuit across all three phases of the affected winding; A method comprising the steps of:

2. The method of claim 1, wherein the first, second, and third power switches are upper power switches of an inverter having three upper power switches and three lower power switches.

3. The method of claim 1, wherein the first, second, and third power switches are lower power switches of an inverter having three upper power switches and three lower power switches.

4. thermally coupling the first, second, and third power switches to a cold plate; cooling the cold plate with a coolant; conducting heat from the first, second, and third power switches to the coolant through the cold plate while a short-circuit current is flowing through the first, second, and third power switches; The method of claim 1, further comprising the steps of:

5. The method of claim 4, wherein the AC motor has inductance and impedance such that the short-circuit current of the AC motor is approximately equal to the rated operating current of the AC motor.

6. The method of claim 1, further comprising, in response to detecting the turn-to-turn fault, opening a contact disposed between a DC bus connected to receive DC power from a DC power source and the motor controller.

7. reporting the turn-to-turn fault to an electronic propulsion controller configured to reconfigure the motor controller to operate in a degraded mode; reconfiguring the motor controller to operate in the degraded mode in response to the reporting; The method according to claim 1, further comprising **Claim 8** A system comprising a DC power supply, a DC bus connected to receive DC power from the DC power supply, a motor controller connected to receive DC power from the DC bus, and an AC motor connected to receive AC power from the motor controller, wherein the AC motor comprises a rotor, a stator, a first winding at a first angular position on the stator, a second winding at a second angular position different from the first angular position on the stator, and a third winding at a third angular position different from the first and second angular positions on the stator, and the first, second, and third windings are included in a first winding group of a plurality of winding groups of the stator, the motor controller comprises an inverter connected to receive DC power from the DC bus and supply AC power to the first, second, and third windings, and the controller (a) controlling first, second, and third switches in the inverter so that three-phase AC power is sequentially supplied to the first, second, and third windings during system operation; (b) detecting a turn-to-turn fault in one of the first, second, and third windings during system operation; (c) in response to detection of the turn-to-turn fault, shorting the first, second, and third power switches together to cause a short circuit across all three phases of the affected winding; performing an operation including the system. **Claim 9** The system according to claim 8, comprising a propeller having a shaft coupled to the rotor of the AC motor. **Claim 10** The system according to claim 8, wherein the first, second, and third power switches of the inverter are upper power switches of an inverter having three upper power switches and three lower power switches. **Claim 11** The system according to claim 8, wherein the first, second, and third power switches of the inverter are lower power switches of an inverter having three upper power switches and three lower power switches. **Claim 12** the first, second, and third power switches are thermally coupled to a cold plate, the cold plate is cooled by a coolant, The system according to claim 8, wherein heat is conducted from the first, second, and third power switches to the coolant through the cold plate while a short-circuit current is flowing through the first, second, and third power switches.

13. The system according to claim 8, wherein the AC motor has inductance and impedance such that a short-circuit current of the AC motor is substantially the same as a rated operating current of the AC motor.

14. An aircraft comprising the system according to any one of claims 8 to 13.

Images