Aircraft electric propulsion motor and motor controller protection system

Abstract

To provide a method for protecting an electric propulsion system in response to occurrence of a fault.SOLUTION: The method includes the step of activating short circuits in power switches of inverters (14a and 14b) in a motor controller (50) to redirect current regenerated by a motor (30) which is electrically coupled to the motor controller (50) and mechanically coupled to a propeller (32). The method further includes feathering the propeller (32) while the motor (30) is regenerating current. The protection logic is designed to address different types of faults, including faults in the high-voltage direct-current bus, faults in the motor controller (50), and faults in the motor (30).SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates generally to power conversion systems, and more particularly to power conversion systems for converting direct current (DC) to alternating current (AC). The present disclosure particularly relates to methods and apparatus for converting DC power to AC power in electric aircraft propulsion systems. [Background technology]

[0002] An aircraft with an electric propulsion system (hereinafter, "electric aircraft") includes an electric motor that converts electrical power into mechanical power. For example, the electric motor rotates one or more propellers of the aircraft to provide thrust. More specifically, the electric motor includes loops of wire (hereinafter, "stator windings") disposed in a magnetic field; when a current is applied to the stator wings, the magnetic field exerts a torque on the rotor, causing the shaft to rotate. This process converts electrical energy into mechanical work.

[0003] Electric aircraft come in many forms, including airplanes, rotorcraft, helicopters, quadcopters, unmanned aerial vehicles, and any other suitable type of electric aircraft. The batteries in electric aircraft are large and designed to provide high power for electric propulsion. In one aspect, the batteries are connected to a high-voltage direct current (HVDC) bus that is also powered by a generator. The term "high voltage," as used in the aviation industry and herein, refers to a DC voltage greater than 500 V. Such high DC voltages are typically obtained by rectifying 230 V three-phase AC power.

[0004] Fully electric or hybrid aircraft propulsion systems use large electric motors to provide thrust for the aircraft. Permanent magnet electric motors are the motor of choice for electric propulsion due to their simple structure, high operational efficiency, and light weight compared to other motor types. Permanent magnet electric motors are driven by a motor controller, which converts the power from the HVDC battery into the power required to drive the electric propulsion motor—at least three-phase AC power with variable frequency and amplitude. Another important function of the motor controller is to protect the system from fault conditions. Fault conditions in electric or hybrid electric propulsion systems can lead to undesirable high-current and high-energy conditions.

[0005] Current technology has been developed for aircraft using high-power motor controllers and motors. However, the nature of the loads, power levels, criticality of the loads, and grounding schemes differ significantly from those used in hybrid-electric propulsion applications. For example, power levels are relatively low, with the maximum motor controller load being 100 kW. In contrast, electric propulsion loads are 500 kW to 1000 kW. This results in a relatively high level of fault energy. Furthermore, in the example aircraft described above, none of the high-power motor and motor controller loads perform aircraft propulsion functions. Most of the functions they perform are related to the environmental control system, electric pumps, engine starting, auxiliary power unit starting, and ram fans. None of these functions are critical. Loss of one or two motor loads is acceptable and does not pose a safety risk. Grounding schemes also differ from those used in electric propulsion applications. The grounding scheme affects how and how quickly a fault is detected and the type of sensors used for detection. Different types of motor loads can affect the direction of power flow after a fault, necessitating the incorporation of post-fault logic. Different motor types in conventional systems (large permanent magnets vs. induction or wound rotors) also impact protection and associated logic. Finally, the number of motor controllers and number of motor phases driving a single motor also impacts protection logic. In non-electric propulsion applications, a single motor controller typically drives a single three-phase motor. In contrast, electric propulsion applications often have multi-phase motors (e.g., 12, 18, etc.) due to the higher power levels. Therefore, multiple motor controllers drive a single motor. This also impacts the required protection logic and coordination between the motor controllers. Summary of the Invention

[0006] The gist of the present disclosure, as described in more detail below, relates to a fault-tolerant power system used for electric propulsion of an aircraft. More specifically, a system and method for protecting an aircraft's electric propulsion motor drive system are disclosed. The proposed configuration of the present disclosure meets the requirements for high-power propulsion in aircraft and also the requirements for system controllability and availability in aerospace applications. The fault-tolerant system of the present disclosure can continue to operate even if any component fails (or experiences one or more malfunctions). The ability to maintain functionality even when part of a system fails is referred to herein as "degradation." A fault-tolerant design allows the system to continue operating, possibly at a reduced level of functionality, even if part of the system fails, rather than failing completely.

[0007] The disclosed motor drive system for electric propulsion of an aircraft includes a motor controller that converts direct current (DC) supplied from a battery into alternating current (AC) supplied to one or more electric motors. The motor controller includes multiple sets of inverters and an inverter controller that controls the states of power switches of these inverters. The motor controller receives DC power from a battery (or a battery system consisting of multiple battery modules) via an HVDC bus. When a fault occurs in the HVDC bus, not only is power supplied to the faulty part from the battery, but power is also supplied to the faulty part from the motor via the motor controller.

[0008] When a fault is detected on the HVDC bus (as disclosed in U.S. Patent Application No. 16 / 862,212), the protection circuit issues a command to cut off power to the motor by opening a contactor located upstream of the input side of the high-voltage DC bus. However, even if the battery is disconnected after a fault, the regenerative current generated by the motor's rotation still passes through the motor controller and is supplied to the fault location. Even if all the motor controller switches are open, the motor controller's freewheeling diode remains connected, acting as a rectifier, allowing the regenerative power from the motor's rotation to be supplied to the fault location. Because propulsion motors are large, the regenerative current can be very large, potentially reaching thousands of amperes. In addition, the air forces that rotate the propeller and motor are large, and this rotation will continue until the propeller is feathered (i.e., the pitch of the propeller blades is adjusted to be approximately parallel to the airflow) by the propeller pitch controller (hereinafter referred to as the "governor"). Feathering the propeller can take as long as 10 seconds. Supplying thousands of amperes of current to a fault site for approximately 10 seconds can transfer excessive energy to the aircraft structure, resulting in undesirable results. Exposure of aircraft structures to high energy conditions should be limited.

[0009] In fault-tolerant configurations, it may be beneficial to maintain limited operation of the electric propulsion motors in the event of a failure of the HVDC bus rather than shutting down the system completely. Safe operation is possible even in such a fault condition. Also, in configurations with redundant channels, the second healthy channel can be used to perform a controlled system shutdown, thereby extending (for a few seconds or minutes) the operation of the electric propulsion system in a fault condition.

[0010] According to the innovative technology proposed in this disclosure, when a fault occurs on the HVDC bus, active short circuit (ASC) control is performed, forcing the motor controller switch to short circuit. Shorting the motor controller switch reroutes the regenerative current to the motor controller instead of the fault location. The regenerative current circulates between the electric propulsion motor and the motor controller. ASC control of the motor controller can be performed very quickly, on the order of milliseconds. The electric propulsion motor and motor controller can be actively cooled using a coolant even in this situation. Therefore, the heat generated by the short circuit current circulating through the motor and motor controller can be actively managed by the cooling system. After the fault occurs and ASC control is performed, the propeller pitch controller (governor) feathers the propeller over a typical period of time using a well-known method. When the propeller is feathered, the air force acting on the propeller to rotate the motor is significantly reduced. As a result, the motor stops rotating, thereby halting the generation of regenerative power. Once the regeneration of power is stopped, the motor controller switch may optionally be switched from the ASC state back to the open state.

[0011] Other faults that can cause high current and high energy conditions include a power switch short circuit, a phase-to-phase or three-phase short circuit in the power supply line between the motor controller and the motor, and a turn-to-turn short circuit in the motor. Shoot-through can also occur when the positive and negative voltage rails are shorted, causing large short-circuit currents to flow through the upper and lower power devices in an inverter. This disclosure also proposes protection logic to protect the system when a fault occurs in the motor or motor controller.

[0012] Various embodiments of systems and methods for protecting an aircraft electric propulsion motor drive system are described below, one or more of which may be characterized by one or more of the following aspects.

[0013] One aspect of the present disclosure, as described in detail below, relates to a method for protecting an electric propulsion system in response to a fault occurrence, the method including shorting a power switch of an inverter included in a motor controller to reroute a regenerative current generated by a motor electrically connected to the motor controller and mechanically connected to a propeller, and feathering the propeller while the motor generates the regenerative current.

[0014] Another aspect of the present disclosure relates to an electric propulsion unit, as described in detail below, including a battery, a DC bus connected to receive DC power from the battery, a motor controller connected to receive DC power from the DC bus and including a plurality of inverters, an AC motor connected to receive AC power from the motor controller, a propeller mechanically connected to the AC motor and including variable-pitch propeller blades, a governor configured to adjust the pitch of the propeller blades in a feathering motion, and a control system configured to perform operations including shorting a power switch of the inverter included in the motor controller to reroute regenerative current generated by the AC motor, and operating the governor to feather the propeller while the motor is generating regenerative current.

[0015] Another aspect of the present disclosure relates to a method for staged shutdown control of a motor controller including multiple inverters, as described in detail below, including: (a) closing one stage of power switches of each inverter included in the motor controller; (b) opening a battery contactor to disconnect a battery from the motor controller; (c) discharging a DC link capacitor of each inverter included in the motor controller; and (d) closing all open power switches in the motor controller after the DC link capacitor has discharged.

[0016] Yet another aspect relates to a method for protecting an electric propulsion system in response to an open-circuit fault of a power switch, the method including: (a) detecting an open-circuit fault of a power switch in one stage of an inverter of a motor controller; (b) determining whether the open-circuit fault of the power switch occurred during field weakening control; and (c) performing a protective action based on the determination result of step (b). Step (c) includes opening another power switch of the inverter if the open-circuit fault of the power switch did not occur during field weakening control. If the open-circuit fault of the power switch occurred during field weakening control, step (c) includes closing a power switch in another stage of the inverter, opening a battery contactor to disconnect a battery from the motor controller, discharging a DC link capacitor of the inverter, and closing all healthy power switches in the one stage after the DC link capacitor is discharged.

[0017] Yet another aspect relates to an electric propulsion unit including a control system configured to perform the operations described in the preceding paragraph. Still other aspects are described below regarding systems and methods for protecting an electric propulsion motor drive system of an aircraft. [Brief explanation of the drawings]

[0018] The features, functions, and advantages described in the above sections can be achieved individually in various embodiments or can be combined in yet other embodiments. For the purposes of illustrating the above and other aspects, various embodiments are described below with reference to the drawings.

[0019] [Figure 1] 1 illustrates an HVDC bus fault and power flow diagram for an aerospace electric propulsion system including a DC-AC converter that receives DC power from a battery system via an HVDC bus. [Figure 2] FIG. 1 illustrates a fault on one HVDC bus of an electric aerospace propulsion system including a motor controller with two channels, and the state of the power switches in the faulted channel when a safe mode is initiated in response to the fault. [Figure 3] FIG. 1 is a block diagram illustrating some of the components of a cooling system configured to remove heat from a motor and motor controller using a coolant, according to one embodiment. [Figure 4] 1 is a flow chart showing the steps of an algorithm for controlling the rotational speed of a propeller according to one aspect of the proposal. [Figure 5] FIG. 10 illustrates an electric aerospace propulsion system configuration in which controllers communicate over a controller area network, according to another embodiment. [Figure 6] FIG. 1 illustrates the configuration of electric propulsion control in the event of an HVDC bus fault and a short-circuit current generated by the motor being supplied to the fault location. [Figure 7] FIG. 1 shows one inverter of a motor controller in which the power switch is held open while the short circuit current generated by the motor is supplied to the fault on the HVDC bus. [Figure 8] FIG. 1 illustrates one inverter of a motor controller in which the bottom three power switches are closed and the top three switches remain open in response to an HVDC bus fault. [Figure 9] FIG. 1 illustrates three power switches of one stage in a motor controller being closed in response to an HVDC bus fault. [Figure 9A] 1 is a graph showing the time course of current through one lower switch and the corresponding upper switch in one inverter of a motor controller before and after the initiation of an active short circuit. [Figure 9B] FIG. 1 is a tree diagram illustrating the accumulation of thermal resistance when a power module is connected to a heat sink. [Figure 10] FIG. 12 shows one inverter of the motor controller with all six power switches in the closed state in response to an HVDC bus fault. [Figure 10A] 10 is a graph showing the time variation of the current flowing through one lower switch and the corresponding upper switch in one inverter of the motor controller. [Figure 11] FIG. 1 illustrates components of an electric propulsion unit according to one embodiment, including a motor controller inverter and an electric propulsion controller configured to perform protective functions in response to detecting an HVDC bus fault. [Figure 12] 4 is a flow chart illustrating method steps performed by a protection function according to one embodiment. [Figure 13] FIG. 1 illustrates a portion of an electric propulsion unit component with a power switch in one of the four channels of the motor controller shorted. [Figure 14] FIG. 1 illustrates components of a protection system configured to perform protective action to mitigate the effects of a short circuit in a power switch of an inverter included in a motor controller. [Figure 15] 15 is a flowchart illustrating a protection logic sequence of a method for providing staged shutdown control of an electric propulsion unit in response to a power switch short circuit fault such as that shown in FIG. 14. [Figure 16]FIG. 1 illustrates components of a protection system according to a first embodiment configured to perform protective action to mitigate the effects of an inter-turn fault in the stator windings of a three-phase AC motor. [Figure 17] 17 is a flowchart illustrating a protection logic sequence used by the protection system shown in FIG. 16 to provide staged shutdown control of the electric propulsion unit in response to an inter-turn fault in the stator winding. [Figure 18] FIG. 2 illustrates components of a protection system according to a second embodiment configured to perform protective action to mitigate the effects of an inter-turn fault in the stator windings of a three-phase AC motor. [Figure 19] 19 is a flowchart illustrating a protection logic sequence used by the protection system shown in FIG. 18 to provide staged shutdown control of the electric propulsion unit in response to an inter-turn fault in the stator windings. [Figure 20] FIG. 10 illustrates components of a protection system according to a third embodiment configured to perform protective action to mitigate the effects of an inter-turn fault in the stator windings of a three-phase AC motor. [Figure 21] 21 is a flowchart illustrating a protection logic sequence used by the protection system shown in FIG. 20 to provide staged shutdown control of the electric propulsion unit in response to an inter-turn fault in the stator windings. [Figure 22] FIG. 1 illustrates components of a protection system configured to perform protective action to mitigate the effects of an open-circuit fault of a power switch in an inverter of a motor controller. [Figure 23] 23 illustrates protection logic according to one embodiment for performing protection actions to mitigate the effects of an open circuit fault in the power switch shown in FIG. 22. DETAILED DESCRIPTION OF THE INVENTION

[0020] In the following description, reference is made to the accompanying drawings, in which like elements are designated with the same reference numerals in different drawings.

[0021] Exemplary embodiments of systems and methods for protecting an aircraft electric propulsion motor drive system are described in detail below. However, this description does not describe all of the features of a practical implementation. Those skilled in the art will appreciate that the development of a practical implementation involves numerous decisions to achieve the developer's goals, which may vary from implementation to implementation, including, for example, satisfying system-related and commercial constraints. Furthermore, those skilled in the art will appreciate that such a development effort, while complex and time-consuming, would represent a routine effort given the benefit of this disclosure.

[0022] The disclosed aircraft electric propulsion motor drive system includes an electric motor that rotates a propeller, one or more motor controllers configured to convert direct current (DC) to alternating current (AC), and a DC power source (e.g., a battery system). The DC power source may include, for example, a DC / DC converter that increases or boosts the voltage level of low-voltage DC power, thereby providing a high-voltage DC (HVDC) power source. A DC / DC converter is an electrical or electromechanical device used to change the voltage level of a DC power source. The high-voltage DC power may be supplied to one or more inverters in the motor controller to provide a high-voltage AC power source.

[0023] An inverter is a power electronic device or circuit that converts direct current (DC) to alternating current (AC). In a simple inverter circuit, DC power is connected to a transformer via a center tap of the primary winding. Rapid on-off switching of a switch alternates the DC power through two paths, one end of the primary winding and the other end. Alternating the direction of current in the transformer's primary winding generates AC in the secondary circuit. According to one proposed aspect, each inverter includes a switch system, a set of inductors, a set of capacitors, and an electromagnetic interference filter. The switch system may include a different number of switches (hereinafter referred to as "power switches") depending on the type of inverter. Each power switch may be, for example, but not limited to, a bipolar transistor device, a metal-oxide-semiconductor field-effect transistor (MOSFET) device, an insulated-gate bipolar transistor device, or other types of semiconductor or switch devices.

[0024] Inverters can take various forms, including, but not limited to, single-phase and three-phase inverters. Three-phase inverters (hereinafter "3-phase inverters") are used for variable frequency drive applications and / or high-power applications such as AC power transmission. A basic 3-phase inverter consists of three single-phase inverters, each containing two switches connected in series with its center point connected to one of three load terminals. In the most basic control method, the operation of the six switches in the three-phase legs is coordinated so that one switch operates every 60 degrees of the fundamental output waveform. This results in a six-step staircase-like line-to-line output waveform. This six-step staircase waveform has zero-voltage steps between the positive and negative regions of the square wave, which suppresses third-order harmonics. When carrier-referenced PWM techniques are applied to the six-step staircase waveform, the fundamental overall waveform, or envelope shape, is maintained, and the third-order harmonic and its integer multiples are canceled. To configure an inverter with a higher rated power, two three-phase inverters that generate a six-step waveform are used, and these two inverters are connected in parallel to increase the rated current, or in series to increase the rated voltage. In either case, a 12-step staircase waveform can be obtained by phase shifting the output waveform. It is also possible to combine more inverters; for example, combining three inverters can configure an inverter that generates an 18-step waveform. Combining multiple inverters is usually done to increase the rated voltage or current, but combining them can also improve the quality of the waveform.

[0025] FIG. 1 is a block diagram showing components of a typical aerospace electric propulsion system with a single propulsor 2. The propulsor 2 includes, in part, a motor controller 50 that converts DC power to AC power. Therefore, the term "motor controller" as used herein includes a DC / AC converter (not shown in FIG. 1). The propulsor 2 also includes an AC motor 30 that receives AC power from the motor controller 50 via multiple or multiple sets of AC power lines 6. The propulsor 2 also includes a propeller 32 rotated by the AC motor 30. The propeller 32 includes a propeller shaft 34 mechanically coupled to an output shaft (not shown in FIG. 1) of the AC motor 30 and multiple propeller blades 36. The propulsor 2 also includes a governor 42 configured to maintain a constant rotational speed of the propeller 32 by varying the pitch of the propeller blades 36. The hydraulic governor adjusts speed by controlling the flow of engine oil through the hydraulic mechanism of the propeller 32 using a hydraulic valve 54.

[0026] In some embodiments, the motor controller 50 has multiple channels for supplying AC current to each of the multiple sets of stator windings of the AC motor 30. Each channel of the motor controller 50 includes an inverter (not shown in FIG. 1) having a set of power switches and an inverter controller (not shown in FIG. 1) that controls the states of these power switches. The power switches are connected to the stator windings of the AC motor 30. The motor controller 50 also includes multiple sensor pairs (not shown in FIG. 1) that measure the voltage and current of the AC power signals output from each inverter. The measured sensor data is fed back to the corresponding inverter controller. The inverter operation is controlled by the inverter controller. Each inverter controller sends control signals to and receives switch state signals from the corresponding inverter via switch signal lines (not shown in FIG. 1). The inverters of the motor controller 50 convert DC power into polyphase AC power for the AC motor 30. These inverters and inverter controllers form a DC / AC converter that is part of the motor controller 50. More specifically, the inverter controller generates pulse width modulated signals that provide reference currents and voltages to be supplied to the motor 30 for optimum mechanical output torque. These reference signals are modulated using a PWM generator to generate commands that are sent to the gate drivers of the power switches of the inverter controlled by the inverter controller.

[0027] The HVDC power source for the system shown in FIG. 1 is a battery 18. The battery 18 may include, for example, multiple battery modules 24 arranged to form a battery pack. In the exemplary embodiment shown in FIG. 1, the battery 18 includes multiple battery strings connected in parallel to positive and negative DC bus bars 38a and 38b via respective contactors 8. The DC current flowing through the positive DC bus bar 38a is measured by a current sensor 16. Each battery string includes multiple battery modules 24 connected in series. The DC current flowing through each battery string is measured by a corresponding current sensor (not shown in FIG. 1). Each battery module 24 is a parallel / series arrangement of individual cells (not shown in FIG. 1). Each battery module 24 may be monitored by an associated module monitoring unit (not shown in FIG. 1). Each module monitoring unit includes separate sensors for measuring virtual cell voltage and individual cell temperature. The module monitoring unit also includes a balancing circuit.

[0028] The system further includes a DC voltage conversion system (not shown in FIG. 1) that receives low-voltage DC power provided by the battery 18 and converts it to high-voltage DC power. The system shown in FIG. 1 also includes an HVDC bus 4 connected to transmit high-voltage DC power output from the DC voltage conversion system to the motor controller 50. For example, the HVDC bus 4 includes a pair of HVDC bus bars connected to receive HVDC power from the DC voltage conversion system.

[0029] The DC voltage conversion system (not shown) includes a voltage converter and a converter controller. The converter controller generates a control signal according to a specific switching modulation algorithm, such as pulse-width modulation, phase modulation, interleaved modulation, or a combination of two or three of these. The voltage converter converts the voltage of an input current under the control of the converter controller using one of the above modulation methods to produce an output current with a voltage that meets specific electrical performance requirements, such as increased efficiency, reduced current ripple, and minimized noise.

[0030] The system shown in FIG. 1 further includes a battery management system 22. The operation of the battery 18 is managed by the battery management system 22. Each module monitoring unit incorporated in the battery 18 sends sensor data indicating virtual cell voltages and individual cell temperatures to the battery management system 22. The battery management system 22 receives data from the current sensors 16. The battery management system 22 is configured to provide redundant protection, fail-safe operation, and selective shutdown of battery strings. The battery management system 22 is also configured to provide battery overcharge protection and to prevent other events or combinations of events that may lead to battery thermal runaway. More specifically, if a fault condition (e.g., a short circuit) is detected in one of the battery strings, the battery management system 22 controls the switching state of selected contactors 8 to an open state.

[0031] As shown in FIG. 1, the system further includes an engine control unit (ECU) 10. The engine control unit 10 operates in cooperation with an inverter controller (not shown in FIG. 1) in a motor controller 50. The inverter controller of the motor controller 50 is communicatively connected to the engine control unit 10, receives control signals from the engine control unit 10, and sends feedback signals to the engine control unit 10. The engine control unit 10 has the function of monitoring and adjusting all of the inverter controllers. As will be described in detail later, the engine control unit 10 is communicatively connected to an electric propulsion controller (EPC) (not shown in FIG. 1) that controls the overall operation of the aircraft electric propulsion motor drive system shown in FIG. 1.

[0032] FIG. 1 shows a state in which a fault 3 (e.g., a short circuit) occurs on the HVDC bus 4. In this example, the HVDC bus 4 applies a nominal voltage of 1000 to 1600 V DC and transmits a nominal current of 1000 A DC. When a fault such as the one shown occurs, a large fault current of 7000 A DC (indicated by the right-pointing arrow) may be supplied from the battery 18. As described above, not only does current flow from the battery 18 to the faulted part, but current from the AC motor 30 also flows into the faulted part through the motor controller 50. For example, the AC motor 30 may be in a state in which a short-circuit current I SC =DC7000A (indicated by the left-pointing arrow).

[0033] 2 shows a propulsor 2′ including a motor controller 50 having two channels 46a and 46b. Channel 46a receives DC power generated by a first battery 18a via a first distribution board 20a and a first HVDC bus 4a. Channel 46b receives DC power generated by a second battery 18b via a second distribution board 20b and a second HVDC bus 4b. The first and second batteries 18a and 18b are managed and protected by battery management systems (BMS) 22a and 22b, respectively. Each of the first and second distribution boards 20a and 20b includes a pair of battery contactors 48. In a closed state, the battery contactors connect the first battery 18a to the first HVDC bus 4a and the second battery 18b to the second HVDC bus 4b, and in an open state, they disconnect the first battery 18a from the first HVDC bus 4a and the second battery 18b from the second HVDC bus 4b. If a malfunction occurs in one channel of the motor controller 50 and it becomes unusable, the other channel can continue to be used. This configuration is referred to herein as a degraded mode of operation of the electric propulsion system.

[0034] In the example shown in FIG. 2 , AC motor 30 is a 2×3-phase AC motor. As shown in FIG. 2 , AC power is input to AC motor 30 from channels 46 a and 46 b via AC power lines 6. The current flowing through each AC power line 6 is measured by a respective current sensor 16. AC motor 30 includes a rotor 28 and a stator disposed across an air gap from rotor 28. The exemplary stator includes star-connected three-phase stator winding sets 26 a and 26 b, to which AC power from each inverter is supplied. Rotor 28 includes multiple sets of windings (not shown) or permanent magnet arrays that interact with the magnetic fields generated by the stator windings to generate a force that rotates propeller shaft 34. AC motor 30 also includes an angular velocity and angular position sensor (not shown in FIG. 2 ) that senses the electrical frequency and angular position of rotor 28 and outputs an angular velocity signal w and a position signal to a control system. The angular velocity signal w is proportional to the rotational mechanical speed of the motor (which is also the speed of the propeller). The position signal represents the angular position of the rotor 28.

[0035] An example of an electric propulsion motor is a permanent magnet motor. Permanent magnet motors offer advantages such as high power density, high efficiency, and low weight. Reducing the weight of an electric aircraft is important. Therefore, the proposed system uses high-power-density components. However, permanent magnet motors have several potential failure modes, requiring specific procedures and careful design for fault isolation. Because permanent magnets are integrated into the motor, a disadvantage of permanent magnet motors is that the motor excitation cannot be de-energized even in a fault condition. For example, if a short circuit occurs between the motor windings, simply turning off the motor controller to remove power to the motor is insufficient. Even with power removed, the motor continues to rotate, and the rotation of the motor generates an excitation field, which continues to generate current in the shorted motor winding and power the faulted part. The proposed fault-tolerant system solves the above problem by taking specific actions in response to a detected fault.

[0036] In the simplified implementation shown in FIG. 2 , channel 46a includes first inverter 14a (including three pairs of power switches associated with each of the three phases) and DC link capacitor 40a, while channel 46b includes second inverter 14b (also including three pairs of power switches) and DC link capacitor 40b. The first and second inverters 14a and 14b are connected to supply three-phase AC power to star-connected stator winding sets 26a and 26b, respectively. The states of the power switches in inverters 14a and 14b are controlled by inverter controllers (not shown in FIG. 2 ) associated with each inverter. The inverter controllers are communicatively connected to engine control unit 10. For example, during normal operation, the states of the power switches in inverters 14a and 14b are controlled to supply six-phase AC power to AC motor 30. However, in the situation shown in FIG. 2 , while channel 46a of motor controller 50 is operating normally, channel 46b is not, and all power switches in inverter 14b are closed for reasons described below.

[0037] As shown in FIG. 2, the electric propulsion system includes an electric propulsion controller 12, to which thrust and pitch inputs are received by the pilot through the operation of thrust control levers and pitch control levers (thrust control lever 21 and pitch control lever 23 are shown in FIG. 5, though not shown in FIG. 2). The electric propulsion controller 12 receives a signal w proportional to the rotational speed of the propeller from a speed and position sensor. In addition, the electric propulsion controller 12 receives a signal representing the measured current from a current sensor 16. The electric propulsion controller 12 sends commands to the engine control unit 10 to control the operation of the inverter based on information from the sensors and pilot inputs. In addition, the electric propulsion controller 12 operates in conjunction with the battery management systems 22a and 22b. The electric propulsion controller 12 is configured to send a digital torque command signal to the engine control unit 10 and an analog pitch command signal to the governor 42. In addition, the electric propulsion controller 12 is configured to control the state of the battery contactors 48 in the power distribution panels 20a and 20b.

[0038] 2, the system is controlled by an electric propulsion controller 12, which receives input from the pilot via thrust control lever 21 and pitch control lever 23. Optimal operation of the propulsion system requires that the propeller speed remain constant regardless of thrust and pitch commands. The electric propulsion controller 12 receives sensor data from a speed sensor indicating propeller speed measurements, compares the measured speed with a reference speed signal, and generates torque commands to send to the engine control unit 10.

[0039] FIG. 4 is a flowchart illustrating steps of an algorithm 80 (hereinafter, "control algorithm 80") for controlling the rotational speed of the propeller 32 according to one proposed embodiment. Of the control algorithm 80, steps 86, 88, and 90 are executed by the electric propulsion controller 12, while a torque loop 92 is executed by the engine control unit 10. As shown in FIG. 4, the electric propulsion controller 12 receives a reference propeller rotational speed w_ref from a pilot interface device 82. The pilot interface device 82 includes a lookup table 84 configured to output the reference propeller rotational speed w_ref at a value corresponding to a pilot input, such as a "speed" command or a "play protection" command. The "play protection" command is used when the pilot manually stops the propeller in an emergency. When this signal is used, the reference speed w_ref is set to zero. The electric propulsion controller 12 also receives a signal w from a speed and position sensor. The signal w is then compared to the reference signal w_ref (step 86). Once the speed error signal is generated, it is fed to a speed controller transfer function Cp, which converts it to a torque reference signal (step 88). The speed controller Cp includes a speed limiting function Wmax that limits the propeller rotational speed to not exceed Wmax to prevent an over-speed condition (step 90). The electric propulsion controller 12 outputs a signal representing a reference torque T_ref, which is input to the engine control unit 10. The engine control unit 10 uses this reference torque to implement a torque loop 112 and generate an appropriate current reference signal proportional to the demanded torque. This current reference signal is sent to the motor controller 50. In this way, the speed feedback control loop is completed.

[0040] Referring again to FIG. 2 , motor controller 50 includes protection circuitry 44 configured to operate motor controller 50 in a safe mode when certain types of faults occur. Protection circuit 44 is hardware-based. Protection circuit 44 is typically implemented using analog circuitry. Protection circuit 44 issues a switch control signal that closes a power switch in inverter 14 a or inverter 14 b. This signal is issued in response to a command issued by electric propulsion controller 12 in response to detecting a fault. More specifically, protection circuit 44 applies low power to the gate drivers of the power switches.

[0041] FIG. 2 shows the protection system responding to a fault 3 (e.g., a short circuit) on the HVDC bus 4b (hereinafter, "HVDC bus fault 3"). The HVDC bus fault 3 is, for example, a differential protection fault. The fault is detected, in part, based on current information provided by a current sensor 16 (see FIG. 1) that senses the current flowing through a bus contactor 48 to the HVDC bus 4b. Differential protection is a unit-type protection that protects designated sections or equipment. This is based on the fact that the differential current (the difference between the input and output currents) is high only when a fault occurs within a section.

[0042] When an HVDC bus fault 3 shown in FIG. 2 is detected, the electric propulsion controller 12 activates the protection circuit 44 to close all power switches 14b and activates the bus contactor 20 to open the switchboard 20b. More specifically, when an HVDC bus fault 3 occurs, active short circuit (ASC) control is performed on the power switches 14b. By shorting the power switches 14b, the current path can be changed so that the regenerative current from the AC motor 30 flows to the motor controller 50 and does not flow to the HVDC bus fault 3. The regenerative current circulates between the electric propulsion motor 30 and the motor controller 50. More specifically, the current generated by the AC motor 30 enters the power switches 14b and circulates between the motor and the power switches. The power switches 14b are typically fixed elements (e.g., transistors) designed for high currents. The power switches are actively cooled with a coolant (oil, a mixture of water and propylene glycol, or any other medium). This is the most efficient way to remove the heat generated by the fault current flowing through the power devices. Similarly, the AC motor 30 is actively cooled with a coolant. Therefore, all of the energy generated by the AC motor 30 can be dissipated as losses in the motor and power switches and removed by the active cooling system.

[0043] The ASC control of channel 46b of the motor controller 50 can be performed very quickly, on the order of milliseconds. Because the AC motor 30 and motor controller 50 are still actively cooled by a coolant, the cooling system actively controls the heat generated by the short-circuit current circulating between the AC motor 30 and channel 46b of the motor controller 50. After a fault occurs and ASC control is performed, the electric propulsion controller 12 causes the governor 42 to feather the propeller 32 for a typical length of time using well-known techniques. When the propeller 32 is feathered, the air force acting on the propeller 32 to rotate the AC motor 30 is significantly reduced. This stops the AC motor 30 from rotating, thereby halting the generation of regenerative power. Once power generation is stopped, the power switch 14b may optionally transition from the ASC control state to an open state.

[0044] FIG. 3 is a block diagram illustrating some of the components of a cooling system 70 configured to use a coolant to remove heat from the motor stator 25 and the power switches 14, according to one embodiment. The arrows represent pipes that transport the coolant. The coolant is circulated by a pump 60. The coolant from the pump 60 enters a flow divider 64, where the coolant is divided between flow through the motor stator 36 and flow through a cold plate 62 that is thermally coupled to the power switches 14. The flow through the motor stator 36 cools the stator windings (not shown in FIG. 3), and the flow through the cold plate 62 cools the power switches 14. The heated coolant is pumped through a mixer 66 and then through a heat exchanger 68. As the heated coolant passes through the heat exchanger 68, it is cooled by ambient air (which acts as a heat sink). The cooled coolant returns to the pump 60, completing the full cycle.

[0045] 5 is a diagram illustrating an electric propulsion system configuration for aerospace applications according to another embodiment. The electric propulsion controller 12 receives input from the pilot via a thrust control lever 21 and a pitch control lever 23. The electric propulsion controller 12 communicates with the battery management system 22 via a first control area network (CAN1) and with the engine control unit 10 via a second control area network (CAN2). The electric propulsion controller 12 sends analog control signals to the governor 42 to control the feathering of the propeller 32. The electric propulsion controller 12 sends information via an Ethernet connection for display on a first display unit 56.

[0046] During normal operation, the battery 18 supplies HVDC power to the motor controller 50. The motor controller 50 converts the DC power to AC power and drives the AC motor 30. The engine control unit 10 receives run / stop and torque commands from the electric propulsion controller 12. The electric propulsion controller 12 monitors pilot input and propeller speed. When the pilot inputs a desired thrust, the electric propulsion controller 12 calculates a torque command for the motor controller 50. In response, the motor controller 50 applies AC current of the appropriate amplitude and phase to the motor 30 to generate torque that rotates the propeller 32. The governor 42 adjusts the rotational speed of the propeller 32 by changing the pitch of the propeller blades 36. When the pilot inputs a request for more thrust, the electric propulsion controller 12 commands the motor controller 50 to increase the torque. The propeller 32 tends to accelerate, and the governor 42 increases the blade pitch accordingly. This provides the increased thrust requested by the pilot. Thus, the propeller speed remains constant throughout operation, and propeller thrust is varied by changing the motor torque and propeller pitch settings.

[0047] FIG. 5 also illustrates a grounding scheme for aircraft electric propulsion unit equipment in accordance with one embodiment. The current return network includes an aluminum structure that functions as the current return network 72. Buildings and facilities on the ground are typically grounded using copper rods or pipes, and the power system equipment can be grounded to these buildings and facilities. However, aircraft have no connection to ground. Instead, they have a lightweight, conductive structure (typically aluminum) to which all electrical equipment is grounded. The current return network 72 is connected to the midpoint of the battery system through a large 1 M ohm resistor, following a grounding scheme known as "high impedance grounding." The motor controller 50 enclosure and motor housing are also grounded to the current return network 72. The grounding scheme often influences how protection functions within various pieces of equipment and the type of protection selected.

[0048] A high-power electric propulsion unit may be configured with multiple motors and motor controllers connected together. Additionally, each motor controller 50 may include multiple inverters with multiple power switches. The power switches of each inverter are switched to provide three-phase AC power to the motor.

[0049] For example, the AC motor 30 shown in FIG. 6 includes a star-connected stator winding set 26a that receives three-phase AC power from inverter 14a via AC power line 6, and a star-connected stator winding set 26b that receives three-phase AC power from inverter 14b. Each three-phase winding set is driven by a corresponding inverter or motor controller. This mitigates the high currents required to generate high torque for propulsion. Motors with multiple windings also provide additional system-level benefits, such as fault tolerance. If a failure occurs in one of the motor's windings, the propulsion system can continue to operate at a reduced capacity using the other windings. The motor and motor controller can be configured with multiple (e.g., three, four, six) star-connected three-phase stator winding sets, thereby increasing the fault tolerance of the propulsion system and reducing the overall impact of a single channel failure.

[0050] The HVDC bus fault 3 shown in Figure 6 may occur, for example, between the positive and negative voltage rails of the HVDC bus 4. The battery protection (fuses and / or string contactors 8) will act very quickly to isolate the battery 18 from the HVDC bus fault 3. Until the battery protection function is activated, the battery 18 will continue to supply power to the HVDC bus fault 3. Furthermore, even after the battery 18 is isolated from the HVDC bus 4, the motor 30 will continue to rotate due to the strong air force acting on the propeller 32, so that the motor 30 will generate AC power and supply power to the fault location even if all the power switches of the inverters 14a and 14b are open. As a result, the short-circuit current I sc flows to HVDC bus failure 3.

[0051] When an HVDC bus fault 3 is detected, the electric propulsion controller 10 commands the governor 42 to feather the propeller 32, which changes the pitch of the propeller blades 36 to reduce the air forces acting on the propeller 32, thereby stopping the motor from rotating. Propeller feathering can take up to 10 seconds. Unless countermeasures are taken, the motor 30 acts as a current source during this time, providing a nearly constant current to the fault. In a fault-redundant architecture, such as that shown in Figure 2, the propeller 32 is not feathered, and operation can continue for an indefinite period with one channel failing.

[0052] FIG. 7 shows the circuit diagram of one inverter 14 of the motor controller 50, illustrating a state when a short-circuit current generated by the motor 30 is being supplied to the HVDC bus fault 3. Each inverter of the motor controller 50 includes three upper-stage power switches 15a and three lower-stage power switches 15b. The motor controller 50 also includes a DC link capacitor 40 and other front-end circuitry (not shown). The first upper-stage power switch and the first lower-stage power switch are connected to the first stator winding of the motor 30. Similarly, the second upper-stage power switch and the second lower-stage power switch are connected to the second stator winding of the motor 30. The third upper-stage power switch and the third lower-stage power switch are connected to the third stator winding of the motor 30. The first, second, and third stator windings are spaced approximately 120 degrees apart from one another. The DC link capacitor is used to limit voltage fluctuations and provide a stable DC voltage to the motor even when the inverter is absorbing a large amount of current. In effect, the DC link capacitor acts as a filter to compensate for the switching losses caused by the on-to-off or off-to-on state transitions of the MOSFET switches.

[0053] 7 also shows an equivalent circuit of the motor 30 in the system shown in FIG. 6. Each equivalent circuit of the motor 30 includes an electromotive force E, a resistance R, and an inductance L. An electromotive force source is similar to a voltage source, and the electromotive force E is generated when the motor 30 rotates due to an external air force (indicated by arrow 74 in FIG. 7), such as when the propeller 32 rotates due to wind. The electromotive force E is calculated using the following formula: E=K t ×speed In the formula, K t is the torque constant of the motor, and "speed" is the mechanical speed of the motor. Also, the short circuit current I sc is calculated by the following formula: I sc =E / (L 2 w 2 +R 2 ) 1 / 2 ≒K t / L In this equation, the angular velocity w represents the electrical frequency of the motor current. Thus, the short-circuit current I sc is proportional to the back electromotive force E and inversely proportional to the motor inductance L.

[0054] When an HVDC bus fault 3 occurs, the motor 30 functions as a constant current source until the propeller 32 has feathered and the motor 30 has stopped rotating. While the governor 42 feathers the propeller 32 for approximately 10 seconds, the pitch of the propeller blades 36 changes, gradually reducing the speed of the motor 30. As the motor 30 speed decreases, the generated electromotive force E also decreases. However, at the same time, the impedance of the motor 30 decreases proportionally to the speed. Therefore, although the generated EMF decreases as the speed decreases, the impedance of the motor 30 to the fault location also decreases, so the magnitude of the fault current remains constant. In other words, the fault current is independent of the motor speed until the motor speed approaches zero. Therefore, unless some action is taken, an undesirably high current of several thousand amperes will flow through the fault location for several seconds.

[0055] Short-circuit current I scThe magnitude of depends on the motor design. For example, a motor can be designed so that the short circuit current is the same as the nominal operating current. However, in such a motor design, the inductance L is increased and the air gap between the stator and rotor is increased, resulting in a larger motor torque constant K t A larger air gap also increases the magnetic flux leakage, so the motor 30 must have more magnets and more turns of windings to achieve the same nominal power. Such a motor is not an optimal design because it increases its weight and size.

[0056] Therefore, as a more suitable and more power dense aircraft motor, the present disclosure provides a motor with a smaller air gap and a motor torque constant K t We propose a design that achieves the same nominal power with a larger inductance and a smaller inductance L. However, such a motor design will also result in a larger short-circuit current. If the nominal operating current of motor 30 at maximum torque and maximum speed is 1.0 unit (pu), then selecting a short-circuit current for motor 30 within the range of 1.2 to 1.5 pu will result in a motor design with optimal power density. (In the unit system, physical quantities are expressed as fractions of a base value. The base value in this case is the amplitude reference value.)

[0057] To reduce the amount of motor regenerative current delivered to the fault during propeller feathering, the innovation proposed herein shorts out the power switches in the motor controller 50, diverting the current path away from the fault. As an example, active short circuit (ASC) control of the motor controller 50 is shown in FIG. 8. In this figure, the bottom three power switches 15b of each inverter in the motor controller 50 are closed, while the top three power switches 15a remain open. Alternatively, the bottom three power switches 15b of each inverter can remain open, while the top three power switches 15a are closed. Because the battery 18 (shown in FIG. 6) may remain connected to the motor controller 50, it is not possible to close all six power switches in any of the inverters. This could result in the battery power being shorted through the motor controller 50, potentially causing a large current of several thousand amperes to flow through the power switches, exceeding their design resistance.

[0058] According to one proposed embodiment of the motor controller 50 protection method, active short circuit control is initiated by closing the power switches of either the upper or lower stage of each inverter. Figure 9 shows three inverter power switches 15 of one stage of the inverter 14, which are closed in response to a detected HVDC bus fault 3, transitioning to a safe mode of operation. In an optimal power density design, the motor short circuit current I when the motor 30 is shorted under this fault condition is sc is 1.2 to 1.5 pu. For example, the motor short circuit current I sc is the maximum nominal operating current I of the motor 30 nom When this current flows through the three power switches 15 in one stage, the short-circuit current I sc is in the range of √2×1.2 to √2×1.5 of the maximum nominal operating current. The power dissipation P dis is proportional to the square of the current (P dis =R on I sc2 , where R on represents the on-resistance of the switch), so (√2×1.2) 2 =2.9 to (√2×1.5) 2 = 4.5. Therefore, while the three power switches 15 of the motor controller 50 are under ASC control, the power loss in each switch increases by approximately 3 to 5 times. j Since the short-circuit current is proportional to the power loss, the temperature of the connection of the power switch 15 also begins to rise. If this temperature exceeds the rated temperature of the switch (typically 175°C), the switch may be damaged. Therefore, if the ACS-controlled state continues for a long period of time (several seconds), the power switch 15, which is in the closed state, may be damaged. Therefore, it is not possible to maintain this state continuously while waiting for the completion of propeller feathering (10 seconds). Another solution would be to increase the size of the power switch so that it can withstand a large short-circuit current. However, this solution would significantly increase the weight and size of the motor controller 50, which is not acceptable for electric propulsion applications for aircraft.

[0059] FIG. 9A is a graph showing the time variation of the current flowing through one of the lower stage switches, S1, and the corresponding upper stage switch, S2, in an inverter. At the time indicated by the arrow in the graph, active short circuit (ASC) control is initiated for the upper stage switches (including switch S2). The current flowing through switch S1 is shown by the dotted waveform, and the current flowing through switch S2 is shown by the solid waveform. During normal operation (before ASC control), switches S1 and S2 each conduct for only half a cycle of a sine wave. When ASC control is initiated, the lower stage switch S1 is opened and does not conduct thereafter. On the other hand, the upper stage switch S2 is short-circuited, so it conducts for the entire cycle instead of just a half cycle. The peak current I due to the short-circuit current generated by the motor 30 p is relatively high (1.2 pu).

[0060] As mentioned earlier, most power switches have a maximum junction temperature specification of 175°C. Therefore, inverter design is constrained to ensure that junction temperatures do not exceed 175°C during a short circuit. Motor design is similarly constrained. The power losses in the copper windings of the motor 30 are limited by the motor's short circuit current I, which is 1.2 times the nominal operating current during a short circuit. sc Therefore, the temperature of the copper windings of the motor 30 will not exceed 230°C.

[0061] FIG. 9B is a tree diagram illustrating the stack-up of thermal resistances when a power module is connected to a heat sink. The heat source 76 at the junction of the power device (or power switch) is indicated by the circled arrow. The power device junction is located inside the power module. Inside the module Rth_Mod is a thermal resistance Rth_Mod. The power module is connected to the heat sink via a thermal interface material (TIM) (such as thermal grease). Here, Rth_TIM represents the thermal resistance of the thermal interface material, and Rth_Heatsink represents the thermal resistance of the heat sink. It is important to consider all thermal resistances to ensure that the temperature at the power device junction does not exceed the maximum allowable temperature specified for the junction (typically 175°C).

[0062] Another proposed protection method for the motor controller 50 performs active short circuit control by closing all six power switches of the inverter 14. FIG. 10 shows the three upper power switches 15a and the three lower power switches 15b of the inverter 14. These six switches are all closed in response to the detection of an HVDC bus fault 3, and the inverter 14 enters a six-switch closed (SSC) mode of operation. The motor short circuit current I sc is again 1.2 to 1.5 pu. For example, the motor short circuit current I sc is the maximum nominal operating current I of the motor 30 nom(1.0 pu). However, since this current is distributed through all six switches, the current passing through each switch is reduced by half. In other words, the short-circuit current I sc is in the range of √2×0.6 to √2×0.75 of the maximum nominal operating current. Therefore, the power loss P dis is proportional to the square of the current, so (√2×0.6) 2 =0.72 to (√2×0.75) 2 = 1.1, which is lower than or very close to the nominal operating current through the switches. Thus, power switches 15a and 15b can operate for an indefinite length of time.

[0063] FIG. 10A is a graph showing the time course of current flowing through one of the lower-stage switches, S1, and the corresponding upper-stage switch, S2, in an inverter with all six switches closed. At the time indicated by the arrow in the graph, active short circuit (ASC) control is initiated for the upper-stage switches (including switch S2). The current through switch S1 is shown by the dotted waveform, and the current through switch S2 is shown by the solid waveform. During normal operation, switches S1 and S2 each conduct for only half a cycle of a sine wave. After ASC control, the lower-stage switch S1 and the upper-stage switch S2 are short-circuited, so they conduct for the entire cycle instead of half a cycle. The peak current I due to the short-circuit current generated by the motor 30 is p is relatively low (0.6 pu). Thus, the system is designed to handle all power losses during normal operation so that the temperature of the switch junctions does not exceed the maximum allowable temperature specified for the junctions.

[0064] According to one embodiment, as shown in FIG. 11 , the electric propulsion controller 12 is configured to execute a protection function when an HVDC bus fault 3 is detected. The method 100 executed by this protection function includes a series of operations shown in FIG. 12 . Specifically, when a fault on the HVDC bus 4 is detected, the electric propulsion controller 12 commands ASC control (i.e., closing) of three power switches (either upper or lower) of the motor controller 50 (step 102). Simultaneously, or nearly simultaneously, the electric propulsion controller 12 opens the battery contactor 48 (step 104) to discharge the DC link capacitor 40. Once it is determined that the bus contactor 48 has opened (typically in less than 50 milliseconds), the electric propulsion controller 12 transitions the motor controller 50 from a three-switch closed state to a six-switch SSC state (step 108). In other words, all power switches that were left open are closed. However, it is not possible to short out all six switches while the battery 18 is connected to the motor controller 50. In an HVDC bus fault condition, a large current will be sourced from the battery 18. Therefore, the battery 18 must be disconnected before activating the SSC mode.

[0065] While the bus contactors are being opened, the three closed switches may be periodically switched from the lower switch 15b to the upper switch 15a (or vice versa). This reduces thermal stress on the switches. For example, if it takes 50 milliseconds to open the bus contactors, the motor controller 50 may hold the upper three switches 15a closed for 10 milliseconds, then open the upper switches while holding the lower switches closed for 10 milliseconds, repeating this cycle until it is determined that the bus contactors have opened. If it is determined that the bus contactors 48 are open, the motor controller 50 is commanded to enter SSC mode.

[0066] Additionally, when an HVDC bus fault 3 is detected, the electric propulsion controller 12 commands the governor 42 (see FIG. 1) to begin feathering the propeller 32. Additionally, the electric propulsion controller 12 also monitors the propeller speed w. Once feathering of the propeller 32 is complete, the motor speed drops to approximately zero, eliminating the regenerative energy provided by the motor 30. Additionally, by maintaining the motor controller 50 in SSC mode, a braking torque is applied to the motor 30, which also effectively maintains the rotational speed of the motor and propeller at zero. As a result, the motor 30 and the inverter 14 enter a safe operating mode.

[0067] In aircraft with two motor-driven propellers (engines), feathering the propeller 32 of the failed propulsion channel is crucial. The aircraft can continue to fly even with only one engine. However, without feathering the propeller 32 of the failed propulsion channel, the aircraft can eventually lose control due to the large asymmetric thrust forces.

[0068] Other faults that can cause high current and high energy conditions include a shorted power switch, a phase-to-phase or three-phase short in the power supply line between the motor controller 50 and the motor 30, and a winding-to-winding fault in the motor.

[0069] FIG. 13 illustrates some of the components of an electric propulsion unit, including a motor controller 50 having four channels 46a-46d. Each channel includes an inverter. Only inverters 14a and 14b of channels 46a and 46b are visible in FIG. 13. In the situation illustrated in FIG. 13, one of the upper power switches 15a of inverter 14a (the switch shown on the far left) is short-circuited.

[0070] In a technology developed over many years in the power electronics industry, shoot-through typically activates desaturation protection for power devices. Shoot-through can occur when a short circuit between the positive and negative voltage rails is detected, causing a large short-circuit current to flow through the upper and lower power devices. During normal operation, the upper and lower switches of the same phase leg are never on at the same time. The upper and lower switches are always out of phase, meaning that when the upper switch is closed, the lower switch is open, and vice versa. In a shoot-through condition, however, some abnormal event causes both the upper and lower switches to be closed. Possible causes of a shoot-through condition include a software error that commands both switches to be on, a processor latch-up, or electromagnetic interference that causes a false turn-on command to the gate driver. Because shoot-through is an undesirable condition, it must be detected and eliminated very quickly, which is achieved by using desaturation protection.

[0071] Desaturation protection is implemented by analog circuitry that continuously monitors the voltages of the power devices along with their commanded states. If a power device is on, the device's voltage should be low; if a power device is off, the device's voltage should be high. Because either the upper or lower switch of a power device in the same phase leg must be off, a shoot-through condition is detected when the voltages of both power devices are low at the same time (simultaneously). In this case, both power switches are quickly turned off within a few microseconds, and all remaining switches of the six switches in the inverter 14 are also turned off. If one power switch in the motor controller is shorted, the power switch cannot transition to the open state even when commanded to transition to the off state, triggering desaturation protection. This desaturation protection forces all six power switches in the inverter 14 to the open state.

[0072] The above-described protection procedure was simulated using a computer. The simulated fault showed that a large ripple in the electromagnetic torque occurred. Desaturation protection begins by first switching all six switches of the first inverter of the motor controller 50 to the open state (SSO), followed by the other inverters (the second through fourth inverters in the example shown in FIG. 13). At this point, all power switches 15a and 15b are open, causing the motor 30 to slow down. However, it takes several seconds for the motor 30 to slow down, during which time regenerative energy is generated by the motor 30 and circulated between the failed power switch and the conducting freewheeling diode 58. The simulation showed that this condition produces very high-frequency torque ripple (with an amplitude of ±1000 nm). This high-frequency torque ripple occurs at all mechanical interfaces between the motor 30 and the propeller shaft 34. If this ripple persists for several seconds, it can adversely affect the structural integrity of the motor 30 and the propeller shaft 34. To minimize the duration of such undesirable situations, the present disclosure proposes an innovative protection logic.

[0073] FIG. 14 illustrates components of a protection subsystem according to one embodiment. The subsystem includes a controller configured to take protective action to mitigate the effects of a power switch short circuit in one of the inverters of motor controller 50. More specifically, FIG. 14 illustrates a situation in which a power switch short circuit fault 7 occurs in the left-most power switch of channel 46b of motor controller 50. Motor controller 50 includes multiple inverters (two inverters 14a and 14b are shown in FIG. 14), each controlled by a corresponding inverter controller. The inverter controllers are configured to receive signals representing quadrature and direct currents from engine control unit 10, which performs vector control functions. Vector control, also known as field-oriented control, is used to control the stator currents (quadrature currents I) in a three-phase AC electric motor. q and parallel current I d ) as two orthogonal components that can be visualized as a vector. One component defines the motor's magnetic flux, and the other component defines the torque.

[0074] I d / I q The controller 17 (part of the engine control unit 10) calculates the current component I from the magnetic flux reference value and torque reference value provided by the electric propulsion controller 12. q and I d The reference value of I shown in Figure 14 is calculated. d and I q The arrow indicates I d and I q Changing the value of I changes certain characteristics of the motor and motor controller. d and I qThe value of affects the control characteristics and therefore the hardware response. More specifically, the inverter controller (not shown in Figure 14) calculates the quadrature and parallel voltages based on the quadrature and parallel current error signals. Field-oriented control is a very powerful technique that allows for accurate, high-bandwidth control of the torque of a three-phase AC motor. This control can be implemented in either hardware or software. Performing this motor control function requires knowledge of the rotor position. This information can be obtained using a position sensor (e.g., a resolver). However, a variation is possible that employs sensorless motor control. Instead of sensing rotor position with a sensor, sensorless control uses a mathematical model or an "observer" internal to the motor controller to derive rotor position from the motor currents and voltages.

[0075] Figure 14 shows I d / I q The controller 17 has two modes of operation: a normal mode (shown as "Nom" in FIG. 14) and an emergency mode (shown as "Emer" in FIG. 14). The normal mode operation of the controller is not within the scope of this disclosure. In the emergency mode, I d / I q The controller 17 supplies a calculated reference current I to discharge the DC link capacitor 40. q And I d Specifically, I d / I q The controller 17 generates a large parallel current I d This will generate no torque in the motor 30 and will quickly discharge the DC link capacitor 40, allowing a safe transition to SSC mode (6 switches closed).

[0076] Instead of transitioning all inverters in the motor controller 50 to SSO mode when a power switch short-circuit fault 7 occurs, this embodiment proposes transitioning to safe mode through staged shutdown control. FIG. 15 is a flowchart showing a protection logic sequence of a method 100a for staged shutdown control of an electric propulsion unit according to one embodiment. In this protection logic, when a power switch short-circuit fault 7 is detected, it is first determined whether the shorted power switch is included in the upper-stage power switches 15a or the lower-stage power switches 15b. Next, ASC control is commanded for the other two power switches included in the same stage as the determined switch (step 102a). If the shorted switch is one of the upper-stage power switches 15a, the other two upper-stage power switches 15a are commanded to transition from an open state to a closed state. On the other hand, if the shorted switch is one of the lower-stage power switches 15b, the other two lower-stage power switches 15b are commanded to transition from an open state to a closed state. In this way, the protection function shorts out the motor 30, thereby exerting a braking force on the motor 30. Next, the battery contactors 48 are commanded to open (step 104). If it is determined that the battery contactors 48 have opened, a large parallel current I d , which discharges the DC link capacitors 40 in all healthy channels of the motor controller 50 (step 106), causing a large parallel current I d Unlike the quadrature current Iq that generates torque in the motor 30, the parallel current I dThe DC link capacitors 40 do not contribute to torque generation, but instead generate energy that acts to reduce the magnetic field of the permanent magnets in the rotor 28. This allows the DC link capacitors 40 to be rapidly discharged within a few milliseconds. There are other methods for discharging the DC link capacitors, which are shown in more detail in Figures 19 and 21 (and described below). Finally, once the DC link capacitors 40 preceding the non-faulty inverters have been discharged, all switches remaining open in each inverter of the motor controller 50 are closed (step 108). This quickly brakes the motor 30, minimizing the duration of an unsafe state where large torque and current ripples are present. Discharging the DC link capacitors 40 is essential to ensure that personnel can safely access the faulty parts during ground maintenance work.

[0077] It is important to identify the type and location of a fault. Each fault can be identified because it has its own unique symptoms. The motor controller 50 monitors all necessary signals (input and output DC and AC voltages and currents, motor speed, rotor position, calculated motor torque, etc.) to identify the type of fault detected. Depending on the result of the determination, the power switch of the faulty motor controller channel is shorted or opened, or a "safe state mode" is selected to be implemented.

[0078] A common fault that occurs in the stator windings of an AC motor is an inter-turn fault, which occurs when two turns of the same stator winding (coil) break down and short circuit. Another type of fault that occurs in stator windings is an inter-phase fault, which occurs when two separate phases, usually adjacent phases in the same slot, break down. A three-phase fault occurs when three star-connected stator windings short circuit.

[0079] 16 illustrates components of a protection system according to a first embodiment configured to perform protective action to mitigate the effects of an inter-turn fault 9 in the stator windings of a three-phase AC motor 30. While the protection system shown in FIG. 14 only discharges the DC link capacitor 40 in the non-faulted inverter, the protection system shown in FIG. 16 also discharges the large parallel current I d By issuing the command, the DC link capacitors 40 in all inverters are discharged. This is the only point in which the present system differs from the system in Fig. 14. In this embodiment, too, a similar operation is performed when a fault such as a phase-to-phase short circuit or a three-phase short circuit occurs in the motor.

[0080] FIG. 17 is a flowchart showing a protection logic sequence of a method 100b for performing stepwise shutdown control of an electric propulsion unit in response to an inter-turn fault 9 in a stator winding, which is used in the protection system shown in FIG. 16. This protection logic first determines whether an inter-turn fault 9 has occurred in the motor 30. Next, ASC control is commanded to the three power switches in the same stage (either the upper stage or the lower stage) in each inverter (step 102). In this way, the protection function shorts out the motor 30, causing the motor 30 to exert a braking force. Next, the battery contactors 48 are commanded to open (step 104). If it is confirmed that the battery contactors 48 are open, a large parallel current I flows through the DC link capacitors 40 in all channels of the motor controller 50. d(step 106). Finally, once the DC link capacitors 40 on all channels have been discharged, all switches remaining open in each inverter 14 of the motor controller 50 are closed (step 108). When in SSC, the motor and motor controller are in safe operating mode 44. This allows the motor 30 to quickly apply braking force, minimizing the duration of unsafe conditions where large torques and current ripples are present. Discharging the DC link capacitors 40 is essential to ensure that personnel can safely access faulty components during ground maintenance operations.

[0081] 18 illustrates components of a protection system according to a second embodiment configured to perform protective action to mitigate the effects of an inter-turn fault 9 in the stator windings of a three-phase AC motor 30. In the protection system shown in FIG. 16, a large parallel current I flows through the DC link capacitor 40. d 16, whereas the protection system shown in FIG. 18 is configured to discharge the DC link capacitor 40 by switching the three power switches of the other stage (the stage that is not short-circuited) to linear mode, which is the only difference between this system and the system shown in FIG. 16. In the figure, as indicated by arrow 19, a series of control signals are sent from the electric propulsion controller 12 to the engine control unit (not shown in FIG. 18), and then from the engine control unit to the inverter controller (not shown in FIG. 18). (Note that arrow 19 does not represent a signal sent directly from the electric propulsion controller 12 to the inverter; such direct communication does not occur.) In this embodiment, similar operations are performed when a fault such as a phase-to-phase short circuit or a three-phase short circuit occurs in the motor.

[0082] A series of control signals (including switch state commands) represented by arrow 19 in FIG. 18 transitions the upper power switch 15a into linear mode (assuming the lower power switch is already in a short-circuit state). Typically, power electronic switches are operated in a closed or open mode. In linear mode, the power switch is neither closed nor open, but somewhere in between. When the power switch is open, its resistance is very high, so no current flows through it. On the other hand, when the power switch is closed, its resistance is very low, so a large current flows through it. In linear mode, while the power switch is in a half-closed or half-open state, its resistance is somewhere between the very high and very low resistance values ​​mentioned above. These switch states are achieved by applying specific voltage signals to the switch gates. Discharging the DC link capacitor 40 in linear mode has the advantage that the capacitor discharge current can be controlled by controlling the switch resistance in linear mode. Discharging the capacitor by transitioning the power switch to a (fully) closed state would result in an excessive discharge current, which could overheat and damage the capacitor. By controlling the discharge of the DC link capacitor 40, the discharge current can be limited, and the heating of the capacitor can also be limited and carried out over a longer period of time.

[0083] FIG. 19 is a flowchart showing a protection logic sequence for a method 100c for performing staged shutdown control of an electric propulsion unit in response to an inter-turn fault 9 in a stator winding, which is used in the protection system shown in FIG. 18. This protection logic first determines whether an inter-turn fault 9 has occurred in the motor 30. Next, ASC control is commanded to the three power switches in the same stage (either the upper or lower stage) of each inverter (step 102). Next, the battery contactor 48 is commanded to open (step 104). If it is determined that the battery contactor 48 is open but the voltage is lower than the maximum allowable voltage, the three switches in either the upper or lower stage are switched to linear mode, thereby discharging the DC link capacitors 40 in all channels of the motor controller 50 (step 110). That is, the three switches in one stage are switched to linear mode to discharge the DC link capacitors 40, and the three switches in the other stage are used to short-circuit the motor 30. Finally, once the DC link capacitors 40 in all inverters have been discharged, all switches remaining open in each inverter 14 are closed (step 108).

[0084] FIG. 20 illustrates components of a protection system according to a third embodiment configured to perform protective action to mitigate the effects of an inter-turn fault 9 in the stator windings of a three-phase AC motor 30. Each channel of the motor controller 50 includes a discharge resistor 79 connected in series with a solid-state switch 78, which in turn is connected in parallel with a DC link capacitor 40. In this example, the DC link capacitor 40 is discharged by closing the solid-state switch 78. As indicated by arrows 13, a series of control signals are sent from the electric propulsion controller 12 to the engine control unit (not shown in FIG. 18) and then from the engine control unit to the driver circuitry (not shown in FIG. 18) for the solid-state switch 78. (Note that arrows 13 do not represent signals sent directly from the electric propulsion controller 12 to the front-end circuitry.) Similar actions are taken in this embodiment when the motor experiences a fault, such as a phase-to-phase short circuit or a three-phase short circuit.

[0085] FIG. 21 is a flowchart showing a protection logic sequence for a method 100d of performing staged shutdown control of an electric propulsion unit in response to an inter-turn fault 9 in a stator winding, which is used in the protection system shown in FIG. 20 . This protection logic first determines whether an inter-turn fault 9 has occurred in the motor 30. Next, ASC control is commanded to the three power switches in the same stage (either the upper or lower stage) in each inverter (step 102). Next, the battery contactors 48 are commanded to open (step 104). If it is confirmed that the battery contactors 48 are open, the solid-state switches 79 are closed, thereby discharging the DC link capacitors 40 in each channel of the motor controller 50 via the discharge resistors 79 (step 112). Once the DC link capacitors 40 are discharged, all switches in each inverter 14 that remain open are closed (step 108).

[0086] Another possible abnormal condition of the motor controller 50 is a condition caused by an open-circuit fault in a power switch. Computer simulations have shown that an open-circuit fault in a power switch increases the DC component in the normally AC motor current, which can cause a large imbalance in the motor current or a large ripple in the DC link current. Therefore, an open-circuit fault in a power switch can be detected based on these three characteristics or a combination of them. Furthermore, computer simulations have shown that there is no significant effect on the motor speed or torque during an open-circuit fault in a power switch.

[0087] When a power switch has an open circuit fault, the switch cannot be controlled to transition from an open state to a closed state and remains open all the time. This fault has two effects. First, the motor phase current I a , I b , and I c The current becomes a current with a large DC component. Normal motor currents are AC currents that are close to sinusoidal, but if any switch remains open, the level of these AC currents shifts up or down and begins to contain a DC component. In addition, because there are multiple inverters and multiple DC link capacitors on the DC input side, current circulates between the DC link capacitors on the motor controller input side.

[0088] FIG. 22 illustrates components of a protection system according to one embodiment configured to provide protection action to mitigate the effects of an open-circuit fault 11 in a power switch of an inverter 14 of a motor controller 50. The system is configured to implement protection logic. In one proposed implementation, this protection logic takes the form of code executed by a processor to implement a protection control algorithm. An open-circuit fault 11 in a power switch is detected by a large DC component in the motor current, a large imbalance in the motor phase currents, a large DC current ripple, or a combination thereof, as described above. The protection logic that is invoked thus depends on the operating conditions of the electric propulsion system at the time the fault occurs. More specifically, when a field weakening operation is being performed, i.e., when a large current I flows through the motor 30, the protection logic is activated. d If a fault occurs when field weakening is being injected, the last step of the protection sequence is to perform ASC control for all inverter switches. d If the fault occurs when no current is injected, the final step in the protection sequence is to control the motor controller 50 to enter the SSO state (opening the six switches).

[0089] Field weakening control is performed when it is necessary to maintain the nominal operating speed of the motor 30 at a relatively low DC link voltage. The motor speed is proportional to the voltage supplied by the motor controller 50. As the motor speed increases, the back electromotive force (EMF) generated by the motor 30 also increases. For the motor controller 50 to drive the motor 30 at a given speed, the motor controller 50 must supply a voltage greater than the back electromotive force (EMF) generated by the motor 30. However, if the DC link voltage is low, the motor controller 50 cannot supply a voltage greater than the motor's back electromotive force voltage. In this case, without field weakening control, the speed of the motor 30 will decrease. In field-oriented control of the motor, the Iq component of the motor current contributes to torque generation, while the I dThe I component contributes to the generation of a motor voltage that effectively weakens the magnetic field, thereby reducing the back electromotive force (EMF) generated by the rotation of the motor. Therefore, typically, when the DC link voltage is sufficiently high, the I component in the motor controller 50 d The current reference point is set to zero. This is efficient because the motor controller can maximize the torque of the motor 30 by using all available current as the Iq component. However, when the DC link voltage is low, the Iq component is used to maintain the motor speed. d It is necessary to inject current to reduce the back electromotive force of the motor, which allows it to operate even in low DC voltage conditions. q Current is injected in these situations, and often when operating at reduced levels. I q When current is injected, some of the available current is used to maintain the speed of the motor 30 rather than to generate torque. Note that full torque can be supplied by increasing the current capability of the motor controller during field weakening.

[0090] When the motor 30 is operated in the field weakening region, i.e., at a low DC link voltage, I d At this time, if the motor controller 50 suddenly stops operating and enters the SSO state, the current to the motor 30 d The current injection is also stopped. In this state, the motor 30 continues to rotate at the same speed, but at this point there is nothing to oppose the back electromotive force of the motor (I dThe motor's back electromotive force increases rapidly because the regenerative current generated by the motor is rectified by the freewheeling diode 58 of the motor controller 50, resulting in a voltage significantly higher than the DC link voltage provided by the battery 18. When this occurs, the regenerative current generated by the motor 30 is supplied to the battery 18 in an uncontrolled manner. Because the battery 18 is a low-impedance power source and the regenerative power is significantly high, excessive current flows into the battery 18. This current is much higher than the battery's nominal charging current. This situation is undesirable because it could lead to battery overcharging, overheating, and thermal runaway. Therefore, the motor controller 50 cannot be controlled to enter SSO mode during field weakening control. Instead, it is preferable to use ASC control to short-circuit the motor 30. This allows the regenerative current to circulate only between the motor 30 and the motor controller 50. However, when the motor 30 is not in field weakening control mode, SSO control is preferable because it has less adverse effects on the battery 18. Also, unlike ASC control, SSO control does not generate any additional braking force acting on the electric propulsion system.

[0091] 23 illustrates protection logic for mitigating the effects of the power switch open fault 11 shown in FIG. 22, according to one embodiment. regenIf the current limit is greater than the limit current, safe mode 44 is activated. If not operating in the field weakening control region, motor controller 50 is commanded to transition to SSO mode. This allows the electric propulsion system to continue limited operation of the electric propulsion motor instead of shutting down the system completely. If motor 30 is operating in field weakening control mode, motor controller 50 is commanded to perform ASC control, which closes three switches in the inverter stage that does not include the switch with the open-circuit fault. Next, battery contactor 48 is opened, and DC link capacitor 40 is discharged using one of the techniques described with reference to Figures 16-21. In a final step, motor controller 50 in ASC control mode closes all healthy switches in the inverter (without an open-circuit fault).

[0092] While the foregoing description has described a system and method for protecting an aircraft electric propulsion motor drive system using various embodiments, those skilled in the art will recognize that various modifications may be made and equivalents may be substituted for components thereof without departing from the scope of the teachings of the present disclosure. In addition, various modifications may be made to adapt to a particular situation without departing from the scope of the present disclosure. Therefore, it is not intended that the scope of the claims be limited to the specific embodiments described.

[0093] The electric propulsion controller and engine control unit (also known as the engine controller) of the present disclosure can be implemented using hardware, software, or a combination thereof. For example, the controller can be implemented using configurable hardware, programmable devices, or both. Configurable hardware includes hardware that can be configured to perform one or more functions of the controller. Programmable devices include any device that can be programmed to implement one or more functions of the controller. Programmable devices include, but are not limited to, a central processing unit, a microprocessor, or a digital signal processor. A programmable device is configured to execute software or firmware, for example, in the form of program instructions, to implement one or more functions of the controller. The program instructions can be stored on any computer-readable, non-transitory, tangible storage medium for execution by or transfer to the programmable device.

[0094] The term "control system" as used in the claims includes one or more controllers. For example, a control system may include an electric propulsion controller, an engine control unit, and multiple inverter controllers.

[0095] The methods described herein may be encoded as executable instructions and embodied in a computer-readable, non-transitory, tangible storage medium, such as, but not limited to, storage and / or memory devices, that, when executed by a processing or computing system, cause the system to perform at least a portion of the methods described herein.

[0096] Further aspects of the present disclosure are described in the appendix below.

[0097] A1. A method for protecting an electric propulsion system in response to an open fault of a power switch, comprising: (a) detecting an open fault of a power switch of one stage in an inverter of a motor controller; (b) determining whether the open fault of the power switch occurred during field weakening control; (c) performing a protective action based on the determination result of step (b).

[0098] A2. The method of claim A1, wherein step (c) includes opening another power switch of the inverter if the open fault of the power switch did not occur during field weakening control.

[0099] A3. If the open fault of the power switch occurs during field weakening control, step (c) closing the power switches of the other stages in the inverter; opening a battery contactor to disconnect the battery from the motor controller; Discharging a DC link capacitor of the inverter; and closing all healthy power switches in the one stage after the DC link capacitor is discharged.

[0100] A4. The method of claim A3, wherein step (a) includes detecting a condition in which the motor current has a large DC component, a condition in which the motor phase currents have a large imbalance, a condition in which there is a large DC current ripple, or a combination of these conditions.

[0101] A5. Battery and a DC bus connected to receive DC power from the battery; a motor controller connected to receive DC power from the DC bus; an AC motor connected to receive AC power from the motor controller; a propeller mechanically connected to the AC motor; A control system comprising: (a) detecting an open fault in a power switch of one stage in an inverter included in the motor controller; (b) determining whether the open fault of the power switch occurred during field weakening control; (c) performing a protective action based on the determination result of step (b).

Claims

1. 1. A method for protecting an electric propulsion system in response to the occurrence of a fault, comprising: Shorting a power switch of an inverter included in a motor controller to reroute a regenerative current generated by a motor electrically connected to the motor controller and mechanically connected to a propeller; feathering the propeller while the motor generates regenerative current; opening a battery contactor to disconnect the battery from the motor controller; the fault is a short circuit in one of the power switches included in one stage of one inverter; The method further includes discharging a DC link capacitor of another inverter included in the motor controller.

2. Shorting the power switch closing other power switches in the stage containing the one power switch that was shorted prior to opening the battery contactor; and closing all open power switches in the motor controller after the DC link capacitor has discharged.

3. 2. The method of claim 1, wherein the fault is a short circuit in a stator of the motor, the method further comprising discharging DC link capacitors of all inverters included in the motor controller.

4. Shorting the power switch closing a power switch of one stage in each inverter before opening the battery contactor; and closing all open power switches in the motor controller after the DC link capacitor has discharged.

5. The fault is a DC bus fault, and shorting the power switch closing a power switch of one stage in each inverter before opening the battery contactor; and closing all open power switches in the motor controller after the DC link capacitor has discharged.

6. A battery, a DC bus connected to receive DC power from the battery; a motor controller connected to receive DC power from the DC bus, the motor controller including a plurality of inverters; an AC motor connected to receive AC power from the motor controller; a propeller mechanically connected to the AC motor and including variable pitch propeller blades; a governor configured to adjust the pitch of the propeller blades in a feathering operation; A control system comprising: Shorting a power switch of the inverter included in the motor controller to redirect a regenerative current generated by the AC motor; operating the governor to feather the propeller while the motor is generating regenerative current; opening a battery contactor to disconnect the battery from the motor controller; and a control system configured to perform operations including discharging a DC link capacitor of an inverter included in the motor controller; Shorting the power switch closing a power switch of one stage in each inverter before opening the battery contactor; and closing all open power switches in the motor controller after the DC link capacitor has discharged.

7. 1. A method for staged shutdown control of a motor controller including multiple inverters, comprising: (a) closing a power switch of one stage among power switches of each inverter included in the motor controller to change the path of a regenerative current generated by a motor electrically connected to the motor controller and mechanically connected to a propeller; (a') feathering the propeller while the motor generates regenerative current; (b) opening a battery contactor to disconnect the battery from the motor controller; (c) discharging a DC link capacitor of each inverter included in the motor controller; (d) closing all open power switches in the motor controller after the DC link capacitor has discharged.

8. 8. The method of claim 7, wherein step (c) includes commanding a large DC current.

9. 8. The method of claim 7, wherein step (c) includes transitioning other stages of power switches of the inverter to a linear mode.

10. 8. The method of claim 7, wherein step (c) comprises closing a solid state switch connected in series with a discharge resistor connected in parallel with the DC link capacitor.

Images