Protection systems and motor controllers for aircraft electric propulsion motors

Abstract

To provide a system and a method for providing differential protection for an electric propulsion system which overcomes a defect of a prior art.SOLUTION: There is provided a method and an apparatus for detecting and characterizing arc faults in an aerospace electric propulsion system and then coordinating the operation of various elements of the protection system to execute a fault-clearing sequence. In a current-based method, the arc is detected and characterized based on differential readouts from current sensors. The difference between currents measured at two ends of a protection zone are compared to a difference threshold. In a power-based method, the arc is detected and characterized based on differential readouts from voltage and current sensors. The differential voltage and current readouts are used to compute the respective powers at two ends of a protection zone. The difference between the respective powers is integrated over a period of time and then the integrated difference is compared to a difference threshold. A differential protection trip mode is invoked when the difference threshold is exceeded.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] This disclosure generally relates to power conversion systems, and more particularly to power conversion systems for converting direct current (DC) to alternating current (AC). In particular, this disclosure relates to methods and apparatus for converting DC power to AC power in aircraft electric propulsion systems. [Background technology]

[0002] Aircraft with electric propulsion systems (hereinafter referred to as "electric aircraft") are equipped with electric motors that convert electrical power into mechanical power. For example, an electric motor can rotate one or more propellers on an aircraft to provide thrust. More specifically, an electric motor has a loop of wiring (hereinafter referred to as "stator winding") in a magnetic field. When current passes through the stator winding, the magnetic field exerts torque on the rotor, which in turn rotates the shaft. Electrical energy is converted into mechanical action in this process.

[0003] Electric aircraft can take various forms. For example, an electric aircraft may be an aircraft, a rotorcraft, a helicopter, a quadcopter, an unmanned aerial vehicle, or any other suitable type of aircraft. In the case of electric aircraft, the battery is large and designed to supply a large amount of power for propulsion. In one implementation, the battery is connected to a high-voltage direct current (HVDC) bus, which is also supplied by a power generation source. In the aerospace industry and as used herein, the term "high voltage" in the context of direct current means 500V. DC This refers to any higher DC voltage. In conventional methods, such a high DC voltage is typically 230V in three phases. AC It is derived from the rectification of electrical power.

[0004] In HVDC systems, undesirable arcing can occur. An electric arc, or arc discharge, is the electrical breakdown of a gas that causes a prolonged discharge. An electric current passing through a normally non-conductive medium such as air generates a plasma. State-of-the-art systems typically rely on overcurrent detection to protect against electrical faults in HVDC distribution systems. Overcurrent protection is calculated by multiplying the square of the current by the time (hereinafter referred to as "i 2 Overcurrent protection is triggered using a fuse and protects against excessive current that could damage wiring and adjacent structures. Typical overcurrent protection includes passive solutions such as fuses, and / or active solutions such as configuring a controller to open an electromechanical contactor in response to an overcurrent indication received from a current sensor.

[0005] Overcurrent protection is an efficient solution for isolating faults, but it is considered a "slow" protection because the load current must significantly exceed (or be greater than) the nominal current at which detection occurs. The amount of accidental energy released during an overcurrent fault can be unacceptably large. In a typical airborne electrical system, 35 A is a common overcurrent. rms "Fast" protection may be activated in response to the detection of a current exceeding a certain threshold. For example, "fast" protection may be implemented using differential protection (DP), which examines leakage currents in a specific zone of the system. Differential protection is a unit-type protection for a designated zone or piece of equipment. Differential protection works on the principle of Kirchhoff's current law, which states that for any node (junction) in an electrical circuit, the sum of the currents flowing into that node is equal to the sum of the currents flowing out of that node.

[0006] In a typical differential protection implementation, current is measured at two points, and any difference between the two current measurements (indicating current leakage) is calculated. Protection is triggered if the difference exceeds a preset threshold. The sensitivity of differential protection allows for much faster triggering than when overcurrent protection is employed, as it can detect small leakage currents in one zone without the load current exceeding the nominal current. In the case of high-impedance faults, the fault can be detected in the early stages of a short circuit with small leakage currents before the fault condition causes thermal runaway.

[0007] 1000 V DC At high power and voltage levels that may exceed 100%, electric propulsion systems benefit from incorporating the ability to provide “fast protection” using differential protection, thereby limiting the accidental energy generated during a fault. [Overview of the Initiative] [Means for solving the problem]

[0008] The subject matter disclosed below in some detail relates to a method and apparatus for detecting and characterizing arc faults in aerospace electric propulsion systems, and then coordinating the operation of various elements of a protection system to perform a fault removal sequence. 1000 V DCAt high power and voltage levels that may exceed certain limits, electric propulsion systems benefit from incorporating the ability to provide “fast” fault isolation using differential protection, thereby limiting accidental energy generated during a fault. According to one proposed implementation, the motor controller performs active short-circuit protection based on information collected and processed in a differential protection control module (controller). The differential protection control module receives sensor data acquired across the differential protection zone and processes that sensor data to detect the occurrence of an arc in the battery pack. According to a current-based embodiment, the arc is detected and characterized based on differential readouts from current sensors that sense current at two ends of the protection zone. In the current-based embodiment, the difference between the respective measured currents at the two ends of the protection zone is compared to a differential threshold. If the differential threshold is exceeded, a differential protection trip mode of operation is invoked.

[0009] According to the power-based embodiment, arcs are detected and characterized based on differential readouts from voltage and current sensors that sense voltage and current at two ends of the protection zone. In the power-based embodiment, the differential readouts from the voltage and current sensors are then used to calculate the respective measured powers at the two ends of the protection zone, the difference between the respective measured powers is integrated over a period of time, and the integrated difference is then compared to a differential threshold. If the differential threshold is exceeded, the differential protection trip mode of operation is invoked.

[0010] One key difference from conventional aircraft power systems is that the electric propulsion system is electrically floating, either isolated or on high-impedance ground. Therefore, there is no short-circuit current during a line-to-ground fault. Another factor is the system's operating voltage. High voltages can cause different types of faults, including series and parallel arc discharge faults in the system, which are difficult to detect. Finally, electric propulsion systems include high-power motors that can regenerate during a HVDC fault. It is crucial for the system to distinguish which load caused the fault and to isolate it. Healthy motor loads can regenerate during a fault, but may not need to trip.

[0011] The protection scheme proposed herein provides “high-speed” protection for airborne electric propulsion systems. The capabilities of the proposed protection system include (a) the ability to detect small leakage currents of high-impedance faults, (b) the ability to detect arc faults (series and parallel), (c) the ability to isolate faults in fault zones while maintaining healthy load operation, and (d) system fault regulating.

[0012] Various embodiments of systems and methods for providing differential protection for electric propulsion systems are described below in some detail, one or more of these embodiments may be characterized by one or more of the following aspects.

[0013] One aspect of the subject matter disclosed in detail below is a method for protecting an electric propulsion system, the method comprising: (a) sensing a first current supplied by a battery pack at a first end of a protection zone which includes at least a portion of power lines connected to receive current from a battery pack and supply current to a motor controller; (b) sensing a second current supplied to a motor controller at a second end of the protection zone; (c) receiving sensor data representing the magnitude of the first current sensed in step (a); (d) receiving sensor data representing the magnitude of the second current sensed in step (b); (e) calculating a current difference equal to the difference between the magnitude of the first current and the magnitude of the second current; (f) determining that the current difference exceeds a differential threshold indicating a fault in the protection zone; (g) instructing the electric propulsion system to operate in a fault isolation mode in response to step (f); and (h) operating the electric propulsion system in a fault isolation mode, wherein steps (c) through (g) are performed by a differential protection control module.

[0014] Another aspect of the subject disclosed in detail below is an electric propulsion system comprising: a battery pack including a parallel string of battery modules; a busbar connected to receive DC power from the battery pack; a power line connected to receive DC power from the busbar; a motor controller connected to receive DC power from the power line and configured to convert the DC power to AC power; an AC motor connected to receive AC power from the motor controller; one or more first current sensors connected to a first end of a protection zone including at least a portion of the power line to sense a first current supplied by the battery pack and configured to output first sensor data representing the magnitude of the first current; a second current sensor connected to a second end of the protection zone to sense a second current supplied to the motor controller and configured to output second sensor data representing the magnitude of the second current; and a differential protection control module connected to receive the first and second sensor data. The differential protection control module is configured to perform an operation that includes (a) calculating a current difference equal to the difference between the magnitude of a first current and the magnitude of a second current; (b) determining that the current difference exceeds a differential threshold indicating a fault in the protection zone; and (c) instructing the electric propulsion system to operate in a fault isolation mode in response to operation (b).

[0015] Further aspects of the subject disclosed in detail below are methods for protecting an electric propulsion system, the methods comprising: (a) sensing a first current supplied by a battery pack at a first end of a protection zone which includes at least a portion of power lines connected to receive current from a battery pack and supply current to a motor controller; (b) sensing a second current supplied to a motor controller at a second end of the protection zone; (c) sensing a first voltage at the first end of the protection zone; (d) sensing a second voltage at the second end of the protection zone; (e) receiving sensor data representing the magnitude of the first current sensed in step (a); (f) receiving sensor data representing the magnitude of the second current sensed in step (b); and (g) sensing the magnitude of the first voltage sensed in step (c). (h) receiving sensor data representing the magnitude of a second voltage sensed in step (d), (i) calculating an integrated power difference based on the magnitudes received in steps (e) through (h) at consecutive moments between time windows, the integrated power difference being derived by integrating the difference between a first power at a first end of the protection zone and a second power at a second end of the protection zone, (j) determining that the integrated power difference exceeds an integrated differential threshold indicating a fault in the protection zone, (k) instructing the electric propulsion system to operate in fault isolation mode in response to step (j), and (l) operating the electric propulsion system in fault isolation mode, steps (e) through (k) being performed by the differential protection control module.

[0016] A further aspect of the subject disclosed in detail below includes a battery pack comprising a parallel string of battery modules; a busbar connected to receive DC power from the battery pack; a power line connected to receive DC power from the busbar; a motor controller connected to receive DC power from the power line and configured to convert the DC power to AC power; an AC motor connected to receive AC power from the motor controller; and a first sensor connected to a first end of a protection zone comprising at least a portion of the power line to sense a first current supplied by the battery pack and configured to output first sensor data representing the magnitude of the first current. The electric propulsion system comprises a current sensor, a first voltage sensor connected to sense a first voltage at the first end of the protection zone current and configured to output second sensor data representing the magnitude of the first voltage, a second current sensor connected to sense a second current supplied to the motor controller at the second end of the protection zone and configured to output third sensor data representing the magnitude of the second current, a second voltage sensor connected to sense a second voltage at the second end of the protection zone current and configured to output fourth sensor data representing the magnitude of the second voltage, and a differential protection control module connected to receive the first to fourth sensor data. The differential protection control module is configured to perform an operation that includes (a) calculating an integrated power difference based on first to fourth sensor data received at consecutive moments during a time window, the integrated power difference being derived by integrating the difference between a first power at a first end of the protection zone and a second power at a second end of the protection zone; (b) determining that the integrated power difference exceeds an integrated differential threshold indicating a fault in the protection zone; and (c) instructing the electric propulsion system to operate in a fault isolation mode in response to operation (b).

[0017] Further aspects of the subject matter disclosed in detail below are methods for protecting an electric propulsion system, the methods comprising: (a) sensing a DC current supplied by a battery pack at a first end of a protection zone which includes at least a portion of power lines connected to receive a DC current from a battery pack and supply a DC current to a motor controller; (b) sensing an AC current supplied to an AC motor by a motor controller at a second end of the protection zone; (c) sensing a DC voltage at the first end of the protection zone; (d) sensing an AC voltage at the second end of the protection zone; (e) receiving sensor data representing the magnitude of the DC current sensed in step (a); (f) receiving sensor data representing the magnitude of the AC current sensed in step (b); and (g) receiving sensor data representing the magnitude of the DC voltage sensed in step (c). The steps include (h) receiving sensor data representing the magnitude of the AC voltage sensed in step (d), (i) calculating an integrated power difference based on the magnitudes received in steps (e) through (h) and the magnitude of power loss in the motor controller at consecutive moments between time windows, the integrated power difference being derived by integrating the difference between a first power at a first end of the protection zone and a second power at a second end of the protection zone, minus the power loss, (j) determining that the integrated power difference exceeds an integrated differential threshold indicating a fault in the protection zone, (k) instructing the electric propulsion system to operate in fault isolation mode in response to step (j), and (l) operating the electric propulsion system in fault isolation mode, wherein steps (e) through (k) are performed by the differential protection control module.

[0018] Other aspects of systems and methods for providing differential protection for electric propulsion systems are disclosed below.

[0019] The shapes, functions, and effects described in the previous section may be realized individually in various embodiments or incorporated into yet another embodiment. Hereinafter, various embodiments will be described with reference to the drawings in order to illustrate the above-described embodiments and other embodiments. [Brief explanation of the drawing]

[0020] [Figure 1] This figure shows an arc fault across two DC power lines in an HVDC power distribution system in an aerospace electric propulsion system equipped with a DC DP control module that monitors a DC protection zone, according to the first embodiment. [Figure 2] This is a flowchart identifying the steps of the algorithm performed by the DC DP control module shown in Figure 1, according to one proposed implementation. [Figure 3] This figure shows an arc fault across two DC power lines in an HVDC power distribution system in an aerospace electric propulsion system, which includes a power DP control module that monitors the DC power protection zone, according to a second embodiment. [Figure 4] This is a flowchart identifying the steps of algorithm 130 performed by the power DP control module shown in Figure 3, according to another proposed implementation. [Figure 5] This diagram illustrates a scenario in which a power DP control module detects the occurrence of a high-impedance parallel arc along the rails of an HVDC busbar. [Figure 5A] Figure 5 is a screenshot from an oscilloscope showing the currents IA and IB, and voltages VA and VB during the generation of a high-impedance parallel arc within the DC power protection zone. [Figure 5B] Figure 5 is a flowchart showing a detection algorithm performed by the power DP control module as one method for monitoring the DC power protection zone and detecting parallel arcs. [Figure 6] This diagram illustrates a scenario in which a power DP control module detects the occurrence of a series arc along the rails of an HVDC busbar. [Figure 6A]Figure 6 is a screenshot from an oscilloscope showing the currents IA and IB, and voltages VA and VB during a series arc within the DC power protection zone. [Figure 6B] Figure 6 shows a flowchart illustrating a detection algorithm implemented by the power DP control module as an alternative method for monitoring the DC power protection zone and detecting series arcs. [Figure 7] This figure shows an arc fault across two DC power lines in an HVDC power distribution system in an aerospace electric propulsion system, which includes a hybrid (DC / AC) power DP control module that monitors DC / AC power protection zones, according to a third embodiment. [Figure 8] This figure shows an arc fault across two DC power lines in an aerospace electric propulsion system comprising two motors and two motor controllers, according to a fourth embodiment. [Modes for carrying out the invention]

[0021] The following will refer to the above drawings, where similar elements in different drawings share the same reference number.

[0022] Exemplary embodiments of systems and methods for providing differential protection for electric propulsion systems are described below in some detail. However, not all actual implementation forms are described herein. Those skilled in the art will understand that in developing any such embodiment, numerous implementation-specific decisions must be made to achieve the specific goals of the developer, which differ for each implementation form, such as compliance with system-related and business-related constraints. Furthermore, while such development efforts can be complex and time-consuming, they will still be considered routine work for those skilled in the art who benefit from this disclosure.

[0023] The aircraft electric propulsion systems disclosed herein include an electric motor that drives the rotation of a propeller, one or more motor controllers configured to convert direct current (DC) to alternating current (AC), and a DC power source (e.g., a battery system). The DC power source may include, for example, a DC-DC converter for increasing, i.e., boosting, the voltage level of a low-voltage DC power source to form a high-voltage DC (HVDC) power source. As used herein, a DC-DC converter is an electrical or electromechanical device used to change the voltage level of a DC power source. The HVDC power can then be supplied to one or more inverters of the motor controller to form a high-voltage AC power source.

[0024] 1000 V DC At high power and high voltage levels that may exceed 500V, electric propulsion systems benefit from incorporating the ability to provide "fast" fault isolation using differential protection, thereby limiting the accidental energy generated during a fault. One key difference from conventional aircraft power systems is that electric propulsion systems are electrically floating, either isolated or on high-impedance grounds. Therefore, there is no short-circuit current during a line-to-ground fault. Another factor is the operating voltage of the system. At high voltages, different types of faults can occur, and series and parallel arc discharge faults can occur in the system, which are difficult to detect. Finally, electric propulsion systems include high-power motors that can regenerate into the fault during a HVDC fault. It is crucial for the system to distinguish which load caused the fault and to isolate it. Healthy motor loads can regenerate during a fault but should not trip.

[0025] The electric propulsion system disclosed in detail below includes at least one DP control module configured to (a) receive sensor data from current and voltage sensors having locations defining the source and load ends of a protection zone, (b) process the sensor data to derive current and voltage measurements, (c) detect when the difference in measurements indicates the occurrence of a fault in the protection zone, and (d) trigger a change in the state of a contactor and / or switch that protects the equipment of the electric propulsion system from damage by isolating the fault.

[0026] The protection scheme proposed herein provides “high-speed” protection for airborne electric propulsion systems. In particular, the DP control module disclosed herein has one or more of the following capabilities: (a) the ability to detect small leakage currents of high-impedance faults; (b) the ability to detect arc faults (series and parallel); (c) the ability to isolate faults in fault zones while maintaining healthy load operation; and (d) system fault regulating.

[0027] Figure 1 shows an aerospace electric propulsion system 2 equipped with a DC differential protection control module 20a (hereinafter referred to as "DCDP control module 20a") according to the first embodiment, which converts DC power to AC power. The DCDP control module 20a shown in Figure 1 is configured to isolate arc faults 3 between the positive HVDC power line 4a and the negative HVDC power line 4b of the HVDC power distribution system 44.

[0028] The electric propulsion system 2 includes a motor controller 50 that converts DC power from the HVDC distribution system 44 to AC power. Therefore, as used herein, the term “motor controller” includes a DC-AC converter (not shown in Figure 1). The electric propulsion system also includes an AC motor 30 that receives AC power from the motor controller 50 via multiple or sets of AC power lines 6.

[0029] The electric propulsion system 2 shown in Figure 1 further includes a propeller 32 that is rotationally driven by an AC motor 30. The propeller 32 includes a propeller shaft 34 mechanically connected to the output shaft of the AC motor 30 (not shown in Figure 1) and a plurality of propeller blades 36. In addition, the electric propulsion system 2 includes a governor 42 configured to maintain a constant rotational speed of the propeller 32 by changing the pitch of the propeller blades 36. The hydraulic governor achieves this by using a hydraulic valve 54 to control the flow of engine oil through the hydraulic mechanism of the propeller 32.

[0030] In some implementations, the motor controller 50 has multiple channels that supply AC current to each set of stator windings of the AC motor 30. Each channel of the motor controller 50 comprises an inverter (not shown in Figure 1) with a set of power switches and an inverter controller (not shown in Figure 1) that controls the state of the power switches. The power switches are connected to the stator windings of the AC motor 30. The motor controller 50 further includes a number of pairs of sensors (not shown in Figure 1) that sense the voltage and current of the AC power signal output by the inverter, and the sensor data is fed back to the respective inverter controller. The operation of the inverter is controlled by the inverter controller, which sends a switch control signal to the inverter and receives a switch state signal from the inverter via a switch signal line (not shown in Figure 1). The inverter of the motor controller 50 converts DC power into multiphase AC power for the AC motor 30. The inverter and inverter controller together form a DC-AC converter that is part of the motor controller 50. More specifically, the inverter controller generates a pulse-width modulated signal that serves as a reference current and voltage that needs to be supplied to the AC motor 30 to achieve optimal mechanical torque output. These reference signals are modulated using a PWM generation function that generates commands sent to the gate drivers of the inverter's power switches, which are controlled by the inverter controller.

[0031] In the embodiment shown in Figure 1, the DC power source is a battery pack 18. The battery pack 18 is connected to an HVDC power distribution system 44 via a battery distribution unit 28 (hereinafter, "BPDU 28"). The BPDU 28 is a housing that contains the hardware necessary for monitoring, rectifying, and controlling the DC power output from the battery pack 18. The BPDU 28 includes a positive busbar 38a and a negative busbar 38b (hereinafter, "busbars 38a and 38b"). The motor controller 50 receives DC power from the BPDU 28 via the HVDC power distribution system 44.

[0032] According to some embodiments, the battery pack 18 includes a plurality of independent battery strings connected in parallel to busbars 38a and 38b. Each battery string comprises several battery modules 24 connected in series to form a battery string with a required usable voltage / potential. In the example shown in Figure 1, each battery string includes a first one-side string of (e.g., four) series-connected battery modules, and the first one-side string is indirectly connected to a second one-side string of (e.g., four) series-connected battery modules (via respective intermediate battery disconnection units not shown in Figure 1).

[0033] The BPDU 28 further includes a first set of string contactors 8 connecting one end of the battery string to the busbar 38a, and a second set of string contactors 8 connecting the other end of the battery string to the busbar 38b. (A contactor is an electrically controlled switch used to switch power circuits. Contactors are designed to be directly connected to high-current load devices.) The high-voltage DC distribution system 44 receives DC power signals from the battery string via the string contactors 8 and supplies the DC power to the motor controller 50.

[0034] The BPDU 28 further includes a battery pack management system 22 (hereinafter, "BPMS 22"). The operation of the battery pack 18 is managed by the BPMS 22. By using multiple parallel battery strings, redundancy can be provided in the event of a failure within the pack, for example, a single string failure. The BPMS 22 may be configured to ensure redundant protection, fail-safe operation, and selective shutdown of battery strings. The BPMS 22 may be further configured to protect the battery from overcharging and to prevent other events or combinations of events that could lead to thermal runaway of the battery. More specifically, the switching state of the string contactor 8 can be controlled by the BPMS 22 to open in response to the detection of a fault condition (e.g., a short circuit) in one of the battery strings.

[0035] The DC current flowing through the positive busbar 38a is sensed by the current sensor 16a. The current sensor 16a (and other current sensors referenced herein) is configured to output sensor data representing the magnitude of the sensed current. Each battery string includes multiple battery modules 24 connected in series. The DC current flowing through each battery string is sensed by their respective current sensors (e.g., current sensors 16c and 16d shown in Figure 1). Each battery module 24 consists of individual cells (not shown in Figure 1) arranged in parallel / series. Each battery module 24 can be monitored by an associated module monitoring unit (not shown in Figure 1). Each module monitoring unit includes sensors for independently sensing virtual cell voltage (voltage across multiple parallel battery cells) and individual cell temperature. The module monitoring unit also includes a balancing circuit. Each module monitoring unit built into the battery pack 18 communicates sensor data representing the virtual cell voltage and individual cell temperature to the BPMS 22. The BPMS 22 also receives data from the current sensors 16c and 16d.

[0036] The system further includes a DC voltage conversion system (not shown in Figure 1) configured to receive low-voltage DC power from a battery pack 18 and convert that low-voltage DC power to high-voltage DC power. The HVDC power distribution system 44 shown in Figure 1 includes positive and negative HVDC power lines 4a and 4b connected to carry high-voltage DC power from the DC voltage conversion system to a motor controller 50. For example, the HVDC power lines 4a and 4b may be connected to a pair of HVDC busbars (not shown in Figure 1) which are then connected to receive HVDC power from the DC voltage conversion system.

[0037] A DC voltage conversion system (not shown) comprises a voltage converter and a converter controller. The converter controller generates control signals using specific switching modulation algorithms, such as pulse width modulation, phase shift modulation, interleaved modulation, or a combination of two or three. The voltage converter is controlled by the converter controller using one of the aforementioned specific modulation methods to convert an input current at an input voltage to an output current at an output voltage, while achieving specific electrical performance requirements, such as improved efficiency, reduced current ripple, and minimized noise.

[0038] As shown in Figure 1, the system further includes an engine control unit 10 (ECU). The engine control unit 10 interfaces with an inverter controller (not shown in Figure 1) inside the motor controller 50. The inverter controller of the motor controller 50 is communicatively coupled to receive control signals from the engine control unit 10 and send feedback signals to the engine control unit 10. The engine control unit 10 is responsible for managing and coordinating all inverter controllers.

[0039] The engine control unit 10 is further communicatively coupled to the electric propulsion controller 20 (EPC), which controls the overall operation of the aircraft electric propulsion system shown in Figure 1. The electric propulsion controller 12 receives pilot input from the thrust control lever and the pitch control lever (not shown in Figure 1). The electric propulsion controller 12 communicates with the BPMS 22 via a first controller area network (CAN1) and with the engine control unit 10 via a second controller area network (CAN2). The electric propulsion controller 12 transmits analog control signals to the governor 42 to control the feathering of the propeller 32. The electric propulsion controller 12 transmits information for display to the flight display unit (not shown in Figure 1) via an Ethernet connection.

[0040] Under normal operation, the battery pack 18 supplies HVDC power to the motor controller 50. The motor controller 50 converts the DC power to AC power and rotates the AC motor 30. The engine control unit 10 receives Run / Stop and Torque commands from the electric propulsion controller 12. The electric propulsion controller 12 monitors pilot input and propeller speed. In response to pilot input requesting thrust, the electric propulsion controller 12 calculates a Torque command for the motor controller 50. The motor controller 50 responds by applying an AC current of appropriate magnitude and phase to the AC motor 30, which generates torque to rotate the propeller 32. The governor 42 adjusts the rotational speed of the propeller 32 by changing the pitch of the propeller blades 36. If the pilot requests more thrust, the electric propulsion controller 12 commands the motor controller 50 to provide more torque. The propeller 32 tends to increase its speed, but the governor 42 responds to the increase in speed by increasing the blade pitch, which in turn results in an increase in thrust commanded by the pilot. Thus, the speed of the propeller 32 is kept constant throughout all operations, and the propeller thrust is changed by changing the motor torque and propeller pitch settings.

[0041] The system shown in Figure 1 further includes an overcurrent protection control module 14 configured to protect the HVDC power distribution system 44 from faults. The overcurrent protection control module 14 is configured to execute an algorithm in which the state of contactor 8 is controlled depending on whether the current flowing through the positive HVDC power line 4a is excessive (greater than a specified threshold). The current flowing through the positive HVDC power line 4a is sensed by a current sensor 16a, which outputs an analog signal indicating the magnitude of the current to the overcurrent protection control module 14. Overcurrent protection protects against excessive currents that could damage wiring and aircraft by multiplying the current by the square of the time (i 2 It is triggered using the result of multiplying by t).

[0042] Still referring to FIG. 1, the motor controller 50 includes a protection circuit 26 configured to operate the motor controller 50 in a safe mode in response to a specific fault. The protection circuit 26 is hardware-based. The protection circuit 26 is typically implemented by an analog circuit. The protection circuit 26 is capable of issuing switch control signals that respectively close the power switches of the inverter in response to commands received from the electric propulsion controller 12 or the DCDP control module 20a, and the commands are then issued in response to fault detection. More specifically, the protection circuit 26 sends a low power input to the gate driver of the power switch.

[0043] FIG. 1 shows a situation where an arc fault 3 (for example, a short circuit) occurs between HVDC power lines 4a and 4b. In this example, the HVDC power lines 4a and 4b are 1000 to 1600 V DC provide a nominal voltage, and 1000 A DC can carry a nominal current. In the event of such a fault, the battery pack 18 can 7000 A DC provide a large fault current that can be as high as that. As described above, not only does the battery pack 18 supply power for the fault, but also the AC motor 30 supplies power for the fault via the motor controller 50, causing a short circuit of current.

[0044] However, due to the intermittent nature of arc discharge and the relatively low energy released during an event, detecting high-impedance faults using overcurrent protection is problematic. The present disclosure proposes a method for detecting and characterizing arc faults based on differential readings from voltage and current sensors, which is then coordinated with protection elements to execute a fault removal sequence.

[0045] According to the embodiment shown in Figure 1, the DCDP control module 20a is configured to execute an algorithm that controls the state of the contactor 8 depending on whether the difference between the input current sensed at one location and the output current sensed at another location is greater than a specified current threshold. The first and second locations define the DC protection zone. According to one embodiment, the DCDP control module 20a controls the current I flowing out of the BPDU 28. BPDU Current I is detected from the current sensor 16a that senses current, and flows into the motor controller 50. MC An analog signal is received from the current sensor 16b which senses the current difference I. According to one proposed implementation, the current sensor 16a is positioned along the positive busbar 38a, and the current sensor 16b is positioned along the conductor that connects the power switch in the motor controller 50 to the HVDC power line 4a. The DCDP control module 20a receives the current difference I DP =I BPDU -I MC Calculate, then, I DP The coefficient and nominal current I nominal (For example, 0.1 x I nominal The difference threshold I may be equal to the product of ) thr It is configured to compare with the following. The DCDP control module 20a can detect small leakage currents between lines and then minimize accidental energy in a fault.

[0046] In the exemplary implementation shown in Figure 1, the DCDP control module 20a monitors only the current of the positive HVDC power line 4a and does not measure the current of the negative HVDC power line 4b. Therefore, the differential protection configuration shown in Figure 1 forms a protection zone covering the positive HVDC power line 4a between the two current sensors 16a and 16b. In the event of a line fault in that zone, the DCDP control module 20a DP It calculates and detects the problem.

[0047] When a fault is detected in the DC protection zone, the DCDP control module 20a, as shown in Figure 1, executes a trip sequence to isolate the fault while minimizing the fault energy. Figure 2 is a flowchart identifying the steps of algorithm 100 executed by the control logic of the DCDP control module 20a in one proposed implementation form. In active mode 102, the DCDP control module 20a controls the current I BPDU and I MC Measure the current difference I DP =I BPDU -I MC Calculate (step 110). Next, the DCDP control module 20a will calculate the current difference I DP The difference threshold I thr Determine if it is greater (step 112).

[0048] In step 112, the current difference I DP The difference threshold I thr If it is determined to be greater, the DCDP control module 20a invokes (implements) differential protection trip mode 104 of operation (hereinafter, "DP trip mode 104") and exits active mode 102. In DP trip mode 104, the DCDP control module 20a issues a command to put the inverter of the motor controller 50 into safe mode (step 116). The electric propulsion system includes a large motor load. During a short circuit in the HVDC system, the inverter stops pulse width modulation, and the motor continues to rotate due to the system's inertia. The motor / inverter system regenerates high current into the fault. To limit the fault accidental energy, it is important to limit and interrupt the motor / inverter current feedback to the fault. The protection logic puts the inverter / motor into safe mode by differentially entering active short circuit (ASC) mode for the inverter, and the upper and / or lower switches of the inverter are commanded to turn on to short-circuit the motor and interrupt the regenerative current. Interrupting the motor regenerative current is important to limit the accidental energy in the fault.

[0049] In response to the detection of the arc fault 3 shown in Figure 1, the DCDP control module 20a is configured to cause the protection circuit 26 to close all power switches of the inverter and open the battery or bus contactor. More specifically, the power switches undergo an active short circuit after the arc fault 3 occurs. Short-circuiting the power switches has the effect of redirecting the regenerative current from the AC motor 30 to the motor controller 50 instead of the arc fault 3. The regenerative current circulates between the AC motor 30 and the motor controller 50. More specifically, the current generated in the AC motor 30 proceeds to the power switch and circulates between the motor and the power switch. Typically, the power switch is a solid-state device (e.g., a transistor) designed to handle large currents. The power switch is actively cooled by a coolant (oil, a mixture of water and propylene glycol, or any other medium), which is the most efficient way to remove the heat generated by the fault current flowing through the power supply. The AC motor 30 is also actively cooled by a similar coolant. The ASC of the inverter in the motor controller 50 can be commanded very quickly, within milliseconds. Since the AC motor 30 and motor controller 50 are still actively cooled by liquid, the heating effect of the short-circuit current circulating between the AC motor 30 and motor controller 50 is actively managed by the cooling system. Thus, all energy generated by the AC motor 30 is dissipated by the motor and power switch losses and then removed by the active cooling system.

[0050] Referring again to Figure 2, after the inverter is placed in safe mode, contactor 8 is instructed to open to isolate the fault zone from the battery pack 18 (step 118). The short-circuit current from the battery pack 18 can be relatively high (>2000 A). DCRapid isolation of arc fault 3 (see Figure 1) from the battery pack 18 is crucial to minimizing fault energy. Alternatively, a dedicated load contactor (not shown) connected to the HVDC power line 4a can be opened to isolate the channel. Fault detection and confirmation times are selected to be approximately 10-15 milliseconds. The opening of contactor 8 can be within a time frame of 10 milliseconds for electromechanical devices and much faster (<1 millisecond) for solid-state switches. The total battery isolation time will range from 20 to 30 milliseconds.

[0051] Depending on the system design, the final step of the DP trip mode sequence is the optional mechanical disconnection of the AC motor 30 associated with the fault zone (step 120). While the AC motor 30 is rotating and the inverter is in safe mode, current flows between the AC motor 30 and the inverter, generating losses and heat. When the motor rotation is stopped, the motor back EMF and the feedback current between the AC motor 30 and the inverter are stopped. If necessary, the DCDP control module 20a can send an analog control signal instructing the governor 42 to feather the propeller 32 by changing the pitch of the propeller blades 36 to reduce the aerodynamic force on the propeller 32 and stop the motor from rotating. More specifically, the DCDP control module 20a can instruct the governor pump (or another mechanical disconnection circuit) to stop the motor rotation by feathering the propeller 32 (or disengaging the motor mechanical drive). The propeller feathering process can take up to 10 seconds, during which time the AC motor 30 acts as a nearly constant current source, continuing to supply power to the fault if no action is taken. To reduce the amount of motor regenerative current supplied to the fault during propeller feathering, the innovative technique proposed herein diverts the current from the fault by short-circuiting the power switch of the motor controller 50 as described above.

[0052] Step 112DP The difference threshold I thr If it is determined that the following is true, then the DCDP control module 20a will then determine the voltage (V) on the HVDC power line 4a. HVDC ) is a voltage limit V limit Determine whether it is less than (step 114). Faults occurring outside the DC protection zone are not detected by the DCDP control module 20a. In the case of an internal battery fault, such faults are isolated by internal battery protection, such as that provided by the midpoint battery disconnect subsystem disclosed in U.S. Provisional Patent Application No. 63 / 089,729 filed October 9, 2020. HVDC When the current is sufficiently reduced, the motor / inverter system regenerates, generating a large current from the motor / inverter to the fault.

[0053] Meanwhile, the DCDP control module 20a in step 114 under condition V HVDC < V limit and I MC If it is determined that < 0 is not satisfied, then the DCDP control module 20a returns to step 110. Meanwhile, in step 114, the HVDC system voltage V HVDC ga V limit It is less than the current I MC If it is determined that the value is less than 0, the DCDP control module 20a then switches to standby mode 106. In standby mode 106, the DCDP control module 20a issues a command to put the inverter of the motor controller 50 into safe mode and cut off the regenerative current (step 122). This action minimizes fault energy from external faults and limits the motor / inverter contribution.

[0054] While the inverter is in safe mode, the DCDP control module 20a further controls the HVDC system voltage V HVDC is a constant K v The electromotive force (EMF) of a doubled AC motor 30 motor Determine whether it is greater than the product of (step 124). Meanwhile, in step 124, the HVDC system voltage V HVDC ga Kv x EMF motor If it is determined that the following is true, the inverter will remain in safe mode. On the other hand, after the fault is cleared, the HVDC system voltage V is determined in step 124. HVDC ga K v x EMF motor If it is determined to be greater, the motor / inverter exits safe mode, and the DCDP control module 20a returns to active mode 102.

[0055] Constant K v This is called the motor voltage constant. Its value depends solely on the motor's design and construction. The constant relates the voltage seen at the motor terminals to the electromotive force (EMF) generated by the motor. It is applicable only to permanent magnet motors.

[0056] The DC protection zone can be made as wide as possible by localizing the current sensors. The zone can be extended by using current sensors placed at the midpoint of each battery string, as shown in Figure 1. The exemplary battery shown in Figure 1 includes two battery strings consisting of battery modules connected in series. Each battery has a midpoint between the two single-sided strings. Figure 1 shows a pair of current sensors 16c and 16d, respectively, sensing the current flowing through the midpoints of the two battery strings. The outputs from current sensors 16c and 16d to the DCDP control module 20a are indicated by dashed arrows in Figure 1. The DCDP control module 20a can be configured to sum the sensed currents for all battery strings to derive a measurement representing the total current output by the battery pack 18, and then compare that total current from the battery pack with the current entering the motor controller 50 sensed by current sensor 16b. In this way, the DC protection zone includes the battery pack 18 as part of the protection zone, and internal battery faults are detected and then isolated by the DCDP control module 20a.

[0057] Arc faults can occur as series or parallel arcs. A series arc can occur when a conductor in series with a load is damaged. However, the arc current cannot exceed the load current. Parallel arcs can occur as short circuits or ground faults. A short-circuit arc reduces the insulating strength of the insulator separating the conductors, generating a high-impedance, low-current arc fault that carbonizes the conductor's insulator, further reducing the effectiveness of the insulator separating the conductors. As a result, the current increases, and a rapidly increasing amount of thermal energy may be released. The current flow in a short-circuit parallel arc fault is limited by the system's impedance and the arc fault.

[0058] The DC differential protection algorithm disclosed above can detect parallel arc discharges between lines using appropriate digital filtering to isolate arc discharge signatures. However, DC differential protection cannot detect series arcs because there is no current leakage.

[0059] Figure 3 shows an aerospace electric propulsion system 2 according to a second embodiment, which receives DC power from a battery pack 18 and is equipped with a power differential protection control module 20b (hereinafter referred to as "power DP control module 20b"). The power DP control module 20b is configured to isolate arc faults 3 that span HVDC power lines 4a and 4b.

[0060] According to the embodiment shown in Figure 3, the power DP control module 20b is configured to execute an algorithm that controls the state of the contactor 8 depending on whether the difference between the input power at a first location and the output power at a second location is greater than a specified differential threshold. The first and second locations define DC power protection zones.

[0061] In the specific example shown in Figure 3, the power DP control module 20b controls the current I flowing out from the BPDU 28. BPDU Current I is detected from the current sensor 16a that senses current, and flows into the motor controller 50. MCAn analog signal is received from the current sensor 16b which detects current I. In addition, the power DP control module 20b detects current I BPDU Voltage V at the location where it is detected BPDU A first voltage sensor (not shown in Figure 3) and current I that sense the current MC Voltage V at the location where it is detected MC An analog signal is received from a second voltage sensor (not shown in Figure 3) that detects the power. Then, the power at each point is calculated and compared.

[0062] More specifically, the input power P at the input of the DC power protection zone. BPDU =V BPDU Base I BPDU , and output power P at the output of the DC power protection zone MC =V MC Base I MC The following is calculated. Next, the power difference P DP The input power P BPDU Output power P MC It is calculated by subtracting (P DP =P BPDU -P MC ). Using additional optional terminology, product

number

[0063] In the exemplary implementation shown in Figure 3, the power DP control module 20b monitors only the power of the positive HVDC power line 4a and does not measure the power of the negative HVDC power line 4b. In addition, the voltage V at the output of the BPDU 28 BPDU and the voltage V at the input of the motor controller 50 MC are measured. Therefore, the differential protection configuration shown in Figure 3 forms a zone covering the positive HVDC power line 4a between the two measurement points. In the event of an inter-line fault in this zone, the power DP control module 20b calculates P DP and detects the fault.

[0064] The use of voltage in the power differential protection algorithm increases the sensitivity of the protection. The power differential protection algorithm can detect parallel arcing between lines by using appropriate digital filtering to isolate arc signatures. In the case of parallel arcing, the algorithm relies on sensing the difference between the respective currents used to calculate P BPDU and P MC to detect a fault. For example, if the current leakage is 30 A DC and there is a voltage of 1000 V DC across the DC power protection zone, the power difference P DP ranges from tens or hundreds of watts to tens of kilowatts, depending on whether the arc is parallel or series. In the case of series arcing, the algorithm relies on sensing the difference between the respective voltages used to calculate P BPDU and P MC to detect a fault. For example, if the arc voltage is 30 V DC and the current is 1000 A DC , the power difference P DPis equal to 30 kW minus the loss in the power feeding device. Therefore, the power differential protection technology proposed herein can detect both parallel arc discharge and series arc discharge. The proposed solution uses HVDC line-to-line (rail-to-rail) voltage monitoring and single rail current monitoring.

[0065] When a fault is detected in the protection zone, the power DP control module 20b shown in Figure 3 executes a trip sequence to isolate the fault while minimizing fault energy. Figure 4 is a flowchart identifying steps of an algorithm 130 executed by the control logic of the power DP control module 20b according to one proposed implementation. In active mode 132, the power DP control module 20b first obtains power P BPDU and P MC , then calculates differential protection power P DP =P BPDU -P MC (step 134). Next, the power DP control module 20b determines whether the differential protection power P DP is greater than a differential threshold P thr (step 136).

[0066] In step 136, if it is determined that the differential protection power P DP is greater than the differential threshold P thr , then the power DP control module 20b switches from the active mode 132 to the aforementioned DP trip mode 104. In DP trip mode 104, the DCDP control module 20a issues a command to put the inverter of the motor controller 50 into a safe mode (step 116). After the inverter is placed in the safe mode, the contactor 8 is commanded to open to isolate the fault zone from the battery pack 18 (step 118). Depending on the system design, the last step of the DP trip mode sequence is optional mechanical disconnection of the AC motor 30 associated with the fault zone (step 120).

[0067] In step 136, the differential protection power PDP The difference threshold P thr If it is determined that the following is true, then the power DP control module 20b will then control the HVDC power line (V HVDC ) The voltage above is the voltage limit (V limit ) is less than the current I MC Determine whether the value is less than 0 (step 138). Faults occurring outside the protection zone are not detected by the power DP control module 20b. As mentioned above, if the fault is voltage V HVDC When the current is sufficiently reduced, the motor / inverter system regenerates, generating a large current from the motor / inverter to the fault.

[0068] Meanwhile, the power DP control module 20b is under condition V in step 138. HVDC <V limit and I MC If it is determined that <0 is not satisfied, then the power DP control module 20b returns to step 132. Meanwhile, in step 138, the HVDC system voltage V HVDC ga V limit It is less than the current I MC If it is determined that is less than 0, the power DP control module 20b switches to standby mode 106 and performs steps 122 and 124 in the manner described above with reference to Figure 2.

[0069] According to the proposed implementation shown in Figure 3, power is calculated based on current and voltage information acquired at locations within the BPDU 28 and within the motor controller 50. However, to extend the length of the DC power protection zone, current and voltage may be measured at locations further away from the current sensors 16a and 16b.

[0070] Power-based differential protection can be implemented in various ways. Power sensing circuits can be used to process data and draw conclusions about whether the electric propulsion system is in a normal or abnormal state. The abnormalities to be sought include, but are not limited to, overcurrent due to hard faults, high-impedance parallel arcs, and series arcs. Overcurrent can be easily detected by monitoring the current of the source and load using current sensors as described above, and then determining whether the overcurrent condition is met, for example, if the sensed current is >50% above the nominal current (hard fault).

[0071] As used herein, the term "hard failure" refers to a failure that causes abrupt changes in the system structure, resulting in an uncontrolled transition from the nominal operating mode to a failure mode. A soft failure, on the other hand, causes continuous changes over time in specific system structure parameters, leading to unknown additional disturbances.

[0072] Figure 5 illustrates a scenario in which the power DP control module 20b detects the occurrence of a high-impedance parallel arc in the DC power protection zone 5, which includes at least a portion of the power line 4. In the scenario shown in Figure 5, the input current I A This is equal to 1,030 A at the source end A of protection zone 5. In this example, the high-impedance parallel arc has a leakage current I C =30 A (indicated by the arrow) is generated, and as a result, current I is generated at or near the load end B of DC power protection zone 5. B = 1,000 A occurs. The source end A and the load end B define a DC power protection zone 5, which is monitored by the power DP control module 20b. According to one proposed implementation, the source end A of the protection zone 5 is located along the positive bus bar 38a as seen in Figure 1, and the load end B is located inside the motor controller 50, in front of the inverter (for example, along the bus connecting the power switch to the HVDC power line 4a).

[0073] According to the embodiment shown in Figure 5, the power DP control module 20b controls the current IA and I B Sensor data is received from current sensors 16a and 16b, which indicate the magnitude of the currents, respectively. In addition, the power DP control module 20b receives voltage V from the source end A and the load end B or a nearby voltage, respectively. A and V B Sensor data is received from voltage sensors 40a and 40b, which can be processed to measure the magnitude of the signal.

[0074] Figure 5A shows the current I during the generation of a high-impedance parallel arc within the DC power protection zone shown in Figure 5. A and I B and voltage V A and V B This is a screenshot from an oscilloscope showing the results. Figure 5B is a flowchart showing a detection algorithm 60 performed by the power DP control module 20b in one way for monitoring the DC power protection zone 5 shown in Figure 5 to detect parallel arcs.

[0075] According to the proposed implementation shown in Figure 5B, the power DP control module 20b controls the current I A and voltage V A Receiving current I A Voltage V A By multiplying by the product (i.e., power P), A ) calculates, and then power P A It includes a first multiplier 62 that outputs to integrator 66. The power DP control module 20b controls the current I B and voltage V B Receiving current I B Voltage V B By multiplying by the product (i.e., power P), B ) calculates, and then power P B It further includes a second multiplier 64 that outputs to an integrator 66, however, the output of the second multiplier 64 is inverted before being input to the integrator 66. The integrator 66 then calculates the power P A and inverting power P B The sum of these is the power difference P at consecutive moments in time. DP (P DP=P B -P A Calculate the power difference P. DP This is integrated over a certain period (window). The integrator 66 calculates the integrated power difference ΣP DP The output is sent to the decision logic 68. The decision logic 68 determines the integral power difference ΣP DP However, the integral power difference threshold (hereinafter referred to as "fault threshold P") that indicates the occurrence of a fault is... f Determine whether it is greater than ''. Failure threshold P f The value of the fault threshold P is also based on the integral of the power difference over a certain period of time. f The failure threshold P f An excess of is selected to indicate the presence of parallel arcs.

[0076] On the other hand, the decision logic 68 determines the integral power difference ΣP DP The failure threshold P f If the following is determined, the decision logic 68 then issues a status signal indicating that the power line 4 is in a normal state. Meanwhile, the decision logic 68 determines the integrated power difference ΣP DP The failure threshold P f If it is determined to be greater than the specified value, the determination logic 68 then determines that a parallel arc fault is present and issues a control signal to switch the power DP control module 20b from active mode 132 to DP trip mode 104 (see Figure 4).

[0077] In the scenario shown in Figure 5, the leakage current I CSince it flows from the normal current path, the current sensor 16b senses a current that is proportionally smaller compared to the current sensed by the current sensor 16b. As confirmed by scientific literature, there is a strong assumption that the voltage drop across a DC arc can exceed 20 V depending on the material of the conductor through which the current is leaking. Therefore, for example, if the leakage current is 10 A or more, the power dissipated in the arc can be 200 W or more (some literature suggests that in the automotive industry, for example, the measurable arc energy can exceed about 50 W, but a more realistic expectation is that the arc power in high-voltage systems exceeds 600 W). Another source of power loss is Joule heating generated by the wiring. (Joule heating is the process by which the flow of current through a conductor generates heat.) In practice, Joule heating cannot be ruled out due to the increased weight associated with higher gauge wiring. Therefore, it is reasonable to assume that the wiring resistance is in the range of 10-100 mΩ. In full electric propulsion applications, the load current value is typically several hundred amperes. Therefore, the loss will be in the amount of several hundred watts. Power losses exceeding 300 W can be reasonably anticipated.

[0078] Therefore, the power DP control module 20b may be configured to look for the power difference between the source end and the load end, measured as the product of voltage and current, including leakage and combined losses in the wiring, in the range of 900 W or more. Fault threshold P indicating parallel arc f -The value of exceedance can be set to 900 W or a similar value. To address the intermittency of parallel arcs (as well as series arcs), the power difference P DP This is integrated over a certain period to mitigate the capacitive and inductive effects of the system. To maximize the power difference, the power difference P DP While this is essentially power loss in the cable, there is additional power loss in the arc during arc discharge, so the power dissipated in the cable should be calculated based on readings from the current sensor 16b during normal operation.

[0079] Figure 6 illustrates a scenario in which the power DP control module 20b detects the occurrence of a series arc in the DC power protection zone 5, which includes at least a portion of the power line 4. In the scenario shown in Figure 6, the input current I is present at the power source end A of the DC power protection zone 5. A = 10 A, and at load terminal B of DC power protection zone 5, the output current I B = 10 A. In this example, the series arc 7 generates a voltage loss of -30 V. Again, the source end A and the load end B define a DC power protection zone 5, which is monitored by the power DP control module 20b. According to one proposed implementation, the source end A of the protection zone 5 is located along the positive busbar 38a as seen in Figure 1, and the load end B is located inside the motor controller 50, in front of the inverter (for example, along the bus connecting the power switch to the HVDC power line 4a).

[0080] According to the embodiment shown in Figure 6, the power DP control module 20b controls the current I A and I B Sensor data is received from current sensors 16a and 16b, which indicate the magnitude of the currents, respectively. In addition, the power DP control module 20b receives voltage V from the source end A and the load end B or a nearby voltage, respectively. A and V B Sensor data is received from voltage sensors 40a and 40b, which indicate the magnitude of the voltage.

[0081] Figure 6A shows the current I during the generation of a series arc 7 within the DC power protection zone shown in Figure 6. A and I B and voltage V A and V B This is a screenshot from an oscilloscope showing the following. The enclosed fragment corresponds to the same instance of the serial arc. V A and V B Traces were captured on different time scales. Figure 6B is a flowchart showing a detection algorithm 70 performed by the power DP control module 20b in one method for monitoring the DC power protection zone shown in Figure 6 to detect a series arc 7.

[0082] According to the proposed implementation shown in Figure 6B, the power DP control module 20b controls the current I A and voltage V A Receiving current I A Voltage V A By multiplying by the product (i.e., power P), A ) calculates, and then power P A It includes a first multiplier 62 that outputs to integrator 66. The power DP control module 20b controls the current I B and voltage V B Receiving current I B Voltage V B By multiplying by the product (i.e., power P), B ) calculates, and then power P B It further includes a second multiplier 64 that outputs to an integrator 66, however, the output of the second multiplier 64 is inverted before being input to the integrator 66. The integrator 66 then calculates the power P A and inverting power P B The sum of these is the power difference P at consecutive moments in time. DP (P DP =P B -P A Calculate the power difference P. DP This is integrated over a certain period (window). The integrator 66 calculates the integrated power difference ΣP DP The output is sent to the decision logic 69. The decision logic 69 determines the integral power difference ΣP DP The difference threshold P thr Determine whether it is greater than or equal to the difference threshold P. thr The value is also based on the integrated power over a period of time sufficient to reach a conclusion regarding the sustainability of a series arc that damages insulation. Differential threshold P thr The excess indicates the presence of a series arc 7.

[0083] On the other hand, the decision logic 69 determines the integral power difference ΣP DP The difference threshold P thr If the following is determined, the decision logic 69 then issues a status signal indicating that the power line 4 is in a normal state. Meanwhile, the decision logic 69 determines the integral power difference ΣPDP The difference threshold P thr If it is determined to be greater than the specified value, the determination logic 69 then determines that a parallel arc fault is present and issues a control signal to switch the power DP control module 20b from active mode 132 to DP trip mode 104 (see Figure 4).

[0084] The detection algorithm 70 for series arcs 7 is similar to the detection algorithm 60 used to detect parallel arcs, the main difference being that a higher drop in the inline voltage at the load end B results in a power differential P DP This results in a larger change in the value of . Also, since the current is the same at the source end A and the load end B, the power differential P DP The main factor in the change in the value is the voltage drop across the series arc. Furthermore, the integration process allows the power DP control module 20b to account for the effects of low-order or high-order harmonics generated by the arc.

[0085] In the embodiments shown in Figures 1 and 3, the DC power carried by the HVDC distribution system 44 is monitored by the DP control module 20a. Figure 7 shows an arc fault 3 across positive and negative HVDC power lines 4a and 4b in an aerospace electric propulsion system, comprising a hybrid power DP control module 20c monitoring a DC / AC power protection zone, according to a third embodiment. The third embodiment uses the power differential concept to include the power inverter (of the motor controller 50) and optionally the motor windings (of the AC motor 30) in the power protection zone. The power differential concept enables the implementation of a hybrid power DP control module 20c that monitors a DC / AC power protection zone encompassing both parts of the DC and AC power systems by using the laws of energy saving to establish relationships between both power systems.

[0086] According to the third embodiment, the hybrid power DP control module 20c controls the battery DC power P DC and inverter / motor AC power P ACIt is configured to run a hybrid power differential protection algorithm that calculates both inverter / motor AC power P. AC This is the orthogonal voltage V received from the inverter controller. q and DC voltage V d , as well as the orthogonal current I from the current sensor 16e d and DC current I q It is calculated using the measured values. Then, the hybrid power differential protection algorithm calculates the AC power P AC Calculate (P AC =V d Base I d +V q Base I q ). Parameter P AC This is the power supplied to the AC motor 30 by the inverter.

[0087] Referring again to Figure 7, the hybrid power differential protection algorithm also checks the voltage V at the battery terminals. bat and current I bat Using the DC power P in battery pack 18 DC Calculate (P) (this is the input power to the DC / AC power protection zone) DC =V bat Base I bat The hybrid power differential protection algorithm calculates the AC power P AC and the calculated inverter power loss P inv Using this, the DC power P was calculated. DC Compare with the product. Using additional optional terminology,

number

[0088] Since the system is floating and phase-ground faults do not generate any short-circuit currents, the hybrid power DP control module 20c only monitors the current of the positive (or negative) rail, and does not need to measure both the positive and negative rail currents as in the case of a grounded system. The DC voltage is monitored by one voltage sensor on the BPDU 28 (V BPDU ). AC power P AC In this case, the orthogonal and DC voltages V from the control loop q and V d (Used for pulse width modulation) is used directly without adding a voltage sensor. Orthogonal current I q and DC current I d The magnitude is reused from the control loop measurement. Thus, the third embodiment shown in Figure 7 forms a DC / AC power protection zone between the two measurement points, covering the HVDC power distribution system 44 and the inverter in the motor controller 50. In the event of a fault in that zone, the hybrid DP protection logic P DP It detects and senses faults. For example, the hybrid power DP control module 20c has differential protection power P DP The difference threshold P thr If it is greater than, step 136 shown in Figure 4 may be performed, followed by steps 116, 118, and 120 in order.

[0089] Hybrid differential protection can detect small leakage currents and then minimize accidental energy in the event of a fault. The proposed concept allows for the extension of the protection zone across the inverter, covering both the DC and AC systems in a single zone. In contrast, state-of-the-art solutions implement separate protection zones for the DC and AC systems, respectively. The use of multiple protection zones requires considerable hardware and control to implement DC-AC power conversion elements (such as inverters) and leave them unprotected. The Hybrid Power DP Control Module 20c covers both the DC and AC zones, including the inverter, without adding critical hardware (sensors or controllers) to the battery or inverter / motor system.

[0090] The use of power computing algorithms enhances the sensitivity of differential protection. The hybrid power differential protection algorithm disclosed herein can detect parallel and series arc discharges using appropriate digital filtering to isolate arc discharge signatures. The protection methodology calculates the AC power P AC DC power P calculated from DC The energy generated by the arc (parallel or series) is measured by subtracting from the measured energy. Based on the arc energy measured using digital filtering and integration, the hybrid power DP control module 20c can detect and isolate recurring arcs. For series and parallel arc discharge protection, the signatures may be different, and different filtering algorithms may be used.

[0091] A high-power electric propulsion unit can include multiple AC motors and motor controllers coupled together. In addition, each motor controller may include multiple inverters, and each inverter may include multiple power switches. The power switches of each inverter can be switched to supply three-phase AC power to the motors.

[0092] Figure 8 shows an arc fault 3 across two HVDC power lines 4a and 4b in an electric propulsion system 2' comprising two AC motors 30a and 30b, two motor controllers 50a and 50b, and an HVDC power distribution system 44, according to a fourth embodiment. The HVDC power distribution system 44 comprises an HVDC bus 52 consisting of positive and negative HVDC busbars 52a and 52b. The HVDC power distribution system 44 further includes the following power lines connecting the motor controllers 50a and 50b to the HVDC bus 52: (a) an HVDC power line 4a connecting the motor controller 50a to the positive HVDC busbar 52a; (b) an HVDC power line 4b connecting the motor controller 50a to the negative HVDC busbar 52b; (c) an HVDC power line 4c connecting the motor controller 50b to the positive HVDC busbar 52a; and (d) an HVDC power line 4d connecting the motor controller 50b to the negative HVDC busbar 52b. The source end of the HVDC power line 4a is connected to the positive HVDC busbar 52a via a bus contactor 8a, and the source end of the HVDC power line 4c is connected to the positive HVDC busbar 52a via a bus contactor 8b. The DC current flowing from the positive HVDC busbar 52a into the HVDC power line 4a is detected by the current sensor 16a, and the DC current flowing from the positive HVDC busbar 52a into the HVDC power line 4c is detected by the current sensor 16b.

[0093] The electric propulsion system 2' shown in Figure 8 further includes a DC / AC power differential protection system comprising a pair of hybrid power DP control modules 20c connected to motor controllers 50a and 50b, respectively. In addition, one hybrid power DP control module 20c receives current data from the current sensor 16a, and the other hybrid power DP control module 20c receives current data from the current sensor 16a. The overcurrent protection control module 14 also receives current data from the current sensors 16a and 16b, respectively.

[0094] Figure 8 shows a scenario where arc fault 3 spans HVDC power lines 4a and 4c, both connected to motor controller 50a. The hybrid power DP control module 20c is configured to isolate the faulty motor / inverter system (e.g., AC motor 30a / motor controller 50a) without tripping a healthy motor / inverter system (e.g., AC motor 30b / motor controller 50b) supplied from the same HVDC bus 52. During arc fault 3 at one branch, the battery pack (not shown in Figure 8) will experience a significant short-circuit current. During a short circuit in the HVDC system, the voltage level can drop significantly. When the voltage drops (V HVDC <V limit ), the pulse width modulation process inside the inverter of the motor controller 50a stops, and the AC motor 30a continues to rotate due to the system's inertia. The motor / inverter system (AC motor 30a / motor controller 50a) regenerates the high current into an arc fault. Due to the inertia of the motor rotor and associated propeller, the inverter / motor regenerates for several seconds, potentially causing significant short-circuit energy and damage. The hybrid power DP control module 20c associated with the motor controller 50a is configured to isolate the faulted branch using the control logic described above for the embodiment shown in Figure 7.

[0095] In addition, during a short-circuit hard fault, a healthy AC motor 30b also experiences a voltage drop (V HVDC <V limitThis can lead to undervoltage, potentially causing regeneration into the fault. If the fault causes the HV system to drop sufficiently, the healthy motor / inverter system (AC motor 30b / motor controller 50b) will regenerate, generating a significant current from the motor / inverter to the arc fault 3. The regenerative current from the healthy motor contributes to the energy dissipated by the short circuit and potential additional damage. Since there is no leakage energy in the healthy branch, differential protection will not activate. To limit the fault accidental energy, it is important to limit and interrupt the healthy motor / inverter current feedback to the fault. To minimize the fault energy of the external fault and limit the motor / inverter contribution, the DP trip condition is not detected, and condition V HVDC <V limit , and I MC If <0 is met, the motor / inverter enters safe mode to cut off regenerative current. As part of safe mode, the inverter switches to active short-circuit (ASC) mode. In ASC mode, an ASC command is issued that closes the upper and / or lower sets of the inverter's power switches to short-circuit the motor itself and cut off regenerative current. Motor regenerative current is cut off. This is important to limit accidental energy in a fault. To limit accidental energy, a healthy motor controller enters safe mode while the fault is being cleared. However, the motor remains in standby mode, ready to restart as soon as the fault is cleared.

[0096] The protection logic proposed herein monitors the bus voltage and compares it to the motor back EMF (observed using speed). When the bus voltage is re-established to a voltage level that ensures a healthy motor does not regenerate (fault cleared), the differential protection logic clears safe mode and re-establishes normal operation of the motor / inverter. Once the fault is cleared, the HVDC system voltage V HVDC ga K v x EMF motor When the value exceeds a certain level, the motor / inverter returns to active mode.

[0097] Systems and methods for providing differential protection for electric propulsion systems have been described with reference to various embodiments, but it will be understood by those skilled in the art that various modifications can be made without departing from the scope of the teachings herein, and that equivalents can be substituted for their elements. In addition, numerous modifications can be made to adapt the teachings of this application to specific circumstances, without departing from the scope of the teachings herein. Accordingly, it is intended that the claims are not limited to the specific embodiments disclosed herein.

[0098] The electric propulsion controllers, engine control units (aka engine controllers), inverter controllers, and DP control modules disclosed herein can be implemented using hardware or hardware in combination with software. For example, a controller or control module may be implemented using configurable hardware, a programmable device, or both. The configurable hardware may comprise configurable hardware that performs one or more functions of the controller. The programmable device may comprise any device that can be programmed to perform one or more functions of the controller. For example, but not limited to, the programmable device may comprise a central processing unit, a microprocessor, or a digital signal processor. The programmable device may be configured to execute software or firmware in the form of program instructions to perform one or more functions of the controller. The program instructions may be stored in any suitable non-temporary tangible computer-readable storage medium for execution by or transfer to the programmable device.

[0099] In particular, the DP control modules disclosed herein consist of control logic that includes one or more algorithms for providing differential protection disclosed herein. The control module may be a unit of individual functions that can be implemented in software, hardware, or a combination thereof. If the functions of the control module are performed in any part through software, the module may include a non-temporary, tangible, computer-readable storage medium. The methods disclosed above may use streaming (or on-the-fly) computations, in which case the control module configured to perform those computations is suitable for FPGA or ASIC or other hardware-based implementations.

[0100] The methods described and claimed herein may include steps encoded as executable instructions, embodied in a non-temporary, tangible, computer-readable storage medium, including, but not limited to, a storage device and / or memory device. When such instructions are executed by a processing system or computer system, the system device performs at least a portion of the methods described herein.

[0101] In the method claims appended to this specification, any alphabetical order of the steps is intended solely to allow for concise reference to preceding steps later, and is not intended to limit the claims to require that the method steps be performed in alphabetical order.

[0102] Note: The following paragraphs describe further aspects of this disclosure.

[0103] A1. An electric propulsion system, A battery pack including a parallel string of battery modules, A busbar connected to receive DC power from the battery pack, A power line connected to receive DC power from a busbar, A motor controller connected to receive DC power from a power line and configured to convert DC power to AC power, An AC motor connected to receive AC power from a motor controller, A first current sensor is connected to a first end of a protection zone, which includes at least a portion of a power line, to sense a first current supplied by a battery pack, and is configured to output first sensor data representing the magnitude of the first current. A first voltage sensor is connected to the first end of the protection zone current to sense a first voltage and is configured to output second sensor data representing the magnitude of the first voltage, A second current sensor is connected to the second end of the protection zone to sense a second current supplied to the motor controller and is configured to output a third sensor data representing the magnitude of the second current, A second voltage sensor is connected to the second end of the protection zone current to sense a second voltage and is configured to output a fourth sensor data representing the magnitude of the second voltage, The system comprises a differential protection control module connected to receive first to fourth sensor data, and the differential protection control module is (a) A step of calculating an integrated power difference based on first to fourth sensor data received at consecutive moments during a time window, wherein the integrated power difference is derived by integrating the difference between a first power at a first end of the protection zone and a second power at a second end of the protection zone, (b) The step of determining that the integrated power difference exceeds an integrated differential threshold indicating a failure in the protected zone, (c) an electric propulsion system configured to perform an operation which includes the step of instructing the electric propulsion system to operate in a mode that isolates a fault in response to operation (b).

[0104] A2. The electric propulsion system described in paragraph A1, wherein the first end of the protective zone is positioned along the busbar.

[0105] A3. The electric propulsion system described in paragraph A1, wherein the second end of the protective zone is located inside the motor controller.

[0106] A4. A method for protecting an electric propulsion system, the method is (a) The steps of sensing the DC current supplied by the battery pack at a first end of a protection zone which includes at least a portion of power lines connected to receive DC current from the battery pack and supply DC current to the motor controller, (b) The step of sensing the AC current supplied to the AC motor by the motor controller at the second end of the protection zone, (c) A step of sensing a DC voltage at the first end of the protection zone, (d) A step of sensing the AC voltage at the second end of the protection zone, (e) A step of receiving sensor data representing the magnitude of the DC current sensed in step (a), (f) A step of receiving sensor data representing the magnitude of the AC current sensed in step (b), (g) A step of receiving sensor data representing the magnitude of the DC voltage sensed in step (c), (h) A step of receiving sensor data representing the magnitude of the AC voltage sensed in step (d), (i) A step of calculating an integrated power difference based on the magnitude received in steps (e) to (h) and the magnitude of power loss in the motor controller at consecutive moments in a time window, wherein the integrated power difference is derived by integrating the difference between a first power at the first end of the protection zone and a second power at the second end of the protection zone, minus the power loss; (j) The step of determining that the integrated power difference exceeds the integrated differential threshold indicating a fault in the protected zone, (k) A step of commanding the electric propulsion system to operate in a fault isolation mode in response to step (j), (l) the step of operating the electric propulsion system in a fault isolation mode, Steps (e) through (k) are performed by the differential protection control module. [Explanation of symbols]

[0107] 2. Electric propulsion system 3. Arc Fault 4 Power lines 4a Positive HVDC power line 4b Negative HVDC power lines 4c, 4d HVDC power line 5 Protected Zones 6 AC power line 7 Series Arc 8 String Contactor 8a, 8b bus contactor 10 Engine control unit 12 Electric propulsion controller 14. Overcurrent protection control module 16a, 16b, 16c, 16d, 16e Current Sensors 18 Battery Packs 20 Electric propulsion controller 20a DC Differential Protection Control Module 20b Power Differential Protection Control Module 20c Hybrid Power DP Control Module 22 Battery Pack Management System 24 Battery Modules 26 Protection circuit 28 Battery distribution unit 30, 30a, 30b motors 32 Propeller 34 Propeller Shaft 36 propeller blades 38a Positive bus bar 38b Negative bus bar 40a, 40b Voltage Sensor 42 Governors 44. High-voltage DC power distribution system (HVDC power distribution system) 50, 50a, 50b motor controllers 52 HVDC buses 52a Positive HVDC busbar 52b Negative HVDC busbar 54 Hydraulic valves 60, 70 detection algorithms 62 First Multiplier 64. Second Multiplier 66 Integrator 68, 69 Decision Logic 102, 132 Active Mode 104 Differential protection trip mode 106 Standby Mode 130 Algorithms

Claims

1. A method for protecting an electric propulsion system, wherein the method is (a) Sensing a first current supplied by the battery pack at a first end of a protection zone which includes at least a portion of power lines connected to receive current from the battery pack and supply current to the motor controller, (b) the step of sensing a second current supplied to the motor controller at the second end of the protection zone, (c) A step of receiving sensor data representing the magnitude of the first current sensed in step (a), (d) A step of receiving sensor data representing the magnitude of the second current sensed in step (b), (e) A step of calculating a current difference equal to the difference between the magnitude of the first current and the magnitude of the second current, (f) The step of determining that the current difference exceeds a differential threshold indicating a fault in the protection zone, (g) A step of instructing the electric propulsion system to operate in a mode that isolates the fault in response to step (f), (h) The step of operating the electric propulsion system in a mode that isolates the fault, A method comprising steps (c) through (g) being performed by a differential protection control module, and step (h) being a step of changing the state of a power switch on the motor controller so as to short-circuit an AC motor connected to the motor controller, thereby preventing the regenerated current from reaching the power line.

2. The method according to claim 1, wherein step (a) includes sensing the current supplied by the battery pack using a current sensor positioned along a busbar connected to the battery pack.

3. The method according to claim 1, wherein step (a) includes sensing the current supplied by the battery pack using a plurality of current sensors, each positioned along a plurality of battery strings of the battery pack.

4. The method according to claim 1, further comprising step (h) opening a contactor located between the battery pack and the first end of the protective zone.

5. The method according to claim 4, further comprising step (h) mechanically disconnecting the AC motor from the second end of the protection zone.

6. It is an electric propulsion system, A battery pack containing a string of multiple battery modules, A busbar connected to receive DC power from the aforementioned battery pack, A power line connected to receive DC power from the aforementioned busbar, A motor controller comprising a power switch connected to receive DC power from the aforementioned power line and converting the DC power to AC power, An AC motor connected to receive the AC power from the motor controller, One or more first current sensors connected to a first end of a protection zone including at least a portion of the power lines to sense a first current supplied by the battery pack, and outputting first sensor data representing the magnitude of the first current, A second current sensor is connected at the second end of the protection zone to sense a second current supplied to the motor controller and outputs second sensor data representing the magnitude of the second current. A differential protection control module connected to receive the first and second sensor data and The differential protection control module is equipped with, (a) A step of calculating a current difference equal to the difference between the magnitude of the first current and the magnitude of the second current, (b) The step of determining that the current difference exceeds a differential threshold indicating a fault in the protection zone, (c) The step of commanding the electric propulsion system to operate in a mode that isolates the fault in response to operation (b) by changing the state of the power switch of the motor controller so as to short-circuit the AC motor and thereby prevent the current regenerated by the AC motor from reaching the power line, An electric propulsion system configured to perform operations including those mentioned above.

7. The electric propulsion system according to claim 6, further comprising a propeller mechanically coupled to the AC motor.

8. The electric propulsion system according to claim 6, wherein the first current sensor is arranged along the busbar.

9. The electric propulsion system according to claim 6, wherein a plurality of first current sensors are arranged along a plurality of strings of a battery module.

10. A method for protecting an electric propulsion system, wherein the method is (a) Sensing a first current supplied by the battery pack at a first end of a protection zone which includes at least a portion of power lines connected to receive current from the battery pack and supply current to the motor controller, (b) the step of sensing a second current supplied to the motor controller at the second end of the protection zone, (c) The step of sensing a first voltage at the first end of the protection zone, (d) The step of sensing a second voltage at the second end of the protection zone, (e) A step of receiving sensor data representing the magnitude of the first current sensed in step (a), (f) A step of receiving sensor data representing the magnitude of the second current sensed in step (b), (g) A step of receiving sensor data representing the magnitude of the first voltage sensed in step (c), (h) A step of receiving sensor data representing the magnitude of the second voltage sensed in step (d), (i) a step of calculating an integrated power difference based on the magnitude received in steps (e) through (h) at consecutive moments in a time window, wherein the integrated power difference is derived by integrating the difference between a first power at the first end of the protection zone and a second power at the second end of the protection zone, (j) The step of determining that the integrated power difference exceeds an integrated differential threshold indicating a fault in the protection zone, (k) A step of commanding the electric propulsion system to operate in a mode that isolates the fault in response to step (j), (l) The step of operating the electric propulsion system in a mode that isolates the fault, A method comprising steps (e) through (k) being performed by a differential protection control module, and step (l) being a step of changing the state of a power switch on the motor controller so as to short-circuit an AC motor connected to the motor controller, thereby preventing the regenerated current from reaching the power line.

11. The method according to claim 10, further comprising step (l) opening a contactor located between the battery pack and the first end of the protection zone, and mechanically disconnecting the AC motor from the second end of the protection zone.

12. The method according to claim 10, wherein the first end of the protective zone is positioned along busbars connected to a plurality of parallel strings of battery modules of the battery pack.

13. The method according to claim 10, wherein the second end of the protective zone is located inside the motor controller.

Images