The implications of aerospace requirements on the design-space of a permanent magnet starter/generator
I. Introduction In the past decade a trend towards more electric aircraft was initiated in an effort to improve efficiency and decrease system weight and cost of ownership. To this end innovative technologies are required and in the case of rotating electrical machines, permanent magnet (PM) machines are a leading contender. Due to the aerospace’s strict safety requirement, PM machines are normally only considered for machines and seldom for generators, as they are pose an inherent safety risk under fault conditions (specifically short circuits) due to the inability to remove the magnetic field from the rotor. This paper therefore outlines what measures need to be taken to realize a PM starter/generator (S/G) that fulfils the aerospace safety requirements. During starting the S/G must deliver 6-8 times the torque it encounters during generation. A fully functional starter/generator, along with the associated inverter and electronics, is constructed and tested as proof of this concept. II. Safety analysis In order to fulfil the low failure probabilities imposed by aerospace requirements a safety analysis was performed in order to identify the most safety critical aspects. A detailed overview of the exact safety analysis (with regards to implications on the design space) will be presented in the final paper, wherein different short-circuit failures of the machine were identified as possible causes of overheating and/or fire. These are: Short-circuit on the terminals of the machine. Internal short-circuit. There are a number of possible internal short-circuit configurations, with the fault probabilities dependent on the machine and winding configuration. In order to meet the low failure probabilities a chain of mitigation measures is required as discussed in the following sections. III. Resultant fault mitigation measures A. Short circuit on the terminals of the machine In the event that a one or all of the phases undergo a short-circuit at the terminals of the machine a means to limit the current is required.  suggests that since the machine is designed to thermally withstand nominal current it follows that designing the machine with a one per-unit (p.u.) inductance will limit the current to its nominal value under terminal short-circuit conditions. Due to the high torque requirements during starting a one p.u. inductance will have negative implications on the V.A. rating of the inverter and required DC bus voltage . A lower system volume was obtained by thermally designing the machine to withstand a short-circuit current for 0.27 p.u. inductance (Fig. 1). More detailed analysis of the currents and flux within the machine reveals that lowest losses (and hence heating) will be obtained for a symmetrical short-circuit, (i.e. all three phases are connected together), since it results in the most balanced currents and lowest rotor losses. Therefore, under any short-circuit conditions on the terminals of the machine an external short-circuit of all three- phases will be applied in order to ensure the lowest loss condition. A detailed investigation of internal short-circuits, specifically turn-to-turn short-circuits and the failure mechanism, within PM machines is given in .  further outlines that for a machine incorporating parallel strands (which is the case here) a three-phase terminal short-circuit will help to reduce the losses within the fault. The result is that under an internal short-circuit condition the fault mitigation method is to also apply and external three-phase short circuit. IV. Fault detection system Both these fault mitigation measures (which are required to bring the design below the specified failure probability) require the accurate detection of either a terminal short or an internal short- circuit, upon which the external three-phase short-circuit is applied (discussed in the next section). The fault detection system is based on monitoring the difference between the neutral point of the machine and the average voltage of the three-phases produced by the inverter. This detection method was conceptually tested in software, and is currently implemented in hardware with a dedicated DSP. Initial testing shows that the majority of short-circuit conditions can be detected. A more detailed description of the fault demodulator and detectable conditions will be given in the final paper. V. External three-phase short-circuit implementation An external short-circuit can either be implemented by a dedicated short-circuit circuit, or alternatively, the inverter (which is done here). This in turn places the requirement of a very low failure probability on the inverter and supporting electronics (gate drivers, power supplies, etc.), since they are now directly in the chain of fault mitigation measures. A detailed outline of all the components and software which are directly within this critical chain of fault mitigation measures will be given in the paper. VI. Boundary conditions imposed on the design space The conditions imposed by these fault mitigation measures produce the final design space in which the design can be realized. The boundary conditions making up this design space therefore need to be taken into consideration when optimizing the S/G and the inverter. The final paper will illustrate what penalties this new design space enforce on the S/G system in terms of weight, volume and development time, as compared to an unconstrained design. It will also be shown whether the selection of a PM machine system is still in fact advantageous, as compared to more fail-safe systems (such as the use of a switched reluctance machine). VII. Conclusion The implications of selecting a PM starter/generator for aerospace applications was analysed from a safety perspective and a large number of necessary conditions were identified to bring its failure rate to within acceptable values. Consequently these conditions formed the boundary conditions of the available design space within which the design had to be realized.