OPERATION OF A FAULT TOLERANT PM DRIVE FOR AN AEROSPACE FUEL PUMP APPLICATION
J A Haylock, B C: Mecrow, A G Jack and D J Atkinson
University of Newcastle,UK
INTRODUCTION
In many applications the failure of a dnve has a serious
impact on the operation of a system. In some cases the
failure results in lost production, whilst in others it may
jeopardize human safety. In such applications it is
advantageous to use a drive capable of continuing to
operate in the presence of any single point failure. Such
a drive is termed fault tolerant and the development of a
fault tolerant drive is the aim of the research presented
here.
Previous work,[ 1 1, has introduced the concept of a fault
tolerant permanent magnet (PM) machine drive for
safety critical applications. This drive was based on a
novel design of PM machine with a high per unit
reactance to lirmit fault currents. It is shown in [2] that
the torque and power densities of this PM drive exceed
those possible with an SRM drive. This previous work
was undertaken Ion a small prototype machine without a
power electronic converter. A new drive has now been
built and extensively tested. It uses a similar topology
to the prototype machine and is designed to an aircraft
fuel pump specifcation, requiring 16 kW at 13000rpm.
This paper reports the key design attributes for this 16
kW drive and provides detailed measured parameters.
The machine is controlled by a power electronic
converter using a separate H bridge to drive each
phase. The conQ:oller,implemented via a DSP, uses the
measured machine flux linkage to provide robust
current control with high dynamic performance.
FAULT TOLEIRANT DRIVE REQUIREMENTS
The requirements for a fault tolerant power system have
been presented by White [3]. These requirements may
also be applied 1:o a fault tolerant drive with only a little
modification, necessitating:
Partitioning and redundancy
Isolation between units
Fault detection and reporting
Continued operation until the next service
opportunity.
The synchronous PM drive has been designed to fulfil
these requirements. The drive is partitioned into 6 single
phase units, each comprising an independent single
ENID97 1-3 September 1997 Conference Publication No. 444 0 IEE 1997
phase inverter to drive a machine phase. The
arrangement for each phase is as shown in Figure 1.
Redundancy is introduced by designing the drive to be
capable of supplying 1/5 of the required power output
from each phase.
P
COMMANDS H - BRIDGE MOTOR PHASE
- i
I
e*
Figure 1 : A Single Phase of the Drive.
Each phase unit has been designed such that a fault in
one phase unit does not directly affect adjacent phases.
The continued fimction of healthy phases is ensured by
providing physical, thermal, electrical and magnetic
isolation between phases.
It is a requirement that the fault does not indirectly
compromise the operation of healthy phases by unduly
disturbing the common input (the dc link) or the
common output (net shaft torque). Thus in the event of
any fault, rapid action must be taken to prevent the
faulted phase from drawing excessive current or
applying significant braking torque to the shaft. Rapid
fault detection is also important in the fault tolerant
drive system, to enable appropriate post fault action to
be taken.
The drive has been designed to ensure that it is possible
to continue to operate with the fault until the faulted
unit can be replaced. Appropriate post fault control
must prevent fault propagation and minimize the impact
of the fault on the dc link and shaft torque. Short circuit
fault current in the machine is limited to rated value by
designing the machine with a 1.O p.u. phase inductance.
DESIGN
The details of this design are summarized in table 1.
The machine is wound with a single coil per phase and
each coil is wound around an alternate single tooth. The
general configuration for a 6 phase, 8 pole machine is
133
TABLE 1 - Machine Design careful electromagnetic design 1.O per unit reactance
has been achieved.

Parameter Value Units The single phase bridges used to control the power flow
into the machine are supplied from a nominal 270 V DC
Operating speed 13000 rpm bus. Certain attributes are required of the bridges:-
Poles 8
Turns per phase 50
* Sufficient thermal and physical isolation between
Phases 6 power electronic devices to allow a device to
Active mass 3.227 kg continue functioning in the event of the failure of its
Target torque with 6 phases 11.75 Nm neighbour.
Target Rated Current (rms. 21.1 A
Ability of devices to survive a supply short circuit
sinusoidal) for sufficient time to detect the fault.
Ability to turn off a power device that has been
shown in Figure 2. Further background on the design turned on in the presence of a short circuit.
topology is presented in [ 11.
IGBTs are used with appropriate gate drive circuits
The stator unit of this machine can be seen in Figure 3. capable of providing monitoring functions.
It is housed in a water cooled casing. The machine
stator is wound in a manner which provides the required MEASURED PARAMETERS
physical, thermal, electrical and magnetic isolation
between phases, thus enabling the machine to continue The parameters of the machine have been measured as
operating with a faulted phase. This topology naturally recorded in table 2. The machine has been mounted on a
results in a relatively high per unit reactance and with test rig, driving a DC load machine through a torque
meter and a toothed belt, Figure 4.

The magnet induced emf of one phase module is plotted

in Figure 5. Because each phase is supplied separately,
triplen harmonics can exist, and a small third harmonic
is present. However, the waveform is relatively close to
a sinusoid.

The static torque characteristic of the machine was

measured using the torque meter on the rig. The
resulting torque vs. angle curves are shown in Figure 6.
The cogging torque of Figure 6 initially appears very
large, but this is because it is displayed in the context of
the torque produced by a single phase. When all phases

-
are used it is proportionately smaller, in fact only 2% of
the rated torque of the machine.

Figure 7 shows the torque per unit current vs. angle for
a range of phase currents. Note that the cogging torque
has been subtracted from the result in Figure 7. It is
Figure 2: Machine Topology. clear that even at 30 amps there is very little loss of

Figure 3: Stator Unit for the 16 kW Machine Figure 4 : The Drive Test Rig .

134
TABLE 2 - Measured Machine Parameters current in phase A, giving a temperature rise of 100
degrees will only give a 5 degree rise in phase B.
Hence thermal propagation of faults from one phase to
Parameter Value Units the next is unldcely.

Peak phase back emf at operating 198.9 V CURRENT CONTROL

speed
Phase resistance 0.156 s1 Each phase of the machine is driven by an independent
Phase self inductance 1.275 mH single phase bridge, thus maintaining the isolation
Mutual coupling between phases 0.028 mH between phases of the machine in the power stack. The
Short circuit current 18.4 A 6 single phase bridges are controlled by PWM
Phase-coolant thermal resistance 1.21 "C/W switching commands, generated by a set of control
Phase-phase tk ermal coupling 0.064 "CTW hardware. The control hardware samples each phase
current at fixed points in each PWM interval. The rotor
torque capability. i.e. cross saturation effects are not position and dc link voltage are sampled at the same
important, even at rated current. instants.
Thermal tests on the machine reveal very low thermal
coupling betwe" phases, as desired. For example, a The machine has been characterized in terms of
measured flux linkage against current and rotor angle.
This measured characteristic is shown in Figure 8. The
y, i, 8 characteristic is held in the controller as a lookup
table.

The current controller uses the sampled quantities and

0 90 180
Rotor Angle (degrees)
the y , i, 8 data to calculate the required PWM demand.
This is applied to the inverter to drive the current to the
exact value desired at the end of the following PWM
interval. The calculation is repeated for each phase
270 360 every PWM cycle.

From the y, i, 8 lookup table the current controller can

Figure 5 : Back emf data measured at 4000 rpm
predict the current at the end of each PWM cycle. Any
5 , , I difference between the current predicted and the current
4 subsequently measured is an indication that the machine
3 has changed, i.e. the machine has developed a fault.
2 This fault detection method is capable of detecting
1 1 shorted turns within the phase.
r. O
g -1 FAULTS UNDER CONSIDERATION
-2

-3 The set of faults considered has been restricted to those

-4
0.08
I I I I I I I I I I I I I 1 I
0 10 20 30 40 50 80 70 80 90
Rotor Position(&agrees) 0.06

Figure 6 : Static torque test results. 0.04

-2
0.15
0
- 0.02

0.1 3 0
C
i
Q
2
0.05 2
G
-0.02

P -0.04
2 O
t
:-0.05 -0.06
I
-0.1 -0.08
80 -60 -40 -20 0 20 40 0 80
-0.15 Current (A)
0 10 20 30 40 50 80 70 80 90
Rotor Posttbn (degrees)
Figure 8 : Relationship between Flux Linkage and
Figure 7 : Static torque per amp Current for a Range of Electrical Angles.

135
occurring in the power converter and the electric inductance. The terminal short circuit can be applied by
machine. It is believed that this set of faults includes all tuming on the upper 2 power switches in the bridge
the most probable and serious electrical failures. The supplying the faulted phase to provide the current
faults considered are: shown path in Figure 10.

0 Open circuit phase A Single Shorted Power Device.

o Phase short circuit at machine terminals
0 Turn to turn short circuit in a phase winding
0 Power device short circuit
0 Power switch open circuit
0 DC link capacitor failure
FAULT DETECTION
With the exception of the DC link capacitor failure, all
the above faults have been deliberately imposed upon
the drive during operation. Some faults, such as a
shorted power device in the power converter, or a turn
to turn short circuit in the machine, must be detected
very quickly. Once detected, appropriate action must be
taken to prevent fault propagation and to enable
continued operation. A sensing scheme which examines
deviation of the phase current from the expected value
has been developed. It has been shown that this sensing
scheme is capable of detecting a single shorted turn
within a phase windingby examining the actual current
value in each PWM cycle [4].
This failure necessitates:-
(a) Inhibiting of the gate drive in the other power device
of that leg to prevent shoot-through.
(b) Shorting of the phase to prevent a significant d.c.
component of phase current [11.
Figures 19 and 20 show that the power switch short
circuit fault can be detected and acted upon sufficiently
quickly to ensure that the drive speed remains
unaffected. These diagrams show the current in the
faulted phase, limited to values within the thermal limit
by the armature inductance. The current in one of the
unfaulted phases is also shown, illustrating how it is
increased by 615 to overcome the loss of torque from
the faulted phase , thereby providing the same total
torque after the fault as before the fault. The upper
traces show that with the drive mounted on the test rig
the torque contribution from the unfaulted phases is

OPE N - FAULTED

In the event of a failure action must be taken to ensure

that the fault does not propagate and that the faulted
phase does not seriously disturb the supply or the net
torque output [5], [6].In particular a faulted phase must
not contribute significant braking torque. 1-t

Certain faults result in many times rated current

flowing. Operation in the event of two such cases is
overviewed below:-
... .., , '.,,. ;,,,,:I,,,,+,.,,:
, , , , i , . , , j , , , . : : , , , .

A Single Shorted Turn. time base: 500ps / div.

trace 1 : Current in faulted phase 10 A / div.
trace 2: Current in shorted turn 100 A / div.
A shorted turn produces one of the most difficult of trace 3: Current in healthy phase 10 A / div.
faults, since the single shorted turn will have current
Figure 9 : Current in a shorted turn, the remainder of
induced in it opposing the entire magnet MMF. When
the faulted phase, and in an adjacent healthy phase
the faulted winding is excited by PWM voltage the
before and after the phase is shorted.
situation becomes more complicated, with the single
shorted turn acting like a shorted secondary in a
transformer. The reduction in phase inductance results
in large current overshoots. Figure 9 shows the current
measured in a single shorted turn to be 300 A pk. This
is 10 P.u., resulting in an exceptionally rapid VDC
temperature rise. Therefore the drive must recognise
the fault and take appropriate action in a few
milliseconds [4]. In this case the correct action is to
short the phase at the terminals, so that the MMF of the
shorted turn becomes spread over the entire winding,
and becomes limited to 1.0 p u . by the phase Figure 10 : Short circuit applied to faulted phase by the
inverter to limit current in the shorted turn.

136
detected sufficiently quickly to ensure that the shaft unaffected by a shorted phase and the drive can
speed remains unaffected. continue to operate

CONCLUSION Undetected turn to turn faults will result in currents

A fault tolerant demonstrator drive has been
constructed. Tesls on this drive have shown that it is
possible to detect all the machine and power electronic
faults considered. It has been shown that if appropriate
action is taken the drive can continue to operate
indefinitely in the presence of any of these faults. In
particular the research has demonstrated that:
The drive cam continue to operate with an open
circuit winding.
A permanent magnet machine can be designed with
1 p.u. reactance to limit the current in a shorted
phase to rated current.
The remaining healthy phases of the drive are
.?
' T
many times larger than rated current flowing in the
faulted winding. If no action is taken the fault is
likely to propagate rapidly.
A single shorted turn can be detected by monitoring
the sampled current each PWM cycle. Shorting the
phase reduces the fault current to rated value.
A shorted power device results in very large shoot
through currents when the healthy power device in
the faulted limb turns on.
Shoot through current can be detected within the
short circuit withstand time of the power devices and
the healthy device turned off again.
In the event of each fault, the healthy phases are
capable of compensating for the torque loss resulting
from the failure.
.
.
ACKNOWLEDGMENTS

The authors would like to thank Lucas Varity, Rolls

Royce IRD and Welwyn, for their support and EPSRC
for funding this research.

REFERENCES

B.C. Mecrow, A.G. Jack, J.A. Haylock, J. Coles,

'Fault Tolerant Permanent Magnet Machine
Drives', .-
A.G. Jack, B.C. Mecrow, and J. Haylock, ' A
time base: 2 ms I div. Comparative Study of Permanent Magnet and
trace 1: Current in faulted phase 20 A I div. Switched Reluctance Motors for High
trace 2: Current in adjacent healthy phase (lower trace) 20 A I div. Performance Fault Tolerant Applications',
trace 3: Machine speed (upper trace) 3000 rpm I div.
E vol.,
32,
Figure 11 : Plot of speed before and after short circuit no. 4, JulyIAugust 1996, pp. 889-895.
power device fault. R.V. White, 'Fault Tolerance In Distributed
.... Power Systems', EPE'95, pp 2.851-2.857.
.
:.
:

" 'ctii zblbm:' ' .i.oxvert' "o.'ixHorz

._ .
' ' j ' ' ' ' j ' ":
,
, .A . J. A. Haylock, B. C. Mecrow, A. G. Jack and D.
. .* . . . J. Atkinson 'Operation of Fault Tolerant
Machines With Winding Failures', IEEE
2
Conference. 1997.
R. Spee, A.K. Wallace, 'Remedial Stratergies for
Brushless DC Drive Failures', IEEE
yrt- Applications, vol. 26,
no. 2, JulyIAugust 1996, pp 259-266.
T.J.E. Miller, 'Faults and Unbalanced Forces in
the Switched Reluctance Machine', IEEE
I ; ,
. . I . . 4 . . .. i . . . .
.. . . , . . . / . . ., .
.
.
: ..
.
.
E
No. 2, MarcldApril 1995, pp. 319-328.
Vol.,31,
time base: 20 ms I div.
trace. 1; Current in faulted phase 20 A / div.
trace 2: Current in adjacent healthy phase (lower trace) 20 A / div.
trace 3: Machine !;peed (upper trace) 3000 rpm / div.

Figure 12 : Plot of speed before and after fault on

longer time scale.

137