ISABE-2017-225231Establishing viable fault management strategies for distributedelectrical propulsion aircraftA review of protection and design challenges of viable faultmanagement strategiesMarie-Claire Flynn, Catherine E. Jones, Patrick J. Norman and Stuart J. [email protected] of StrathclydeGlasgowUKABSTRACTElectrical propulsion has the potential to increase aircraft performance. However, this will require the design anddevelopment of an appropriate aircraft electrical system to power the propulsor motors. In order to protect thissystem against electrical faults, which have the potential to threaten the safety of the aircraft, a robust faultmanagement strategy (FMS) is required. The FMS will comprise aspects of system design such as redundancy,reliability and reconfiguration and will rely on a range of protection devices deployed on the electrical system tointercept and manage faults. The electrical architecture will be shaped by the FMS as this will determine theoptimal configuration to enable security of supply. The protection system is integral to the system design. Henceit must to be considered from the outset, as part of the wider aircraft concept development. This paper presents arobust framework to develop the optimal FMS for an electrical propulsion aircraft, which is subject to all therelevant aircraft constraints and incorporates the available protection devices for a chosen aircraft for a givendevelopmental timeframe. A case study is then presented in which this protection design methodology is appliedto the NASA STARC-ABL aircraft concept in order to demonstrate that the available protection for an electricalpropulsion aircraft defines the possible electrical architectures.Keywords: electrical propulsion; protection; fault managementISABE 2017

2ISABE MCMVDCPWMSFCLSMESSSCBSSPCTeDPTRLCurrent Source ConverterCurrent Source InverterEntry Into ServiceElectromagnetic InterferenceExtended Twin Engine OperationsFault Management StrategyGenerator Control UnitHigh Voltage Direct CurrentMore-Electric AircraftMost Important ConstraintModular Multilevel ConverterMedium Voltage Direct CurrentPulse Width ModulationSuperconducting Fault Current LimiterSuperconducting Magnetic Energy StorageSolid State Circuit BreakerSolid State Power ControllerTurboelectric Distributed PropulsionTechnology Readiness Level1 INTRODUCTIONElectrically driven propulsion has been presented as a possible solution to improve aircraft performance, reducingnoise and emissions [1], as global levels of air travel continue to increase by 5% per year [2]. However, much ofthe benefit of this concept hinges on both the efficient and reliable transfer of electrical power from the generatorsor energy storage to propulsors driven by electrical motors [3]. As this transmission and distribution network iscrucial in ensuring flight safety, electrical fault protection and management is required. This paper will focus ondeveloping a methodology for design of feasible Fault Management Strategies (FMS), which will ensure thatelectrical power will continue to be transferred from the generators to the motors in the event of an electrical faultoccurring. The FMS will be the strategy used to design a robust and resilient electrical power system. The processof selecting an optimal FMS will incorporate the aircraft configuration as well as available protectiontechnologies, and the chosen FMS will influence the possible architecture design for a given aircraft. This designmethodology is iterative and would be repeated for any variations in the aircraft constraints and where the finalarchitecture choice has implications for the FMS.1.1Fault Management Strategy RequirementsThe fault management strategy (FMS) must not reduce the efficiency of the electrical power system below anoverall target efficiency, result in an unacceptable weight penalty, abnormally affect the normal operation of theelectrical power system (e.g. affect stability) and detect and respond appropriately within an acceptable time frameto abnormal conditions [4]. The FMS may include the use of added redundancy and reconfigurability, along withprotection devices which will perform the main fault management functionality in the event of a fault. Therefore,the capability of the available protection devices in terms of operation and potential maximum ratings must beknown before the FMS can be defined for a given aircraft. It is particularly important to identify any protectiondevices that must be omitted from an FMS from the outset, due to unsuitability against a particular constraint, forexample unacceptable (anticipated or confirmed) speed of operation or weight of device at the point where theelectrical system for an aircraft entering service is finalised. This paper will firstly describe and discuss thechallenges associated with designing an optimal FMS. Secondly, a framework for FMS design that seeks toovercome these challenges will be introduced and explained. A case study will then be presented which willdemonstrate this proposed FMS design methodology and demonstrate the influence of the FMS on candidateelectrical power system design and selection.2 FUTURE PROTECTION DEVICE CRITERIAIn order to describe the challenges in applying electrical fault management to future aircraft, firstly the paradigmshift between conventional aircraft and electrical propulsion concepts must be considered. There are a number ofareas associated with electrical power system design that are affected by this, and for the development of an

FLYNN ET AL225233appropriate FMS, two areas where this is particularly evident are the electrical power ratings and the protectiontechnologies.2.1Target Electrical Power RatingsThe electric propulsion power ratings for the aircraft electrical system define the range of suitable power ratingsfor the protection devices. The propulsive power is derived from the thrust required at take-off and is scaled foreach motor and generator according to required redundancy levels. The generated electrical power must alsoconsider losses within the system, with less efficient systems requiring a higher power generation capability.Therefore, it is critical that the overall power train is as efficient as possible. Depending on the number of channelsused to supply the load (percentage of maximum power that a section of network must support) and the positionof the device on the network, power ratings of protection devices will vary. Since conventional aircraft electricalpropulsion systems will be supporting loads in the several MW range [5], if solid state switching components(power electronic converters, circuit breakers) are required, then these must be developed suitable for use in anaero-electrical power system at these high power ratings. These power levels are much higher than is currentlysupported on current state-of-the-art and More Electric Aircraft (MEA) [6]. Scaling protection devices up to thesehigher power ratings whilst maintaining high power density remains a key challenge. For example,superconducting Fault Current Limiters (SFCL)s are already rated in the MW range [7], however, the weight andvolume would need to be scaled down to utilise this technology on an aircraft application.2.2Target Protection TechnologiesCurrent aircraft protection devices are largely unsuitable for use on future electric propulsion aircraft. Due toincreased power ratings and increased electrical system complexity, devices such as fuses, breakers and SolidState Power Controllers (SSPC) are likely to require significant specification improvement or be superseded bynovel protection technologies. Maintenance of the electrical power system, including the protection system, mustalso be kept to a minimum to reduce aircraft downtime. Thus fuses are not desirable as they require to be replacedafter a fault has occurred. An advantage of SSPCs is that they are able to combine advanced fault detectionalgorithms with a fault isolation capability. At higher power ratings on a compact network, fault detectionfunctions may be decoupled from the fault isolation technologies to enable flexibility of fault response and toallow centralized control of the protection system [8]. However, the on-state losses of solid state devices such asSSPCs may reduce the overall system efficiency [9] and their susceptibility to EMI failure may be a challenge[10]. Furthermore, there is the possibility of using the power converter switching capability as part of a faultmanagement strategy, to block or limit current [11], as discussed later in Section 3.5.3. Extinguishing of powerflow via this mechanism is not currently employed on aircraft systems, but is being developed for HVDC systems[12]. In summary, future aero-electrical protection devices are likely to include: AC and DC circuit breakersPower electronic converters with current limiting or current interruption abilityFault current limiters3 KEY FAULT MANAGEMENT STRATEGY CHALLENGES3.1Architecture DesignThere are a number of key challenges to designing optimal and reliable electrical propulsion system architectures.To date, the proposed electrical propulsion system architectures which include a fault management system eitherhave minimal protection [13], a preliminary selection of and/or placement of devices [14][15] or no developedfault management strategy [16][17]. The amount of protection devices which are deemed necessary for a chosenaircraft system also varies considerably [11][18]. Protection devices are often included in system configurationsonce the network architecture design has been largely concluded. Whilst this may be sufficient for a first passdesign to scope novel system configurations, much more detailed design of the electrical architecture is needed toidentify the most efficient and reliable configuration. Hence, in the FMS framework proposed in this paper, thechoice of FMS determines the key architecture decisions and precedes the architecture design process.3.2ConstraintsAlthough some of the limitations of protection devices and protection fault response of electric propulsion systemshave been studied [19][20], the authors believe that the identification of the most critical constraint on the FMSshould provide the starting point for development of initial solutions. The choice of the Most Important Constraint(MIC) has a significant impact not only on the protection methodology, but also on the choice of protectiondevices. If, for example, the maximum fault current is excessively large due to the low impedance of the network,then the FMS should focus on fault current limiting devices and the ratings of components in the worst affectedareas of the network. If, on the other hand, the speed of response to a fault is the most critical due to the allowablelevels of loss of thrust, then the operation time for devices should be prioritised and the control system for

4ISABE 2017protection devices should have minimal latency. As a result, the framework for FMS design proposed in this paperincorporates selection of the most important design constraint for the protection system, and then uses thatconstraint to drive the choice of feasible FMSs.3.3Variation in Standards and Development TargetsThe lack of established electrical system designs and power quality standards for future electrical propulsionaircraft [21] results in the situation where different manufacturers and influential organisations are directingdevelopments in a given protection technology towards different end goals and ratings. In addition, if the devicespecifications (such as rated voltage) are subject to change with the evolution of the electrical design, then it ismore difficult to select and develop technologies which will be suitable within the development time frame of theproject. This uncertainty in constraints and standards is the motivation to map the interdependencies betweenconstraints from the outset, so that the impact of variation in the range or threshold for a given constraint on thewider FMS design can be identified.3.4Time Available for DevelopmentAn important factor in the determination of the optimal architecture for a given aircraft is the developmental timeframe. If a particular aircraft is not an N 3 or N 4 concept, then there may only be limited time until the electricalsystem is finalised. In effect, this simplifies the feasible FMS options, since the disparity between current andprojected protection devices is reduced. For other aircraft concepts that are less developed and still open to a largedegree of variation in configurations and specifications, it is more difficult to accurately quantify the constraintson the system as well as the range of protection technologies which might reach high TRL. In this case, wherethere is more scope to assess the various merits and challenges posed by different configurations, it is possiblethat there could be many iterations of feasible FMS solutions leading to a wide range of possible architectures.Thus, depending on the time available, the optimal solution can be derived and moulded by changes in constraintsand devices as well as any variation in the aircraft configuration.3.5Technology ChallengesThere are also a number of challenges in protection system design which result from the projected capabilities offuture protection technologies. These are explored below.3.5.1 DC Circuit BreakersDC breakers are a standard protection mechanism in many applications. However the DC breakers which areavailable commercially for state of the art aircraft are typically SSPCs which are not available above 540 V [22].MVDC breakers developed for other application areas such as naval and terrestrial grids are physically very large[9] and are not available at power density levels which would make them suitable for aircraft. If it is proposedthat a DC breaker be used on every cable in the DC sections of a network (or at least in every protection zone)these devices require to be smaller scale and distributed across the network. If this cannot be realised within theconstraints of the FMS design then there are important implications for the FMS and the architecture, wherebyanother means of managing and isolating the DC system fault condition would have to be implemented [11] orDC systems would have to be eliminated as a feasible power distribution method. Another possible solution tomeet volume or weight constraints could be to reduce the number of breakers. The availability of DC breakersalso has implications for the ratings of the other protection devices on the network in terms of their speed ofoperation (where there is a coordinated discriminative protection scheme in place), or for the need for currentinterruption.3.5.2 Fault Current LimitersSFCLs have been deployed in a number of terrestrial grid projects [7] and are under development for naval systems[23]. Superconducting electrical power systems are under consideration for larger ( 5-10 MW) aircraft [24].However, the current weight of the devices and the cooling system prohibits their use in aero-electricalapplications, unless the complete electrical system is superconducting and so the additional cryogenic coolingweight is negated by the availability of a systems level cryogenic cooler. An ambient temperature dynamic faultcurrent limiter device for naval systems has been developed [25]. The removal of a requirement for an externalcooling system enables a reduction in the overall weight of the system. The recovery time of devices is also aconcern [26], especially if there are multiple faults in succession.3.5.3 Power Electronic ConvertersThe advantages of achieving electrical decoupling between different sections of the propulsion electrical powersystem have been reported in the literature [27], such as enabling the electrical machines to operate at their mostefficient speed. However, this would entail the use of rectifiers/inverters at the interface of the network andelectrical machines, which would have a non-negligible weight penalty. Where the power transmission is AC,then two conversion stages (rectification and inversion) would be required to condition the power fed to the ACbus and maintain frequency synchronisation between machines. Additionally, DC power transmission has been

FLYNN ET AL225235proposed for electrical propulsion aircraft due to the potential to reduce cable weight [28] and losses [29]. It is notyet clear which network configuration will be optimal, particularly in terms of weight, and so this remains animportant area of future work.From an electrical protection perspective, an advantage of using power electronic converters is that they mayperform a secondary function as part of the FMS by providing fault current limitation [9]. Whilst this means thatthe overall number of devices would not have to significantly increase, it does require fault tolerant converterdesign and may restrict the choice of power electronic converters. If this strategy is employed, then the remainingunfaulted network may temporarily lose power if there is a single fault anywhere on the downstream networkserved by a single converter. Additionally, the losses in the converters are a significant weight and efficiencyconstraint on the FMS design. Current state of the art converters for MEA have an efficiency of approximately97% [30] (but it is estimated that converters with an efficiency of at least 99% are required for electrical propulsionapplications [31]).4 METHODOLOGY FOR DESIGN OF AIRCRAFT FMSFrom the discussions presented in Section 3, it is clear that there are a number of constraints which influence thechoice of feasible electrical protection devices and solutions for distributed propulsion aircraft. If the protectionsystem is added to the design after the architecture has been selected it may not be possible to satisfy all theconstraints, and the resulting protection solution may not be the most optimal given the available technologieswithin the relevant timeframe. Therefore, the authors have developed an FMS design methodology, shown inFigure 1, which defines the feasible FMS for a given system within a given developmental period andsubsequently identifies feasible candidate electrical architectures.Figure 1 Flow diagram of FMS design conceptOn the right hand side of Figure 1, the aircraft developmental timeframe is defined first. This is an importantinitial step as it will determine the range of aircraft configurations which are being proposed and the protectiondevices which should be reaching technical maturity by the time the aircraft design is finalised. The next stage is

6ISABE 2017the aircraft configuration and protection functionality, which enables the constraints path to be initiated. Todetermine the scope of feasible protection functionality, the available protection devices are first identified. Theadvantages and disadvantages of different technologies or topologies are then assessed to determine the limitationsof the available protection options. The protection device trade space can be then be subsequently mapped bycombining different specifications of devices in order to identify the feasible regions where a device must exist tobe viably incorporated into a FMS for the given aircraft [32].The aircraft concept and the feasible protectionfunctionality and devices (circuit breakers, fault current limiters, as well as power converters and energy storagedevices with protection capability) are then fed into the FMS design on the left hand side of Figure 1, whichreturns the most important constraint (MIC).To determine the MIC, the constraints are first identified and quantified as far as possible. The constraints may bedriven by the physical shape of the airframe (such as where devices will actually fit), certification requirements(such as ETOPS (Extended Twin Engine Operations) criteria [33] or electrical safety standards) or technologylimitations (such as the minimum possible time of circuit breaker operation). Once the main constraints are known,the next stage is to map the interdependencies between the constraints. This allows the impact of changes in aconstraint set-point to be understood and inform trade-offs between different design criteria. At this point, theconstraints can be ranked in terms of priority, with the most critical constraints ranked highest. The most criticalconstraint with the most significant impact on the FMS design, is then selected as the Most Important Constraint(MIC). The MIC then feeds into the identification of feasible fault management strategies, along with the availableprotection devices and aircraft configuration. Feasible architectures are then identified, based on the FMS andthe necessary protection system.The process is iterative as a change in developmental timeframe would entail that the process be recommencedwhilst the MIC could be varied where there are a number of key constraints, or where the priority level of aparticular constraint (such as voltage standards) is dependent on external factors. The mapping of the constraintsallows the process to be flexible, adjusting to developments in the aircraft systems or protection technology, at astage where the important dependencies are already known. Hence the sensitivities of the FMS design tofluctuation in a specific constraint (e.g. chosen network voltage rating) can be anticipated, making the designprocess more robust.5 CASE STUDYTo demonstrate the design framework outlined in Section 4 whereby a suitable FMS for an aircraft is derivedbased on the protection device development and the FMS constraints, this design methodology was applied to achosen aircraft. The case study could have focussed on either a superconducting or conventional aircraft as themethodology applies to both, but in this instance a conventional aircraft, namely the NASA STARC-ABL hybridelectric aircraft (shown in Figure 2) was chosen.Figure 2 STARC-ABL aircraft concept and proposed electrical architecture [1]5.1Developmental TimeframeThis aircraft has proposed point of entry into service of 2035 [1] and can be considered as an N 3 aircraft [34].Therefore, selection of appropriate protection devices will be based on technologies which have reached high TRLat the point when the aircraft design is finalised, an appropriate length of time before 2035.5.2Aircraft ConfigurationThe chosen aircraft for this configuration is a conventional tube and wing passenger aircraft with two turbofanson the wings and a single propulsor motor housed in the tail cone. This has the benefit of utilising existing aircraft

FLYNN ET AL225237design configurations (as opposed to a blended wing body aircraft [35], for example) and thus providing atechnology stepping stone between the current turbofan driven aircraft and future electric propulsion concepts.Power is generated by the generators located on the engines and is supplied to the rear propulsor motor. Theelectrical system provides 20% thrust at rolling take-off and 44% at the top of climb [1]. This implies that theFMS requires sufficient redundancy and fault ride-through capability in order to continue to provide this level ofthrust in an engine-out scenario during take-off.5.3Available Protection DevicesWith the developmental timeframe for the aircraft chosen, available protection technologies can be identifiedahead of scoping possible constraints and the MIC. Since the STARC-ABL is an N 3 concept, the system isalmost certainly not superconducting [34]. From the literature [32] it is likely that SFCLs will be too large wherethe system itself is not superconducting. It is currently unclear whether DC breakers and DC SSPCs will befeasible within the given timeframe. The STARC-ABL has only two generators and a single thruster motor.Therefore as there are only 2 power transmission channels needed (from each generator) and one powerdistribution (to the load) as shown in Figure 2, the minimum number of circuit breakers that would be requiredcan be found.In terms of AC network protection, a conventional Generator Control Unit (GCU) could be used at the generatorto provide isolation of a generator fault and reconfiguration of power flow between the two generators at theinterface to the AC network [36]. This technology is already operational on aircraft; so as a baseline technology,GCUs could be feasibly included in a FMS targeted towards use on an aircraft with an EIS of 2035. However, by2035 other more advanced technologies may also have reached high TRL. The specific aircraft requirementswould dictate whether the GCU technology would be sufficient, or whether an alternative method of achievingthis protection functionality is required or desired to overcome any identified functionality deficiencies or toadditional aircraft-level benefits.5.4Identification of ConstraintsThe constraints for the aircraft are largely similar to those general electrical propulsion constraints which havealready been identified in [32]. Specific STARC-ABL aircraft constraints which are known at present aresummarised in Table 1.Table 1 Known constraints for the STARC-ABL aircraft [1]ConstraintVoltage ratingPower ratingElectrical system weightNumber of passengersNumber of generatorsNumber of motorsLocation of generatorsLocation of motorsExpected value or range600-4800 V2.8 MW total generation capacity1394 kg15021Pylon mounted on centre of wings behind enginesOne single, large motor on tail of aircraft fuselageInitial studies conducted by NASA for the STARC-ABL aircraft included estimates of the protection systemweight and total electrical system weight, based on projections of protection system improvements. However, theactual value of weight is (as indicated in Table 1) is likely to change from these figures as the design evolves.5.5Constraint InterdependencyInterdependencies between key constraints will exist and can be identified at this stage of the process. Theavailability of technology is intrinsically linked to the TRL level and so any delay in the development, testing orcertification of a protection device will reduce the chance of that device being available. Another importantinterdependency is that between redundancy, weight and maximum allowable loss of thrust. Increasingredundancy via parallel or series components will increase the weight unless a redundant component acts as asubstitute for an existing component on the network. Higher redundancy reduces the potential loss of thrust, whichis an important constraint, but having greater total weight means that the minimum take-off thrust required is alsoincreased. Efficiency and thermal management are also related, as heat losses reduce overall electrical efficiencyand have to be safely dissipated from the system. This is more challenging where the power losses are higher andwhere there are more components with a thermal load. Hence increasing the number of components in order toimprove the redundancy of the network may result in an increase in rating of the thermal management system.

8ISABE 20175.6Most Important Constraint (MIC)The maximum electrical system weight will determine whether or not novel protection devices are feasible forthis application. The weight constraint is also the main challenge in transferring technologies from a conventionalelectrical network or naval application to a future aircraft. This is further verified by the focus given to minimisingweight of the entire system in a number of studies for Turboelectric Distributed Propulsion (TeDP) hybrid aircraft[11], [18], [27]. Hence, for this case study weight has been chosen as the MIC for the protection system.5.7Choice of Protection Devices and Functionality of FMSThe choice of weight as the MIC eliminates a number of protection options. As discussed in Section 5.3, SFCLsare not appropriate for fault current limiting on an N 3 aircraft and hence alternative methods of providing thisprotection functionality must be considered. The compact nature of the system results in low levels of intrinsicimpedance in the network to limit short circuit fault current levels [20]. Hence either the FMS has to operatebefore the maximum fault current is reached, or include current limiting converters, or increase the maximumfault tolerance of components [15]. For the purposes of this case study, the chosen option is to operate before peakfault current is reached. This is a viable option as differential DC protection for aircraft has been demonstrated atlow TRL to operate within a few microseconds for DC faults [37]. Assuming that the protection is designed forthe specific di/dt characteristic of the system, this FMS will be able to isolate an area of faulted network beforethe maximum fault current is reached which allows the current rating of components on the network to be reduced.This FMS, however, relies on fast acting and possibly solid state DC breakers on the network which if available,would contribute significantly to the weight of the protection system. However, as there are only two powerchannels, it is proposed that only four breakers are required. The weight penalty of the circuit breakers could beoffset by the component count remaining low. If the weight of the DC breakers was to push the total electricalprotection system weight above an allowable limit, then the FMS framework would be used to identify alternativeoptions, either to eliminate the use of circuit breakers from the system or reduce the number used.As this aircraft seeks to combine conventional aircraft configurations with electrical propulsion technology [38],the FMS for the AC sections of the network (where the electrical machines which are AC interface with thetransmission and distribution network) is chosen to be largely similar to current protection systems. A GCU, asdiscussed in Section 5.3, is selected for each generator and another control unit is used at the mo

optimal configuration to enable security of supply. The protection system is integral to the system design. Hence it must to be considered from the outset, as part of the wider aircraft concept development. This paper presents a robust framework to develop the optimal FMS for an electrical propulsion aircraft, which is subject to all the