Fault Tolerant Inverter Topology for the Sustainable Drive of an Electrical Helicopter

A R T I C L E I N F O A B S T R A C T Article history: Received: 05 April, 2017 Accepted: 12 May, 2017 Online: 22 May, 2017 The paper describes the results of the system analysis of various options of electric inverter topologies for the use in the traction drive of an electrical helicopter. The paper explains the optimal choice, in terms of the design requirements and future operational conditions, and the type and topology of the electric inverter to supply the traction permanent magnet synchronous motor with the batteries. The main focus has been set on the study of the overload capacity, thermal behavior, and the fault tolerance of the multilevel electric inverter. In order to estimate these parameters, the Markov models of the multi-state system’s reliability evaluation were used.


Introduction
Nowadays, according to the long-term plans for the electrification of various types of vehicles, the task of the electrification of air traffic has now become very important. First of all, the application of electric drives is a promising one for small helicopters designed for search and rescue operations with a nominal power of 510 kW, a rotational speed of 400 rpm, and a voltage of 800 V. Regarding the choice of an optimal electric inverter topology for the traction drive the main attention was paid to the flight safety.
The simplest solution would be to maximize the number of redundant equipment, but strict limitations on weight and dimensions do not allow this. The papers [1,2] show that only multi-phase electric motors are capable to satisfy the requirements to the fault tolerance (λ ≤ 10 −9 /h), set up for the electric traction drive of the helicopter.
Taking into account the safety and sustainability of helicopter's operations, the relevant options for inverter topologies were evaluated. Thus according to [2] for the comparative analysis the semiconductor inverters for 6-, 7-, and 9-phase motors were taken.
Due to the great relevance of the creation of electric inverters for special applications, there are many publications describing the topologies and the analysis of inverters with different levels of fault tolerance for various vehicle types. The results of these studies were taken into account by the authors at carrying out of their investigations. Hence, the main task of this research is to find the decision, how it becomes possible to achieve the required values of the inverter's fault tolerance.

Approach and Parameters for Evaluation
For each component of the helicopter's traction drive, based on the project requirements and conditions of future operations, the most important parameters are: • reliability and fault tolerance; • weight, volume, and dimensions.

Reliability and Fault Tolerance
For the safety-critical aircraft applications accurate assessment of reliability and fault tolerance indices of the electric inverter at the design stage of the helicopter is crucial for further operation. The operating experience of electric inverters indicates that the most vulnerable elements of inverter are the capacitors, semiconductors, and printed circuit board (PCB) [3,4]. Statistical data of failure in various parts of inverter are shown in Figure 1. The main reason of the failures is the overheating of the semiconductors caused by current overloads, as can be seen in Figure 2.
In accordance with [3][4][5][6] the following failure cases were considered, shown in Figure 3. In these cases for the fault-tolerant operation either the inverter module must be shut down or must be switched to the possibly existing redundant inverter leg or module. Each of these modes is connected with a rapid increase in the current at the emergency site and an overload of semiconductors. On the basis of data on the standard overload capacity of power electronics has been plotted the graph presented in Figure 4. The most of the fail operational modes caused by technological overloads. At the overload power losses occur in the p-n-transition and its temperature due to the low heat capacity increases dramatically. In the case of exceeding a certain critical temperature of pn-transition, the semiconductor device fails. So overheating temperature is the main parameter characterizing the overload capacity of semiconductor devices as can be seen in Figure 5. So, the consequences of overload in failure operational modes are overcurrent and overheating of an inverter, which lead to a reduction of the reliability indices of the motor and to a decrease in lifetime [7].

Weight, Volume, and Dimension
The modern options of the fault tolerant topologies of electrical inverters [6,[8][9][10] have a different number of components designed for different values of operating parameters. Therefore, the number of components, the flexibility of their placement, and the inverter parameters are largely determining such important characteristics of the helicopter, such as weight, volume, and dimensions. The comparative analysis of these values for different inverter topologies are presented in the next sections of this paper.
I. Bolvashenkov et al. / Advances in Science, Technology and Engineering Systems Journal Vol. 2, No. 3, 401-411 (2017) 3 Topologies for the Comparative Analysis The first part of this section explains the conventional topologies, such as 6-pulse-bridge (B6-bridge) and the H-bridge. However, the second part analyzes the use of multilevel inverters, i.e. cascaded H-bridge (CHB) inverters.

Conventional Full-and Half-Bridge Topologies
One of the previous papers [2] compared multi-phase permanent magnet synchronous motors (PSM) for safety-critical drive trains. As a result, 6-, 7-, and 9phase motors are preferable in order to reach the requirements regarding fault tolerance. Hence, possible 9-phase machine topologies are presented in Figure 6, as well as in Figure 7. Those are commonly used and can be adapted to all different numbers of phases. The already mentioned inverter topologies are compared for a failure case (open circuit) in one phase. This is also valid for a short circuit failure, if the fault is instantaneously detected and isolated, as described in [11,12]. Hence, the advantage of Hbridges is the separation of every single phase in order to monitor failures. For this inverter topology comparison, an existing electrical machine with three phases serves as an exemplary machine for the failure simulations. At first sight, the results can relatively be adapted to other power requirements.     After the transient response of the simulation model, the failure takes place at 0.4 seconds and the results are shown in Figure 8 and Figure 9. The speed fluctuations are clearly visible for both machines in Figure 8, whereas the amplitude of the 6-pulse bridge is higher, as well as the speed ripple. Considering Figure 9, the results show, that the power or torque ripple get a lot smoother for the H-bridge, since the peaks for the B6-bridge even drop down to 0. The peak to peak value equals up to ±100% for the 6-pulse-bridge, compared to approximately ±40% for the H-bridge.
In summary, considering a one phase failure and hence fault tolerance, the H-bridge is recommendable for machines with multiple phases, because of the lower power degradation. Due to the high requirements, the machine is already highly saturated in nominal operation; hence, overload in a failure case is not applicable. Thus, in case of a 6-pulse-bridge, three phases fail, since the inverter is unable to drive two out of three phases. In contrast, each H-bridge drives one phase and consequently in case one phase fails, eight phases still operate. Assuming an equally distributed power per phase, the H-bridge topology provides 89% of the nominal power and the B6-bridge only 67% respectively for a 9-phase machine. For the 6-phase machine the situation gets even worse.
However, after first analytical approximations and considering the application case, weight is 20%, volume 60% higher, and the power losses are slightly higher (10%) for the H-bridge compared to the 6pulse-bridge topology. This results out of the increased number of semiconductors being necessary for the H-bridge topology. Therefore, the next section includes the analysis of a multilevel inverter trying to solve the problems regarding weight, volume, and power losses, since there is no definitely preferred option. [11][12][13]

Multilevel Inverter -Cascaded H-Bridge Inverter
Multilevel inverters offer several advantages compared to their two-level counterparts [14]: smaller power filters, smaller voltage ratings for semiconductors, lower switching frequencies, and less power losses. They offer also more modularity and are more reliable. The inverter with three H-bridges and the B6-bridge inverter need higher voltage range semiconductors (1000V range).
Considering [15][16][17], CHB inverters with the lower number of components than other classic multilevel counterparts, such as the Neutral Point Clamped (NPC) or Flying Capacitor (FC), are the best candidate for the use in electric drives. They need more components than CHB and have less modularity, due to the central storage unit. The number of components (power switches, diodes and capacitors) for one phase with 17-level output voltage steps is: 288 for the NPC, 168 for the FC and 40 for the CHB (see Figure 10). Figure 10 shows, that the cascaded H-bridge topology has the most advantages with more than 5-level. CHB inverters offer higher modularity and have the capability for embedding energy storage units in a split manner, given the existence of several submodules operating at low voltages (see Figure 13).  Table 1 shows the parameters of the system. It also shows the structure of the batteries used for the B6bridge inverter with centralized energy source (battery rack) and CHB inverter with decentralized energy sources (battery modules). V L is the phase volt-age of the machine, V cell the battery cell voltage, V mod the battery module voltage, and V rack the battery rack voltage. The capacity/energy content of the storage units is neglected. A multilevel inverter with 17 level output voltage steps needs 8 battery modules in each phase. The number of required submodules depends on the value of the minimal phase voltage of the machine and on the minimal battery module voltage V battmin and is calculated as follows: Using a higher number of submodules the output voltage is near to a sinusoidal wave form and the harmonics on the electrical machine are lower.
The CHB inverter uses battery modules as shown in Figure 13. Each module is connected to an H-bridge with 4 MOSFETs. The use of MOSFETs enhances the efficiency of the CHB inverter, because of the low conduction losses. Usually, IGBTs are used for a higher voltage range, such as for B6-bridge inverters.
The prototype of the three phase CHB inverter is compared to a commercial B6-bridge inverter (Siemens S120) with the same nominal power 36 kW, taking into account weight, volume, and efficiency. The power-to-volume ratio of the B6-bridge inverter including the power filter is 36 kW/30.8 l = 1.17 kW/l. Finally, Table 2 shows the results of the comparison between B6-bridge and CHB inverter and it proofs the advantages of CHB over the B6-bridge inverter in volume and weight. The next section discusses results of reliability and fault tolerance analysis.

Preliminary Assessment
Based on initial data and the technique for reliability evaluation described in [4,9,[18][19][20][21][22][23], reliability and fault tolerance indices were analyzed. Statistical data for calculating the reliability function of the multilevel inverter in 6-, 7-, and 9-phase implementation are shown in Table 3 and Table 4. Figure 11 shows the reliability function of the multilevel inverter. It can be seen that the probability of failure-free operation of 6-phase inverter is higher than 7-and 9-phase, due to a smaller number of components. However, the difference between the 6-and 9-phase options does not exceed 20% for 10,000 operating hours.
www.astesj.com On the basis of the schedule of acceptable inverter's overload (see Figure 4) and the method described in [24], the qualitative analysis of the inverter's ability to function was carried out in case of a failure of 1, 2, and 3 submodules in a single phase. The analysis results are summarized in Table 5 and  Table 6.
Considering the requirements of the project, the most critical failure mode of the traction drive, as can be seen from Table 5, is when it is necessary to maintain stably during 2 minutes 113% of nominal power. Further, this mode will be more carefully simulated and estimated for the failure cases using a Markov model.

Multi-State System Reliability Markov Model
For the maximum accurate estimation of the fault tolerance value of each comparable inverter option and its compliance (or non-compliance) with design requirements, a Multi-State System Reliability Markov Model (MSS MM) was constructed, which theoretical base is described in [25,26].

State Diagram of Markov Model
For the present study the phase open-circuit failure has been considered as the main dangerous failure for electric inverter, i.e. it is the most severe kind of failure, to which less dangerous failures can be summarized. The impact of this failure on the safety oper-ation of the power drive is very significant. In this way, the phase open-circuit failure of a multilevel inverter's submodule can be considered as one of the main causes of failures in traction electric drives, since practically all other electrical failures of the inverter can be attributed to it [7].
Thus, the multilevel inverter can be considered as a multi-state system with a loaded functional redundancy and consequently, with an appropriate reserve of the fault tolerance. A more accurate approach to build the Markov model is described in [2,27].
The number of the degraded states of the MSS MM has to be determined in accordance with the requirements of the project on the fault tolerance and on the technical capabilities of the object to continue functioning with reduced performance as a result of the critical failure.
Regarding the above requirements on the fault tolerance of safety-critical drives, as well as statistical data on the reliability of electric inverters, it was determined that the optimal model for the analysis of fault tolerance in such conditions is a multistate Markov model with a minimum of five states, as shown in Figure 12. With one degradative state of inverter, it is not feasible to realize the required values of fault tolerance. The first state "0" corresponds to a completely failure-free operation of the inverter. The second, third, and fourth state are the states of degradation and correspond to failure cases. The last red state of the model corresponds to the failure of one phase considering the CHB (see Table 6) or respectively, a completely failed conventional inverter (see Table 5) when the traction motor does not receive the necessary power for a safe flight. Thus, every following state of the degradation corresponds to the worst case -a loss of an inverter's submodule in the same phase.

Transition Probabilities
The most important and difficult fact for a simulation by Markov models is to determine the transition probabilities and determination of the number of states with a reduced level of functionality. The values of the Markov Model transition probabilities λ 1 , λ 2 , . . . , λ k are derived from the results of calculations of the Degree of Fault Tolerance (DOFT ) for the states 1, 2, . . . , k, respectively, according to the method [28] based on the analysis of an overload capacity and thermal stability of an inverter: Here R is the value of reduced level of performance according to the project requirements and i is the number of critical failures. A large number of different factors affect the magnitude of the transition probabilities, from the environmental parameters to the used maintenance strategies, monitoring, and diagnostics.
As can be seen from (3), for the calculation of the transition probabilities the main challenge is the correct calculation of DOFT for given project required performance levels. The method of determining its value in accordance with [24] is presented below.
Considering the definition of fault tolerance of a technical system as an ability to maintain the required functional level of the system, in case of one or more failures of its components, the DOFT can be defined as the amount of time, in which the system may remain in a degraded state without irreversible changes in its functionality. Mathematically, in general form this can be written as in (4): where W R and W N are the reduced (R) and nominal (N) values of the performance of technical system; ∆t i and ∆t N are the duration of functioning after i failures and without failure, respectively.
For quantitative assessment of the overload capability and thermal stability of the inverter's submodule, their thermal behavior for various load modes has been experimentally investigated and is discussed below.

Thermal Behavior of the Inverter
The thermal stability and overload capacity of the power electronic inverter is an important part for a save and sustainable operation of an electrical helicopter. Therefore, the definition of these parameters must be performed with the great accuracy.
On the basis of an experimental study, the compliance of the graph of Figure 4 with the real values of the inverter's overload capacity was verified, as well as the legitimacy (or illegitimacy) of its use in determining the transition probabilities for MSS reliability Markov Models.
As mentioned above the optimal option, considering the project requirements is a cascaded H-bridge 17-level inverter as shown in Figure 13. It consists of 8 submodules in each phase and 9 similar phases. Each submodule consists of a battery storage unit and a MOSFET full bridge and is connected in series with other submodules. A full bridge used in a cascaded H-bridge multilevel inverter with lithium batteries was taken into account for an experimental verification of the normative thermal stability of the MOSFET's power inverter.
For this verification of EN61000-2-4 [29] was the full bridge tested for 20 min with 10% more current than the nominal current, 10 min with 25%, 60s with 50% more current and 1 s with 100% (double of the nominal current). Furthermore the thermal capacity of the inverter has been estimated and the thermal behavior of the full bridge was observed. Table 7 shows the characteristics of the MOSFET type IPP023NE7N3, which has been investigated. Figure 14 shows an experimental test bench for investigating the thermal behavior of the inverter's submodule. For the construction of the test bench, the results of the research, discussed in [30][31][32], were taken into account. In general, the test bench consists out of a power www.astesj.com I. Bolvashenkov et al. / Advances in Science, Technology and Engineering Systems Journal Vol. 2, No. 3, 401-411 (2017)  supply, the submodule, load resistors, and the measurement devices. The submodule is directly connected to the power supply on the DC-side and the resistors on the AC-side. The DC current at the power supply was set by adjusting the resistance of the load resistors. Therefore the power supply was working in control voltage mode, excepted from the last test (double nominal current), which would exceed the capabilities of the power supply. The output voltage of the power supply had to be reduced in order not to exceed the maximum output power of 3 kW. The full bridge was working with a pulse width modulated (PWM) signal. The constant pulse width of 500 s was generated by a PWM frequency of 1 kHz and a duty cycle of 50%. The submodule had to operate covered under a box with just a few holes near the top and bottom side. This box ensures that only natural convection can take place and a possible airflow in the measurement environment would not affect the measurement results.
The measurement data consists out of the timestamps and two MOSFET temperatures, namely MOS-FET 2 and MOSFET 3 of the submodule from Figure 13. The temperature measurements of the test item, as can be seen in Figure 15, were taken by a thermocouple sensor. Two bimetal temperature sensors, which were evaluated by multi-meters, were used as measuring means. Thermal imaging was also used to validate the temperature measurement by the thermocouple. The measurement was evaluated as representative. Figure 16 shows the picture of the thermal imaging camera. It illustrates that the heat transfer to the cooling elements work properly and that the chosen measurement points offer a representative result. A STM32F4 controller generates the PWM signal for the control of the full-bridge. The standard PWM frequency within the inverter is 1 kHz. It should be noted that each experiment with different load levels continued until the failure of the tested MOSFETs or when the normative values of the duration of fail-safe operation were significantly exceeded.
The Figures 17-21 show the thermal characteristics of the submodule for various load modes, i.e. nominal load, 10%, 25%, 50%, and 100% overload of power electronic devices. The experiments were stopped when the time range significantly exceeded the normative values of Figure 4 for every load mode. The experimental targets were clearly exceeded. The tested submodule has shown large reserves in the overload capacity. During the tests no unexpected defects have been occurred. Thus, the normative over-load data (Figure 4) can be used to determine the transition probabilities of MSS MM without any restrictions.

Results of Simulation
By the simulation has been considered the worst case, critically dangerous variant of failure -the submodule failures occur consistently in the same phase. In case of the simulation of a not safety-critical failure, as well as the possibility of partial recovery of power drive's operating ability in the degraded state, the value of the fault tolerance will be significantly higher. Considering the design requirements on the fault tolerance, the sustainable functionality of the inverter in the failure cases was analyzed using the above MSS MM for a power demand of 113% of the nominal value. The corresponding graphs for a different number of phases are presented in Figure 17. The results of simulation of three consecutive critically dangerous failures allow quantifying the degree of fault tolerance of a multilevel inverter, which is a one important part of the traction drive of helicopters. The 7-and 9-phase options have shown the maximum compliance with the requirements relating to the safety-critical drives. For further studies of reliability and fault tolerance of safety-critical electrical drives, it is advisable to evaluate the integrated performance of electric drive as a whole, considering the reliability characteristics of electric power source, power electronics, and electric motor.
It is also of significant interest to quantitatively assess the impact of the maintenance strategy on the reliability and fault tolerance of electrical drive of the helicopter.

Conclusion
The paper presents the results of complex comparative analysis of an important part of the safety-critical drive train -the electric inverter, including an analysis of the reliability and fault tolerance of inverter in emergency operational modes.
On the basis of the developed techniques and models, taking into account the strict requirements on the safety-critical drive of an electrical helicopter, the authors carried out a comparative analysis of the fault tolerance degree of considered inverter topologies, which, in turn, led to the conclusion about the optimal range of applicability and feasibility of each compared variant of topology considering the specified safety requirements.