Essential Protections and Controls of an Aerospace Generator Control Unit

4/27/2012Washington University in St. LouisAustin Robert Morman

Generator Control Unit Airplane Generator

Abstract

An electric power generating system on an aircraft consists of an engine driven generator and its associated electronic generator control unit. The generator control unit’s main functions are to ensure demanded current is provided at the appropriate voltage level and take appropriate steps to protect the generator or electrical loads if the electric system malfunctions. This paper focuses on the simulation logic I created to ensure appropriate system state changes occur for a certain combination of conditions for a minimum of eight common protections that the software and hardware within the control units will need to perform. Then a simulation using various input signals combined with some of the protective settings demonstrates the startup sequence that makes the electric source available, i.e. bring the generator on-line, to begin providing electric power to the airplane. Typical aircraft electric system voltages, currents, frequencies, and time delays were used.

2

Being the first to accomplish the long desired dream of flight, the Wright brothers created an industry that would push the envelope of speed, distance and technology. Modern airplanes are far more complex then the Wrights brothers’ bi-wing requiring hundred of individual systems to function together, yet they are one of the safest forms of travel. This paper will look at one such system and the logic it takes to make the airplane function safely. This paper will start with a macro view of how an aircraft electric power generation system (EPGS) is laid out. Then it will delve into the inner workings of the generator control unit’s (GCU) logic as it ensures the voltage and currents are at the appropriate levels while protecting the generator or electrical loads if the electric system malfunctions.

Below is a simple single-line diagram of a two channel 3-phase electric power generating system (EPGS) on an aircraft. The scope of the project will focus on the single channel highlighted in the black box. This diagram has the generator represented as an AC source connected by a single line which reflects the bundle of feeder cables to a three phase main-line contactor (MLC) that serves as the primary AC bus power connection for one channel of electricity. This power relay also serves as the Point of Regulation (POR) for the Generator Control Unit (GCU) to verify proper system voltage level. A Generator Current Transformer (GCT) on the neutral side of each phase of the generator and a Line Current Transformer (LCT) with each phase of the feeder cables going through it near the power relay is also shown. These CTs are used to measure the electric currents to ensure the correct amount of electricity is being provided to the AC bus loads and if any electrical open or short circuits occur. All the associated signal level wires to-and-from these devices and various switches used by the GCU for control and protection in the simulation are not shown for simplicity.

Figure 1: Single Line Diagram (SLD)

As seen from the SLD there are multiple generators on an airplane including an auxiliary generator (APU GEN) but as stated this project will focus only on the one channel of the EPGS. Specifically, a more detailed focus on the protections the GCU can employ will be described. There are only 3 options of how a protection can function. It can switch, de-excite, or remove a power source from a load bus. The switching option means connecting one generator to run both channels. While this control logic is possible it is out of the scope of this project. Therefore the two options the model

3

employs for the protections are the logic for de-exciting the generator and removing the generator from a load bus. The software and circuits of the GCU must coordinate how these two options are accomplished. The next section will go into detail about 8 common protections that the GCU monitors and controls to maintain a safe generator operation. Below is a simplified version of the top view of the interaction between the Control Block and the Protection Block (The actual model view can be seen in appendix C).

Figure 2: Simplified Top Most Level of Control and Protection Blocks

4

Inside Protection Block

Undervoltage Overvoltage

Differential Open Phase

Underfrequency Overfrequency

Failure to Open Failure to Close

Output : VR Enable and DP Fault

Protection BlockBelow is the simplified top view of the protection block. This gives a visual representation of each of the different subsystems within the protection block. Each subsystem will be discussed in more detail and how each functions in regards to the generator protection. The actual model protection block can be seen in Appendix D.

Figure 3: Top View of Protection Block

For the various Protection blocks of the simulations, the following Inputs or Output Signals as well as main Commands, used in the simulation, are described:

1. AC AUX- the signal sent from the sensor at the MLC2. AC CMD – Signal that gives the state of the MLC3. Freq- the frequency of the generator current measured from the Permanent Magnet Generator

stage of the aircraft generator. Acts as a base reference for how fast the generator is spinning and the frequency of the electrical power.

4. Gen Current A- The current measured from phase A directly out of generator.5. Gen Current B- The current measured from phase B directly out of generator 6. Gen Current C- The current measured from phase C directly out of generator 7. Line Current A- The current output of Phase A in the feeder wire near the contactor.8. Line Current B- The current output of Phase B in the feeder wire near the contactor. 9. Line Current C- The current output of Phase C in the feeder wire near the contactor.10. POR Phase A- The voltage output of Phase A of the airplane generator 11. POR Phase B- The voltage output of Phase B of the airplane generator 12. POR Phase C- The voltage output of Phase C of the airplane generator

5

Protection Inputs

13. Reset Cond 2- Signal Received from the Control block that will reset a tripped protection, specifically protections OV, DP, Open Phase Protection, Failure to Open, Failure to Close, and Overfrequency.

14. Reset Cond. 1- Signal Received from the Control block that will reset a tripped protection, specifically protections UV and Underfrequency

15. VR_Enable- signal that represents the voltage regulation of the GCU is enabled. It is a sum of all the protection fault outputs from each protection. Will take the generator offline if a protection is tripped.

6

Protection: Undervoltage (UV)

Description: Checks that the minimum POR voltage of all three phases taken from the generator terminals shall not drop below 91.5 volts. If the Undervoltage (UV) condition is true for 140ms the protection shall go from low to high. This shall cause generator shutdown and opening of the main line contactor. The 140ms delay is reset if the minimum phase rises above 93.5 volts. This protection shall be reset by the Reset Cond. 1 signal.

Figure 4: UV Protection Diagram

Protection Test: Plots

Explanation of Test: After 2 seconds of simulation time the POR voltage of all three phases were set to 80 volts and 140ms later the UV protection was tripped causing VR Enable to go low shutting down the power to the generator and the control signal AC CMD to go low opening up the main line contactor protecting the rest of the aircraft from the faulty generator.

7

Protection: Overvoltage (OV)

Description: Checks that the maximum POR voltage of all three phases taken from the generator terminals shall not rise above 130 volts for 2 seconds. If the protection should go from low to high it shall cause generator shutdown. The 2 second delay is reset if the maximum phase drops below 120 volts. This protection shall be reset by the Reset Cond. 2 signal.

Figure 5:OV Protection Diagram

Protection Test: Plots

Explanation of Test: After 2 seconds of simulation time the POR voltage of all three phases was set to 135 volts and 2 seconds later the OV protection was tripped causing VR Enable to go low shutting down the power to the generator and the AC CMD signal to go low opening up the main line contactor protecting the rest of the aircraft from the faulty generator.

8

Protection: Differential Protection 1 (DP 1)

Description: Compares the difference between the current from the generator measured by the Generator Current Transformer (GCT) and the current measured by Line Current Transformer (LCT) near the end of the feeder cable. The fault condition for a DP1 protection follows: If the max phase Gen Current is greater than 130 amps and the difference measured between the GCT and LCT is greater than 30 amps, or if the max Gen Current of any phase is less than 130 Amps and the difference between the Gen and Line current is greater than or equal to 20 amps. If the fault condition is true for 100ms the protection goes low to high. There shall also be a 4ms delay to when the DP protection is tripped to when the main line contactor is opened. The protection shall be reset by Reset Cond. 2

Figure 6: DP Protection Diagram

Protection Test: Plots

9

Explanation of Test: After 2 seconds of simulation time the Line Current values were set to 80 amps and 1 second later the DP protection is tripped causing the AC CMD signal to go low opening the main line contactor. There is a 4ms delay before the generator is shutdown as seen by the delay in VR Enable going low. This delay helps the GCU decide if it is fault in the generator or a fault in the bus load that the generator is supplying power to.

10

Protection: Failure to Open Protection (FTO)

Description: This protection ensures the main line contactor is not malfunctioning. If the main line contactor is commanded open and AC AUX signal senses that the main line contactor is closed the protection goes from low to high. This protection shall have a delay time of 15ms. The protection shall be reset by Reset Cond. 2 signal.

Figure 7: FTO Protection Diagram

Protection Test: Plots

Explanation of Test: At 2 seconds of simulation time the input speed of the engine was put below 4500 rpm causing an Underspeed condition in the control block. This condition resulted in the main line contactor signal (AC CMD) to be commanded open at 2.80 seconds and since the sensor at the main line contactor (the AC AUX signal) continued to sense a closed position, the FTO protection was tripped 15ms later at time 2.95 seconds. This caused VR Enable to go low resulting in a generator shutdown.

11

Protection: Failure to Close Protection (FTC)

Description: This protection also ensures the main line contactor is not malfunctioning but for the opposite state of the FTO protection. If the main line contactor is commanded close and AC AUX signal senses that the main line contactor is open the protection goes from low to high. There shall be a time delay of 15ms. The protection shall be reset by Reset Cond 2 signal.

Figure 8: FTC Protection Diagram

Protection Test: Plots

Explanation of Test: At 2 seconds of simulation time the main line contactor sensor recorded the main line contactor open even with an AC CMD of closed. This resulted in the FTC condition and 15ms later the fault was tripped causing VR Enable to go low which caused both generator shutdown and for the main line contactor to open as seen by the AC CMD signal going from high to low. This protection will prevent the generator from going online to the rest of the aircraft when there is a faulty MLC.

12

Protection: Overfrequency (OF)

Description: This protection ensures the frequency of the generator shall stay within an appropriate range to ensure proper electric power quality. There are three possible OF fault conditions:

1) If the frequency of the generator rises above 420 Hz for more than 4 second the protection shall go from low to high.

2) If the frequency of the generator rises above 440 Hz for more than 16ms the protection shall go from low to high.

3) If the frequency of the generator rises above 454 Hz for more than 9ms the protection shall go from low to high.

This protection shall cause generator shutdown and shall be reset by the Reset Cond. 2 signal.

Figure 9: OF Protection Diagram

13

Protection Test: Plots

Explanation of Test: At 2 seconds of simulation time the frequency was changed from the normal 400 Hz to 445 Hz causing the middle OF condition to be true. This resulted in the OF protection tripping and lowing VR Enable only 16ms later or at 2.16 seconds of the simulation time. This was the only case tested but there are two other conditions that could cause the OF protection to be tripped. Each case has the same end result of generator shut down and opening the MLC.

14

Protection: Underfrequency (UF)

Description: This protection ensures the frequency of the generator shall stay within an appropriate range to ensure proper electric power quality. There are 2 possible UF fault conditions:

1) If the frequency of the generator drops below 380 Hz for more than 4 seconds the protection shall go from low to high.

2) Or if the frequency of the generator drops below 375 Hz for more than 12ms the protection shall go from low to high.

This protection shall cause generator shutdown and shall be reset by the Reset Cond. 1 signal.

Figure 10: UF Protection Diagram

Protection Test: Plots

Explanation of Test: At 2 seconds of simulation time the frequency was changed from the normal 400 Hz to 350 Hz causing the bottom UF condition to be true. This resulted in the UF protection tripping and lowing VR Enable only 12ms later or at 2.12 seconds of the simulation time. This was the only case tested but there is one other condition that could cause the OF protection to be tripped. Each case has the same end result of causing the generator to shut down and opening the MLC.

15

Protection: Open Phase Protection (OPP)

Description: This protection compares the difference between 2 phases of the Generator current. If the difference between 2 phases of the Gen current is greater than 30 amps and the phase with the lowest gen current is less than 4.5 amps for longer than 2.50 seconds the proetction shall go from low to high. This portection shall be reset by the Reset Cond. 2 signal.

Figure 11: Open Phase Protection Diagram

Protection Test: Plots

Explanation of Test: At 2 seconds of simulation time both the Gen and Line Current of Phase B are forced to zero essentially simulating the cable being cut or disconnected. Then 2.5 seconds later or 4.5 seconds of simulation the protection is tripped and VR Enable goes from high to low shutting down the generator and opening the Main Line Contactor.

16

Control BlockNow that we understand how the GCU protects the generator we will look at how the generator

spins up to start providing electric power to the channel. The following steps describe how a simulation, using various input signals combined with some of the protective settings, demonstrates the startup sequence that makes the electric source available by bringing the generator on-line so it can begin providing electric power to the airplane.

For the Control Blocks simulations, the following Inputs or Output Signals (*outputs are in bold) as well as main Commands used in the simulation are described:

1. AC CMD- Signal output that closes the MLC. Also an input to the FTO and FTC protections.2. AC Reset Switch- allows the pilot to Enable only the reset condition 1 and not reset condition 23. DP1- signal related to the Differential Protection 1. Will take the generator offline.4. Engine_Shutdown- Signal sent from the pilot when the engine is turned off. Helps protect the

generator from trying to provide power when the engine is not spinning5. GCS_Off- Signal that ensures the Generator Control Switch is in the off position6. GCS_On –Signal that ensures the Generator Control Switch is in the on position7. GCU_Enable- Signal connected directly to switch in the cockpit that the pilot can switch from on-

to off-to on to reset/clear all tripped generator protections.8. Input Speed- RPM measured directly from airplane engine9. Internal_Power_Ready- an output from the power available block that lets the GCU know

when the generator is ready to provide power to the aircraft10. POWER AVAILABLE- Another signal that tells the GCU the generator can go online11. UNDERSPEED - Output from the underspeed block that feeds into the power available block12. VR_Enable- major signal that groups all of the Protections together. Will take the generator

offline if a protection is tripped.

17

Below is the top most level of the Control Block. This gives a visual representation of how each of the different subsystems are connected within the control block. Each subsystem will be discussed in more detail and how each functions in regards to the generator spinning up and providing power to the associated loads. The general steps of closing the MLC is that the criteria for the Underspeed must be met first, then the criteria for Power Available subsystem, and finally the MLC Close Logic. This diagram also shows the reset conditions block which is discussed in Appendix A.

Figure 12: Top View of Control Block

Underspeed: Criteria needed that will allow the generator to be excited. The generator cannot produce power until it is spinning at a certain minimum speed, i.e. 4500 rpm.

Figure 13: Underspeed Logic Diagram

Available Power Logic: Criteria needed for the generator to have power available to deliver to the aircraft. To have power ready: The pilot must have started the engine and the engine must have a minumum input speed, the pilot has flipped on the generator control switch, and no protection has tripped.

Figure 14: Available Power Logic Diagram

18

Main Line Contact Close logic: Criteria needed for the generator to actively power the respective electrical channel by closing the MLC. The criteria is as follows: The pilot must have turned on the engine, the generator is spinning fast enough to supply power (internal power ready), the GCS switch is on, and the DP1 protection is false.

Figure 15: Main Line Contactor Close Logic Diagram

Once all these steps have been taken the MLC is closed and the generator is supplying the aircraft loads of that channel. With the MLC closed and the Protections aspect functioning properly our model GCU logic can now accomplish its main goal of voltage regulation.

Through the use of Matlab Simulink Model this report demonstrated four main accomplishments. It shows the protection and command logic for one channel of an aircraft electric power generating system. This simulation allows exploration of combinations of logic until proper operation satisfies a customer’s system requirements. Also, the use of time delays ensured real life hardware or software constraints to be understood. And finally, the results can now be utilized to write the software necessary to execute the logic described.

19

ReferencesKyle Ives. Kyle Ives is a Systems Engineer at Hamilton Sundstrand with 6 years of industry leading experience in designing, building, and testing aerospace power generation systems. Can be reached by email at Kyle.ives@hs.utc.com

Title Page Generator Picture found http://www.hamiltonsundstrand.com.sg/culture/ace.html

Title Page GCU Picture found http://www.aeroprecision.com/Hamilton-Sundstrand.php

20

AppendixAppendix A: Reset Conditions

Below are the criteria for Reset Cond. 1 and Reset Cond.2. These Reset Conditions allow the pilot to clear any protection sensed by the GCU and resume normal generator function provided the problem causing the protection to be tripped has been fixed.

Reset Conditions: Criteria that will reset the GCU and clear all tripped protections. The GCU is reset by turning the generator control switch (GCS) from on to off and back to on. The Generator Control Switch is a switch the pilot has direct control of in the cockpit. This switch is essentially the power switch for the generator control unit.

Another aspect of the reset conditions is that the pilot also has access to the AC Reset Switch. This switch clears only the UV and UF protections that might have been tripped during start up. This switch allows the pilot the option to clear those two protections without hard resetting the GCU by turning it off and then back on.

Figure 16: Reset Condition Diagram

Appendix B: Abbreviations

1. AC- Alternating Current2. CMD- short for command3. Cond- short for condition4. DP- Differential Protection5. EPGS- Electric Power Generation System6. GCS- Generator Contact Switch7. GCT- Generator Current Transformer8. GCU- Generator Control Unit9. LCE- Line Current Transformer10. MLC- Main Line Contactor

21

11. POR- Point of Regulation12. SLD- Single Line Diagram

Appendix C: This the actual model diagram of how the control and protections blocks interact. The Purple blocks are “goto” blocks that are used for neatness of the model. The inputs are green with the outputs colored orange.

Figure 17: Top Most view of Interaction of Control and Protection Block

22

Appendix D: Actual Top view of Protection Block. Each green block represents a protection subsystem.

Figure 18: Actual Top view of Protection Block

23