Fault Tolerant Control of Advanced Power Generation Center for More-Electric Aircraft Applications

This article presents a control scheme for a recently reported aircraft advanced power generation center (APGC) during postfault operation conditions. Within the APGC, two electrical generators extract power from two separate engine shafts and supply electrical power to a common high-voltage direct current (HVDC) bus through their dedicated main ac/dc power converters. An extra back-to-back (BTB) converter is also used to connect the ac terminals of the two generators. This architecture provides merits of fault tolerance capabilities of the APGC. In the case of main ac/dc power converter failure, the system can be reconfigured and the BTB converter provides an extra power flow path from the generators to the HVDC bus. This ensures electrical power generation capabilities onboard. This article discusses in detail about the control of the APGC under fault conditions with one main ac/dc converter failure. A seamless transition scheme from normal operation to postfault conditions is proposed using a voltage command initialization technique within the BTB converter. Both experimental and simulation results have verified the fault tolerance improvement and control performances of the APGC.


I. INTRODUCTION
T HE more-electric aircraft (MEA) concept is a major trend in the modern aerospace industry due to the advantages of high efficiency, low maintenance cost, and benefits to the environment. Much conventional onboard equipment consuming pneumatic, mechanical, and hydraulic energies will be replaced by their electrical counterparts. As a result the electric power demand increases significantly and this introduces challenges in designing a suitable electrical power generation center (PGC) [1].
Conventionally, an electrical generator is coupled with the engine high-pressure spool (HPS) due to its relatively constant speed [2]. However, with the increase of electrical loads onboard, this single-generator structure has difficulty in meeting the increased electrical power demand of the MEA. Furthermore, electrical power extracted from the engine HPS is also limited as excessive power extraction will undermine the efficiency and stability of the engine [3]. An effective way to address these challenges is to use another generator on the low-pressure spool (LPS) of the engine. With both spools supplying electrical power to the downstream loads, more power becomes available. Furthermore, adding an extra generator will improve the redundancy of the power generation system. To fully explore the advantages of this dual-generator system, a common dc-bus architecture has been proposed in recent studies [4]- [7] as shown in Fig. 1. Compared with ac systems, the dc system emerges as a superior option in terms of efficiency and weight. The dc network also allows parallel operation of multiple sources, such as the generator on the LPS, the generator on the HPS, and the auxiliary power unit [8]. Moreover, energy storage devices can be integrated, realizing peak shaving of the power demand [9].
Although the PGC in Fig. 1 shows advantages in terms of controllability and efficiency, there are two critical constraints. One is the field-weakening (FW) operation of the highpressure spool generator (HPG). Since the HPS is running at a high speed (close to 20 000 rpm in the high-speed settings of engine [10]), the coupled HPG will induce a high back electromotive force (back EMF), which requires the associated high-pressure channel rectifier (HPR) to provide a high ac voltage to handle the back EMF. However, due to the limited dc-link voltage (270 V as per [11] and [12]), the ac voltage of the HPR is also limited, which causes difficulties in handling the high back EMF of the HPG. To address this problem, FW operation is developed for the HPG in high-speed conditions to limit the stator voltage considering Fig. 2. Architecture of the APGC with a BTB converter [24], [25]. the limited dc-link voltage [13]. FW current needs to be injected into the permanent magnet machine-based HPG to reduce the rotor flux beyond the base speed. However, the negative effect is that the FW current will circulate in the path of the HPG and the HPR, resulting in considerable copper loss in the HPG, and increasing conduction and switching losses in the HPR.
Another critical constraint of the architecture in Fig. 1 is the poor fault tolerance capability in terms of power conversion. In traction and power generation related systems, power converters are identified as the most vulnerable parts in terms of reliabilities [14], [15]. If contingency such as open-circuit fault occurs to the low-pressure channel or HPRs (LP rectifier, i.e., LPR, and HP rectifier, i.e., HPR) in Fig. 1 due to gatedriver fault or cycling high currents, the faulty rectifier needs to be stopped and disconnected from the dc grid [16]. However, the associated generators cannot be shut down suddenly as they are connected to the aircraft engine, which has a significant inertia. Moreover, even if the generators are stopped smoothly, these generators are no longer available for the electrical loads. This will undermine the power generation capability and thus limit large-scale applications of onboard electrical equipment. Furthermore, losing one generator may lead to severe system instability at high load power scenarios [4].
To enhance the reliability of a permanent-magnet synchronous generator (PMSG)-based power generation system, much research has been focused on the fault tolerance control for the main rectifiers. For example, in the case of a single-phase open-circuit fault of a three-level rectifier, fault tolerance is achieved using the redundant voltage vectors to synthesize the targeted voltage vector [17], [18]. In [19], a carrier-based pulsewidth modulation (PWM) with zero-sequence voltage injection is proposed to reduce current distortion in the case of open-circuit failure. Although these methods do not require additional hardware setup, the rectification performance in the healthy state cannot be fully restored. In order to achieve the same control performance as in a healthy state, a redundant phase leg is deployed to replace the faulty phase leg hence a healthy three-phase rectifier can be reconstructed [20], [21].
However, this method requires additional power modules and switches.
Although the above-mentioned strategies can provide fault tolerance control, they are only effective in addressing the single-phase fault. In practice, due to the power modules of the three-phase legs being spatially close, when one leg fails due to high ambient temperature or high current, other legs are also prone to failure. The above-mentioned fault tolerance methods are not suitable to deal with this multiphase failure situation, but an effective solution is to deploy multiple redundant phase legs or multiple converters in parallel. However, this will undoubtably increase the overall cost [22], [23].
To deal with the constraint of high FW current and the requirement of fault tolerance, an advanced power generation center (APGC) was proposed in our previous work [24], [25], as shown in Fig. 2. A back-to-back (BTB) converter connects the original dual power generation channels shown in Fig. 1. With this configuration, the following benefits can be achieved.
1) The HPG can operate at high speeds without FW. This is achieved due to a high internal dc-link voltage in the BTB converter. With no FW current injected into the HPG, it significantly reduces power loss of the HPG and the HPR. 2) An improved fault tolerance capability and system availability. In the case of either HPR or LPR failure, the BTB converter can provide an additional power flow path for the generators, allowing the two generators to continue operating and supplying power and services to the downstream loads. The characteristics of FW elimination have been investigated in [24] and [25], where a 5% efficiency improvement is achieved. As a continuation of our earlier work, this article will focus on the realization of the fault tolerance enhancement and the associated fault tolerant control. It should be noted that despite the incorporation of an extra BTB converter in the APGC, the two objectives of FW elimination and improved fault tolerance are achieved at the same time. Therefore, deploying a BTB converter is considered better than the solutions which add parallel converters [22], [23].
Since there are multiple power converters, generators, and various loads in the system of Fig. 2, proper control design in both healthy and postfault operation state is of great importance. The rest of this article is organized as follows. Control schemes for the overall system are developed in Section II to make those power converters coordinated in the healthy state. Section III illustrates the system reconfiguration at either HPR or LPR failures. A voltage command initialization strategy is applied to the BTB converter to avoid the abrupt change in the generators' currents when transiting from the healthy state to postfault operation state. The experimental and simulation results are presented and discussed in Section IV. Section V presents considerations of the APGC in the practical application. Section VI concludes this article.

II. SYSTEM DESCRIPTION AND BASICS OF CONTROL DESIGN UNDER NORMAL OPERATION CONDITIONS OF THE APGC
As can be seen in Fig. 2 an extra BTB converter is used, providing an extra power flow path between the HP generator and the LP generator compared with the PGC in Fig. 1. This configuration allows power transfer between the HP channel and LP channel. More importantly, the BTB converter provides a power flow path to the main high-voltage direct current (HVDC) bus for the remaining generator in the case of rectifier failure. Hence generators can supply continuous power to the onboard loads and the fault tolerance of the overall system is improved.
A description of the circuitry configuration is elaborated in this section. Moreover, although control schemes for the APGC under normal conditions have been discussed in our previous publication [24], some of the key findings (especially the control of the four ac/dc converters) will be briefly introduced in this session to make this article self-contained.

A. Circuitry Configuration Analysis
It can be seen from Fig. 2 that the four power converters, i.e., HPR, LPR, BTB 1 , and BTB 2 converter, are all voltage source converters (VSCs). To enable them to operate compatibly, inductors should be deployed to separate these VSCs. Moreover, inductors can filter high frequency PWM harmonics generated by the switching actions of power devices. There are four possible configurations in total with different locations of inductors, as shown in Fig. 3.
In Fig. 3(a) and (b), an inductor, denoting as L 2 , is placed at the front end of the BTB 2 converter close to the HPG side. In these cases, the terminal voltages of the HPG are limited within (v dc / √ 3) using the typical space vector PWM (SVPWM) [10], where v dc is the main HVDC bus voltage. The value of v dc is considered as 270 V to follow the MIF-STD-704F standard. Hence, for some permanent magnet-based generators, such as the Aircraft Electrical Generation with Active Rectification Technology (AEGART) electrical machine developed under the frame of the Clean Sky project [26], it means that FW operation is still needed for the HPG with the configurations shown in Fig. 3(a) and (b).  In Fig. 3(c) and (d), L 2 is deployed at the front of the HPR. In this case, terminals voltages of the HPG are limited within (v BTB / √ 3) using the SVPWM, where v BTB is the dc-link voltage within the BTB converter. By increasing the voltage of v BTB , the HPG can operate at a high speed without field-weaking control. The difference between Fig. 3(c) and (d) is the location of inductor L 1 . Since most power of the LP channel is delivered through the LPR to feed the dc bus loads, and a relatively small proportion of power is transferred through the BTB converter, the phase current of the LPR is larger than that of the BTB 1 converter. Placing L 1 at the front end of the BTB 1 converter instead of the LPR can reduce the power losses in the inductor L 1 . To conclude the above, the configuration of inductors as shown in Fig. 3(d) are chosen to build the APGC in Fig. 2.

B. Control Design for the Rectifiers in a Normal Operation Condition
Under normal operation conditions, the two main rectifiers (HPR and LPR) connected to the main HVDC grid shared the same control scheme presented in Fig. 4. It can be seen that a classical cascaded control structure has been implemented with the inner loop controlling the d-axis and q-axis currents. The outer loop is to control the dc currents injected by the HPR and LPR to the HVDC bus. A droop control is adopted to manage the power sharing between the HPR and the LPR because it does not need communication links [4], [27]. In Fig. 4, the dc current reference is generated according to a predefined V -I droop characteristic, which is shown as follows: where g LP and g HP are the droop gains of the LPR and HPR controller, respectively. i ref dcLP and i ref dcHP are the dc current commands for the LPR and HPR, respectively. v * dc is the nominal dc voltage, which is 270 V as per the aerospace standard [12].

C. Control Design for the BTB 1 Converter in the Normal Operation Conditions
In normal operation conditions, the BTB converter can be used to exchange power between the LP channel and the HP channel. As discussed in [28], power transfer from the LP shaft to the HP shaft will be inevitable if more power needs to be extracted from the engine core to supply the increasing electrical power loads for the future aircraft. The BTB converter essentially consists of two separate ac/dc converters, denoting as BTB 1 and BTB 2 converter, respectively. In this section, the control designs for the two converters are illustrated briefly.
The diagram of the low-pressure spool generator (LPG) and LPR subsystem is presented in Fig. 5. Since the ac terminals of the LPG and BTB 1 converter share the same junctions a, b, and c, an effective way to control the transferred power from the LP channel to the BTB converter is to control the currents of LPG (i xLP ) and BTB 1 converter (i xBTB1 , x = a, b, c) to be in phase. In that case, power sharing between the LPR and BTB 1 converter can be achieved by proportionally controlling the magnitudes of the phase currents, i.e., controlling the magnitude ratio between the phase currents i xLP and i xBTB1 .
On the other hand, the BTB 1 converter is also responsible for regulating the dc-link voltage v BTB . To synchronize i xBTB1 and i xLP in phase and achieve dc-link voltage v BTB control, a new control structure is shown in Fig. 6. The control scheme is able to fulfill the two functions, i.e., dc voltage regulation within the BTB converter and synchronization of the phase currents i xBTB1 and i xLP , where x = a, b, c. As can be seen in Fig. 6, within the BTB 1 converter, the d-axis and q-axis current references are dependent on the dq-axes currents of the LPG and the power ratio gain m between the LPG and BTB converter. A common d-axis (LPG's rotor angle) will be used to transform the phase currents i xBTB1 and i xLP to the i dBTB1 , i qBTB1 , i dLP, and i qLP , respectively. By doing this, i xBTB1 and i xLP will be synchronized in phase (see Fig. 5). The gain m will be the magnitude ratio of i xBTB1 over i xLP .
If dc-link voltage v BTB is smaller than its reference, the gain m, and hence i xBTB1 will increase, thus more power will be transferred to the BTB converter to charge the internal dc-link capacitor. On the other hand, if v BTB is larger than its reference, the gain m, and hence i xBTB1 will decrease, thus less power will be transferred to the BTB converter and v BTB will be back to the reference value. With this control strategy, v BTB can be stabilized, and i xBTB1 and i xLP can be synchronized. This control scheme is very different from the conventional active front-end control scheme [29], [30], where the output of the voltage controller is active current command or active power command. In the steady state, the power generated by the LPG, i.e., P LPG and the power transferred to the BTB converter, i.e., P BTB should have the following relation:

D. Control Design for the BTB 2 Converter in Normal Operation Conditions
Since the HPG is coupled to the HP shaft of the engine, the rotation speed of the HPG is dependent on the HP shaft, denoting as ω mHP . Then the mechanical power P m extracted from the HP shaft can be expressed as P m = ω mHP T e , where T e is the electromagnetic torque of the HPG. Since the speed of the HP shaft depends on the specific operation mode of the engine, to control the output power of the HPG, the only available variable that can be used is T e .  Since the terminals of the HPG are directly connected to the BTB 2 converter, operation of the HPG can be controlled by the BTB 2 converter. For a considered surface-mounted permanent magnet machine, T e can be expressed as [31] T e = 1.5 pψ f i qHP (3) where p is the pole pairs. ψ f is the flux linkage of magnet. i qHP is the q-axis currents of HPG. Based on (3), the reference of i qHP can be obtained as where P HPG is the expected active power of the HPG. p and ψ f are the machines parameters and ω mHP is the mechanical angular speed of the machine which can be measured with a position sensor or estimated using a sensorless scheme. The active power of the HPG P HPG is defined by the total load power requirement and the power sharing ratio between the HPG and LPG. Using this information, the i q reference of the HPG, i ref qHP , can be obtained. The HPG normally runs at a high speed (over 20 krpm). Using the system architecture in Fig. 1, a FW control may be needed as the machine back EMF will be high and the HVDC bus voltage is limited to 270 V. Application of the BTB converter will avoid such an issue. Since the dc-link within the BTB converter is not directly connected with the onboard loads, its dc voltage can be set higher than the HVDC bus. In that case, the HPG can be operated with no need of FW. The i d reference i ref dHP can be set as 0 to realize the maximum torque per ampere control. This, in return will reduce copper loss in the HPG and thus increase the system efficiency. The control scheme for the BTB 2 converter is shown in Fig. 7.
To conclude Section II, the overall configuration and control schemes for each individual power converters in the healthy state are summarized in Fig. 8. The relationships of the power  Table I. To be specific, power sharing between the LPR and HPR is realized by droop control. Using droop gains g LP and g HP , the power sharing ratio can be controlled. Assuming that the ratio between the HPG's power and the total power is γ HP , the output active power of the HPG (P HPG ) depends on the total load power and γ HP . Hence, the power transferred through the BTB converter compensates for the difference between the HPR's power and the HPG's power.

III. SYSTEM RECONFIGURATION AND CONTROL SCHEMES WITH SEAMLESS TRANSITION AT RECTIFIER FAILURES
As mentioned previously, one of the key advantages of the APGC is its fault tolerant capabilities. The BTB converter provides flexibility to reconfigure the APGC after rectifier failures. During the transition from normal operation state to fault and then postfault operation states, the torque of generators may change abruptly. This needs to be avoided as the abrupt change of generator torque may have significantly negative impact on aircraft engines. To cope with this issue, system reconfiguration with seamless transition from normal to postfault operation conditions is essential and will be developed in this section.

A. System Reconfiguration and Seamless Transition Scheme at LP Rectifier Failure
Once a fault within the LPR is detected, the circuit breaker at the LPR's dc side can disconnect the LPR from the HVDC grid. The rest of the system will be reconfigured as shown in Fig. 9. In the postfault operation conditions, all of the power of the LPG is transferred to the HP channel and then fed to the main dc bus by the HPR. The LPG will continuously supply power to the HVDC grid. The impacts of failure to the electrical loads will need to be minimized with smooth reconfiguration transition.
After reconfiguration, the HPR control will be amended to stabilize the main dc bus voltage. As can be seen in Fig. 9, the inner loop of the HPR control is i dHPR and i qHPR control, where i dHPR and i qHPR are the currents (in the dq frame) flowing into the HPR. The outer loop is to maintain the main dc bus at the reference level (270 V in this case). The droop control used for power sharing for the HPR is deactivated as the paralleled LPR is no longer available.
The BTB 1 converter control will also need to be changed and will be running as an active front-end to regulate the  internal dc-link voltage v BTB within the BTB converter. No managed power transfer is required any more as all the power from the LPG will be routed through the BTB converter. The inner loop of the BTB 1 converter is i dLP and i qLP control, where i dLP and i qLP are the dq currents of the LPG. The outer loop is the dc-link voltage v BTB control. For the BTB 2 converter, the control scheme presented in Section II-C remains to regulate the active power of the HPG. To summarize, the BTB 1 converter is used for stabilizing the dc voltage within the BTB converter, and the control for the BTB 2 converter is to regulate the HPG's power.
From the viewpoint of power, there are two essential electrical power sources in the reconfigured system, i.e., the HPG and LPG. The HPG's power can be actively managed by controlling its torque as its speed is dependent on the aircraft engines. The LPG's power is transferred from the LP to HP channel through the BTB converter. The LPG automatically compensates for the difference between the total load power and the HPG's power. The functions and control objectives of each converter before and after fault are summarized in Table II.
Directly disconnecting the LPR from the HVDC grid after fault will result in an abrupt change of the LPG's terminal voltages and thus draw excessive currents from the LPG. This, in return, will lead to an undesired torque. In the worst case, it could damage the engine shaft. To avoid this and to achieve a seamless transition between normal and postfault operations, the terminal voltages of the LPG should remain unchanged during this transition. Since the LPG's ac terminals and the BTB 1 converter's ac terminals are connected through a filter L 1 , maintaining the LPG's ac terminal voltages can be achieved by actively controlling the BTB 1 converter's terminal voltages.
The equivalent circuit of the LPG-BTB 1 converter subsystem after fault is built in Fig. 10. The definitions of variables and nodes are shown in Fig. 9, where v ag is the phaseto-neutral voltage of the LPG, v a g is the leg voltage of the BTB 1 converter, L 1 and R 1 are the inductance and equivalent resistance of the filter whose voltage drop is v aa .
Based on Figs. 9 and 10, the following relations can be derived: Adding the three equations in (i) and considering (ii), the voltage difference between the reference points g at the BTB dc-link side and the LPG's neutral point g can be obtained as Applying the abc/dq transformation to (5) and considering (6), the electrical relationship of the LPG-BTB 1 converter subsystem in the dq frame can be derived as follows: where v dLP and v qLP are the LPG's dq-axes terminal voltages. i dLP and i qLP are the dq currents of the LPG. v dBTB1 and v qBTB1 are the ac voltages of the BTB 1 converter in the dq frame.
Using the first-order Taylor expansion, (7) can be discretized as follows where T s is the sampling period and k is the index of sample. As mentioned before, the core of seamless transition control is to ensure that the terminal voltages of the LPG remain unchanged before and after any change of the control scheme for the BTB 1 converter. Thus, assuming a fault occurs to the LPR in the (k)th sampling interval, a seamless transition requires Using (8) and (9), the BTB 1 converter's voltage commands at time (k)th, i.e., v dBTB1 (k) and v qBTB1 (k), can be derived. The implementation of such seamless transient control is shown in Fig. 11. Within the digital controller, in each sampling interval, a few events will be implemented in sequence, i.e., fault detection and protection, control scheme application, and updating the PWM registers based on the dq-axes voltage commands.
, and i qLP (k) are stored and updated. With the stored values and (9), voltage commands for the BTB 1 converter, i.e., v dBTB1 (k) and v qBTB1 (k), can be calculated using (8). This process is indicated by the star #1 in Fig. 11.
Once the fault has been detected and captured by the controller in the (k)th sampling interval, denoted as #2, the system will be reconfigured and the BTB 1 converter's control scheme is changed from Fig. 6 to that in Fig. 9 within the control Machine parameters of the targeted LPG can be found in [13]. L act 1 is the actual inductance of L 1 , which is considered as 1 mH [24]. scheme application cycle in the #3 process. The voltage commands for the BTB 1 converter are set to the calculated v dBTB1 (k) and v qBTB1 (k) using (8) and (9). Using the revised v dBTB1 (k) and v qBTB1 (k) to initialize the voltage commands for the BTB 1 converter will help avoid an abrupt change of the LPG's currents.
From (8) it can be seen that the calculation of the initialization voltage v dBTB1 (k) and v qBTB1 (k) depends on the value of inductance L 1 . Deviation between the actual L 1 (L act 1 ) and the value used in the digital controller (L con 1 ) will lead to inaccurate initialization voltages. To study the parameter sensitivity, v dBTB1 (k) and v qBTB1 (k) at different powers of the LPG and different inductance values used in the digital controller are shown in Fig. 12.
In Fig. 12, a ±20% inductance mismatch is considered. It can be seen that in the low power region, the mismatch between L act 1 and L con 1 does not lead to significant deviation in voltages. As the increase of power, v qBTB1 (k) with mismatched L con 1 is still close to the optimal voltage. But the deviation in v dBTB1 (k) becomes significant. Due to the voltage limitation imposed by the dc-link voltage and PWM technique, v dBTB1 (k) in the high-power regions is restricted. Hence the optimal initialization voltages cannot be outputted. However, compared with no voltage initialization, in the high-power region the transient performance of the current can still be improved to some extent.

B. System Reconfiguration and Seamless Transition Scheme Considering the HP Rectifier Failure
In the case of HPR failure, the HPR can be disconnected from the system and the rest of system is reconfigured to a structure shown in Fig. 13, where the control schemes for each converter are exhibited. In normal operation conditions, the HPG's power is delivered to the main dc bus through the HPR. In postfault operation conditions, all the HPG's power is transferred to the HVDC bus through the BTB converter and then the LPR converter.
Within this postfault architecture, the LPR is controlled to stabilize the main dc bus voltage. The LPR's inner control loop is a current loop of i dLPR and i qLPR , and the outer loop is to maintain the HVDC bus voltage. The droop control used for power sharing for the LPR is deactivated as the paralleled HPR is unavailable in this scenario.
Since the power flow direction is from the HP to LP channel through the BTB converter, control of the BTB 2 converter is changed to regulate the internal dc-link voltage (which used to be BTB 1 for this function when the LPR fails). As can be seen in Fig. 13, where the inner loop of the BTB 2 converter is still the i dHP and i qHP current control, the outer loop is changed to the dc-link voltage v BTB control. For the BTB 1 converter, the phase current synchronization strategy in Fig. 6 will be used. The gain m is actively managed to control the power from the HPG. The method for controlling m is illustrated as follows.
From the viewpoint of power, the power delivered by the BTB 1 converter from the HP to LP channel essentially comes from the HPG. The LPG's power compensates for the difference between the total load power and the HPG's power. Assuming the targeted power sharing ratio between the LPG and the HPG is ρ LP : ρ HP , then the following relation can be derived: where v dBTB1 and v qBTB1 are the dq-axes voltages of the BTB 1 converter. i dBTB1 and i qBTB1 are the dq-axes currents of the BTB 1 converter. P t is the total load power. It can be obtained by the measured dc voltage v dc and load current i Load , where P t = v dc · i Load . Combining the power sharing ratio equations (2) and (10) it gives With the defined power ratio ρ LP and ρ HP , the gain m can be calculated as follows: The control scheme for the BTB 1 converter under the HPR faulty scenario can thus be given as the structure shown in Fig. 14. The functions and control objectives before and after the HPR fault of each converter are presented in Table III.
As can be seen in Table III, the control scheme will be changed for the BTB 2 converter before and after the HPR fault. Since the terminals of HPG are directly connected with the BTB 2 converter, to avoid the abrupt change of HPG's currents when switching control schemes for the BTB 2 converter, the voltage commands in the new control scheme in Fig. 13 needs to be initialized. Similar to that process after the LPR fault, to achieve a seamless transition before and after the HPR fault, the terminal voltages of the HPG during transition should remain the same. Assuming at (k − 1)th interval, voltage commands of the healthy state control scheme in Fig. 7 are . At the (k)th sampling interval, a fault occurs to the HPR and it is disconnected from the system. The system is reconfigured to Fig. 13. The voltage commands of the new control scheme for the BTB 2 converter are initialized as v ref Comparing Sections III-A and III-B, it can be seen that the difference between the low-side fault tolerance (LFT) and the high-side fault tolerance (HFT) is that the postfault system reconfigurations are different. Hence, the associated fault tolerant controls are also different due to the different reconfigured architectures. The system configuration and control with LFT is shown in Fig. 9, and that with the HFT is shown in Fig. 13. Moreover, due to the different locations of the filtering inductance L 1 and L 2 (L 1 is located at the front end of the BTB 1 converter and L 2 is located at the front end of the HPR), the seamless transition strategy for the LPG at the low-side failure is different from the seamless transition strategy for the HPG at the high-side failure.

C. Fault Detection
In the following validations, PWM firing pulses for the rectifiers are disabled to simulate the open-circuit fault condition (three-phase open-circuit fault). Since the main objective of this article is to investigate the postfault reconfiguration and the associated control for the APGC, regarding the fault detection, this article did not propose a new method. The open-circuit fault detection method proposed in [32] is adopted because it is simple for implementation, fast and accurate for detection, and needless for extra sensors.
The detection logic is straightforward: once a three-phase open-circuit fault occurs, the phase currents drop to zero. This means that after coordinate transformations, the q-axis current i fdb q is also zero. However, as can be seen in Fig. 4, in the digital controller, the output of the dc current controller, which is the reference of q-axis current i ref q is not zero. If the actual q-axis current i fdb q is zero whilst the gap between i ref q and i fdb q is larger than a defined threshold, the associated rectifier can be considered open circuited. The fault detection process is summarized in the flowchart as shown in Fig. 15. In Fig. 15, I noise is the noise tolerance for current measurement because even if in the open-circuit condition where the actual i fdb q is zero, the measured i fdb q can still have some value due to noises. In this article I noise is designed as 0.2 A. I th is the threshold gap between abs(i ref q ) and abs(i fdb q ). In this article I th is set as 50% × abs(i fdb q ). If the two conditions are met for more than three consecutive sampling periods, the fault detector will report an open-circuit fault and the system is reconfigured for postfault operation. The maximum detection  delay is only three sampling periods. The detection sensitivity can be easily adjusted by tuning I noise and I th .
Although the short-circuit fault scenario is not considered in the following simulation and experiments, the short-circuit detection and isolation technique is briefly presented here for a complete discussion.
The experimental setup uses both hardware protection and software protection to solve the overcurrent problem caused by the short-circuit faults. The hardware protection is realized by the desaturation function provided by the gate driver IC. The ACPL-331J gate drive output optocoupler is used. ACPL-331J monitors the saturation (collector) voltage of the IGBT and triggers a fault shutdown sequence if the collector voltage exceeds a threshold due to the high short circuit current. Before the dissipated energy can reach destructive levels, the IGBT is shut off. Then the output of pinFAULT (pin No.3) of ACPL-331J is changed from a high impedance state to a logic low state within 5 μs.
From the software side, the output signal from the pin FAULT is measured in every sampling period. If a logic low signal is detected, it means that the desaturation function is triggered due to overcurrent. Then all the PWMs will be disabled in the program of digital signal processor (DSP).
The overall short circuit protection process is summarized in the following flowchart Fig. 16, where the software protection and hardware protection are highlighted.

IV. SIMULATION AND EXPERIMENTAL VALIDATIONS
To verify the fault tolerant capability of the APGC and proposed control scheme, a downscaled lab prototype consisting  of two rectifiers and one BTB converter has been built as shown in Fig. 17. An autotransformer (AF) whose primary side is connected with the utility grid is used to emulate the LPG. The frequency of the AF's voltage is 50 Hz. A Chroma QuadTech 31120 programmable ac source is used to emulate the HPG, and its voltage frequency is set as 80 Hz. The TMDSCNCD28379D control card is used as the digital control platform. A resistive load bank and an APM electronic load (E-load) are connected to the dc bus. Other system parameters are listed in Table IV. In this section, the system reconfiguration and fault tolerant control proposed in Section III will be investigated in simulation and experiments. Engine performances with the PGC (see Fig. 1) and the APGC (see Fig. 2) under the rectifier faulty conditions are also compared using the engine compressor map. The characteristics that will be checked are included in Table V.

A. Simulation Results From the Normal Operation to the LPR Failure
During this simulation study, the APGC starts running under a normal operation condition. A load change is then applied to test the power control in a healthy condition before the LPR failure. The APGC is supplying a 40-resistor load through the HVDC bus from the beginning to 1.5 s. At t = 1.5 s, the E-load will be applied and increase the total load power on the dc bus to 3.3 kW. At t = 2 s, PWM signals for the LPR are disabled to simulate the open-circuit faulty scenario for the LPR. Meanwhile, the fault tolerant control is activated. By disabling the PWM signals, the LPR  Fig. 18, the voltage command initialization for seamless transition is not applied. The dc bus voltage is presented in Fig. 18(a). It can be seen that the HVDC bus voltage v dc deviates from the reference (270 V) due to the application of droop control. As the increase of load power at t = 1.5 s, the deviation becomes larger, and more dc current will be supplied to the HVDC bus from the HPR and LPR. Disabling the PWM signals for the LPR at t = 2 s, only the HPR is left in the system and there is no need for droop control. Therefore, v dc is restored to the rated value 270 V.
DC currents of the HPR and LPR are shown in Fig. 18(b). During this test case, the droop gains of these two converters are set to be identical. As a result, before the fault happens at t = 2 s, the dc current of the HPR i dcHP equals that of the LPR i dcLP . When disabling the PWM for the LPR at t = 2 s, the LPR can be regarded as disconnected from the HVDC bus and thus i dcLP is zero. All the power is delivered by the remaining HPR, thus i dcHP doubles from 0.19 pu to around 0.38 pu. Hence, the first point in the checklist Table V is validated, confirming the effectiveness of the dc bus voltage control and the droop control in Fig. 4.
The dq currents of the HPG and phase currents of the HP channel are exhibited in Fig. 18(c) and (d). It can be seen that the d-axis current of the HPG is kept to zero. As the increase of load power at t = 1.5 s, the magnitude of q-axis current of the HPG also increases. The steady-state values of i qHP during t = 1.5-2 s and after t = 2 s are the same, which means that the removal of the LPR does not affect the steady-state operation of the HPG. This can also be observed from the unchanged HPG's phase current i aHP . Since all the power is dq currents of the LPG and phase currents of the LP channel are exhibited in Fig. 18(e) and (f). It can be seen that the phase current of the LPR is zero after t = 2 s because of the disconnection of the LPR. The steady-state q-axis current and phase current of the LPG are kept unchanged after t = 2 s. However, since the voltage command initialization for the BTB 1 converter is not considered, current surge occurs in the transient process, which will lead to undesirable torque on the LPG and trigger overcurrent protection of the system. From Fig. 18(c)-(f), the second point in Table V is validated, confirming that in the case of LPR failure, the system reconfiguration and fault tolerant control in Section III-A can ensure that the two generators continue operating.
Electrical powers of the HPR, LPR, HPG, LPG, and total load power are given in Fig. 18(g) and (h). Before t = 2 s, P HPR and P LPR are both 1.65 kW due to identical droop gains. At t = 2 s, PWM signals for the LPR are disabled, hence P LPR = 0 and P HPR = P t , where P t is the total load power. The power sharing ratio between the LPG and HPG is set as 2:1. Hence, power of the HPG is one-third of the total power P t . According to the power relations in Table I, before the fault happens at t = 2 s, P BTB = HPR Power − HPG Power = (1/2 − 1/3)P t = 0.56 kW. After t = 2 s, the total power increases to 3.6 kW as v dc increases to 270 V. All the power of the LPG is transferred by the BTB converter, hence, P LPG = P BTB = 2.4 kW. Hence, the fourth point in Table V is validated, confirming that the power flow is consistent with that in Table I.
To diminish the current surge during the transition of disabling the LPR, the voltage command initialization strategy proposed in Section III-A is applied and results are shown in Fig. 19. It can be seen from the dashed lines in Fig. 19(a) that without initialization, the dq voltages of the LPG restore to zero volts at t = 2 s because of switching to a new control scheme for the BTB 1 converter. The oscillated dq voltages will lead to oscillated currents. This is the reason for the current surge in Fig. 18(e) and (f). As a contrast, the solid lines show the dq voltages when the smooth transition scheme is applied after the fault occurs. Consequently, comparing with Fig. 18(e) and (f), the currents in Fig. 19(b) and (c) transit smoothly with negligible current surge at t = 2 s. The results confirm the effectiveness of the proposed seamless transition control and thus the second point in the checklist Table V

B. Experimental Results for Cases With the LPR Failure
Experimental results when the LPR fails without seamless transition scheme are presented in Fig. 20. There are three operating stages. In stage 1, a fixed resistor is connected to the dc bus, absorbing a 1.2-kW power. In stage 2, the E-load performs as a constant power load (CPL), consuming an extra 550-W power. In stage 3, the LPR is disconnected to simulate the faulty scenario. The droop gains for the HPR and LPR are set identical in the first two stages.
From Fig. 20(a) it can be seen that i dcLP and i dcHP are the same in the first two stages due to identical droop gains. The dc bus voltage v dc decreases from 268 V in stage 1 to 265 V in stage 2 because of increased power. After disabling the PWM for the LPR, i dcLP drops to zero, while i dcHP is around double from 3.3 to 6.4 A because the HPR delivers all of the load power. v dc restores to the rated 270 V in stage 3 as only the HPR is left hence there is no need for power sharing using droop control. The results in Fig. 20(a) are perfectly consistent with the simulation results in Fig. 18(a) and (b).
The experimental results of phase currents are exhibited in Fig. 20(b). With the increase of power from 1.2 to 1.75 kW, the magnitude of all phase currents also increases. After disabling the PWM for the LPR, i aLPR becomes zero, while i aHPR boosts because the HPR carries all the load power.
Evident current surge in the LPG's phase current i aLP can be seen in the transient process of the LPR's disconnection. As can be seen in the expanded figure, the current surge is around 8 A larger than the normal phase current. T e results in Fig. 20(b) are in accordance with the simulation results in Fig. 18(d) and (f).
To diminish the current surge in the LPG's phase current, the proposed voltage command initialization strategy is used as shown in Fig. 21. Compared with Fig. 20(b), the proposed method provides a much smoother transient performance in i aLP . Overall, the results in Figs. 20 and 21 confirm the fault tolerance improvement and seamless transition when the LPR fails.

C. Simulation Results From the Normal Operation to the HPR Failure
Simulation results when the HPR's failure occurs are demonstrated in Fig. 22. In stage 1, t = 1 s-1.5 s, the dc bus is loaded with a 40-resistor. In stage 2, t = 1.5 s-2 s, the load power increases to 3.3 kW. In Stage 3, t = 2 s, PWMs for the HPR are disabled.
The performance of the main dc bus voltage in Fig. 22(a) is the same as that in Fig. 18(a). For the dc currents demonstrated in Fig. 22(b), since the two droop gains are identical, hence before t = 2 s, i dcHP = i dcLP . At t = 2 s, i dcHP changes to zero because the gate drive signals for the HPR are disabled, which means that the HPR can be regarded as disconnected from the HVDC bus. Hence, the first point in the checklist Table V is validated, proving the effectiveness of the dc bus voltage control and the droop control in Fig. 4.
The dq currents of the HPG and phase currents of the HP channel are presented in Fig. 22(c) and (d). It can be seen that the phase current of the HPR, i aHPR , is zero after t = 2 s due to disabling the HPR. The values of other currents are kept unchanged after the HPR fails, which means that the operation of the HPG is not affected. However, since the voltage command initialization for the BTB 2 converter is not considered, the current surge of the HPG can be observed in the transient process.
dq currents of the LPG and phase currents of the LP channel are exhibited in Fig. 22(e) and (f). From Fig. 22(e) it can be concluded that operation of the LPG stays the same as that in the healthy state. Fig. 22(f) shows that before t = 2 s, the magnitude of i aLPR is smaller than i aLP because the BTB converter transfers power from the LP to HP channel. However, after t = 2 s, the HPG outputs power to the LP channel through the BTB converter, making the magnitude of i aLPR larger than that of i aLP . From Fig. 22(c)-(f), the third point in the checklist Table V is validated, confirming that in the case of the HPR failure, the system reconfiguration and fault tolerant control in Section III-B can ensure that the two generators continue operating as normal.
Electrical powers are given in Fig. 22(g) and (h). Before t = 2 s, P HPR and P LPR are 1.65 kW, achieving an equal power sharing. At t = 2 s, gate drive signals for the HPR are disabled, hence P HPR = 0 and P LPR = P t = 3.6 kW. The power sharing ratio between the LPG and HPG is set as 2:1. Hence, the power of the HPG is one-third of the total power P t . The BTB converter carries all 1.2-kW power of the HPG. A negative power P BTB shows that this power is transferred from the HP to the LP channel. Hence, the fourth point in the checklist Table V is validated, confirming that the power flow is consistent with that in Table I.
The voltage command initialization strategy proposed in Section III-B is tested to limit the current surge in the transition of disabling the HPR. As can be seen from the dashed lines in Fig. 23(a), without initialization, dq voltages of the HPG change to zero volts at t = 2 s and then oscillate because a new control scheme is applied to the BTB 2 converter. The oscillated voltages lead to current surge in Fig. 22(c) and (d). However, with the voltage initialization, voltages of the HPG transit smoothly at t = 2 s. Therefore, Fig. 23(b) and (c) shows a much smoother current performance than that in Fig. 22(c) and (d). This means that the voltage initialization method in Section III-B can effectively ensure a smooth transition, and hence the third point in Table V is validated.

D. Experimental Results for Cases With the HPR Failure
Experimental results of the HPR failure without voltage command initialization are given in Fig. 24. The operating stages and settings are the same as that in Fig. 20. From Fig. 24(a) it can be seen that the dc currents are the same in the first two stages due to identical droop gains. The dc bus voltage drops with the increase of power. In stage 3 where the PWM signals for the HPR are disabled, i dcHP falls to zero and i dcLP is doubled. The dc bus voltage restores to 270 V because of the deactivation of droop control. The results in Fig. 24(a) are consistent with the simulation results in Fig. 22(a) and (b).
The experimental results of phase currents are shown in Fig. 24(b). As the load power increases from 1.2 to 1.75 kW, the magnitude of all phase currents also increases. In the transient process when the PWM signals for the HPR are disabled, i aHPR drops to zero, and i aLPR boosts significantly. The results in Fig. 24(b) are consistent with the simulation results in Fig. 22(d) and (f), showing that phase current surge will occur to the HPG if directly changing to the fault tolerant control without voltage command initialization.
The effectiveness of the proposed voltage command initialization strategy is tested as shown in Fig. 25. Compared  with Fig. 24(b), the transient performances of the HPG's phase current become smoother with limited current surge and recovery time. This is consistent with the simulation results shown in Fig. 23, confirming that the proposed voltage command initialization strategy can provide a seamless transition when disabling the HPR.

E. Engine Performance Comparison Using Different PGC Architectures
To study the engine performances with the PGC in Fig. 1 and the APGC in Fig. 2, a multispool turbofan model has been developed by our group using the intercomponent volume method and CFM56 engine maps [2], [28]. The cruise mode is focused because cruising usually consumes the majority of a flight. The altitude is 39 kft, Mach number is 0.79. The speed of the LPS is fixed to provide a constant thrust. The operating points are shown in Fig. 26, where A and B indicate that the engine operates with the PGC in Fig. 1 and the APGC in Fig. 2. LPR is considered to be faulty and disconnected from the system.
As proved in the previous sections, with the APGC, operating states of the LPG and HPG are not affected when  disabling the LPR. However, with the PGC, disabling the LPR will make the remnant HPR feed all the load power. As a result, the HPG needs to extract more mechanical power from the HPS, decreasing the rotary speed of the HPS. Since the high-pressure compressor (HPC) is coupled with the HPS, the speed of the HPC is also reduced, leading to a decreased mass flow demand. In this case, the HPC acts as a blockage for the rear side of the low-pressure compressor (LPC), pushing the LPC to decrease its mass flow at the same speed. Consequently, the pressure ratio of the LPC will increase and the operating point will move close to the surge line on the compressor map. This is the reason why the operating points in Fig. 26 move from B to A.
Comparing point B with A, it can be concluded that when the LPR is faulty and disconnected, the APGC can provide a larger compressor surge margin than the PGC does. A larger surge margin means a larger stability margin. Therefore, the APGC is a favorable option considering the safe operation of engine.

A. System Weight and Fuel Efficiency Analysis
Compared with the PGC in Fig. 1, there is an additional BTB converter (including two ac/dc power converters), capacitor bank, and filtering inductors in the APGC in Fig. 2. These components bring extra weight and size, which will cost more fuel burn. However, as revealed in [24], the APGC offers a higher power generation efficiency than the PGC. This section will investigate how the actual fuel efficiency will change with the APGC architecture.

1) Fuel Consumption (FC) Increase Due to the Additional BTB Converter System:
The B787 Dreamliner is considered as the targeted MEA. The essential characteristic of the B787 is listed in Table VI. It can be seen that the total power  [2] rating of the main generators is 1000 kVA. For the state-ofthe-art power electronics technologies, the power density is considered as 14.3 kW/kg and the power conversion efficiency is 97.5% [33], [34]. Hence, given the requirement to handle the 1000-kVA power in the postfault operation mode, the weight of the power electronics of the BTB converter can be assumed to be: W PE = W BTBL + W BTBH = 2 × [1000 kW/(97.5% × 14.3 kW/kg)] = 143.3 kg. The power density of the cooling system is considered as 15 kW/kg [35], hence the weight can be assumed to be W Cool = 2 × (1000 kW/15 kW/kg) = 133.3 kg. Some state-of-the-art inductors for high-current high-frequency applications with acceptable weight (W L = 23.5 kg [36]) are suitable to be applied in the APGC. Hence the total weight increase is W Total = W PE + W Cool + 2 × 2 × W L = 370.6 kg.
A rule-of-thumb is that an 1% increase in weight results in an 0.75% increase in FC [37]. Considering the maximum landing weight in Table VI  2) FC Decrease Due to the Higher Power Generation Efficiency: As indicated in [24], a 5% power generation efficiency improvement can be achieved using the APGC compared with the PGC. Therefore, the total energy saving with the APGC can be calculated with the flight mission data in Table VII Energy saving = 1000 kW × 5% × 245 min/60 min/h = 204 kW · h.
Considering the aviation fuel energy density in Table VI, the saved FC is 204 kW·h/12.5 kW·h/kg = 16.32 kg. Consequently, the saved FC (16.32 kg) is larger than the extra consumed FC (5.5 kg), which means a higher fuel efficiency is achieved by using the APGC architecture for the studied B787 aircraft in a 4-h flight mission scenario.

B. Potential Challenges From the Down-Scale Lab Prototype to a Full-Scale System
Although the effectiveness of the postfault reconfiguration and fault tolerant control has been verified in this article, there are still some challenges in implementing the proposed method to a full-scale system. The potential challenges include the following.
1) The scaling of essential variables such as the generator's speed and torque used for feedback control. 2) To investigate the dynamic performance of a full-scale system through an available down-scale system, time should be scaled as well. Moreover, in the lab prototype an AF and a programable ac source are used as the LPG and HPG simulator, respectively. There are some differences between the generator simulators and the actual generators. To be specific.
1) The actual generators have shaft inertia while the generator simulators do not. The shaft inertia determines the rate of change of speed, which correlates to the back EMF and fundamental frequency of the actual generators. As a contrast, for the generator simulator, there is no back EMF, and the fundamental frequency is manually changed. 2) Another difference is related to the control issues. For an electrical generator for high-speed applications, the electrical parameters are relatively small. For example, for the AEGART electrical machine developed under the frame of the Clean Sky project [26], the stator resistance and inductance are 1.058 m and 100 μH, respectively, [38]. Such small impedance causes the motor current to change quickly, resulting in difficulty for discrete digital control. Moreover, the machine parameters depend on operating conditions, such as stator current, fundamental frequency, and temperature [39]. All these issues cause difficulty in control. As a contrast, these nonlinearities do not exist in the generator simulator, which ease the control design. Although there are some differences between the actual system and the lab prototype, from the perspective of fault-tolerant control and power control that this article focuses, these differences do not cause significant impact. The idea of system reconfiguration and fault tolerant control strategy are the same, while the control parameters and control bandwidth should be adjusted for a larger scale system.

VI. CONCLUSION
To reduce the power losses caused by the significant FW current of the HPG, and enhance fault tolerance of the power generation system in the MEA, an APGC was proposed in our previous work. As a continuation, to fully exploit the APGC's fault tolerance potential, in this article, system reconfiguration and associated fault tolerant control is tailored for the APGC. The main advantages of the proposed solution that have been experimentally and simulatively validated can be highlighted as follows.
1) After the HPR or LPR failure, through system reconfiguration and fault tolerant control, the BTB converter can provide a power flow path to the generator of the failed channel. The generator associated with the faulty rectifier can supply continuous power through the BTB converter to the healthy rectifier and then to the dc bus. In this way, the generator can provide power to the load without interruption, which ensures a reliable power supply capability and this is proven to be beneficial to the stability of the engine.
2) To avoid the current surge of the generator's current during the transition from the normal operation to postfault operation, a seamless transition strategy is proposed where the voltage command is properly initialized when switching to a new controller of the BTB converter. Overall, this article provided a systematic solution of the fault tolerance enhancement for the APGC. The proposed strategy of system reconfiguration and seamless transition can be of interest for other researchers who are interested in the fault tolerance issue of the onboard dc grid of the MEA.
Besides the FW current elimination and fault tolerance enhancement, the APGC is found to have the potential to improve stability of both dc grid and engine. At the high-power settings of engine, more mechanical power can be taken from the HP spool than LP spool to avoid overspeed of the HP spool. However, by analyzing the stability of the dc grid, it reveals that the LPR should share more power that the HPR. Denoting the power of the HP spool, LP spool, HPR, and LPR as P HPS , P LPS , P HPR , and P LPR . For the PGC in Fig. 1, if P HPS > P LPS , P LPR cannot be larger than P HPR . Otherwise, if P LPR > P HPR , P HPS cannot be larger than P LPS . Hence, PGC is hard to improve both engine and dc grid stability. But the APGC in Fig. 2 can fulfill this goal by transferring power from the HP to LP channel through the BTB converter channel. Detailed study regarding this point is currently under development by our team.