A Fault-Tolerant Strategy for Three-Level Flying-Capacitor DC/DC Converter in Spacecraft Power System ^†

Abstract

With the development of space exploration, high-power and high-voltage power systems are essential for future spacecraft applications. Because of the effects of space radiation such as single event burnout (SEB), the rated voltage of power devices in converters for a spacecraft power system is limited to a level much lower than that for traditional ground applications. Thus, multi-level DC/DC converters are good choices for high-voltage applications in spacecraft. In this paper, a fault-tolerant strategy is proposed for a three-level flying capacitor DC/DC converter to increase the reliability with minimal cost. There is no extra hardware needed for the proposed strategy; the fault tolerance of the converter is only achieved by changing the software control strategy. A stage analysis of the proposed strategy is provided in detail for different fault locations and ratios between the input and output voltage. Finally, a simulation model and prototype are built to verify the effectiveness of the proposed strategy.

1. Introduction

The architecture of a high-power spacecraft distributed power system is shown in Figure 1. The spacecraft power system is a typical DC power system [1,2]. It consists of solar arrays, batteries, a fuel cell, flying wheel, power converters, etc. The solar arrays provide the power for the load and charge the battery during the sunlight period of the orbit. Storages such as batteries provide the power for the load during the eclipse period of the orbit. The power converters are used to regulate the DC bus voltage and control the battery charging and discharging. With the development of space exploration, the power capacity of spacecraft has become larger and larger, and the voltage level of the spacecraft power system has become higher and higher. Currently, high voltage and high power are the trends and necessary factors for a spacecraft power system to meet the requirements of future spacecraft, such as high-power SAR satellites, electric propulsion spacecraft, deep space spacecraft, space stations, and space solar energy power stations, etc. [3] The power ratings of these spacecraft will need to be larger than 100 kW, and the voltage level will need to be higher than 1000 V. However, the current power converters cannot meet the requirements of this high-voltage application. The characteristics of the power device in space are obviously different from that on the ground. Due to space radiation effects such as single event burnout, the high-voltage power device is the main limitation for spacecraft power converters. Currently, the available voltage of power devices such as power MOSFETs for spacecraft power converters is lower than 500 V. However, the requirement of the output voltage of converters is much higher than 500 V for future space applications. In order to solve the mismatch between future high-voltage applications and the available low-voltage power devices, the multi-level DC/DC converter is a better solution for these high-voltage applications with the voltage limitation of the power devices. Even though they are not used in traditional spacecraft power systems in which the highest DC bus voltage is 100 V, these converters are widely used in ground high-voltage applications. The voltage stress of the power devices in a multi-level DC/DC converter can clearly be reduced [4,5,6,7,8,9,10]. For multi-level DC/DC converters, the number of power devices is relatively larger than the traditional two-level converter. Each failure of the power device may cause the output interruption of the converter, so the reliability of the multi-level DC/DC converter is relatively low without a fault-tolerant strategy [11,12,13,14,15,16]. In addition, the reliability of the converter is very important for the spacecraft. The failure of the converter will result in huge losses, especially for an unmanned spacecraft. Thus, the fault-tolerant strategy is very important for the multi-level converter in a spacecraft power system. Fault-tolerant schemes of multi-level DC/DC converters have been proposed by researchers [14,15,16,17,18,19,20]. The redundant subsystem, units, circuits, or devices have been added to multi-level converters to improve their reliability [14,15,17,18]. The fuse is a common component that is used to isolate the short-circuit fault parts of the converter. The main disadvantage of the fuses is that the blowing time of a fuse is difficult to control. Moreover, the use of a fuse will increase the parasitic inductance of the commutation loops of the converter, and larger parasitic inductance causes a higher voltage stress, which reduces the reliability of power devices [19,20]. Additional hardware is needed for these former methods. However, the additional hardware increases the mass of the converter, which results in an obviously higher cost of the launch. For space application, the limitation of the mass of converters is extremely strict. A three-level flying capacitor DC/DC converter is the typical multi-level DC/DC converter. A fault-tolerant control strategy for three-level flying capacitor DC/DC converters is proposed in this paper. The reliability of the three-level DC/DC converter is improved with minimal cost. The fault tolerance of the converter is achieved by only changing the software strategy, and no extra hardware is needed. The concept of the fault-tolerant strategy can also be applied in other multi-level converters.

In Section 2, the control scheme of the fault-tolerant strategy for a three-level flying capacitor DC/DC converter is introduced. In Section 3, the stage analysis of the converter under short-circuit fault conditions is given in detail. In Section 4, the proposed strategy under different conditions is verified by experiments and simulations. Finally, the conclusions are summarized.

2. Control Scheme of Fault-Tolerant Strategy for Three-Level Flying Capacitor DC/DC Converter

In order to achieve the fault-tolerant operation of the three-level flying capacitor DC/DC converter after a short-circuit fault of the power devices, a seamless transfer control from three-level mode to two-level mode is designed. Before the fault, the converter operates in three-level mode, and after the fault, the converter operates in two-level mode. The control scheme of the proposed fault-tolerant strategy for a three-level flying capacitor DC/DC converter is shown in Figure 2.

The fault-tolerant strategy consists of three loops, including a three-level voltage regulation loop, a flying capacitor voltage loop, and a two-level voltage regulation loop. When the power devices of the converter are normal, the output voltage and flying capacitor voltage are regulated by a three-level voltage regulation loop. Output voltage and flying capacitor voltage are two control targets for the three-level voltage regulation loop. The reference of flying capacitor voltage is half of the reference of the output voltage of the converter. When a short-circuit fault of the power device occurs, the converter is regulated by the flying capacitor voltage loop after the short-circuit fault of the power device is detected. If a short-circuit fault of inner switch S₂ or S₃ occurs, the voltage reference of the flying capacitor changes from half of the output voltage to zero. The normal inner power devices are opened immediately, and the driver signals of the normal inner switches are set as low. If a short-circuit fault of outer switch S₁ or S₄ occurs, the reference of the flying capacitor voltage changes from half of the output voltage to the output voltage, and the driver signals of the normal outer switches are set as high. When the voltage of the flying capacitor reaches the reference value, the converter changes its mode to the two-level mode. If the inner switch is at fault, the driver of the other inner switch is set as high in the two-level mode. The driver signals of the two outer switches operate in the complementary state. If the outer switch is at fault, the driver of the other outer switch is set as high. The driver signals of the two inner switches operate in the complementary state.

3. Analysis of Operation Modes for the Converter under Short-Circuit Fault Conditions

According to the analysis of the flying capacitor three-level DC/DC converter, the operation stages of the converter are different between the situation in which the ratio of the input and output voltage is smaller than 0.5 (V_L < 0.5 V_H) and the situation in which the ratio is larger than 0.5 (V_L > 0.5 V_H).

The diagram in Figure 3 shows the key quantity for the situation in which the short-circuit fault occurs in switch S₃ when the ratio of the input and output voltage is smaller than 0.5 (V_L < 0.5 V_H). When the short-circuit fault of switch S₃ is detected by the detection circuit, the converter is regulated from the three-level mode to the flying capacitor voltage control mode. The reference of the flying capacitor voltage decreases from half of the output voltage V_H to zero. The voltage of the flying capacitor is changed by the flying capacitor voltage loop from half of the output voltage to zero during this stage. After the voltage of the flying capacitor is detected to have reached zero, the converter finishes the flying capacitor voltage control mode and begins to operate in two-level mode.

The analysis of operation stages under this fault situation is shown in Figure 4. The g₁, g₂, g₃, and g₄ are gate drivers of switches S₁, S₂, S₃, and S₄, respectively. When V_L < 0.5 V_H, the duty cycle of inner switches g₃ and g₄ is larger than 0.5. The three-level mode is the pre-fault mode. The stages of the three-level mode are shown in Figure 5. There are four stages in the three-level mode. In the three-level mode, the driver signal of g₁ and g₄ are complementary, and the driver signal of g₂ and g₃ are complementary.

The stages during the flying capacitor voltage control mode are shown in Figure 6. There are also three stages after the short-circuit fault occurs. In Stage V, S₃ is short-circuited and S₂ turns on, then the flying capacitor is short-circuited. There is a large current spike occurring in S₂, so the fault is detected. After the fault is detected, the converter operates in Stage VI and VIII; in these two stages, g₄ is in the PWM state, and the values of g₁, g₂, and g₃ are 0 when the short-circuit fault occurs in S₃. Similarly, g₁ is in the PWM state, and the values of g₂, g₃, and g₄ are 0 when the short-circuit fault occurs in switch S₂. The two-level mode is the post-fault mode. In the two-level mode, the driver signal of g₁ and g₄ are complementary, and g₂ is set as 1 when the short-circuit fault occurs in switch S₃. Similarly, g₃ is set as 1 when S₂ is where the fault occurs.

The diagram in Figure 7 shows the key quantities under the situation in which the short-circuit fault occurs in the outer switch S₄ when V_L is lower than 0.5 V_H. Before the fault occurs, the converter operates in three-level mode. When the short-circuit fault of the switch S₄ is detected, the converter begins to operate in flying capacitor voltage control mode. The flying capacitor voltage is regulated gradually from half of the output voltage to output voltage. When the flying capacitor voltage reaches the output voltage, the converter turns to operate in two-level mode.

The stage analysis in this situation is shown in Figure 8. The stages of the three-level mode are the same as those in which the short-circuit fault of S₃ occurs. The stages of the flying capacitor voltage control mode after a short-circuit fault are shown in Figure 9. There are three stages after the short-circuit fault occurs in the outer switches. In Stage V of the flying capacitor voltage mode, g₄ is short-circuited and g₁ turns on; then the output capacitor is connected directly with the flying capacitor. Due to the existence of the voltage difference between the output voltage and the flying capacitor voltage, there is a current spike occurring in S₁, and the fault can be detected. After Stage V, the converter operates in Stages VI and VII. In these two stages, g₃ is in the PWM state, and g₁, g₂, and g₄ are 0 when the short-circuit fault occurs in S₄. Similarly, g₂ is in the PWM state, and g₁, g₃, and g₄ are 0 when the short-circuit fault occurs in S₁. In the two-level mode, the driver signal of g₂ and g₃ are complementary, and g₁ is set as 1 when the fault occurs in S₄. Similarly, g₄ is set as 1 when the fault occurs in S₁.

Then the situation when V_L is higher than 0.5 V_H is analyzed in detail. The stage analysis is shown in Figure 10 for when S₃ is short-circuited in this situation. This situation is different from the situation when V_L is lower than 0.5 V_H. The duty cycle of g₃ and g₄ is less than 0.5.

When the short-circuit fault of S₃ is detected, the converter is regulated by the flying capacitor voltage control loop. Then S₄ is opened. Because V_L > 0.5 V_H and the initial value of v_fly is half of v_H, inequality (1) can be derived at the beginning of the fault. The voltage difference between the inductor is always positive. It should be noticed that if inequality (2) holds, the current of the inductor will continue to increase during Stage VI. When v_fly is lower than (v_H − v_L), the converter operates in Stages VII and VIII. When the flying capacitor voltage reaches 0, the converter turns into the two-level mode, and the S₂ is closed.

$$v_L>v_H-v_{fly} (v_L>0.5v_H,V_{fly}=0.5v_H)$$

(1)

$$v_{fly}>v_H-v_L$$

(2)

The proper inductance value of the inductor L should be designed, and additional an over-current protection method should be considered. The flying capacitor voltage and inductor current can be calculated by (3). The current spike analysis in this situation when S₃ is short-circuited is shown in Figure 11.

$$\{\begin{array}{l}{v}_{fly}(\mathrm{t})=\frac{I_L\sqrt{LC}}{C}\sin (\frac{1}{\sqrt{LC}}\mathrm{t})+(V_{fly}-V_H+V_L)\cos (\frac{1}{\sqrt{LC}}\mathrm{t})+(V_H-V_L)\\ i_L(\mathrm{t})=I_L\cos (\frac{1}{\sqrt{LC}}\mathrm{t})-\frac{(V_{fly}-V_H+V_L)C}{\sqrt{LC}}\sin (\frac{1}{\sqrt{LC}}\mathrm{t})\end{array}$$

(3)

where v_fly is the flying capacitor voltage, V_H is the output voltage, V_L is the input voltage, L is the inductance of the input inductor, C is the capacitance of the flying capacitor, i_L is the current value of the inductor, and I_L is the initial value of the inductor current. If the output voltage is 100 V, the input voltage is 80 V, the inductor is 1 mH, and the initial current of the inductor is 10 A, then it can be calculated that the maximum inductor current is 17.2 A. The maximum current under different levels of inductance when S₃ is short-circuited is shown in Figure 12.

The current spike analysis when S₄ is short-circuited is shown in Figure 13. When the short-circuit fault of S₄ is detected, S₃ is turned off. Because v_L is larger than 0.5 V_H and the initial value of V_fly is half of V_H, inequality (4) can be derived at the beginning of the fault. The voltage difference between the inductor is always positive. It should be noticed that if inequality (5) holds, the current of the inductor will continue to increase during Stage VI. When v_fly is higher than 0.5 V_H, the converter operates in Stages VII and VIII.

$$v_L>v_{fly} (v_L>0.5v_H,V_{fly}=0.5v_H)$$

(4)

$$v_{fly}<0.5v_H$$

(5)

When the voltage of the flying capacitor voltage reaches V_H, S₁ is turned off. The proper inductance should also be designed carefully. The flying capacitor voltage and inductor current can be calculated by (4). The current spike analysis is given in Figure 14. If we take the same parameters as the situation when S3 is faulty, the maximum inductor current is 17.2 A. The maximum current under different levels of inductance when S₄ is short-circuited is shown in Figure 15.

$$\{\begin{array}{l}{v}_{fly}(\mathrm{t})=\frac{I_L\sqrt{LC}}{C}\sin (\frac{1}{\sqrt{LC}}\mathrm{t})+(V_{fly}-V_L)\cos (\frac{1}{\sqrt{LC}}\mathrm{t})+(V_L)\\ i_L(\mathrm{t})=I_L\cos (\frac{1}{\sqrt{LC}}\mathrm{t})-\frac{(V_{fly}-V_L)C}{\sqrt{LC}}\sin (\frac{1}{\sqrt{LC}}\mathrm{t})\end{array}$$

(6)

The parameters of the flying capacitor DC/DC converter can be calculated as below. According to the stage analysis of the circuit, the inductance of the input inductor is derived by (7), the capacitance of the flying capacitor is derived by (8), and the capacitance of the output capacitor is derived by (9).

$$L_{IN}=\{\begin{array}{ll}\frac{(\frac{U_o}{2}-U_{IN})(1-D)}{{\delta }_I{I}_{in}\cdot f_s} & (D>0.5)\\ \frac{(U_{IN}-\frac{U_o}{2})\cdot D}{{\delta }_I{I}_{in}\cdot f_s} & (D<0.5)\end{array}$$

(7)

$$C_{fly}=\{\begin{array}{ll}\frac{I_{IN}(1-D)}{\frac{{\delta }_f{U}_o}{2}\cdot f_s} & (D>0.5)\\ \frac{I_{IN}D}{\frac{{\delta }_f{U}_o}{2}\cdot f_s} & (D<0.5)\end{array}$$

(8)

$$C_o=\frac{I_o}{{\delta }_o{U}_o\cdot f_s}$$

(9)

where the output voltage U_o is 100 V, the input voltage U_IN is 30~80 V, the switching frequency f_s is 10,000 Hz, the duty cycle D is 0.2~0.7, the input current I_IN is 33 A, the output current Io is 10 A, the ripple ratio of the input current δ_I is 0.02, the ripple ratio of the flying capacitor voltage δ_f is 0.1, and the ripple ratio of the output capacitor voltage δ_o is 0.01. Then the inductor is 0.9 mH, the flying capacitor is 200 μF, and the output capacitor is 1 mF. With the consideration of the current spike analysis after a short-circuit fault in the simulation, the inductance of the inductor is chosen as 1 mH, and the capacitances of the flying capacitor and the output capacitor are chosen as 200 μF and 1 mF, respectively.

4. Simulation and Experiment Verifications of the Fault-Tolerant Strategy

In order to verify the proposed fault-tolerant strategy, the simulation model of the flying capacitor three-level DC/DC converter based on PSIM was built. In the model, the rated power of the flying capacitor three-level converter is 1 kW. The output voltage of the converter is 100 V. The two types of input voltage are considered, including 30 V (V_L<0.5 V_H) and 80 V (V_L > 0.5 V_H). The inductance of the inductor is 1 mH. The capacitance of the flying capacitor is 200 uF, and the capacitance of the output capacitor is 1 mF. The parameters of the simulation are shown in

Table 1. The parameters of the different simulation cases.

Item	Case I (Figure 16) Value	Case II (Figure 17) Value	Case III (Figure 18) Value	Case IV (Figure 19) Value
Input voltage	30 V	30 V	80 V	80 V
Output DC bus voltage	100 V	100 V	100 V	100 V
Input inductor	1 mH	1 mH	1 mH	1 mH
Flying capacitor	200 μF	200 μF	200 μF	200 μF
Output bus capacitor	1 mF	1 mF	1 mF	1 mF
Load power	100 W/1000 W	100 W/1000 W	100 W/1000 W	100 W/1000 W
Fault location	Inner switch S3	Outer switch S4	Inner switch S3	Outer switch S4

.

The simulation waveforms when a short-circuit fault occurs in outer switch S₄ under two load conditions are shown in Figure 16. It can be seen that the output voltage of the converter is uninterruptible when a short-circuit fault of S₄ occurs. The mode transfer after the fault is seamless.

The simulation results when the input voltage is lower than half of the output voltage are shown in Figure 17. The waveforms when a short-circuit fault occurs in inner switch S₃ under different load conditions are shown in Figure 17a,b. The two load conditions are 100 W for a light load and 1000 W for a heavy load. It can be seen that the output voltage of the converter is uninterruptible after the S₃ fault occurs. The spike of the current and voltage is in the normal range during the mode transition after the fault.

The simulation results when the input voltage is higher than half of the output voltage are shown in Figure 18 and Figure 19. The waveforms when a short-circuit fault occurs in S₃ under two different load conditions including a light load and a heavy load are shown in Figure 18a,b, and the waveforms when a short-circuit fault occurs in S₄ under two different load conditions are shown in Figure 19a,b. It can also be seen that the output voltage is uninterruptible when two types of faults occur. The spike and surge of the current and voltage are also in the normal range.

The prototype of the three-level flying capacitor DC/DC converter is built to verify the fault-tolerant strategy. The parameters of the prototype are shown in

Table 2. The parameters of the prototype of flying capacitor DC/DC converter.

Item	Value
Input voltage	10 V
Output DC bus voltage	32 V
Input inductor	100 μH
Flying capacitor	20 μF
Output bus capacitor	470 μF

.

The waveform when the short-circuit fault of S3 occurs is shown in Figure 20a. CH1 is the output voltage of the converter. CH2 is the flying capacitor voltage. CH3 is the trigger signal. CH4 is the driver signal of the power switch S3. The waveform of the three-level mode before the fault occurs is shown in Figure 20b. The waveform during the fault is shown in Figure 20c. It can be seen that the output voltage is uninterruptible and the flying capacitor voltage is regulated from 16 V to 0. The waveform of the two-level mode after the fault occurs is shown in Figure 20d. The waveform when the short-circuit fault of S4 occurs is shown in Figure 21a. The waveform before an S4 fault is shown in Figure 21b. The waveform during the fault is shown in Figure 21c. It can be seen that the output voltage is uninterruptible and the flying capacitor voltage is regulated from 16 V to 32 V. After the S4 fault, the waveform is shown in Figure 21d.

5. Conclusions

In order to improve the reliability of converters for the interface of the PV, battery, or other sources in spacecraft power systems for future high-voltage application, the fault-tolerant strategy of a three-level flying capacitor DC/DC converter is proposed in this paper. If a short-circuit fault occurs in the power devices, the converter can provide uninterruptible power for the load. It can turn from the three-level mode to the two-level mode, and during the mode transition, the voltage of the flying capacitor is regulated to the different target value based on the different fault locations. There is no extra hardware needed for this proposed strategy; the fault tolerance of the converter is only achieved by changing the software control strategy, and the reliability of the converter is improved with minimal cost. The stage analysis of the three-level converter is provided in detail. Different ratios between the input and output voltage and different fault locations are considered. Finally, a simulation model and prototype of the converter with the fault-tolerant strategy are built to verify the proposed strategy. The results show the fault tolerance operation of the converter is achieved after a short-circuit fault occurs.