Detection and Diagnosis Solutions for Fault-Tolerant VSI

Abstract

This paper presents solutions for fault detection and diagnosis of two-level, three phase voltage-source inverter (VSI) topologies with IGBT devices. The proposed solutions combine redundant standby VSI structures and contactors (or relays) to improve the fault-tolerant capabilities of power electronics in applications with safety requirements. The suitable combination of these elements gives the inverter the ability to maintain energy processing in the occurrence of several failure modes, including short-circuit in IGBT devices, thus extending its reliability and availability. A survey of previously developed fault-tolerant VSI structures and several aspects of failure modes, detection and isolation mechanisms within VSI is first discussed. Hardware solutions for the protection of power semiconductors with fault detection and diagnosis mechanisms are then proposed to provide conditions to isolate and replace damaged power devices (or branches) in real time. Experimental results from a prototype are included to validate the proposed solutions.

I. INTRODUCTION

For many critical applications it is extremely important the reliability of electric drives to perform certain tasks, particularly when human lives, environmental damages or important economic losses are involved. Power electronic converters play an important role in electrical drives where certain fault conditions such as open- or short-circuit can lead to potentially dangerous situations. Thus, seeking new fault-tolerant solutions and enhanced converter reliability attracts the attention of power electronics researchers.

Improving the reliability of power electronic converters results from investigation activities in the areas of design, manufacturing, and field application [1]. Some researchers have focused on the design and manufacture of power electronic modules (this paper will focus only on IGBT+diode devices) by analyzing progressive degradation due to cycling stress and fatigue at different assembly parts [2] or dissecting the IGBT silicon die to determine the failure cause [3]. Others focused on predicting the lifetime and modeling reliability of power modules [4]. Many solutions for improving reliability are reported in literature based on field application. Such improvements are usually achieved by providing overrated or more reliable components, using redundant design, or adopting automatic changes in the control strategy in the event of partial failures in the converter. Several special converter structures and control strategies can be found in literature for fault-tolerant machine drives that can be separated into three main groups:

A comparison of the features, cost, and limitations of these methods is given in [8], [9]. Applications that involve electrical drives, where fault transients are partially filtered by the machine and mechanical load, have been the object of research particularly in terms of fault-tolerant converter-machine associations [10]. Most of the proposed solutions that require special machine design, converter structure and control, or even fully redundant converter-machine associations provide only partial fault tolerance capabilities and decreased output power capacity.

Despite significant developments achieved in special converter structures and control strategies, most solutions do not address the following critical issues:

The present study intends to contribute with new solutions of fault-tolerant two-level three-phase VSI inverters with the capability to maintain normal operation after failure. This paper proposes protection mechanisms for power semiconductors along with hardware fault detection and diagnosis devices that, combined with redundant topologies and fast switchover methods, intend to overcome the effects of the most important types of device failure modes.

Failure modes and their causes, along with suitable detection and protection strategies, need to be studied to extend reliability. However, these factors are complex because of the high integration and interaction of system components. The failure modes of IGBT-based devices are then reviewed.

 

II. FAILURE MODES AND THEIR CAUSES

Aside from electrolytic capacitors, power semiconductors and their control electronics within a VSI are considered the main cause of faults [11]. Several factors can cause failures in power semiconductors and control electronics. Although different, many of these causes lead to three main failure states that compromise any converter operation: transistor short-circuit, transistor open-circuit, and freewheeling diode open-circuit.

A. Power Switch Short-Circuit

Power switch short-circuit is probably one of the most common failure modes [12] and there are mainly two reasons why an IGBT becomes a short: fault in the control or drive electronics resulting in a continuous drive signal or junction temperature rising above the critical temperature (250 °C–300 °C). Although modern IGBT modules can withstand maximum currents to values between 2 to 10 times the nominal current, a leg short-circuit must be stopped within a few micro-seconds by using fast fault detection and soft-switch turn-off. If the power switch does not turn off earlier, the leg is a full short-circuit and the energy stored in the DC capacitor bank can result in explosion of the IGBT modules and stresses on the drivers [4]. Under a high stress condition, the freewheeling diode can fail shortly after the reverse recovery peak voltage that can, in turn, lead to IGBT short-circuit during turn-on because of excessive inrush current [13].

B. Power Switch Open-Circuit

Power switch open-circuit can be caused by a fault in control electronics, thereby resulting in an unavailable gate drive signal, by internal rupture of the connections in case of a short-circuit because of overheating, or by bond wire lift-off because of thermal cycles. Aside from short-circuit, bond wire lift-off is one of the major failure mechanisms that affect power devices. An open transistor fault can lead to overstresses on healthy power switches and pulsating current. This condition can then lead to failures in other components [4], [12].

C. Freewheeling Diode Open-Circuit

The freewheeling diode open-circuit can be caused by any reverse-recovery failure or because of external ruptures between power semiconductor modules and electrical loads. When this failure mode occurs, it normally leads to destructive overvoltages and cannot be ignored.

 

III. FAULT DETECTION, DIAGNOSIS, AND PROTECTION TECHNIQUES

A. Known Fault Detection and Diagnosis Techniques

Fault detection and diagnosis techniques are crucial to ensure the operation of any fault-tolerant converter. Without appropriate automated detection and diagnosis systems, necessary corrective measures cannot be taken and all improvements made in reliability and fault tolerance have no effect. Some efforts have been undertaken to develop several fault localization techniques based on software, including knowledge-based ones such as pattern recognition [14] as well as fuzzy logic and artificial intelligence [15]. These techniques have variable detection time periods, which typically range between 10ms and 60ms.

Detection methods based on mathematical transformations using software can detect the damaged device, but they are not fast enough to cause any protective action [16], especially in the presence of shorted devices. Using fast active detection hardware techniques in applications with strict safety requirements is imperative to avoid the most destructive scenarios. Known hardware detection techniques are mostly based on the desaturation method, current mirror [17], and gate voltage sensing methods [18].

B. Known Fault Protection Techniques

Fault protection is particularly crucial in case of shorted power devices. Short-circuit failures in converters are difficult to deal with and usually results in destructive di/dt rates. Several techniques that provide short-circuit protection can be found in literature, although many were not designed to manage critical IGBT short-circuit failures such as fault under load (FUL) or hard switch fault (HSF) [19]. Most known dynamic protection techniques are based on gate voltage limiting [20], snubbers, clamp circuits and slow turn-off using additional parameters [21], and two-step gate pulse [22].

 

IV. PROPOSED TOPOLOGIES FOR FAULT TOLERANCE

The most desirable way to achieve device redundancy and isolation capacity in static converters is entirely by means of semiconductor devices. However, a closer look reveals that this approach to achieve significantly improved reliability against common failure modes becomes much more complicated and inefficient than can be tolerated. Fig. 1 presents several possible solutions for the redundancy of one device (i.e., an IGBT with a free-wheeling diode).

Fig. 1.Basic redundancy schemes for a single IGBT-diode power device.

The basic solution of Fig. 1(a) is a series of two similar power devices that can provide redundancy for one shorted device, but does not handle any open-circuit failures (because the series remains open. Fig. 1(b) shows a solution that uses parallel power devices, which results in the opposite condition (dual) in terms of failure modes. It can eliminate an open device but not a shorted one because the parallel remains shorted.

Only parallel-series schemes [Figs. 1(c) and 1(d)] can cope with both types of failure modes. However, this condition occurs at the expense of multiple redundancies where at least two devices work simultaneously under current stress and the other two (in standby) remain under voltage stress. Thus, the heat losses are duplicated and the number of devices exposed to failure increases.

Integrating protection, detection, and diagnosis into converter structures that can segregate failed elements is necessary to achieve the desired fault tolerance. This paper proposes topologies based on redundant standby power devices, branches, or even entire converters combined with contactors or relays [23]. Fig. 2 shows some examples of such topologies.

Fig. 2.Topologies for fault-tolerance with standby redundancy.

 

V. PROPOSED SOLUTIONS FOR DETECTION, DIAGNOSIS, AND PROTECTION

A. Fault Protection Solutions

This section proposes two possible protection circuits to deal with the effects of short-circuit failures without compromising the detection and diagnosis of the remaining failure modes. The first protection solution is based on the Z-source circuit. This circuit can be easily integrated in the fault-tolerant schemes mentioned in the previous section. An example of this solution can be seen in Fig. 3 where the Z-source circuit replaces the DC bus capacitor.

Fig. 3.Fault-tolerant two-level, three-phase VSI proposed with short-circuit protection provided by the Z-source circuit.

The impedance-source or Z-source was originally designed to operate as a buck-boost inverter with a wide range of obtainable voltages, thereby overcoming certain limitations of VSI and current-source inverters (CSI) converters [24]. The three-phase Z-source inverter bridge can achieve nine permissible switching states (vectors) in normal conditions, unlike the traditional three-phase VSI that can achieve eight states. The ninth state is an extra zero state and is called shoot-through or short-circuits zero state. This extra zero can achieve the desired voltage in the three-phase Z-source VSI converter through an appropriate duty cycle.

The Z-source in this study attempts to provide di/dt limitation (1) in case of shorted devices. Given this characteristic, increasing the survival time of IGBTs to the most critical SC scenarios is possible, which allows switching off of healthy power devices without destroying any additional component or even the whole converter.

As an example of short-circuit protection, assume that the power device S1 is shorted at a certain moment. When the power device S2 switches on, an inverter leg short-circuit will arise. This type of short-circuit is usually called HSF [19]. Fig. 4(a) shows the equivalent circuit during an HSF short-circuit where CZ capacitors transfer energy to LZ inductors. S2 is switched off after fault detection, and inductors return energy back to the capacitors’ thought equivalent DC circuit and diode D according to Fig. 4(b). The switching of the mechanical commutator (i.e., SA) associated with the damage inverter branch should be simultaneously ordered.

Fig. 4.Operation steps of a fault-tolerant topology with protection accomplished by the Z-source circuit during an HSF short-circuit.

In redundant schemes such as that proposed in Fig. 3, the switching process is not completely “soft” as would be desired in case of shorted semiconductors is expected to have an initial electric arc between contacts. In the meantime, additional diodes and redundant devices will force the arc extinction. A complete “soft” commutation can be achieved if additional low cost, low power semiconductors (bidirectional switch) are added to mechanical commutators (Fig. 5), where a short pulse duration (4 ms to 5 ms) is sufficient to ensure a complete “soft” commutation

Fig. 5.Bidirectional power semiconductors to achieve a complete “soft” commutation after short-circuit detection.

Although the Z-source circuit ensures the desired protection against short-circuit, a disadvantage of using this circuit type is the additional losses that will be higher than the conventional converter; these losses are comparable with those of a converter with an active front end [27].

The second protection solution proposed in this report is based on a similar concept to interphase inductors [25]. This solution requires some modifications in the fault-tolerant schemes presented in the previous section to replace each classic VSI branch by two separated branches composed of an IGBT and a diode in series. This type of branch is common in DC–DC converters. Inductors can then be inserted between branches (interbranch inductors). Fig. 6(a) shows a basic topology (non fault-tolerant) of this protection solution, which results from the parallel association of two DC–DC converters, one from the first quadrant and another from the second quadrant. Fig. 6(b) presents an example of fault-tolerant topology with protection against short-circuit failures using interbranch inductors.

Fig. 6.Topologies using interbranch inductors.

The di/dt limitation provided by this protection circuit is given by Eq. (2) as follows:

With the same di/dt assumed for both protection solutions, the following relation between inductors can be established in Eq. (3):

This equation means that inductors of the Z-source circuit should be four times higher than inductors used in each individual phase of the interbranch solution. Consequently, the losses will be higher. However, the interbranch solution requires one inductor per phase and some modification in the fault-tolerant structures. The operation steps of interbranch solutions are also more complex than those of the Z-source circuit solution.

B. Detection and Diagnosis Solution

The proposed solution includes the detection and diagnosis of four distinct failures per IGBT and a common failure mode, namely:

The IGBT gate drive circuits with desaturation detection in this study were selected and combined with fault protection circuits (i.e., Z-source circuit or interbranch inductors) to achieve the desired fast and active short-circuit protection. Several IGBT gate drive manufacturers offer solutions for fault detection through the desaturation method [26]. Fig. 7 presents a simplified diagram of the adopted desaturation method. Several fast recovery diodes must be placed in series (DS1,...,DSn) to adjust the value of the VCE desaturation threshold voltage.

Fig. 7.Simplified diagram of the desaturation method.

The major drawback of this detection method is the inability to distinguish between open- or short-circuit failures because no dynamic feedback information is provided. In open-circuit failure mode, the VCE voltage is high because the operation mode is similar to the IGBT turn-off. In case of short-circuit failure, the VCE voltage also increases and moves away from the saturation zone (desaturation) because of large short-circuit currents.

The developed solution to diagnose failure modes is based on complex programmable logic devices (CPLDs). These hardware devices use fault information provided from drive circuits and from several auxiliary circuits to diagnose the abovementioned failure modes. The auxiliary circuits are responsible for measuring the VCE voltage (Fig. 7) of power devices after the mechanical commutation. These circuits are also responsible for measuring gate voltages (Fig. 7) of power devices. All the logic values provided by these auxiliary circuits are isolated by using high-speed optocouplers.

The fault diagnosis of both open-circuit and short-circuit of power devices from the same branch is determined jointly. Table I presents the results of this diagnosis.

TABLE IDIAGNOSTIC OF OPEN-CIRCUIT AND SHORT-CIRCUIT FAILURE MODES FOR POWER DEVICES S1 AND S2

In Table I, “Fault S1=1” means that a failure has emerged in power device S1 (unknown open- or short-circuit) whereas “VCE S1=1” means that VCE voltage is present in power device S1 without a gate signal applied. VCE voltage measurement is considered valid only after effective mechanical commutation, i.e., without the influence of currents in the damaged power device. The same principle is applied to other branches.

Continuous or unavailable gate drive signal failures and gate drive signal in both power devices of the same branch are diagnosed by using simple logic circuits as presented in Fig. 8. The same principle is applied to other devices and branches.

Fig. 8.Example of failure diagnosis in gate drive circuits.

 

VI. EXPERIMENTAL RESULTS

This section presents experimental results performed on the topology of Fig. 3, whose control circuit diagram and redundant scheme details are presented in Fig. 9. An additional RCD snubber circuit (R = 0.1 Ω, C = 2.2 μF) was introduced in the redundancy scheme. This circuit can help to stabilize the Z-source output voltage and prevent excessive overvoltages after fault detection.

Fig. 9.Redundant scheme and control technique adopted in the laboratorial prototype.

Experimental results with fault-tolerant topologies using interbranch inductors are not yet available at this point.

Direct hardware detection (desaturation) of failures in IGBTs was combined with a Z-source circuit (Cz = 470 μF e Lz = 150 mH) to ensure self-protection against short-circuit. The adopted control strategy is based on a closed-loop speed control with current mode SVM technique applied to a 2 kW, 230 V delta-connected, 50 Hz, three-phase induction motor (IM). The control circuit is provided by a dedicated digital signal processor (DSP) device. Given that the main subject of this paper is fault tolerance, issues such as the Z-source circuit and machine control techniques were not addressed in detail.

Fig. 10(a) shows a photograph of the laboratorial prototype that was used to obtain the experimental results of the above schemes. Details about connections of the redundant topology presented in Fig. 9(a) can be seen in Fig. 10(b).

Fig. 10.Photographs of the laboratorial prototype presented in Fig. 8(a).

An experimental result obtained from an open-circuit failure of power device S1 is shown in Fig. 11, where (from top to bottom): (Ch1-5V/div) is the trigger signal to promote the mechanical commutation of relay; (Ch2-5A/div) is the stator current in Phase 1 (ia); (Ch3-5A/div) is the current in lower diodes of the auxiliary bridge (id); and (Ch4-5A/div) is the current in upper diodes of the auxiliary bridge (id’). The last diagram shows the current deviated by the lower diodes of the auxiliary bridge immediately after contactor opening. A transient bounce during contact closing again leads to conduction in the lower diodes. If the failure arises in the negative half cycle of the current, the upper diodes (id’) will conduct during the commutation process. This process takes approximately 4 ms to 5 ms to accomplish using an accelerator circuit as described in [23].

Fig. 11.Experimental result obtained from an OC failure of power device S1: (Ch1-5V/div) is the trigger signal to promote the commutation; (Ch2-5A/div) is the stator current in a faulty phase (ia); (Ch3-5A/div) is the current in lower diodes of auxiliary bridge (id); and (Ch4-5A/div) is the current in upper diodes of auxiliary bridge (id’).

A pair of contacts from an external mechanical commutator was deliberately used to emulate the failure of power device S1 to obtain experimental results with shorted semiconductors. The protection process against short-circuit failures during a converter drive stop can be observed in Fig. 12(a): the gate signal applied to device S2 (Ch1-10V/div) is continuously maintained until the short-circuit current (rising almost linearly, limited by the Z-source circuit) reaches the threshold level in less than 50 μs (Ch2-50A/div); a fault signal is then generated by the gate drive circuit (Ch3-10V/div). The fault signal will trigger the switching process between the main and redundant inverter leg. The experiments were performed at 350 V DC link voltage.

Fig. 12.Experimental result obtained from the prototype presented in Fig. 10 in short-circuit failure conditions.

The protection process against short-circuit failures during the converter start operation can be observed in Figs. 12(b) and 12(c). Fig. 12(b) shows that (Ch1-500V/div) is the output voltage (Uo) in the Z-source circuit during short-circuit protection, detection, and diagnosis. The gate signal applied to devices S1 and S2 is modulated according to the control law in this case, whereas device S1 remains shorted; (Ch2-20A/div) is the stator current in the faulty branch phase (iM); (Ch3-20A/div) is the stator current in the bidirectional switch (iSBD) (Fig. 5) during the commutation process; and (Ch4-20A/div) is the stator current in the redundant branch phase (iR). Fig. 12(c) shows details of the short-circuit current before detection by the gate drive circuit (desaturation method) and limited by the Z-source circuit. Several PWM gate drive signals may be necessary to reach the threshold level for SC detection in these operating conditions.

The achieved experimental results show that the detection, isolation, and replacement of faulty power devices can be performed in approximately 4 ms. The detection time is clearly shorter than the isolation and replacement process and depends on the fault instant and PWM duration. The detection time is usually less than 200 ms in the short-circuit situation and less than 20 ms in the open circuit situation. Most known methods found in literature require between 10 and 60 ms to detect open circuit failure modes and do not include isolation and replacement mechanisms.

The proposed solution is not as fast as the other methods described in [16] in terms of short-circuit detection time. Nevertheless, neither of those previous methods offers isolation and replacement mechanisms nor do they have the ability to simultaneously detect multiple failure modes such as those presented in this paper.

 

VII. CONCLUSIONS

This paper presents some solutions for fault protection, detection, and diagnosis of fault-tolerant VSI topologies with standby redundancy. Special attention was given to short-circuit failures where two protection circuits were presented. The Z-source circuit has the advantage of simplicity and does not involve modifications in the structure of fault-tolerant topologies. However, it requires larger inductors to provide the same protection as interbranch solutions. Interbranch inductors require several modifications in fault-tolerant topologies and are more complex with respect to the isolation and replacement of damaged power devices.

Experimental results using the Z-source circuit combined with hardware detection and diagnosis circuits have shown that the arrangement of mechanical commutators and redundant power devices can provide solutions to overcome usual device failure modes and provide full output power capability. The results also show that detecting, isolating, and replacing faulty power devices in approximately 4 ms is possible.

The proposed solutions also have some disadvantages, such as increased costs because of redundant power devices or branches, additional protection, and auxiliary circuits. These disadvantages are the natural cost of the increased fault tolerance.

The results obtained so far and presented in this paper for one of the proposed topologies with the Z-source protection circuit provide a positive indication for the expected performance of other proposed fault-tolerant converter structures that combine mechanical commutators and semiconductors.