Essential Protections and
Controls of an Aerospace
Generator Control Unit
4/27/2012
Washington University in St. Louis
Austin Robert Morman
Generator Control Unit
Airplane Generator
Abstract
An electric power generating system on an aircraft consists of an engine driven generator and its
associated electronic generator control unit. The generator control unit’s main functions are to ensure
demanded current is provided at the appropriate voltage level and take appropriate steps to protect the
generator or electrical loads if the electric system malfunctions. This paper focuses on the simulation
logic I created to ensure appropriate system state changes occur for a certain combination of conditions
for a minimum of eight common protections that the software and hardware within the control units
will need to perform. Then a simulation using various input signals combined with some of the
protective settings demonstrates the startup sequence that makes the electric source available, i.e.
bring the generator on-line, to begin providing electric power to the airplane. Typical aircraft electric
system voltages, currents, frequencies, and time delays were used.
2
Being the first to accomplish the long desired dream of flight, the Wright brothers created an
industry that would push the envelope of speed, distance and technology. Modern airplanes are far
more complex then the Wrights brothers’ bi-wing requiring hundred of individual systems to function
together, yet they are one of the safest forms of travel. This paper will look at one such system and the
logic it takes to make the airplane function safely. This paper will start with a macro view of how an
aircraft electric power generation system (EPGS) is laid out. Then it will delve into the inner workings of
the generator control unit’s (GCU) logic as it ensures the voltage and currents are at the appropriate
levels while protecting the generator or electrical loads if the electric system malfunctions.
Below is a simple single-line diagram of a two channel 3-phase electric power generating
system (EPGS) on an aircraft. The scope of the project will focus on the single channel highlighted in the
black box. This diagram has the generator represented as an AC source connected by a single line which
reflects the bundle of feeder cables to a three phase main-line contactor (MLC) that serves as the
primary AC bus power connection for one channel of electricity. This power relay also serves as the
Point of Regulation (POR) for the Generator Control Unit (GCU) to verify proper system voltage level. A
Generator Current Transformer (GCT) on the neutral side of each phase of the generator and a Line
Current Transformer (LCT) with each phase of the feeder cables going through it near the power relay is
also shown. These CTs are used to measure the electric currents to ensure the correct amount of
electricity is being provided to the AC bus loads and if any electrical open or short circuits occur. All the
associated signal level wires to-and-from these devices and various switches used by the GCU for control
and protection in the simulation are not shown for simplicity.
Figure 1: Single Line Diagram (SLD)
As seen from the SLD there are multiple generators on an airplane including an auxiliary
generator (APU GEN) but as stated this project will focus only on the one channel of the EPGS.
Specifically, a more detailed focus on the protections the GCU can employ will be described. There are
only 3 options of how a protection can function. It can switch, de-excite, or remove a power source
from a load bus. The switching option means connecting one generator to run both channels. While
this control logic is possible it is out of the scope of this project. Therefore the two options the model
3
employs for the protections are the logic for de-exciting the generator and removing the generator from
a load bus. The software and circuits of the GCU must coordinate how these two options are
accomplished. The next section will go into detail about 8 common protections that the GCU monitors
and controls to maintain a safe generator operation. Below is a simplified version of the top view of the
interaction between the Control Block and the Protection Block (The actual model view can be seen in
appendix C).
Figure 2: Simplified Top Most Level of Control and Protection Blocks
4
Protection Block
Below is the simplified top view of the protection block. This gives a visual representation of each of the
different subsystems within the protection block. Each subsystem will be discussed in more detail and
how each functions in regards to the generator protection. The actual model protection block can be
seen in Appendix D.
Inside Protection Block
Protection
Inputs
Undervoltage
Overvoltage
Differential
Open Phase
Underfrequency
Overfrequency
Failure to Open
Failure to Close
Output :
VR Enable
and DP
Fault
Figure 3: Top View of Protection Block
For the various Protection blocks of the simulations, the following Inputs or Output Signals as well as
main Commands, used in the simulation, are described:
1. AC AUX- the signal sent from the sensor at the MLC
2. AC CMD – Signal that gives the state of the MLC
3. Freq- the frequency of the generator current measured from the Permanent Magnet Generator
stage of the aircraft generator. Acts as a base reference for how fast the generator is spinning
and the frequency of the electrical power.
4. Gen Current A- The current measured from phase A directly out of generator.
5. Gen Current B- The current measured from phase B directly out of generator
6. Gen Current C- The current measured from phase C directly out of generator
7. Line Current A- The current output of Phase A in the feeder wire near the contactor.
8. Line Current B- The current output of Phase B in the feeder wire near the contactor.
9. Line Current C- The current output of Phase C in the feeder wire near the contactor.
10. POR Phase A- The voltage output of Phase A of the airplane generator
11. POR Phase B- The voltage output of Phase B of the airplane generator
12. POR Phase C- The voltage output of Phase C of the airplane generator
5
13. Reset Cond 2- Signal Received from the Control block that will reset a tripped protection,
specifically protections OV, DP, Open Phase Protection, Failure to Open, Failure to Close, and
Overfrequency.
14. Reset Cond. 1- Signal Received from the Control block that will reset a tripped protection,
specifically protections UV and Underfrequency
15. VR_Enable- signal that represents the voltage regulation of the GCU is enabled. It is a sum of all
the protection fault outputs from each protection. Will take the generator offline if a protection
is tripped.
6
Protection: Undervoltage (UV)
Description: Checks that the minimum POR voltage of all three phases taken from the generator
terminals shall not drop below 91.5 volts. If the Undervoltage (UV) condition is true for 140ms the
protection shall go from low to high. This shall cause generator shutdown and opening of the main line
contactor. The 140ms delay is reset if the minimum phase rises above 93.5 volts. This protection shall
be reset by the Reset Cond. 1 signal.
Figure 4: UV Protection Diagram
Protection Test: Plots
Explanation of Test: After 2 seconds of simulation time the POR voltage of all three phases were set
to 80 volts and 140ms later the UV protection was tripped causing VR Enable to go low shutting
down the power to the generator and the control signal AC CMD to go low opening up the main line
contactor protecting the rest of the aircraft from the faulty generator.
7
Protection: Overvoltage (OV)
Description: Checks that the maximum POR voltage of all three phases taken from the generator
terminals shall not rise above 130 volts for 2 seconds. If the protection should go from low to high it
shall cause generator shutdown. The 2 second delay is reset if the maximum phase drops below 120
volts. This protection shall be reset by the Reset Cond. 2 signal.
Figure 5:OV Protection Diagram
Protection Test: Plots
Explanation of Test: After 2 seconds of simulation time the POR voltage of all three phases was set to
135 volts and 2 seconds later the OV protection was tripped causing VR Enable to go low shutting down
the power to the generator and the AC CMD signal to go low opening up the main line contactor
protecting the rest of the aircraft from the faulty generator.
8
Protection: Differential Protection 1 (DP 1)
Description: Compares the difference between the current from the generator measured by the
Generator Current Transformer (GCT) and the current measured by Line Current Transformer (LCT) near
the end of the feeder cable. The fault condition for a DP1 protection follows: If the max phase Gen
Current is greater than 130 amps and the difference measured between the GCT and LCT is greater than
30 amps, or if the max Gen Current of any phase is less than 130 Amps and the difference between the
Gen and Line current is greater than or equal to 20 amps. If the fault condition is true for 100ms the
protection goes low to high. There shall also be a 4ms delay to when the DP protection is tripped to
when the main line contactor is opened. The protection shall be reset by Reset Cond. 2
Figure 6: DP Protection Diagram
Protection Test: Plots
9
Explanation of Test: After 2 seconds of simulation time the Line Current values were set to 80 amps and
1 second later the DP protection is tripped causing the AC CMD signal to go low opening the main line
contactor. There is a 4ms delay before the generator is shutdown as seen by the delay in VR Enable
going low. This delay helps the GCU decide if it is fault in the generator or a fault in the bus load that the
generator is supplying power to.
10
Protection: Failure to Open Protection (FTO)
Description: This protection ensures the main line contactor is not malfunctioning. If the main line
contactor is commanded open and AC AUX signal senses that the main line contactor is closed the
protection goes from low to high. This protection shall have a delay time of 15ms. The protection shall
be reset by Reset Cond. 2 signal.
Figure 7: FTO Protection Diagram
Protection Test: Plots
Explanation of Test: At 2 seconds of simulation time the input speed of the engine was put below 4500
rpm causing an Underspeed condition in the control block. This condition resulted in the main line
contactor signal (AC CMD) to be commanded open at 2.80 seconds and since the sensor at the main line
contactor (the AC AUX signal) continued to sense a closed position, the FTO protection was tripped
15ms later at time 2.95 seconds. This caused VR Enable to go low resulting in a generator shutdown.
11
Protection: Failure to Close Protection (FTC)
Description: This protection also ensures the main line contactor is not malfunctioning but for the
opposite state of the FTO protection. If the main line contactor is commanded close and AC AUX signal
senses that the main line contactor is open the protection goes from low to high. There shall be a time
delay of 15ms. The protection shall be reset by Reset Cond 2 signal.
Figure 8: FTC Protection Diagram
Protection Test: Plots
Explanation of Test: At 2 seconds of simulation time the main line contactor sensor recorded the main
line contactor open even with an AC CMD of closed. This resulted in the FTC condition and 15ms later
the fault was tripped causing VR Enable to go low which caused both generator shutdown and for the
main line contactor to open as seen by the AC CMD signal going from high to low. This protection will
prevent the generator from going online to the rest of the aircraft when there is a faulty MLC.
12
Protection: Overfrequency (OF)
Description: This protection ensures the frequency of the generator shall stay within an appropriate
range to ensure proper electric power quality. There are three possible OF fault conditions:
1) If the frequency of the generator rises above 420 Hz for more than 4 second the protection shall
go from low to high.
2) If the frequency of the generator rises above 440 Hz for more than 16ms the protection shall go
from low to high.
3) If the frequency of the generator rises above 454 Hz for more than 9ms the protection shall go
from low to high.
This protection shall cause generator shutdown and shall be reset by the Reset Cond. 2 signal.
Figure 9: OF Protection Diagram
13
Protection Test: Plots
Explanation of Test: At 2 seconds of simulation time the frequency was changed from the normal 400
Hz to 445 Hz causing the middle OF condition to be true. This resulted in the OF protection tripping and
lowing VR Enable only 16ms later or at 2.16 seconds of the simulation time. This was the only case
tested but there are two other conditions that could cause the OF protection to be tripped. Each case
has the same end result of generator shut down and opening the MLC.
14
Protection: Underfrequency (UF)
Description: This protection ensures the frequency of the generator shall stay within an appropriate
range to ensure proper electric power quality. There are 2 possible UF fault conditions:
1) If the frequency of the generator drops below 380 Hz for more than 4 seconds the protection
shall go from low to high.
2) Or if the frequency of the generator drops below 375 Hz for more than 12ms the protection
shall go from low to high.
This protection shall cause generator shutdown and shall be reset by the Reset Cond. 1 signal.
Figure 10: UF Protection Diagram
Protection Test: Plots
Explanation of Test: At 2 seconds of simulation time the frequency was changed from the normal 400
Hz to 350 Hz causing the bottom UF condition to be true. This resulted in the UF protection tripping and
lowing VR Enable only 12ms later or at 2.12 seconds of the simulation time. This was the only case
tested but there is one other condition that could cause the OF protection to be tripped. Each case has
the same end result of causing the generator to shut down and opening the MLC.
15
Protection: Open Phase Protection (OPP)
Description: This protection compares the difference between 2 phases of the Generator current. If the
difference between 2 phases of the Gen current is greater than 30 amps and the phase with the lowest
gen current is less than 4.5 amps for longer than 2.50 seconds the proetction shall go from low to high.
This portection shall be reset by the Reset Cond. 2 signal.
Figure 11: Open Phase Protection Diagram
Protection Test: Plots
Explanation of Test: At 2 seconds of simulation time both the Gen and Line Current of Phase B are
forced to zero essentially simulating the cable being cut or disconnected. Then 2.5 seconds later or 4.5
seconds of simulation the protection is tripped and VR Enable goes from high to low shutting down the
generator and opening the Main Line Contactor.
16
Control Block
Now that we understand how the GCU protects the generator we will look at how the generator
spins up to start providing electric power to the channel. The following steps describe how a simulation,
using various input signals combined with some of the protective settings, demonstrates the startup
sequence that makes the electric source available by bringing the generator on-line so it can begin
providing electric power to the airplane.
For the Control Blocks simulations, the following Inputs or Output Signals (*outputs are in bold) as well
as main Commands used in the simulation are described:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
AC CMD- Signal output that closes the MLC. Also an input to the FTO and FTC protections.
AC Reset Switch- allows the pilot to Enable only the reset condition 1 and not reset condition 2
DP1- signal related to the Differential Protection 1. Will take the generator offline.
Engine_Shutdown- Signal sent from the pilot when the engine is turned off. Helps protect the
generator from trying to provide power when the engine is not spinning
GCS_Off- Signal that ensures the Generator Control Switch is in the off position
GCS_On –Signal that ensures the Generator Control Switch is in the on position
GCU_Enable- Signal connected directly to switch in the cockpit that the pilot can switch from onto off-to on to reset/clear all tripped generator protections.
Input Speed- RPM measured directly from airplane engine
Internal_Power_Ready- an output from the power available block that lets the GCU know
when the generator is ready to provide power to the aircraft
POWER AVAILABLE- Another signal that tells the GCU the generator can go online
UNDERSPEED - Output from the underspeed block that feeds into the power available block
VR_Enable- major signal that groups all of the Protections together. Will take the generator
offline if a protection is tripped.
17
Below is the top most level of the Control Block. This gives a visual representation of how each of
the different subsystems are connected within the control block. Each subsystem will be discussed in
more detail and how each functions in regards to the generator spinning up and providing power to the
associated loads. The general steps of closing the MLC is that the criteria for the Underspeed must be
met first, then the criteria for Power Available subsystem, and finally the MLC Close Logic. This diagram
also shows the reset conditions block which is discussed in Appendix A.
Figure 12: Top View of Control Block
Underspeed: Criteria needed that will allow the generator to be excited. The generator cannot produce
power until it is spinning at a certain minimum speed, i.e. 4500 rpm.
Figure 13: Underspeed Logic Diagram
Available Power Logic: Criteria needed for the generator to have power available to deliver to the
aircraft. To have power ready: The pilot must have started the engine and the engine must have a
minumum input speed, the pilot has flipped on the generator control switch, and no protection has
tripped.
Figure 14: Available Power Logic Diagram
18
Main Line Contact Close logic: Criteria needed for the generator to actively power the respective
electrical channel by closing the MLC. The criteria is as follows: The pilot must have turned on the
engine, the generator is spinning fast enough to supply power (internal power ready), the GCS switch is
on, and the DP1 protection is false.
Figure 15: Main Line Contactor Close Logic Diagram
Once all these steps have been taken the MLC is closed and the generator is supplying the aircraft loads
of that channel. With the MLC closed and the Protections aspect functioning properly our model GCU
logic can now accomplish its main goal of voltage regulation.
Through the use of Matlab Simulink Model this report demonstrated four main
accomplishments. It shows the protection and command logic for one channel of an aircraft electric
power generating system. This simulation allows exploration of combinations of logic until proper
operation satisfies a customer’s system requirements. Also, the use of time delays ensured real life
hardware or software constraints to be understood. And finally, the results can now be utilized to write
the software necessary to execute the logic described.
19
References
Kyle Ives. Kyle Ives is a Systems Engineer at Hamilton Sundstrand with 6 years of industry
leading experience in designing, building, and testing aerospace power generation systems. Can
be reached by email at Kyle.ives@hs.utc.com
Title Page Generator Picture found http://www.hamiltonsundstrand.com.sg/culture/ace.html
Title Page GCU Picture found http://www.aeroprecision.com/Hamilton-Sundstrand.php
20
Appendix
Appendix A: Reset Conditions
Below are the criteria for Reset Cond. 1 and Reset Cond.2. These Reset Conditions allow the
pilot to clear any protection sensed by the GCU and resume normal generator function provided the
problem causing the protection to be tripped has been fixed.
Reset Conditions: Criteria that will reset the GCU and clear all tripped protections. The GCU is reset by
turning the generator control switch (GCS) from on to off and back to on. The Generator Control Switch
is a switch the pilot has direct control of in the cockpit. This switch is essentially the power switch for
the generator control unit.
Another aspect of the reset conditions is that the pilot also has access to the AC Reset Switch.
This switch clears only the UV and UF protections that might have been tripped during start up. This
switch allows the pilot the option to clear those two protections without hard resetting the GCU by
turning it off and then back on.
Figure 16: Reset Condition Diagram
Appendix B: Abbreviations
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
AC- Alternating Current
CMD- short for command
Cond- short for condition
DP- Differential Protection
EPGS- Electric Power Generation System
GCS- Generator Contact Switch
GCT- Generator Current Transformer
GCU- Generator Control Unit
LCE- Line Current Transformer
MLC- Main Line Contactor
21
11. POR- Point of Regulation
12. SLD- Single Line Diagram
Appendix C: This the actual model diagram of how the control and protections blocks interact. The
Purple blocks are “goto” blocks that are used for neatness of the model. The inputs are green with the
outputs colored orange.
Figure 17: Top Most view of Interaction of Control and Protection Block
22
Appendix D: Actual Top view of Protection Block. Each green block represents a protection subsystem.
Figure 18: Actual Top view of Protection Block
23