The As400 Power Control and Distribution Unit - A Modular and Flexible Unit With B2r Solar Array Regulation For High Power Leo Missions

This paper presents the ‘High Power’ Power Control and Distribution Unit (HP-PCDU) which has been designed as modular and generic equipment in order to cope with the growing power demand of Low Earth Orbit (LEO) missions. Next to the AS400 satellite platform of Airbus Defence and Space it will be used for the MetOp-SG satellites.The HP-PCDU supports unregulated bus voltages of 50V and 100V and provides a 30V secondary regulated power bus.Solar Array Regulation with Maximum Power Point Tracking (MPPT) is performed by Buck-Boost-Regulators (B2R) operated in a cold-redundant ‘N+1’ topology. A new FDIR strategy based on discrete hardware protections and FPGA-logic for autonomous failure handling is presented.Next to an outline of other power control and distribution functions this paper also includes a summary of the novel High Rate Diagnostics Mode that allows monitoring telemetry signals with a time resolution up to 200μs.


MOTIVATION
In a system study on New Modular and Flexible Power Systems for LEO Missions performed by ESA and carried out by Astrium (now Airbus Defence and Space), architectures and sizing of various existing and upcoming LEO missions have been analysed. As a conclusion of this study, Solar Array (SA) control by Buck-Boost Regulation (B2R) with MPPT has been identified as the most promising recurrent power architecture suitable for all LEO missions [1].
Following the results of this study, Airbus Defence and Space has defined the AS400 'High Power' LEO platform for which the AS400 PCDU has been developed as the key equipment of the Electrical Power System (EPS). The High Power PCDU extends the range of generic LEO PCDUs available from Airbus Defence and Space beyond the power class of the LEO PCDU EVO [5] for a Solar Array Power of more than 7kW, bus voltages of 50V or 100V and Maximum Power Point Tracking.

Figure 1. High Power PCDU in the configuration for MetOp-SG Satellite-A
During the design phase special attention was put on creating a modular and scalable product which can be used in a wide range of satellite and EPS configurations enveloping the following: x Unregulated Main Bus voltage adaptable to 50V or 100V (with an option down to 28V) x Solar Array power capability from 1000W to 7200W x Solar Array V OC up to 150V x Solar Array configuration with up to 11 individual MPPT groups x Battery Charge/Discharge current up to 110A x Provision of a secondary regulated power bus with 30V, providing up to 2500W with single failure tolerance x Provision of up to 124 Latching Current Limiters (LCL) with current capabilities ranging from 0.5A to 20A nominal trip-off current x Provision of up to 288 (nominal and redundant) switchable heater outlets x Provision of up to 72 (nominal and redundant) release initiator lines, configurable to drive either electro-explosive or heating device actuators.

PCDU ARCHITECTURE
In order to meet the required level of flexibility and scalability, a PCDU design based on individual modules has been chosen, allowing stacking the modules together in a very flexible way. In total six different module types have been defined, each covering a wide performance and functional range. System-UV Outputs 9 Switch-Off Line Inputs 9 DNEL-Trigger Inputs 9 Direct-On Command Inputs 9

BUCK-BOOST SOLAR ARRAY REGULATOR B2R
The Solar Array Regulator (SAR) based on B2R and a cold-redundant N+1 architecture is a key novelty of the High Power PCDU concept. By using a Buck power stage followed by a Boost stage, the converter input voltage (i.e. Solar Array Voltage) can be above or below the main bus voltage level [2]. The MPPT function is available in both domains.
Due to the wide main bus voltage range for which the HP-PCDU is designed, Solar Array regulation by B2R is the most flexible solution creating a high level of independence between the operational SA voltage range and the main bus voltage range.
Each Solar Array Regulator Module (SARM) contains two B2R regulators, each with individual input sections and individual MPPT-control.

Regulator Concept
The basic block diagram of a single B2R regulator is shown in Figure 5 below. Each regulator provides two inputs which can be used for independent SA sections. Each input line is protected by an electronic diode against short circuits at SA or harness level. An input protection formed by a latching current limiter (LCL) is used for SAR input filter charging during switch-on and separates the regulator in case of failure from its SA sections. The buck stage is formed by a standard buck converter using parallel N-channel MFETs for loss reduction and buck diodes. A dedicated hardware-based protection circuit detects any failure causing excessive losses (e.g. Linear Mode failure in FETs) and can isolate the regulator if necessary. It is followed by a standard boost converter.
To protect the main bus against any short circuit failure in the regulator a dedicated Reverse Current Protection (RCP) monitors the output current of each SAR. While in a pure buck or boost regulator the relations between voltages and currents at input and output are clear, the location of the highest current in a B2R configuration is not obvious. Therefore both input and output currents are monitored and limited if necessary by an internal control loop in order to control the maximum dissipation of the regulator. This leads to a maximum power envelop as shown in Figure 4 below.

Motivation and Trade-Off
During the definition phase of the High Power PCDU extensive trade-offs have been performed to identify the optimum redundancy concept for the SA regulation function. While in the past operation with classical two-out-ofthree redundant regulators has proven to be very robust due to its simplicity, the key drawback of this approach is the approximately 50% overhead in terms of EEEparts, mass and volume on top of the nominal demand.

Figure 6. Two-out-of-Three Redundancy Concept with common failure tolerant MPPT and failure tolerant power capability of two regulators
As a more mass and volume efficient concept, the N+1 redundancy scheme with segregated regulators operated in cold redundancy has been identified. It connects each group of SA sections to one single regulator and provides one single, common regulator for redundancy. Together with an individual MPPT function per regulator, this concept additionally allows better tracking granularity compared to the two-out-ofthree redundancy concept which needs to share a failure tolerant MPPT control for the group of three regulators.
In case of a failure in any of the nominal regulators, the failed one is disconnected from SA and Main Bus and the SA power is connected to the redundant regulator.
With an overhead of approximately (N+1)/N plus some extra hardware for failure detection and activation of the redundancy, it typically becomes more mass and volume efficient for N regulators. The obvious drawback of this architecture is the higher technical complexity necessary for detection and isolation of a failed regulator. Nevertheless, as the High Power PCDU is especially optimized to cope with a SA power of above 2kW and typically up to more than 7kW, the mass saving and higher system flexibility was found to be the dominating argument for the selection of this redundancy scheme.

3.2.2
Deviation Switch One of the most critical functions in the N+1 redundancy scheme is the switch-over between any nominal to the redundant regulator. Each B2R SAR contains a so-called 'Deviation Switch' downstream its input diodes which is able to connect the SA sections to a common power rail feeding the input of the redundant SAR. This failure tolerant Deviation Switch is formed by an antiparallel quad of MFETs. The FET drivers are supplied from the second regulator on the same module, therefore are able to activate the Deviation Switch fully independent of the state of its own SAR. In case of failure of the regulator, the Deviation Switch is activated and the failed regulator is disconnected from SA and power bus. The Deviation Switch can be activated by the internal hardware protection of the regulator, by an FPGA based health check or by external command. Its activation is fully reversible.

Failure Protection Strategy
3.3.1 FDIR Approach As already mentioned in the previous sections, the N+1 architecture in combination with Buck-Boost Regulation requires a higher complexity in PCDU-based Failure Detection, Isolation and Recovery (FDIR) compared to the two-out-of-three redundancy schemes. As a key requirement, and in order to achieve full compliance to chapter 5.7.2 of ECSS-E-ST-20C, the switching between any nominal SAR and the redundant one needs to be autonomously done by the PCDU itself.

3.3.2
Health Check The Health Check algorithm is implemented in both FPGAs of the DHSM. It case of hot redundant operation only one of them executes the function. The principle of the Health Check is to compare the behaviour of a pair of Solar Array regulators to each other and -in case of significant differences -activates the Deviation Switch of the regulator with the lower power output. This monitoring is continuously repeated for any definable pairs of regulators.
Before starting the comparison of regulators, two main conditions must be fulfilled: x The SAR must be in MPPT mode, i.e. taper charge with reduced SA power demand has not been reached x The total SAR input and output current must be above a minimum threshold, which means that the satellite is not in eclipse or abnormal illumination conditions Using High Data Rate Telemetry (see section 8) for input voltage and current, the FPGA calculates average values for the input power (without the typical MPPT tracking ripple). The input power figures of the pair of regulators are compared to each other. If the difference in power input exceeds a configurable delta for a predefined number of times, a failure in the regulator with the lower power is assumed and its Deviation Switch is activated by the FPGA.
In order to confirm a failure of the regulator and to exclude failures at Solar Array level, the same check is repeated between the redundant regulator and the healthy regulator of the original pair as well as between the redundant and the failed one.
If a failure in the regulator is confirmed, i.e. significantly better electrical performance is achieved by the redundant one, this configuration is kept and the health check is deactivated, otherwise the original regulator is reactivated.
The configuration of the PCDU (e.g. number of Solar Array Regulator Modules, regulator pairs for comparison etc.) and the health check threshold parameters are fully configurable.

B2R Module Options
In the baseline design, the SARM is built to cope with the maximum performance envelope defined for the High Power PCDU.
In order to optimize the module for missions with lower requirements, a number of options have been foreseen in the design.
These include for example: x For systems requiring only a buck-based regulation, the boost stage can be removed and bridged to reduce mass and improve the transfer efficiency. x The modules can be populated with EEE-parts of different voltage ratings in order to optimize cost and efficiency for each main bus voltage range.

B2R Typical Performances and Test Results
For performance testing and hardware characterisation, three EM modules of the B2R have been built, using flight-quality representative EEE-parts for the power cells. One module has been built in the 50V UMB version, another two in a 100V UMB version.
The figures below show the measured efficiency of one single regulator in the 100V UMB version over temperature, one with the output voltage at 100V and the other at 80V. As it can be seen, the BOL efficiency in typical operating areas is far above 96% and above 98% in the DET mode, when the input voltage is similar to the output voltage. A solid state battery separation switch made from 10 parallel N-channel MFETs is able to connect and disconnect the battery from the main bus during onground and in-orbit operations. It contains a currentlimited pre-charging function for connection of the battery to the main bus filter and an end-of-life (EOL) passivation function.
In order to activate the EOL passivation, two commands (Passivation Arming and Passivation Confirmation) must be sent through discrete communication lines. Once activated, the function inhibits Solar Array Regulation and interrupts the power transfer from Solar Array to Main Bus. The battery remains connected to the Main Bus and will consequently be fully discharged by the power demand of the satellite after the passivation has been initiated. Each of the two passivation commands acts on one series connected latching relay, which generate the internal passivation signal. This kind of passivation commanding is single-failure tolerant against unintentional activation but can be lost with one single failure (see ref. [6] for details).
The High Power PCDU can be launched in powered or unpowered configuration. In case of an unpowered launch, the battery switch is kept open for launch and the Solar Array regulation is inhibited. Once two of the three available separation straps have been pulled off after successful separation from the upper stage of the launcher, the battery switch automatically connects the battery to the main bus and activates the B2R modules.

30V REGULATOR MODULE
The 30V DC/DC Regulator Modules (DCDCM) are supplied by the unregulated main bus and generate a secondary regulated power bus distributed via a power rail to all other modules inside the PCDU. Each DCDCM contains two parallel buck-type converters operated in hot redundancy. The power capability of each buck converter is up to 750W peak in case one single DCDCM is implemented, but has to be limited for thermal reasons in case two or three modules are mounted. A maximum failure tolerant power capability of 2500W is available in the full configuration of the PCDU. The DCDCM is able to cope with the full voltage range of the unregulated main bus with one single electrical design thus provides a maximum flexibility for a wide range of applications.

POWER DISTRIBUTION MODULE
Next to the SA regulation the power distribution is typically the function of a PCDU which requires the highest flexibility and the one with the highest number of individual elements needed. Therefore special care was applied for definition and design of the Power Distribution Module (DISTM) in order to achieve a maximum in flexibility and configurability.
The DISTM of the HP-PCDU contains Latching Current Limiter (LCL) outlets and Heater Group outlets.
Depending on the required PCDU configuration, the power outlets can be allocated in three independent voltage groups with separated connectors, for which each can be either connected to the unregulated main bus (50V or 100V) or the regulated secondary bus (30V).
Four types of different LCLs are available on each module and can be configured as needed: x Standard LCLs with one single switching barrier with configurable trip-off currents between 0.5A and 12A and trip-off times up to 20ms x Safe-Off (SO-) LCLs with two independent switching barriers allowing to switch off the outlet even in case of one failure inside the LCL. Trip-off currents up to 5A are available. Additionally up to 16 LCLs with a trip-off current up to 20A can be implemented for specific mission needs.
Further on each DISTM includes individually switchable heater line outlets (1.5A / 2A max), protected by the upstream HG-LCLs.

DEPLOYMENT MODULE
In the maximum configuration the redundant Deployment Modules (DEPLM) can provide up to 72 (nominal and redundant) deployment actuator lines supporting both Electro-Explosive Devices (EED, driven by a current source) or Heating Device Actuators (HDA, e.g. thermal knifes driven by a voltage source).
To fire an actuator three independent barriers need to be activated: x A latching relay to select one output line x A latching Arming Relay, common for all outlets on the module x A common LCL protecting the main bus against short circuit failures in the deployment chain The firing pulse itself will be generated by a DC/DC converter which can be configured to act either as current or voltage source.

Overview
The high flexibility and configurability of the HP-PCDU product is a major driver also for the design of the PCDU-internal command and control elements and the related external communication interfaces. Using the HRDM the HP-PCDU can monitor critical analogue TM data with up to 5kHz and therewith creates plenty of new possibilities for spacecraft testing and operation, especially for failure investigation in orbit. As very interesting scenarios one could imagine e.g.: x Observe the inrush current behaviour of equipment supplied by the PCDU when switching LCLs or a function changing the internal consumption of the equipment x Monitor the Solar Array MPP tracking behaviour x Monitor pyro initiator current profiles during firing x Observe the voltage ripple or spikes on the main bus or detect current variations on a power outlet

CONCLUSION
This paper illustrates the functionality and the wide performance range of the High Power PCDU product developed by Airbus Defence and Space. The unit is implemented in the AS400 satellite platform and other LEO missions (e.g. MetOp-SG). Through its generic design approach with a very high scalability in terms of bus voltage, power and functionality it can be easily adapted to the need of many other missions, not only limited to LEO. It provides the following key advantages: x High scalability and flexibility, therefore simple adaptation without significant non-recurring development for various applications possible x Reduced risk and cost for the user due to highly recurring design x Application with a wide range of Solar Array designs and battery voltages possible, thus allows an efficient standardization also for these components x Functions unused for a specific mission can be efficiently removed or bypassed to fly only necessary hardware and avoid unnecessary risks This paper also outlines the novel concept of using B2R Solar Array Regulators in a N+1 cold redundancy scheme and explains the necessary protection features including a digital health check implemented in the central control FPGA of the unit.

ACKNOWLEDGEMENT
The Buck-Boost Solar Array Regulator described in this paper was developed in the frame of a GSTP-program under contract 4000112434/14/NL/LvH. The authors of this paper wish to thank Mr. Olivier Mourra and Mr. Ferdinando Tonicello of ESA ESTEC for their support in the execution of this project and the fruitful technical discussions.