Fault tolerant control of a three‐phase PMSM by limiting the heat of an inter‐turn fault

Projekt DEAL Open access funding enabled and organized by Projekt DEAL Abstract Inter‐turn faults are most commonly the initial stator winding fault in power trains with Voltage Source Inverters. Without counteractions, these faults can propagate and cause catastrophic failures in safety critical applications like all‐electric aircraft. The propagation of an inter‐turn fault can be reduced, by limiting the local temperature at the fault. In this article, a fault tolerant control scheme is designed and validated, which reduces the heat of an inter‐turn fault by a controlled adaption of the operating point. The control strategy utilizes the hyperbolas of constant torque and the controller design is based on a linear time‐invariant system description. A machine learning regression is used for the online heat estimation and a 3D lumped‐parameter model to evaluate the thermal effectiveness. To test the control scheme, an inter‐turn fault is actively switched, which generates the local heat equal to 13% of the overall stator copper losses. The control scheme adopts the operating point within 30 electric periods, which reduces the generated heat of the inter‐ turn fault by 70%. This causes a temperature reduction at the fault locally from 367°C to 175°C, which extends the approximated insulation life from 30 s to 5000 h.


| INTRODUCTION
Inter-turn faults are often the initial stator winding fault and can propagate to more severe phase-to-phase or phase-toground faults, if no counteraction is performed [1]. Interturn faults are caused by the degradation of the insulation, which results from thermal, electrical, mechanical and environmental stresses [2]. According to [3], the stator winding accounts for 37% of all motor failures. Especially for safety critical applications like all-electric aircraft, it is essential to fulfil the current load cycle without a catastrophic failure [4]. Therefore, a fault tolerant system with the ability that a fault in a component or sub-system does not lead to a system failure is required [5]. In the considered context, the fault tolerant control aims to reduce the propagation of an inter-turn fault, in order to prevent a machine failure. Fault tolerant control of permanent magnet synchronous machines (PMSMs) with inter-turn faults was already addressed in previous works.
The authors in [6] developed a fault tolerant control, to reduce the torque ripple caused by an inter-turn fault. A modified reference current is injected, in order to generate a constant output torque. However, the effect on the fault current is not taken into account and therefore, the propagation of the interturn fault is not reduced. A fault tolerant control to compensate the speed and torque ripple in a combined approach, is presented in [7], by utilizing a repetitive controller. Since the authors propose to disconnect the faulty phase from the power supply, the faulty phase cannot actively weaken the induced voltage of the shorted turns. The severity of the inter-turn fault is not considered and thus, the fault can propagate without subsequent counteractions. In [8], the author introduces a normalized quantity, to calculate and to observe the severity of the fault. If an inter-turn fault is detected, the fault current is actively minimized by fluxweakening. The approach is developed for PMSMs with a characteristic fault current ψ PM =L d below the maximum phase current i max . Therefore, the approach is not suitable for highly utilized machines with ψ PM =L d > i max . A thermal analysis is performed with a 2D lumped-parameter model, consisting of 5 bodies. Since the local temperature rise of an inter-turn fault strongly depends on the detailed fault position, this model is not suitable for a solid analysis of the thermal behaviour. A mitigation technique for machines with negligible mutual phase inductances is proposed in [9], by analysing the effect of different current angles. A method to reduce the fault current is described, by limiting the rotational speed and torque in combination with flux-weakening. The corresponding control scheme to apply the described method is missing and thus, there is no adaption of the operating point shown. Also, the fault location within the stator winding is neglected for the thermal simulations. This means that the thermal effectiveness of the mitigation technique cannot be determined accurately. In [10], the authors reduce the fault propagation, by modulating the magnetic flux instead of flux-weakening. The derivative of the flux is limited to a given value, which is obtained by a non-specified machine diagnostic. The fluxmodulation enables safe operation in case of a fault, but also causes increased torque oscillations, which further stresses the machine mechanically. A current injection technique is presented in [11]. The fault current is limited more effectively compared to flux-weakening and no increased torque oscillations occur. The calculation of the injected phase currents is based on a flux linkage estimation of the faulty phase and directly aims to minimize the flux linkage of the shorted turns. However, the proposed method is not suitable for single three-phase PMSMs and relies on a triple three-phase stator winding. In [12], we present a fault tolerant control scheme for PMSMs with distributed windings and a characteristic fault current, which is larger than the maximum phase current. The principle of a controlled adaption of the operating point is shown with simulation results, which illustrates the reduction of the generated heat of an inter-turn fault. The heat estimation within the simulation environment is performed with a machine learning approach and the thermal effectiveness is analysed with a 3D Finite Element Method (FEA) model for individual operating points.
In this article, we extend the approach presented in [12] by a thorough analysis for the subsequent validation at the test bench. The limitation and accuracy of the heat estimation are evaluated for the test bench operation and the performance of the fault detection is discussed. The insulation life is approximated with the assumption of an exponential degradation, due to the arising thermal stress. The temperatures are analysed with a new developed 3D lumped-parameter model, which also enables an efficient simulation of temperature profiles. The interaction within the control scheme is described analytically and the design of the control parameters is presented. For the training data of the heat estimation, a novel approach to combine measurement data with FEA data is introduced. Finally, the test bench setup is introduced to validate the tolerant control scheme with measurement results and the corresponding thermal impact is evaluated.

| MACHINE ANALYSIS
In this section, the effect of inter-turn faults on the electric and thermal behaviour of PMSMs is introduced. The focus is on PMSMs, since they offer the highest power density and efficiency compared to other electrical machines.

| Electric behaviour
Inter-turn faults cause a circulating fault current, which generates the local heat at the contact resistance: The severity of the fault is determined by the number of shorted turns w F and the fault resistance R F . In addition to the characteristics of the fault, the fault current also depends on the operating point, which is defined by the currents i d and i q and the rotational speed n. The local heat P F can be expressed by a function f : Furthermore, the fault current reduces the average electromagnetic torque � T and causes a distinct second harmonic 2 T . Compared to the nominal power of the machine, the scope of the generated heat P F is neglectable small and the impedance of the shorted turns is much smaller than the considered resistance R F . Therefore, the effect off the interturn fault on the electromagnetic torque is not further considered within the control scheme.
The basic machine analysis of the electric behaviour was performed with a lumped-parameter model, which we presented in [13]. The electric circuit of this model is shown in Figure 1a with an inter-turn fault in phase Ph1. The cross section of the analysed PMSM with the corresponding winding scheme is shown in Figure 1b. The inter-turn fault equals a stationary asymmetry in the stator winding. It can be derived analytically that this asymmetry causes second 2 v dq and fourth 4 v dq harmonics in the dq-voltages, which indicate the severity of the fault [14]. The fault estimation is based on the second harmonics, since they are more distinct than the fourth harmonics. Figure 2a shows the fault current I F in proportion to ψ PM =L d over the amplitude 2 b v q in proportion to 1 The fault currents are shown for w F ¼ 1; 2; 3 f g and R F ¼ 0 Ω; …; ∞ Ω f g at the nominal operating point. The maximum fault currents occur for R F ¼ 0 Ω and slightly differ due to the different ohmic resistance of the shorted turns. It can be seen that the fault currents cannot be determined by the amplitude 2 b v q uniquely and individual combinations of w F and R F lead to the same fault current. Figure 2b shows the generated heat P F in proportion to the stator copper losses P Cu over the amplitude 2 b v q . The fault parameters and operating point are equal to Figure 2a. An inter-turn fault starts to develop from a large fault resistance. As the fault propagates, the fault resistance decreases and the generated heat increases until the fault resistance is equal to the ohmic resistance of the shorted turns. Subsequently, the generated heat decreases and if the fault resistance is R F ¼ 0Ω, the generated heat locally at the fault is also P F ¼ 0 W. In this theoretical case, the fault current would only generate heat by the ohmic resistance of the shorted turns. The focus of this manuscript is on the early stage of inter-turn faults, which is essential to enable fault tolerant operation. In this stage, the fault resistance is much larger than the impedance of the shorted turns and the approximation with the black dashed line is valid. This approximation is independent on the numbers of shorted turns and the rotational speed. The second harmonic of v d shows an equivalent correlation to the fault current and generated heat as the amplitude 2 b v q , with the difference of reduced maximum values of the amplitudes.

| Thermal requirement
The generated heat P F causes a temperature rise at the fault locally. This temperature rise must be limited, in order to reduce the propagation of the inter-turn fault [2]. Especially safety critical applications must be able to fulfil the current load cycle without a failure of the machine. To prevent an instant breakup of the insulation, the maximum temperature at the fault ϑ F;max is defined equal to the minimum heat shock temperature of the magnet wire. The minimum heat shock temperature is defined as 20K above the Temperature Index (TI), which equals the thermal class rating. The corresponding test stresses the magnet wire thermally and physically and measures the capability to withstand the cracking of the insulation [15]. The approximated insulation life LðϑÞ due to the arising thermal stress is calculated according to [16]: With the exponential degradation, an approximated insulation life of 5000h is obtained for the operation at heat shock temperature, considering a reference insulation life of L 0 ¼ 20000h at the thermal class rating and a Halving Index (HI) of 10 K. Thus, the quantities L 0 , TI and HI specify the thermal robustness of an insulation system and can be obtained by the corresponding data sheet. It would also be possible to choose a higher maximum temperature at the fault, but the degradation is a very complex chemical process and depends on the insulation material composite. This can lead at certain temperatures to a sudden increase of the degradation process [17], which is not part of the exponential approximation. Therefore, the minimum heat shock temperature is chosen for a more general approach to define the thermal requirement and the exponential degradation is regarded as a best-case scenario. The limit value P � F for the fault tolerant control is calculated by: Therein, ϑ F;max denotes the maximum allowable temperature at the fault and ϑ F;nom denotes the temperature at the fault during nominal operation with zero generated heat. The thermal analysis showed that the temperature at the fault increases proportional to the generated heat. Therefore, the constant β F is introduced to describe the temperature rise caused by 1W of generated heat. This value primarily depends on the machine geometry and the fault location. The thermal 3D lumpedparameter model presented in [18] is used to calculated β F . The model consists of 720 bodies and can take the generated heat of an inter-turn fault at any location within the stator winding into account. If the inter-turn fault is located in the centre of the active material and close to the stator yoke, β F is for the analysed machine equal to 3 K W . If the faults location is in the centre of the end windings, β F increases to 13 K W . Since the F I G U R E 1 Analysed three-phase permanent magnet synchronous machines with the corresponding winding scheme F I G U R E 2 Fault current and generated heat for control scheme cannot determine the physical location of an inter-turn fault, a worst-case estimation is used to determine the target value of the maximum allowable heat P � F . Thus, the fault location is assumed in the centre of the end windings, where the thermal path to the stator housing is the longest.

| FAULT TOLERANT CONTROL SCHEME
The fault tolerant control scheme is shown in Figure 3. During healthy operation, the Maximum Torque per Ampere (MTPA) approach transfers the target torque T � into the target currents i � d and i � q . The high dynamic current controller introduced in [19] forwards the target voltages v � d and v � q to the Voltage Source Inverter (VSI). The measured currents and voltages are transformed into the dq-reference frame and forwarded to the frequency analysis. The fault detection and estimation then utilizes the average currents � i d and � i q and the amplitude of the second harmonics 2 b v d and 2 b v q . If the fault detection classifies an inter-turn fault, the target currents are determined by the fault control strategy.

| Frequency analysis
The frequency analysis is based on the Discrete Fourier Transformation (DFT) [20]: This equation calculates the complex Fourier coefficient X ðkÞ of a time vector xðnÞ with N elements, by processing a sum with the same number of elements. A recursive implementation is used, in order to reduce the computational effort of the algorithm: This equation results from (5) and computes the amplitude of the k-th frequency for the time step t 0þ1 using the results from the previous time step t 0 . To obtain only positive frequencies, the negative ones are mapped onto the positive ones, which results in the multiplicative factor 2. The sampling frequency f S;DFT of the time vector is equal to the switching frequency of the inverter f SF and the calculation of (6) is performed for every new sample.

| Fault diagnosis
The fault diagnosis includes the fault estimation and fault detection and can be separated into model and data based approaches [21]. In [22], the authors present a model based fault diagnosis, whereas the authors in [23] focus on a data based approach. The accuracy of a model based approach strongly depends on the used model and the computational effort increases with the models complexity. Therefore, a more robust and efficient data based approach is developed especially for the fault diagnosis of the fault tolerant control.

| Fault estimation
For the fault estimation, a Support Vector Machine (SVM) regression is used. Compared to an Artificial Neural Network (ANN), the SVM offers significant advantages for the implementation in this use case. The SVM inherently reduces the problem of over-fitting [24] and is more efficient for a smaller amount of data [25]. Furthermore, the interpretation of an ANN is very complicated [26], which is a drawback for the implementation in safety critical applications. The formula to calculate the estimated heat P F;SVM is derived from [25] and given by: Therein, x is the input vector, α n and α � n are Lagrange-Multipliers, which define the support vectors of the regression and the offset is given by b. The input vector includes the currents � i d and � i q , the rotational speed n and the amplitudes 2 b v d and 2 b v q . Measurement results show that the second harmonics 2 b v dq also exist during healthy operation, which is caused by asymmetries due to the non-ideal manufacturing process. Theses harmonics depend on the rotational speed n and must be taken into account for the fault estimation. The temperature of the machine is not necessary for the estimation, because it does not affect the asymmetry. The fault estimation currently uses the measured phase voltages. Alternatively the target voltages v � dq can be used to determine the harmonics 2 b v � dq , which also indicate the severity of the fault. Since there is a difference among the target voltages and the terminal voltages of the PMSM, a model of the VSI must be taken into account. To generate the training data for the SVM, a combination of measurement and FEA results is used. The harmonics 2 b v dq must be initially determined during healthy operation and can be merged with FEA results, to emulate the operation of the physical machine with different inter-turn faults. This procedure allows an implementation of the fault estimation without measurement results for different inter-turn faults. To combine the measurement and FEA results, the harmonics are split into their real and imaginary part: 2v d ¼ ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi The harmonic parts 2 v dq;re;H;mes and 2 v dq;im;H;mes for the healthy operation are determined by measurements and the harmonics parts 2 v dq;re;F;FEA and 2 v dq;im;F;FEA for faulty operation are determined by FEA simulations. Figure 4 shows the comparison between measurement and combined results for the maximum severe inter-turn fault of the test bench.
The amplitude 2 b v d is shown in Figure 4a and the amplitude 2 b v q is shown in Figure 4b. It can be seen that there is a good accordance among both results and therefore, the training data are generated with the combined approach. For the data set, the currents i d and i q are chosen equally spaced with 0:1 ⋅ i max , for amplitudes of the current vectors within the circle of maximum current. In general, the minimum amount of variables to define a quadratic function is equal to three. Therefore, three different fault severities are used to train the SVM, since also a quadratic Kernel function is used. The healthy operation is used for zero severity and two inter-turn faults along the approximation of Figure 2b are used for a medium and severe fault. In total, the training data consist of M ¼ 270 different scenarios, which results from 90 dq-currents and 3 fault severities. The RMS value of the generated heat over all scenarios is 10 W. The RMS error is used to evaluate the difference between the predicted values b y m and observed values y m : e RMS ¼ ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi If the training data is used to train the SVM and to determine the RMS error, this results in e RMS ¼ 0:8W. To evaluate the performance of the SVM on the test bench, measurement data is used for the observed values instead of the training data. Due to the difference between both data sets, a reduced accuracy with e RMS ¼ 1:3W is obtained. If necessary, the resulting difference of 0:5W could be further reduced by improving the FEA model, utilizing measured BH-curves and taking skin and proximity effects into account.

| Fault detection
The fault detection is implemented with a decision tree, based on the fault estimation. The fault detection classifies an interturn fault, if the estimated heat P F;SVM exceeds the predefined limit P � F for a duration of 2T el , which equals the time delay T D from (13). The time delay is introduced to avoid false alarms due to disturbances and therefore, the fault detection time is independent of the faults severity. During a disturbance or a transition period below the duration of T D , the new classification C t 0þ1 is determined by the previous classification C t 0 . The resulting process is noted by: This means that a state must be constant for 2T el to impact the fault detection, otherwise the previous classification maintains. The fault detection offers an inherently high detection performance, since the predefined limit P � F is larger than the accuracy of the fault estimation. Missed or false detections can occur, especially if the estimated heat is close to the limit value. A missed detection occurs on the hand, if the generated heat is greater than the predefined limit, but the estimated heat does not cause a classification due to the corresponding accuracy. A false detection occurs on the other hand, if the generated heat is below the predefined limit, but the estimated heat exceeds this value. Both scenarios have a neglectable impact on the resulting operating point, since the generated heat is in the area of the acceptable limit with e RMS ¼ 1:3W. If the fault propagates, the generated heat increases and a missed or a false detection can become a true detection. Therefore, the detection performance increases with an increased severity of the fault. A false detection can also occur, if another fault creates an equivalent fault signature as an inter-turn fault. For example phase-to-phase or phase-toground faults also generate second harmonics in the dqvoltages. To distinguish these faults, the phase angle of the harmonic voltages must be considered, which is not in the scope of this article. The generated heat of an inter-turn fault FOITZIK AND DOPPELBAUER -5 depends according to (2) on the operating point and on the fault combination. This means that for example an increased speed can cause the classification of an inter-turn fault, since the induced voltage of the shorted turns increases. For a given fault resistance, the generated heat increases with an increased number of shorted turns according to Figure 2b. An inter-turn fault starts to develop from the faultless case, which means conversely that for an increased number of shorted turns a larger fault resistance is sufficient to exceed the predefined limit P � F . The limit value is reached for the analysed machine with one shorted turn, if the fault resistance is equal to R F1 ¼ 15R T , whereas R T is the ohmic resistance of a single turn. Since the generated heat is approximately proportional to the squared number of shorted turns, the fault resistance must be equal to R F2 ¼ 4R F1 for two shorted turns and equal to R F3 ¼ 9R F1 for three shorted turns.

| Fault control strategy
If the fault detection classifies an inter-turn fault, the target currents i � dq are determined by the fault control strategy according to Figure 5a. The resulting fault tolerant operating point is unknown, since the fault combination cannot be determined online. The input of the control scheme is the target torque and the speed is determined by the application, according to specific torque-speed curve. The mechanical time constant is assumed to be much larger than the time constant of the fault tolerant control. Therefore, abrupt variations of the load or the speed are not considered during the adaption of the operating point. If both time constants are in the same range, the fault tolerant control must be inactive during nonstationary conditions.
For PMSMs with ψ PM =L d > i max the minimum heat P F is generated, if the maximum current is used for field weakening, as shown in Figure 5b. To reduce the generated heat and to maintain the target torque, the operating point moves in a first step along the hyperbola of constant torque from point 1 towards 2, utilizing the lookup table i � q ¼ LUTðT � ; i � d Þ, which considers the non-linear magnetic circuit. If the estimated heat is still greater than the maximum acceptable heat, the operating points moves further along the circle of maximum current from point 2 towards 3, utilizing the equation i � q ¼ ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi ffi . Figure 5b shows the generated heat of the inter-turn fault with w F ¼ 3 and R F ¼ 100 mΩ for the operation at half and full nominal speed, with a quadratic correlation between generated heat and speed. For the presented machine, the generated heat can be reduced at constant speed and torque by 25%, if the operating point is shifted from 1 to 2. If the maximum current is used for field-weakening, the generated heat can be reduced at constant speed in total by 75%. In this case, the output torque is equal to zero and the fault tolerant control only limits the propagation of the fault. Due to the permanent magnets in the rotor, the generated heat can only be equal to zero, if the rotational speed and the output torque are also equal to zero.

| Controller design
The control scheme shown in Figure 6a is used to adjust the current i � d until the estimated heat P F;SVM equals the target value P � F . The current i � q is calculated by i max , i � d and T � , as shown in Figure 6b.
To design the controllers, the system performance is analysed at first. The system behaviour G ITF ðsÞ of an inter-turn fault is modelled with a proportional element PðsÞ and a delay element DðsÞ: The input of G ITF ðsÞ is the target current i � d and the output is the estimated heat P F;SVM . The gain k F is approximated for the two segments along the hyperbola and circle: The time delay T D is determined by the frequency analysis and the transient behaviour of the PMSM. The fundamental component of the electric frequency f el is used for the windowing. Thus, the minimum time delay to determine the second harmonics 2 b v dq after a load step is the sum of one electric period T el and the settling time of the transient voltages. Since the settling time depends on the load step and is always less than one electric period, a fix time delay T D ¼ 2 ⋅ T el is defined for the system G ITF ðsÞ. To ensure a constant operating point during this period, also the sampling time of the controllers is set to T S;C ¼ 2 ⋅ T el . The transfer function G ITF ðsÞ is due to the different gains along the hyperbola and circle dependent on the current segment. To achieve an closed-loop behaviour, which is independent on the current segment, two separate heat controllers G C;hyp ðzÞ and G C;circ ðzÞ are used for the implementation. The general transfer function of the used discrete PI-controllers is given with the backward Euler method by [27]: Therein k P is the proportional gain and k I is the integral gain. The inter-turn fault is in a real-world application timevariant and starts to develop from a low severity on. To ensure a stable control for different fault scenarios, the two controllers are tuned for the maximum severe inter-turn fault of the test bench. This results according to (14) in the coefficients k F;hyp ¼ 0:5 and k F;circ ¼ 2:5. These values are for less severe inter-turn faults smaller, which is why they do not downgrade the stability of the closed-loop system. A robust control behaviour is considered with the phase margin φ mar ¼ 90°and the gain margin G mar ¼ 15dB, which results in a bandwidth equal to 3Hz at nominal speed. The control parameters are obtained with the Bode diagram of the open loop system. For G C;hyp ðzÞ the parameters are k P;hyp ¼ 0:2 and k I;hyp ¼ 8 and for G C;circ ðzÞ the parameters are k P;circ ¼ 0:04 and k I;circ ¼ 1:6. The step response of the closed-loop system is shown in Figure 7a. The rise time is equal to 560ms for both segments G cl;hyp and G cl;circ . In a real-world application, an inter-turn fault starts to develop from the faultless case with an increasing severity. Figure 7b shows the output of the close loop system for two different temporal developments of an inter-turn fault. For the time-variant scenario, the inter-turn fault develops linear within 1s from zero to full severity. For the time-invariant scenario, the full severity of the inter-turn fault occurs at t ¼ 0s. The target value P � F is reached by 90% for the time-invariant fault after 520ms and for the timevariant fault after 1:25s. Therefore, the time-invariant fault forces an increased controller response and is critical for the stability of the fault tolerant control scheme.

| TEST BENCH
This section describes the setup of the test bench, which was built to validate the developed fault tolerant control scheme. Furthermore, the machine parameters, measurement results and thermal effectiveness are presented and discussed.

| Setup
The test bench includes the inverter cabinet and the machine bed as shown in Figure 8a. Figure 8b shows a diagram of the test bench setup. The DC-link voltages of the machine inverters are provided by an active front end and a buck converter with U DC1 ¼ 250V and U DC2 ¼ 150V. The switching frequency of the machine inverters is f SF ¼ 10 kHz. The cabinet also includes the Fault Switching Device (FSD), which can actively switch individual inter-turn faults and can measure the fault current I F . The contactor LEV200A5ANA from Tyco Electronics is used to switch an inter-turn fault with a low contact resistance. For a self-contained operation, the signal processing of the test bench is additionally included in the cabinet. A System on Chip (SoC) device is used from the Zynq-7000 family, which is described in [28]. The combination of an ARM-Cortex A9 processor with an Kintex-7 FGPA allows an efficient implementation of the control algorithms. The time consumption for a single calculation of the complete control scheme is about 40 μs. The Device Under Test (DUT) and the Load Machine (LM) are mechanically connected on the machine bed. Figure 8c shows the DUT with access to individual turns of phase Ph1 and Ph2, which are connected to the fault switching device.

| DUT machine parameters
The number of slots per pole per phase is two, the number of pole-pairs is two, the number of slots is 24 and the number of phases is three. A distributed stator winding is used and within the slot the winding is random. The DUT is built with the ohmic phase resistance R Ph ¼ 460 mΩ, the inductances L d ¼ 3.9 mH and L q ¼ 6.9 mH and the permanent magnet flux linkage ψ PM ¼ 158 mV s. The nominal operating point is defined by T nom ¼ 8 N m and n nom ¼ 1500 min −1 . The fault switching device can actively short circuit 1,2 or 3 turns with the fault resistances 100 mΩ, 140 mΩ or 190 mΩ. The copper magnet wire has the thermal class F with the heat shock temperature ϑ HS ¼ 175°C. During faultless nominal operation, the temperature at the worst-case fault location is ϑ F;nom ¼ 82°C. According to Section 2.2, the minimum heat shock temperature equals the maximum allowable temperature with ϑ F;max ¼ 175°C. Thus, the maximum allowable heat results from Equation (4) with P � F ¼ 7W.

| Fault tolerant control
To validate the fault tolerant control, the inter-turn fault with maximum severity w F ¼ 3 and R F ¼ 100 mΩ is switched on at nominal operation. The estimated heat exceeds the maximum allowable value at t ¼ 0 s and after 2T el the fault detection activates the fault control strategy. Figure 5b already shows that it is feasible to adapt the currents i d and i q in order to reduce the generated heat to the target value P � F ¼ 7W. It also can be seen that the fault tolerant operating point can only be reached at nominal speed for this severe inter-turn fault with a reduction of the output torque. Figure 9a shows the dq-currents over the time t.
Until the fault control strategy is enabled, the machine operates at the MTPA point with i d ¼ −4.5 A and i q ¼ 15.7 A. It can be seen that every operating point is constant for two electric periods, which equals the specified delay time t D ¼ 2T el ¼  Figure 4. It can be seen that after each load step the harmonics need more than one and less than two electric periods to settle. This is due to the windowing of the DFT calculation and the transient behaviour of the DUT. Figure 12 shows the calculated heat P F;RMS by the RMS value of the measured fault current and the estimated heat P F;SVM .The estimated heat is further divided into the transient and discrete SVM regression. The input vector of the transient regression contains the calculations of (6) with f S;DFT ¼ 10 kHz, equivalent to the signals of Figure 11b and cannot be processed without filtering. Since every operating point is constant for two electric periods, each final value of this time frame is used to determine the discrete SVM out of the transient SVM. Therefore, the estimated heat P F;SVM is set equal to the discrete SVM. The transient regression exceeds at t ¼ 0s the limit value. Subsequently, the interturn fault is classified after 2 T el and at the same time the fault tolerant control is activated. The measured heat P F;RMS and the estimated heat P F;SVM are at the nominal operating point equal to 23W. The maximum deviation can be evaluated at the end of every constant operation point. This occurs at t ¼ 12 T el with the measured heat P F;RMS ¼ 15.3 W and the estimated heat P F;SVM ¼ 18.1 W, which equals the difference of ΔP F ¼ 2:8W. The target heat P � F is reached by 90% after 560ms and by 100% after t ¼ 30 T el ¼ 600 ms, which results in a heat reduction of the inter-turn fault by 16 W. The deviation at the fault tolerant operating point is maximum ΔP F ¼ 0.2 W. Due to the robust control parameters of the two heat controllers, there is no overshooting. The profile of the estimated heat is equivalent to the output of the closed-loop system for the time-invariant fault in Figure 7b. This underlines the analytical description of the system performance and the controller implementation. The impact of the fault tolerant control on the performance of a specific application depends on the correlation between the torque and speed of the load. Due to the broad variety of possible correlations, an application with constant speed was considered for the measurement results. For an aircraft application, a quadratic correlation between the torque and speed can be assumed, as described by a fan curve. In this case, a torque reduction would lead to a speed reduction. Since a speed reduction also reduces to the induced voltage of the shorted turns, the generated heat would also be reduced. Therefore, the target value P � F is reached with an increased output torque compared to an application with constant speed. The fault tolerant operating point is given for the fan curve load by a speed of 1200 min −1 and an output torque of 6:5 N m. Since the mechanical time constant is assumed to be much larger than the time constant of the fault tolerant control, the control scheme reduces the output torque to 2 N m in a first step. As the rotational speed decreases according to the mechanical time constant, the output torque subsequently increases until the fault tolerant operating point is reached.

| Thermal impact
The temperature profiles of the DUT are simulated with the 3D lumped-parameter model. Thermal measurements are with the presented setup not feasible, since the heat is generated in the fault switching device and not in the stator winding of the DUT. An outer stator housing temperature of 65°C is assumed. The copper losses P Cu are dominant compared to the iron losses P Fe . At nominal operation, the copper losses are 184 W and increase to 276 W at maximum current. The iron losses are 13 W at nominal operation and decrease to 4 W at the fault tolerant operating point due to the flux-weakening. The temperatures over the time t are shown in Figure 13. The machine operates until 750 s at the nominal operating point without an inter-turn fault. Thereafter, the fault with maximum severity is active and the difference between the nominal and fault tolerant operating point is visible. It can be directly seen that the thermal time constant is much greater than the time constant of the heat controllers, which justifies the focus on a robust closed-loop behaviour rather than on an increased bandwidth. During healthy and nominal operation, the average temperature is ϑ avg;nom ¼ 74°C and temperature at the fault is ϑ F;nom ¼ 82°C, caused by the increased thermal path to the cooling system. If there is an inter-turn fault with w F ¼ 3 and R F ¼ 100 mΩ and the operating point is not adopted, the average temperate increases to 108°C and the temperature at the fault to 367°C. Therefore, the temperature ϑ F is increased by 192K compared to the thermal class rating. With the exponential degradation according to Equation (3), this would result in a insulation life of 30 s, which is not acceptable for safety critical applications. At the fault tolerant operating point the temperature at the fault is ϑ F;ft ¼ 175°C, which is equal to an insulation life of 5000h. Also the average temperature decreases to ϑ avg;ft ¼ 94°C, although the overall losses in the stator winding are increased. This is due to the fact, that the copper losses are distributed more equally in the stator winding and therefore, the heat can be conducted more efficiently.

| CONCLUSION
We are able to validate the proposed fault tolerant control scheme with the measurement results. A failure of the machine is prevented by limiting the local temperature of an inter-turn fault. The resulting benefit for the insulation life is approximated with an exponential approximation of the degradation process. Since the location of the fault is unknown, a worst-case estimation is used. This assumption could lead to torque reduction, although the actual temperature at the fault is due to a more beneficial location below the limit. A thermal 3D lumped-parameter model is used to determine the equivalent target heat for the heat controllers. A machine learning approach is used to estimate the heat for every individual operating point. The SVM regression is trained with a combination of measurement and FEA results. Thus, the approach does not rely on measurement data with inter-turn faults. For the controller design, an approximated system description is used and the time delay is defined as twice the electric period. Since the resulting fault tolerant operating point is unknown, two separate controllers are used to adapt the operating point along the hyperbola of constant torque and the circle of maximum current, to satisfy the thermal requirement. The measurement results show that the target heat is reached without overshooting. The corresponding thermal analysis proves that the temperature at fault is limited to the heat shock temperature and the thermal time-constant is significantly larger compared to the controller bandwidth. Due to the efficient implementation of the control scheme and the advanced setup of the training data, the presented approach is besides all-electric aircraft applicable for a broad variety of safety critical applications.

ACKNOWLEDGEMENT
Open Access funding enabled and organized by Projekt DEAL. WOA Institution: N/A Blended DEAL: Projekt DEAL.

DATA AVAILABILITY STATEMENT
The data that support the findings of this study are available on request from the corresponding author. The data are not publicly available due to privacy or ethical restrictions.