Protection Coordination for Reliable Marine DC Power Distribution Networks

This paper presents demonstration of a protection scheme integrated into marine DC power distribution networks to investigate the coordination between each protection action. The integrated protection scheme is based on three different time-frame protection actions: fast action - bus separation by a solid-state bus-tie switch, medium action - feeder protection by high-speed fuses, and slow action - power supply protection by generator deexcitation. As the backup protection of the power supply protection, AC fuses are installed between generators and rectifiers. To coordinate each protection action, the influences of the inductance in the bus-tie switch and the DC-link capacitance are investigated by DC short-circuit tests with the different inductance and capacitance values. The protection scheme, coordinated by the above investigation, is verified by system-level short-circuit tests for bus and feeder faults. To validate the protection scheme for various fault conditions, low- and high-impedance fault currents are analytically calculated for the bus faults and simulated for the feeder faults. Time-current curve analyses show that the coordinated protection scheme can effectively protect marine two-bus DC power distribution networks with correct operations of the protection measures and enough time margins between the different actions.


I. INTRODUCTION
The marine sector has endeavoured to mitigate its impact on global warming, targeting to cut down energy consumption by 30% by 2025 from the level in 2004 [1]. Since 2013, as one of the solutions to achieve the goal, low-voltage DC (LVDC) technologies have been employed into commercial marine power distribution networks (PDNs) with their outstanding benefits: fuel savings with utilisation of variable-speed generation systems, easy integration of energy storage systems, weight and footprint reduction in electrical installations, and optimisation of running engines by closed-bus operation [2]- [6].
Currently, several industrial manufactures are the main players to push the market forward with their DC solutions, as summarised in Table 1. The protection schemes of the DC solutions are commonly composed of three-different time frame protection actions (three-level protection in the paper): The associate editor coordinating the review of this manuscript and approving it for publication was Dragan Jovcic .
• fast action (the first level) -bus separation by solid-state bus-tie switches (SSBTSs) (up to several tens of microseconds) • medium action (the second level) -feeder protection by high-speed fuses or solid-state circuit breakers (SSCBs) (up to a few milliseconds) • slow action (the third level) -power supply protection by generator deexcitation, fold-back protection control, high-speed fuses, or SSCBs (up to several seconds). When the feeder fault occurs in Fig. 1, the SSBTS rapidly separates the DC buses in a range of several tens of microseconds (fast action). After that, the high-speed fuse on the faulty feeder isolates the fault from the system in a few milliseconds (medium action). As the last action, the power supply protection eliminates the fault contribution of the generator for the feeder protection failure or the DC bus fault (slow action). The power supply protection is strongly linked to the rectifier type. In case of a diode rectifier, deexcitation of a synchronous generator, specially designed to have high subtransient reactance (X d ), is used to limit the fault VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ TABLE 1. Marine LVDC solutions and their protective devices [7]- [10]. Whereas a synchronous generator (SG) is combined with all rectifiers, a permanent magnet synchronous generator (PMSG) is only coupled with a voltage source converter (VSC) due to the lack of its excitation control.
current from the generator [11]. The amplitude of an initial DC fault current can be mitigated by the high subtransient reactance value. A generator protection unit, on the other hand, removes the excitation for eliminating the fault current generated from the generator when the overload condition is detected. A thyristor rectifier can manage the fault current by forcing the firing delay angle (e.g., around 120 • , called fold-back protection control) [12], [13], whereas a high-speed fuse and a SSCB are commercially employed for the VSC protection [9], [10] (see Table 1).
In the three-level protection, the protection actions should be coordinated to ensure the proper operation of the SSBTS, faster than the fuse operation, and the continuous operation of adjacent healthy loads installed in parallel to the faulty feeder. For the first point, the current limiting inductor in the SSBTS (L lim in Fig. 3) should be carefully selected. If the inductance value is not properly selected, it may cause the breaking failure (too low inductance) or the coordination failure (too high inductance). Note that the sizing of the current limiting inductor is presented in Section III. The continuous operation of the adjacent healthy loads is greatly related to the capacitance existed in the faulty bus. In general, the high capacitance helps not only to reduce the fault clearing time by the faster fuse operation, but also to maintain the voltage of the bus at which the fault occurs [14], [15].
To prove the fault ride-through capability, the works of [9], [16], [17] introduced one experimental test result on fault clearing by the three-level protection against the feeder fault. The test result showed that marine LVDC PDNs in [9], [16], [17] were protected by exact operations of an integrated SSBTS and an installed fuse on the faulty feeder (i.e., the fast action, followed by the medium action). However, the works did not cover technical descriptions and discussions on the protection coordination, the current limiting inductor influence, the DC-link capacitance influence, and their selection as those are crucial for the coordination between the protection actions. Furthermore, the protection method was verified only with one fault resistance case in the works.
For the bus fault in Fig. 1, the two DC bus sections are separated first and then the fault current provided by a synchronous generator is blocked by the power supply protection (i.e., the combination of the fast action and the slow action for the bus fault). If the generator deexcitation is used for the power supply protection, the rectifier should be rigorously sized to sustain relatively high fault energy due to its slow fault blocking ability [18]- [20]. As the diode rectifier is a critical device in power supply systems, the backup protection can be considered to improve the reliability of the protection scheme. Once the backup protection is employed, it is also necessary to coordinate the power supply protection and the backup protection.
There are works to investigate each power supply protection measure in [9], [13], [21]. However, the works focused on each measure and its performance, not dealing with the coordination between the actions and the study on the system-level protection scheme, which are covered in this paper. It should be mentioned that most of the works for marine LVDC PDNs have been conducted by industrial manufacturers. They have published limited information on their solutions to protect their knowledge from being used by others, especially in the technical background of the system protection as it is one of the key technologies.
As described above, the three-level protection has been employed by the industrial manufacturers and the several works introduced its fault management performance. However, with the lack of information regarding the protection coordination, there are technology gaps in system design, protective device setting, and protection coordination verification for various fault resistances. Hence, this paper tackles these gaps by demonstrating the whole process of the system protection along with technical discussions on the coordination: two-bus DC PDN implementation, device setting, protection scheme integration, and its system-level verification. For this purpose, this paper presents experimental and analytical verifications of the three-level protection in marine DC PDNs, designed and coordinated under in-depth technical assessments. Complete lab-scaled two-bus DC PDNs are implemented with the integrated three-level protection (fast action -bus separation by a SSBTS, medium action -feeder protection by high-speed fuses, slow action -power supply protection by generator deexcitation, and backup protection by AC fuses). Section II describes the hardware test setup, which is to replicate marine two-bus LVDC PDNs, for experimental short-circuit tests and system-level protection scheme study. The influences of the current limiting inductance and the DC-link capacitance are investigated by relevant experimental tests in Section III. In the same section, protective devices and their setting are also introduced. Section IV presents the performance of the implemented protection scheme with experimental and analytical approaches. The last section summarises the findings and the main results.

II. HARDWARE TEST SETUP
The hardware test setup to replicate marine two-bus DC PDNs of 500 V consists of two DC motor-generator sets, two diode rectifier systems, protective devices (a SSBTS and AC/DC fuses), resistive loads, fault resistors, and a central controller, as shown in Fig. 1. Note that the employed fuses are described in the next section.

A. POWER SUPPLY SYSTEMS
Two DC motor-generator sets are installed in the test setup: the first set (GEN1) -10 kW, 380 V; and the second set (GEN2) -25 kW, 380 V. Each set includes a DC motor drive, a DC motor, and a synchronous generator combined with an automatic voltage regulator (AVR), as shown in Fig. 2a and Fig. 2b. The DC motor driven by the thyristor-based motor drive acts as a prime mover, mimicking a diesel engine typically found in the onboard networks. The generators are based on direct excitation and their terminal voltages are directly regulated by ABB Unitrol 1005 AVRs that utilise a buck converter topology [22].
To establish the diode-based DC solution in Table 1, three-phase six-pulse diode rectifiers (SEMIKRON SKKD 100/16 [23]) are assembled in the rack (see Fig. 2c) and they are coupled with DC-link capacitor banks. The capacitor banks are designed to adjust the DC-link capacitance values from 2.3 mF to 11.5 mF.

B. SOLID-STATE BUS-TIE SWITCH
A SSBTS developed in the works of [24], [25] is installed in the test setup, as shown in Fig. 2d. The SSBTS has the following ratings: nominal voltage -600 V, rated current -100 A, and maximum allowed current -200 A.
The SSBTS uses a four-quadrant switch topology [four diodes (D 1 , D 2 , D 3 , and D 4 ) and one IGBT module (S)] with a current limiting reactor (L lim ) and a freewheeling diode (D L ) in series to the IGBT module, as illustrated in Fig. 3. An RC The right-side supply forces to flow the current through D 2 , L lim , S, and D 3 if the IGBT is the ON-state (see Fig. 3a). For the left-side supply, the current direction is the opposite, i.e., the current flows through D 1 , L lim , S, and D 4 . The IGBT module is first turned OFF in the event of a fault. This forces the overcurrent to flow through the snubber circuit and the MOVs (see Fig. 3b). The energies stored in the current limiting inductor and the system stray inductance are dissipated by the diode of D L and MOVs, respectively, until the interruption is terminated.
To select the current limiting inductor, it is necessary to check the time to interrupt the fault current after the instant of the threshold level (time delay in the paper). For this purpose, the breaking test result conducted in the work of [24] is provided in Fig. 3c. When the current reaches the threshold value of 100 A, the SSBTS starts to interrupt the current. Total clearing time under the test condition is about 15 µs. This result shows that the SSBTS can autonomously detect and clear the fault current within several tens of microseconds that is required for achieving the three-level protection, and the time delay between the detection and the interruption is observed as approximately 5.5 µs. Note that the current limiting inductor shown in Fig. 2d is large because it has a current rating of 1 kA, available in the laboratory. The actual required component can be much smaller.

C. CENTRAL CONTROLLER
A central controller for the system control and protection is realised with Pixsys TD820 that is a human-machine interface panel with an integrated programmable logic controller (PLC) [26]. The central controller controls the AVRs to regulate DC bus voltages under normal conditions as well as to remove the excitation under fault conditions. The controller also handles the SSBTS by talking with its local controller (PLEXIM RT Box in Fig. 2d [27]), as depicted in Fig. 1. Moreover, it manipulates switches to generate feeder and bus fault conditions. Two resistors of 2 in parallel are used and the fault resistance including the stray and line resistances is 1.3 . Note that the bus separation by the SSBTS is done by its local controller (RT Box) with its sampling rate of 1 µs in case of a fault event.

III. IMPLEMENTATION OF PROTECTION SCHEME
DC faults are highly sensitive on system parameters (equivalent inductance and equivalent capacitance existed in a fault circuit) [28] and thus their impacts on the faults should be examined to design the protection scheme. In this section, the influences of the current limiting inductance in the SSBTS and the DC-link capacitance are investigated with relevant experimental tests. From the investigations, the whole protection scheme and its setting are established and applied to the lab-scaled two-bus DC PDNs.

A. INFLUENCE OF THE CURRENT LIMITING INDUCTANCE
A DC short-circuit fault in the DC networks results in a voltage drop at the bus at which the fault occurs. This voltage drop generates the potential difference between the healthy bus and the faulty bus. The potential difference finally causes the current flow from the healthy bus to the faulty bus. The current limiting inductor in the SSBTS plays a role to control the rate of rise of this current.
Once the fault current passing through the SSBTS reaches the threshold value, it interrupts the current after the time delay, aforementioned, i.e., an actual breaking current is higher than the threshold current due to the current increase during the time delay. If the inductance is too small, the fault current level at the interruption instant may be higher than the breaking current rating (the maximum allowed current rating) of the SSBTS. On the other hand, if it is too high, the high inductance significantly decreases the rate of the current rise. This may cause the time coordination failure between the fast action and the medium action (an example case of this failure is shown in Fig. 4). Hence, the basic principle for the inductor sizing is to select the minimum inductor value that does not cause the breaking failure under the worst condition. With this principle, the required inductance can be calculated by As shown in Fig. 3c, the SSBTS integrated in the test setup takes around 5.5 µs to interrupt the fault current after the detection. In addition to that, the maximum allowed current of the SSBTS is 200 A. As 40 A (2 pu of the GEN1 current rating) is selected for the threshold current in the paper, t and i in the test setup are 5.5 µs and 160 A (= 200 A − 40 A), respectively. With these parameters, the required inductance is 17.2 µH by the consideration of the worst condition (V d = 500 V). However, in practice, there is no zero impedance fault and the voltage decreases with the time constant of the system capacitance and the fault resistance. This allows the networks to employ slightly lower inductance. Based on this technical review, the inductor of 16 µH, which was available in the laboratory, is installed in the SSBTS (see Fig. 2d).
The other reason why this low inductor is employed is related to the fault identification time in the SSBTS controller. The rate of the current rise also depends on the fault resistance value. As shown in Fig. 9d in Section IV, the lower fault resistance develops the higher current rise rate, i.e., the faster fault identification is possible. This lower fault resistance also decreases the fault clearing time by the high-speed fuse. Hence, to achieve the correct operation between the fast action and the medium action, the two DC bus sections have to be separated as fast as possible. In other words, the high value of the current limiting inductance may cause the time coordination failure between the actions.

B. INFLUENCE OF THE DC-LINK CAPACITANCE
In the three-level protection, the higher DC-link capacitance value can generally help to realise the lower fault clearing time of the feeder fuse as well as the lower bus voltage drop. DC short-circuit tests with the fault resistance of 1.3 are conducted to investigate the described general influence of the DC-link capacitance on the system protection. As presented in Fig. 6, when the fault occurs at BUS1 in Fig. 1, the SSBTS is turned OFF at around 50 µs and then the prearcing of the feeder fuse is started at around 170 µs. These actions are similarly observed for all the test cases. On the other hand, the fault clearing time and the bus voltage are different depending on the included DC-link capacitor values. For 2.3 mF, the total clearing by the fuse happens at 12.1 ms and the minimum voltage is 330 V. Those become 7.2 ms and 413 V, respectively, in case of the DC-link capacitance with 4.6 mF. By increasing the total capacitance to 6.9 mF, the voltage drop can be reduced around 0.1 pu (445 V) while there is no improvement of the total clearing time. An inverter installed at every feeder may be disconnected if the bus voltage becomes lower than its undervoltage protection level. It implies that, to maximise the network availability, the adjacent healthy loads connected in parallel to the faulty feeder have to be operated continuously during the feeder fault clearing by the high-speed fuse, i.e, the remaining bus voltage should be higher than the undervoltage trip threshold. Considering this, the DC-link capacitance of 6.9 mF, allowing for around 0.1 pu voltage drop, is selected for the coordination purpose in the paper as the threshold setting value has to be lower than the steady state DC voltage tolerance limit (e.g., 0.1 pu [29]).

C. DEVICE SETTINGS AND PROTECTION SCHEME
The SSBTS including the current limiting inductor of 16 µH is used for the fast action (the bus separation). As the power rating of GEN1 is 10 kW, the threshold current of 40 A (2 pu) is selected to turn OFF the SSBTS.
For the medium action (the feeder protection), IR semiconductor fuses rated for 500 Vdc and 15 A are employed at each feeder. Due to the lack of its datasheet, the characteristics of the fuse is tested, as shown in Fig. 6. From the test, the fuse is characterised with its parameters: I p (peak let-through current) -350 A, prearcing I 2 t -11.7 A 2 s, and total clearing I 2 t -37.5 A 2 s.
The generator deexcitation is implemented in the central controller (the Pixsys PLC), as the slow action (the power supply protection). Once the controller detects the fault current, after a time delay (T ON _D ), the deexcitation command is sent to the AVR and then the IGBT in the AVR is turned OFF (see Fig. 7a). The used parameters are i threshold = 40 A for GEN1 and 100 A for GEN2, and T ON _D = 0.1 s.
As the backup protection of the power supply protection, Mersen AC fuses rated for 690 Vac and 160 A are installed between the generators and the rectifiers. The parameters of the fuse are found from the datasheet [30]: prearcing I 2 t -2.68 kA 2 s and total clearing I 2 t -16 kA 2 s. The overall diagram of the protective devices is depicted in Fig. 7b. The protective devices and scheme, described above, are summarised in Table 2.   In this protection scheme, the fault detection relies on overcurrent criteria in Table 2. On one hand, the SSBTS instantly breaks the overcurrent if the current passing through the SSBTS is higher than the pick up level (40 A in the study) within several tens of microseconds. On the other hand, once 2 pu of the overcurrent through the rectifiers flows for 0.1 s (see Table 2), the generator excitation (the last action) is removed by the block diagram depicted in Fig. 7a. This means that the feeder fault can also be picked up for the last action. However, there may be no operation of the last action if the fuse on the faulty feeder correctly clears the fault in a time range of a few milliseconds as the turn-on delay applied in the study is 0.1 s.
The implemented protection scheme can autonomously localise DC faults by the three-different time frame actions. For the feeder fault in Fig. 1, the SSBTS disconnects the two bus sections and then the fault is isolated by the high-speed fuse. These bus and feeder disconnections indicate the feeder fault. The bus fault in Fig. 1 causes the bus disconnection, followed by the generator deexcitation. These actions provide the information on the occurrence of the bus fault. As most of marine LVDC PDNs in [7]- [10] are based on the centralised configuration in which all the DC parts are located in the metallic cabinets. Hence, the fault distance in the DC networks is less important in marine LVDC PDNs.

IV. VERIFICATION OF PROTECTION SCHEME
The whole protection scheme is validated by the experimental short-circuit tests with the bus and feeder faults. For further verification for various fault conditions, low-and high-impedance fault currents are calculated by a fault current equation for the bus faults and by a PLECS simulation for the feeder faults.

A. PROTECTION FOR BUS FAULTS
The protection performance for the bus fault is first examined by the DC short-circuit test on BUS1, as shown in Fig. 8a. The fault with its resistance of 1.3 develops the voltage drop on BUS1 and it results in the current flows from both power supplies (GEN1 and GEN2) to the fault point (see Fig. 8b). The fast action happens at 61 µs and this ultra-fast bus separation allows BUS2 to be operated independently with almost no influence of the fault event. On the other hand, there is the fault current contribution from GEN1 (I GEN 1 ) after the bus separation. In the continuous-time current, the first peak of I GEN 1 is provided by the DC-link capacitor with a short time constant and then the generator becomes the main source of the fault current with a relatively high time constant. At 0.1 s, the AVR is turned OFF to remove the excitation of the synchronous generator. This deexcitation diminishes the bus voltage and the fault current in time and finally makes them zero.
For the analysis by using a time-current curve (TCC), the continuous-time fault current (i F ) is converted to a RMS current (i F_RMS ) by The RMS current is drawn in Fig. 8c and compared to the operating time of the backup protection (the AC fuse). The result shows that the deexcitation effectively mitigates the fault current without the operation of the backup protection and also the time margin between them is enough.
The current limited by the deexcitation is decreased exponentially, i.e., it decreases quickly first and takes a relatively long time to make it completely zero. Hence, the time when the RMS current is the same as the continuous current rating of the rectifier is selected to be a fault clearing time in the paper. At 0.9 s, the RMS current reaches the continuous current rating of 91 A and the continuous-time current is around 6 A.
While the protection scheme successfully handles the DC short-circuit fault of 1.3 , it does not guarantee that the DC networks can be protected from other fault conditions. Therefore, its performance should be verified for different fault conditions. For this purpose, fault currents limited by the generator deexcitation with the fault resistance values of 1 m (assumed as a low-impedance fault condition) and 5 (2.5 times of the power rating of GEN2, as a high-impedance fault condition) are calculated by the equation for the fault current calculation under the deexcitation introduced in [31]: where, the parameters of i F (t) are provided in Appendix. VOLUME 8, 2020  Fig. 8d shows that the DC short-circuit fault with R F = 1 m generates the much higher fault current (red line) than the tested case (blue line). Nevertheless, this low-impedance fault can be managed by the generator deexcitation without the operation of the backup protection. In case of the high-impedance fault (R F = 5 , yellow line), the continuous-time current at 0.1 s is observed as 70 A and this current is high enough to operate the deexcitation (the threshold level of 40 A). It is expected that the high-impedance fault can be cleared more easily.

B. PROTECTION FOR FEEDER FAULTS
The feeder protection should be more carefully coordinated due to the small time margin between the fast action and the medium action. In the previous section, the influences of the current limiting inductance and the DC-link capacitance were investigated and they were selected as 16 µH and 6.9 mF, respectively. With these parameters, a DC short-circuit fault of 1.3 at the BUS1 feeder is artificially generated (see Fig. 9b) and the continuous-time waveforms during this event are presented in Fig. 9a.
In this test, the two DC bus sections are disconnected by the SSBTS (the fast action) and then the feeder fuse isolates the feeder fault (the medium action). The protection scheme based on the three-level protection is correctly operated for the feeder fault without the operation of the generator deexcitation (the slow action). In detail, the two DC bus sections are decoupled at 51 µs after the fault and then the feeder fuse starts its melting at 170 µs. This prearcing (or melting) of the fuse is also observed by the sudden increase in the fuse arc voltage at the same instant (purple voltage line). At 7.3 ms, the fault is completely cleared by the fuse (see Fig. 6). Similarly to the case of the bus fault test, BUS2 can be sustained solely by the ultra-fast bus decoupling. The BUS1 voltage drops below the minimum steady state tolerance limit (i.e., 450 V) at the instant of the SSBTS breaking for around 10 µs. Except this period, the voltage levels are within the limits. Hence, the adjacent inverters (if they are installed) may maintain their operations by filtering out this short period transient in their undervoltage protection.
To confirm the protection scheme for different feeder fault conditions, the DC short-circuit currents under the low-and high-impedance feeder faults are simulated by PLECS that is a software tool for system-level simulations. The system modeling is simplified as the combination of the DC-link capacitances at both buses, the current limiting inductor with a time-controlled ideal switch (disconnected in 5.5 µs after the threshold), and the fault resistance. The equivalent series resistance (38 m /unit) and inductance (20 nH/unit) of the installed DC-link capacitor [32] are applied to the simulation and the result is compared to the test waveform, as shown in Fig. 10. With this simulation model, the fault current from GEN1 and the through SSBTS current (the fault current from GEN2) are calculated for the fault resistance values of 1 m and 5 , assumed as the low-and high-impedance fault conditions. Note that the prearcing of the feeder fuse is not considered in the simulation model and therefore there is no current interruption by the fuse.
The study result on the different fault conditions is presented in Fig. 9d. For the low-impedance fault (R F = 1 m , red line), the SSBTS is disconnected at 42 µs and the fault energy reaches to the prearcing rating of the feeder fuse at 111 µs. Whereas the time margin between the actions is decreased to 69 µs (the time margin is 119 µs in case of the 1.3 fault case, blue line), the coordination is still achieved. It implies that a low impedance fault develops a high fault current and this increased current reduces the operating time of the SSBTS as well as the feeder fuse. The bus separation is taken place with a relatively high time delay (245 µs) for the high-impedance fault of 5 (yellow line). Along with this delayed operation, the feeder fuse is also melted slowly at 1.2 ms (the prearcing) due to the reduced fault energy.
From these investigations, the performance of the integrated protection scheme is verified for the possible feeder fault conditions. Hence, it could be stated that the protection scheme can provide reliable fault clearing not only with enough time margins between the fast action and the medium action, but also without the maloperation of the slow action.

V. CONCLUSION
This paper has presented coordination and verification of the protection scheme based on the three-level protection. For the study, the protection scheme is integrated into the marine two-bus DC PDNs and it consists of the bus separation by the SSBTS, the feeder protection by the high-speed fuses, and the power supply protection by the generator deexcitation. As the backup protection of the power supply protection, the AC fuses are also installed between the generators and the rectifiers. The coordination of each protection action is investigated by demonstrating the whole process of the system protection, such as, system design and implementation, protective device setting, protection scheme integration under in-depth analyses, and system-level experimental/analytical verifications.
The study results provide the important findings. First, the current limiting inductor in the SSBTS should be rigorously selected to ensure the fault interruption (not too small) and the coordination between the actions (not too high). Secondly, the higher DC-link capacitance helps not only to realise the less fault clearing time by the feeder fuse, but also to allow for the lower voltage drop of the faulty feeder. Lastly, the protection scheme has to be coordinated more thoroughly for the feeder faults as the allowed time margin is in a range of several tens of microseconds. This paper has covered the protection coordination on the three-level protection composed of the SSBTS, the fuse, and the generator deexcitation. However, considering the various combinations of each protection measure (see Table 1), there are lots of future research perspectives in the protection coordination to be studied.

APPENDIX
The parameters of i F (t) in (3) are  VOLUME 8, 2020