Sorry i've been a bit vague with the explanations. Also apologies for the massive screen-shots, earlier in the thread. I didn't realise they would be scaled up like that.
This does get a bit technical, and in some places have still omitted some details to avoid "going down a rabbit hole".
Firstly, for battery protection, we have a ML-RBS-7713 remote battery switch from Blue Sea Systems. This was quite a pricey piece of kit, but worth it i think. We had to import it from the US, which was a bit of a rigmarole. It is intended to be used where the batteries are inaccessible, and comes with an illuminated remote switch with sliding guard. On the main unit there is a knob which enables it to be locked off or overridden. The really useful thing about this unit is that the on/off control wire behaves as if the switch is a conventional relay, except that it is internally magnetically latched and draws very little current in either state.
Currently we only have protection for the overall battery pack voltage. I hope to improve this soon. We use a couple of cheap modules which can be found on ebay, search "12v voltage control relay". Two of these modules are used, one upper and one for lower trip points. The trip voltage is configured via the buttons and display. Wires are connected via screw terminals.
This switching/protection scheme was knocked-up quite quickly using off the shelf parts. I would like to revisit this at some point to make it more fail safe, improve the monitoring etc... If the battery voltage exceeds limits, it disconnects the battery and sounds an alarm buzzer.
When my dad bought this boat, the alternator was already fitted with a Sterling AR12VD alternator controller. This system needed modifying in order to behave as we wanted it to. The first trap we encountered was that the alternator's internal regulator was still installed, with the AR12VD overriding it to boost the alternator output. We had to disconnect the alternators internal regulator so that the AR12VD would have full control. As luck would have it, the AR12VD is based on a PIC microcontroller, and the circuit is relatively simple. It was easier just to write fresh firmware to our own requirements, and swap the chip. This firmware has gone through many iterations. We have also made mods to the circuit to install a warning buzzer and an illuminated push-button to enable the charge mode to be selected from the control panel.
Additional modifications; The temperature sensor for the AR12VD, which was intended to be installed onto a battery terminal, is now installed on the alternator. The auxiliary relay within the unit, which previously had no use to us, has been re-purposed to control a cooling fan for the alternator. The cooling fan takes cool air from outside of the engine room, and forces it into and around the alternator at the rectifier end.
Incidentally, when I first removed this alternator, before any of this upgrade work, I discovered 2 diodes in the rectifier had completely disintegrated. So it probably hadn't been running at full output for some time.
I'm a little unsure about posting schematics of this unit due to potentially infringing the design. The circuit is essentially an ordinary alternator regulator circuit but with the reference voltage generated by the PIC. I think the only reason such a high pin-count PIC has been chosen is because it is driving 7 LEDs!
As the firmware has evolved, we've ended up just driving the alternator field fully on for charging at full rate, or off for not charging. There is no need to have voltage regulation function. I was half tempted to simplify the whole setup, and just have a relay, providing basic on/off control. Then to use another programmable voltage switch module to cut the field when the batteries are charged.
In the end we've kept the AR12VD because it does now monitor the alternator temperature, controls the alternator cooling fan, and performs a few trivial checks on the battery and field voltages. We have kept a kind of "float" mode, which can be selected with a short press of the button, but we don't use it.
This alternator is supposed to be 100A rated. Output is engine RPM dependent and I've often thought possibly a bigger crank pulley might be beneficial, but I've not had much luck locating one.
The output current is significantly dependent on the the temperature of the alternator. This is mainly to resistive copper losses in the phase windings. Forced air cooling has a significant beneficial effect, and we're able to hold between 80A and 90A at fast idle. From stone cold, it can peak out at about 110A. One thing we soon realised is that alternator output ratings are somewhat optimistic. In an automotive application, the high load current would typically occur after a cold engine start on a cold morning, which would coincide with the alternator's best performance conditions. A 100A rated alternator is therefore not intended to provide 100A continuously.
Without the additional forced cooling, I imagine this alternator would have a very short life expectancy as we used to measure temperatures well in excess of 100C.
For load-dump protection, initially we did nothing. Except to inform anyone on board not switch off the batteries while the alternator was running. Switching off the batteries is quite easy with the RBS remote switch, so the risk of this occurring is possibly a little higher than average. Also if a fault were to occur which somehow caused the alternator regulator to over-charge the batteries, the battery protection scheme is designed to disconnect them; A good thing for the batteries, but bad for just about everything else.
The solution to this is far from trivial. Initially I was considering something functionally equivalent to a Zener, to be connected at the output of the alternator. Something which would prevent the output voltage from rising to a destructive level. The snag with this idea is Power. If, for example, the alternator output were to be clamped to 16V, and if the output were giving a full 100A, there would be 1.6kW of power to be dissipated. There would then need to be another "fail safe" system which could shut down the alternator quickly. Before long, the size and complexity of this approach out-strip any potential usefulness. That's without considering reliability.
To add further complications anything installed at the output of the alternator, is also connected directly to the battery most of the time. Leakage currents need to be low.
Another thing that was considered was crow-baring the output of the alternator. i.e. applying a dead short if a surge is detected. This sounds initially like a very bad idea however an automotive alternator does not operate in the manner you'd expect. Inside the alternator, there is quite a significant air gap between the rotor and stator, which means the leakage flux in the stator windings is quite substantial. This means that the equivalent circuit for the machine will have a dominant series inductance on each of the winding outputs. i.e. a high-ish source impedance
A simplified DC analogy of this would be to imagine the 100A alternator being comprised of a DC source of e.g. 150V, with 1.38 Ohm resistor in series. At 100A, the series resistor would be dropping 138V, leaving 12V for the output. With this analogy we can see that if the output were to become open-circuit, the voltage would jump up to 150V, which matches the real-world behaviour. But we can go further, and answer the question what would happen if the output were shorted out? This can be calculated as 150/1.38 = 109A, so not significantly more than the rated output current. Of course this assumes that the simplified DC analogy is correct. The resistive element in the analogy is in reality inductive, so frequency i.e. RPM plays a part. Also the fixed 150V DC source in the analogy is in reality a variable voltage AC source, with voltage and frequency depending on RPM and field current. But the end result, if the analogy is correct, is that the output can quite safely be shorted out / crow-barred.
There is a further benefit to a crow-bar, which might not be immediately obvious. The field winding power is usually derived from the fields via a separate rectifier, usually half-wave. If the alternator is shut down using a crow-bar, the field supply will also be shut down. This will stop all power generation, and will be a safe off state. Further-more, the warning lamp on the console will then illuminate to show the field voltage is low. Ok, there will be a very slight field energisation from the warning lamp, and potentially any remanent flux in the rotor, but i don't believe that to be significant.
By comparison to using the Zener approach, where the power would be dissipated directly into the silicon device; crow-baring causes the unwanted power to be dissipated into the copper phase windings which have significantly more "thermal mass", and cooling capacity.
The obvious place to install such a crow-bar would be at the output terminal of the alternator, however there's a problem with that. The output terminal is connected to the batteries most of the time (via a fuse) - not good to short out. This could be overcome by installing yet another diode to prevent current back-flowing from the battery to the alternator crow-bar. However, when considering the power dissipation of a typical silicon diode with 0.6V drop, the power at 100A would be 60W! Dealing with that power leads to more complexity.
So then I though, how about connecting the crow-bar directly to the phase windings. The downside of this is that 3 crow-bars would be needed instead of 1. The only requirements are that the crow-bar must be fast to switch, it must short all 3 phases simultaneously, and it must have a low electrical resistance.
In the crow-bar circuit demonstrated, to achieve the high detection/switching speed, the threshold detection and latch circuits are all implemented with basic transistor logic. (No integrated circuits / micro-controllers). For the low electrical resistance, the phases are shorted using MOSFETs.
The circuit monitors the voltage on each phase. Anything above about 19V will cause the circuit to trip and latch. Monitoring all phases within the unit is easier than running an additional monitor wire to the alternator output terminal. LEDs show the presence of voltage and polarity on each of the phases. This gives, at a glance, an indication of the health of the each rectifier diode within the alternator. Green=good, Red=bad/fault.
A test button provides a simulated transient, which should trip the crow-bar, and buzzer provides audible indication that it has tripped. There is also a reset button.
The only aspect of the design which i've not been able to resolve cleanly is the need of a permanent supply to power the latch circuit. The latch circuit requires practically zero current while in its off state, and only a few mA once tripped, however it is critically important that the supply remain connected permanently in order for the unit to remain correctly in a tripped state in the event of a surge. We have this connection made to the starter battery (un-switched) via a 1A fuse.
Attached files 2x photographs of Alternator being re-built, 1x Photograph of Sterling AR12VD with cover removed, 1x Schematic of Crow-bar circuit, 2x Photos of crow-bar unit partially built.
The links to the youtube videos posted earlier in this thread demonstrate the trip threshold, the test and reset function, and a demo running on an engine with batteries being remotely disconnected while being charged at 100A.
I'm willing to share the source code for the alternator controller, however I don't know how much use this will be, given that we have modified our unit quite substantially.