AN-2036: Redundant Power Supply and Redundant Measurement

AN-2036: Redundant Power Supply and Redundant Measurement

The effective application of redundancy in measurement and control technology is a crucial approach to enhancing system reliability. However, if the concept of redundancy is applied improperly, it will not only fail to improve system reliability but may also introduce uncontrollable risks to the system’s normal operation.

Simply put, redundancy is essentially backup: when one system fails, another takes over to ensure the system continues to operate normally. These two systems are in an “OR” logical relationship, as illustrated in the figure below:

Redundancy is further categorized into “cold redundancy” and “hot redundancy.” In “cold redundancy,” a manual switchover to an alternate system is performed only after a failure in the primary system has been detected. By contrast, in “hot redundancy,” both systems A and B operate normally; if one system fails, the other automatically takes over within nanoseconds, without any interference from the failed system on the backup’s operation. Hot-redundancy technology is widely employed in power-management subsystems.

In redundant system design, a “voting” mechanism is often essential to achieve fault tolerance. By “voting,” we mean that the minority yields to the majority. For digital logic commands, voting can be implemented using combinational logic; for analog measurement and control loops, it must be realized through computer programs. Regardless of the implementation method, the goal is always to discard the most unreliable measurement value.

Redundant systems can also experience failures. The primary failure modes include catastrophic failures, single-point failures, and secondary failures.

A so-called catastrophic failure is one that cannot be avoided no matter how redundancy is designed. Examples include complete power loss of the system, mechanical failure of actuators, and rupture of the enclosure leading to the failure of most electrical connections.

So-called single-point failures and secondary failures occur when designers have an insufficient understanding of redundancy, select components improperly, or encounter implementation issues during project execution, resulting in damaged units causing secondary damage to functioning units and thereby preventing the system from operating normally. For example, a broken common power cable may cause a blown fuse to short-circuit onto a signal line; molten solder balls can create unintended short circuits at component or connector nodes; a failed unit may block power supply or communication to healthy units; or backup systems may fail to activate in a timely manner.

Below, we will use the cases we have experienced to validate the aforementioned points.

Case 1: Improper Component Selection Leads to Secondary Failures

A certain model requires a hot-redundancy design for its 28 V main power supply and backup power supply, with stringent requirements for low power loss and minimal switching threshold and switching time. Following analysis, the two Schottky fast-recovery diodes shown in the figure below are required to achieve this:

Specifically, the output voltage of the main power supply is 0.8 V higher than that of the backup power supply; the minimum required output current is 8 A; the switching threshold is ≤0.8 V; and the switching time is ≤50 ns.

After analysis and selection, SM1U21PST was ultimately chosen for implementation.

SMIU21PST is a common-cathode dual Schottky fast-recovery diode in a T0-257A package, B _V ≥200V, I _OM ≥18A, t _r ≤35 ns; the microscopic image of its interior is shown in the figure:

The advantage of this structure is its compact package size, allowing the housing to be directly mounted onto the heat sink. However, its drawback is that if one of the paths is damaged by an abnormal electrical surge and burns out, the resulting mobile metallic debris (see the figure below) can easily short-circuit the anode and cathode of the bypass diode, leading to secondary failures.

This is a typical case where the design concept is sound, but improper component selection leads to secondary failures. The solution is to, within the constraints of available board space, select two Schottky diodes in separate packages with similar reverse recovery times.

Case 2: Secondary Faults Caused by Inappropriate Power Supply Current Limiting

A certain model requires “thermal redundancy” power distribution for three sensors, while also imposing a maximum current limit on the total current drawn from the power supply by each sensor assembly. The following schematic configuration is used to achieve this:

Component selection: D1 = D2: 1N5819

　　　　　D3: 1N5245

　　　　　R1=R2=R5: 100Ω

　　　　　R3, R4: Unknown C1: 0.1 μF

This design not only achieves “hot redundancy” for the primary and backup power supplies, but also limits the power drawn by each sensor assembly from the +15 V supply; moreover, subsequent software processing can be used to perform voting on the outputs of the three sensors. Under normal operating conditions, it functions effectively.

However, the redundant design of the system is precisely intended to handle non-normal distributions.

The problem with the aforementioned design is that, when one of the three sensor assemblies experiences a power-supply-to-ground short circuit, the supply voltage to the other two assemblies drops, leading to abnormal output from those assemblies as well. The underlying cause is illustrated in the figure below (using the P3 sensor power-supply-to-ground short circuit as an example):

Component Selection: D1: 1N5819

　　　　　　　　　　 R1=R5: 100Ω

After a short circuit to ground occurs in the power supply for the P3 sensor, the voltage supplied to the Po and CL sensors drops by at least half due to the voltage-divider effect of the two current-limiting resistors, R1 and R5, in the upstream and downstream stages; it is therefore hardly surprising that their outputs become abnormal.

To avoid this situation, simply follow the diagram and reduce the current-limiting stages from two to one.

Component selection: D1 = D2: 1N5819

　　　　　　　　　　D3=D4=D5: 1N5245

　　　　　　　　　　R1=R2=R5: 100Ω

　　　　　　　　　　C1=C2=C3: 0.1 μF

Case 3: Pseudo Redundancy

A certain model requires a dual-redundancy design for its control commands. Due to space constraints, the SG2803J was selected as one of the redundancy levels.

The SG2803J is an eight-channel Darlington transistor; see the figure below.

Its advantage lies in its ease of implementation as “wired-AND” or “wired-OR” logic when combined with subsequent transistors, thereby enabling dual-redundant design of instructions within a compact footprint.

However, since the isolation among these eight Darlington transistors is achieved through reverse-biased diodes, it does not conform to the insulation-medium isolation principle inherent in redundant design.