AN-2036: Redundant Power Supply and Redundant Measurement

In modern electronic devices, operational amplifiers are an indispensable component. Particularly in the design of domestically produced op‑amp circuits, selecting appropriate components and optimizing the circuit architecture have become focal points for many engineers. Today, we will delve into the key principles and techniques of designing domestic op‑amp circuits, helping you elevate your circuit‑design expertise. 1. Understand the Basic Characteristics of Operational Amplifiers First and foremost, when designing a domestic op‑amp circuit, it is essential to grasp the amplifier’s fundamental characteristics. The core performance of an op‑amp hinges on parameters such as gain, input impedance, and output impedance. Gain determines the signal‑amplification capability; input impedance affects the source‑load interaction; and output impedance influences the signal‑transmission efficiency. Only by thoroughly understanding these basic traits can we proceed with more effective circuit design. 2. Choose the Right Domestic Operational Amplifier While the market offers a wide array of domestically manufactured op‑amps, not every model is suitable for your specific project. When making your selection, consider several critical factors: bandwidth, power consumption, operating temperature range, and cost. For instance, if your application involves high‑frequency signal processing, bandwidth becomes the primary consideration. Conversely, for projects with stringent low‑power requirements, prioritize low‑power consumption.

AN-2036: Redundant Power Supply and Redundant Measurement

The effective application of redundant measurement and control technologies is a crucial means of enhancing system reliability. However, the inappropriate use of redundancy not only fails to improve system reliability but also introduces uncontrollable risks to the system’s normal operation.

In simple terms, redundancy is a form of backup: when one system fails, another takes over to ensure the system continues to operate normally. These two systems are connected by an “OR” logic relationship, as illustrated in the figure below.

Redundancy is further categorized into “cold redundancy” and “hot redundancy.” In “cold redundancy,” when a failure in one system is detected, operators manually switch to the backup system. By contrast, in “hot redundancy,” both systems A and B operate normally; if one system fails, the other automatically takes over within nanoseconds, without allowing the failed system to interfere with the backup’s operation. Hot redundancy technology is widely employed in power‑management subsystems.

In redundant designs, a “voting” mechanism is often essential to achieve fault tolerance. By “voting,” we mean that the minority yields to the majority. For digital control commands, voting can be implemented using combinational logic; for analog measurement and control loops, it must be realized through software algorithms. Regardless of the approach, the goal is always to discard the least reliable measurement.

Redundant systems can also experience failures. Among the potential failure modes, the most common include catastrophic failures, single-point failures, and secondary failures.

A so‑called catastrophic failure is one that cannot be avoided, no matter how redundancy is designed. Examples include total power loss to the entire system, mechanical failure of actuators, or structural rupture leading to the failure of most electrical connections.

So‑called single points of failure and secondary failures occur when designers lack a sufficient understanding of redundancy, select inappropriate components, or encounter implementation issues, causing a failed module to inflict secondary damage on functioning modules and thereby preventing the system from operating normally. Examples include a common power‑supply line opening, a blown fuse shorting to a signal line, molten solder balls creating unintended shorts between devices or connectors, a damaged module obstructing power or communication to healthy modules, or delayed activation of backup systems.

Below, we will use cases we have encountered to substantiate some of the points outlined above.

Case 1: Improper component selection leads to secondary failures.

A certain model requires a hot‑redundancy design for both the 28 V main power supply and the backup power supply. The requirements are low power loss, as well as low switching thresholds and short switching times. After analysis, the two Schottky fast‑recovery diodes shown in the figure below are needed to meet these specifications.

Specifically, the main power supply’s output voltage is 0.8 V higher than that of the backup power supply; the minimum required output current is 8 A; the switching threshold is ≤0.8 V; and the switching time is ≤50 ns.

After analysis and selection, the SM1U21PST was ultimately chosen to accomplish the task.

SMIU21PST is a common-cathode dual Schottky fast-recovery diode in a T0-257A package, B _V ≥200V, I _OM ≥18A, t _r ≤35 ns; the microscopic image of its interior is shown below:

The advantage of this structure is its compact package size, allowing the housing to be directly mounted onto the heat sink. However, its drawback is that if one of the paths fails due to an abnormal electrical surge and burns out, the resulting mobile metallic debris (see the figure below) can easily short‑circuit the diode’s anode and cathode, leading to secondary failures.

This is a typical case where the design concept is sound, but improper component selection leads to secondary failures. The solution is to select two Schottky diodes with separate packages and similar reverse recovery times, provided that the available board space permits.

Case 2: Secondary Faults Caused by Improper Power Supply Current Limiting

A certain model requires “thermal redundancy” power distribution for three sensors, while also imposing a maximum current limit on the total current drawn from the power supply by each sensor assembly. The following circuit configuration is employed to achieve this:

Component selection: D1 = D2: 1N5819

　　　　　D3: 1N5245

　　　　　R1=R2=R5: 100Ω

　　　　　R3, R4: Unknown; C1: 0.1 μF

This design not only achieves “hot redundancy” for the primary and backup power supplies but also limits the power drawn by each sensor assembly from the +15 V supply. Furthermore, it enables voting logic on the outputs of the three sensors through subsequent software processing. Under normal operating conditions, it performs reliably.

However, the system’s redundant design is precisely intended to handle non-normal conditions.

The problem with the aforementioned design is that, when one of the three sensor assemblies experiences a power‑to‑ground short circuit, the supply voltage to the other two assemblies drops, causing their outputs to become abnormal as well. The underlying cause is illustrated in the figure below (using the P3 sensor’s power‑to‑ground short circuit as an example):

Component selection: D1: 1N5819

　　　　　R1=R5: 100Ω

After the P3 sensor’s power supply experiences a short circuit to ground, the voltage supplied to the Po and CL sensors drops by at least half due to the voltage‑division effect of the two current‑limiting resistors, R1 and R5, in the front and rear stages; it is therefore hardly surprising that their outputs are abnormal.

To avoid this situation, simply follow the diagram and change the two-stage current limiting to a single-stage current limiting.

Component selection: D1 = D2: 1N5819

　　　　　D3=D4=D5: 1N5245

　　　　　R1=R2=R5: 100Ω

　　　　　C1=C2=C3: 0.1 μF

Case Three: Pseudo-Redundancy

A certain model requires a dual-redundancy design for its control commands. Given the constraints on available space, the SG2803J was selected as one of the primary-level controllers.

The SG2803J is an eight-channel Darlington transistor; see the figure below.

Its advantage lies in its ease of interfacing with subsequent transistors to implement “wired-AND” or “wired-OR” logic, thereby enabling dual-redundant instruction design within a compact footprint.

However, since the isolation between these eight Darlington transistors is achieved through reverse-biased diodes, it does not conform to the insulation‑medium isolation principle of redundant design.