I am building a flight computer for a sounding rocket. I want to include redundant power supplies - in other words: parallel DC-DC converters. What do I need to consider in order to do this? (is my approach doable: see schematic)
V+ on the input is connected to two 3S LIPO Batteries (also in parallel with ORing diodes).
Additionally: would you suggest using ORing FETs instead of just diodes? That would give me the possibility to disable a power supply that has "burned through" (output = input)
Unless this is a regulatory requirement, you probably ought to make the converter more robust rather than doubling up. If one dies, the other is very likely to die of the same cause.
Rather than adding shut off FETs, just use a higher voltage rated part e.g. TPS5420.
With 3s you'll have~12V, which means you'll only have 5V headroom. RC stuff can be rather noisey, and switch mode converters are like electronic hammers. Your Vin should have a ceramic decoupling capacitor as well as the 100uF electrolytic, 10uF ish and I'd add a ferrite bead to damp the high frequency ringing, spiking and emissions.
Honestly, I think you can attain much better reliability with half the components...
Short and open each component in turn and then all combinations of any two components.
So 2 conditions for individual components, and 4 combinations for each pair of any two components.
eg D21 short + D22 short.
Why would that happen?
Who knows? - But, working out why it DID happen after lithobraking is harder.
So have D21a + D21b, D22a + D22b.
Likely needed? Of course not.
Silly? Maybe not.
Over-voltage and under-voltage the converters.
Low-OK, High-OK, OK-Low, High-Low, Low-Low, High-High.
The last two may only be transient to not be fatal.
The pin 5 commonality looks unwise and unnecessary.
Joining the two sections in any way if not essential should be avoided.
I have had an isolated sense IC incinerate itself and thus breach the isolation barrier - not allowing any possible path and as few impossible ones as you can is wise.
Vin clamping of converters is fatal even with two batteries BECAUSE OF battery ORING - a S/C converter takes down 2 x batteries. Better a dud battery taking down 1 converter than a dud converter taking down 2 batteries.
A polyswitch resettable thermal fuse in each Vin may help - or non OR'd batteries - or a hard fault trip on high Iin for more than a set period.
Decide what protection circuits you need in your batteries. Do they need per cell high and low voltage and overcurrent and ... ?
These are unlikely failure points but not impossible ones.
You MAY be better off with 3 unprotected cells per back and then per pack protection circuitry tailored to what is liable to perhaps go wrong and perhaps avoiding what is unlikely to happen, if protecting against it may result in higher overall risk.
How high?
Cooling at even quite moderate altitudes 'gets worse" and at real-sounding-rocket altitudes converter cooling may need radical rethinking.
Note that water is a marvellous thermal sink - 850 litre-degrees_C per kWh.
Think MURPHY!
What would Murphy do to break this with minimum faults?
What WILL Murphy do to break this with minimum faults?
The big boys do it too:
Gemini 6A, October 25th 1965 (were you alive then? :-) ) failed to launch when an anomaly was detected 1.5 seconds AFTER engine ignition - but before clamps were released at 3.2 seconds, because "a plug fell out" in a connecting umbilical and created an unknown circuit condition. [THere was a second as then unknown fault that would probably have terminated launch at 2.2 seconds as someone had left a sealing cap in a gas generator and one engine would not have risen to launch power, probably !!!]
What you've shown is a design that has both power supplies (trains) running at the same time. You need to be careful with that type of design to make sure that the power trains will share current equally, or nearly so, and that the control loops won't fight each other. [EDIT] You also need to ensure each power train can provide 100% of the current if needed.
I am not sure this is what you want. Sounds like you want a block-redundant power system, where only one of the two power supplies is operating. If that's the case, I recommend going with the isolation (ORing) MOSFETs on the output of each power train, and control them from an external point. Like this, from a multi-voltage power supply:
Something else to consider. For your mission, are you going to have time to detect a problem with the power train (supply) that is on-line (operating) and switch over to the other power supply?
