0
\$\begingroup\$

I am building a flight computer for a sounding rocket. I want to include redundant power supplies - in other words: parallel DC-DC converters. What do I need to consider in order to do this? (is my approach doable: see schematic) Schematic of Redundant Power Supply

V+ on the input is connected to two 3S LIPO Batteries (also in parallel with ORing diodes).

Additionally: would you suggest using ORing FETs instead of just diodes? That would give me the possibility to disable a power supply that has "burned through" (output = input)

\$\endgroup\$
  • 3
    \$\begingroup\$ What happens when one of the DC converters goes short circuit on its input port? What is the flight time of the rocket? Does a short flight time justify dual circuitry? How would you prevent one converter from going faulty and producing a large voltage on the output and overriding the good device due to using diode OR methods? How would you know that one of the power supplies has "burned through"? \$\endgroup\$ – Andy aka Dec 17 '19 at 9:30
2
\$\begingroup\$

Unless this is a regulatory requirement, you probably ought to make the converter more robust rather than doubling up. If one dies, the other is very likely to die of the same cause.

Rather than adding shut off FETs, just use a higher voltage rated part e.g. TPS5420.

With 3s you'll have~12V, which means you'll only have 5V headroom. RC stuff can be rather noisey, and switch mode converters are like electronic hammers. Your Vin should have a ceramic decoupling capacitor as well as the 100uF electrolytic, 10uF ish and I'd add a ferrite bead to damp the high frequency ringing, spiking and emissions.

Honestly, I think you can attain much better reliability with half the components...

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Thank you for your feedback! I don't really understand what the shut off FETs have to do with a higher voltage rated part? I would need the FETs on the ENABLE Pin 5 to turn on/off the device. To turn it on, I will bypass the FET with a button and after around 2s the uC will hold the power and I can release the button. After the rocket lands, the uC can self-power down. (not drawn in this part of the schematic) Do you know how the pros apply redundancy to their power supplies? Regarding "If one dies, the other is very likely to die of the same cause". Two different chips? \$\endgroup\$ – lazerlini Dec 17 '19 at 10:43
  • \$\begingroup\$ I was referring to the ORing FETs instead of diodes. \$\endgroup\$ – David Molony Dec 18 '19 at 7:55
  • \$\begingroup\$ The pros will examine the system for possible causes of failure and eliminate them all. The remaining failure modes will be random chip failure (1 in tens to hundreds of millions). If that's deemed unacceptable, doubling up with active switching the inputs, fusing/clamping, output diodes so they can't feed current back through the dead one. However, for what i presume is a toy rocket, a pro electrical engineer will not be concerned by random failure of a dcdc converter, them they will have used an appropriately rated and installed part and have a very very low failure rate... \$\endgroup\$ – David Molony Dec 18 '19 at 8:01
1
\$\begingroup\$

Short and open each component in turn and then all combinations of any two components.
So 2 conditions for individual components, and 4 combinations for each pair of any two components.

eg D21 short + D22 short.
Why would that happen?
Who knows? - But, working out why it DID happen after lithobraking is harder.
So have D21a + D21b, D22a + D22b.
Likely needed? Of course not.
Silly? Maybe not.

Over-voltage and under-voltage the converters.
Low-OK, High-OK, OK-Low, High-Low, Low-Low, High-High.
The last two may only be transient to not be fatal.

The pin 5 commonality looks unwise and unnecessary.
Joining the two sections in any way if not essential should be avoided.
I have had an isolated sense IC incinerate itself and thus breach the isolation barrier - not allowing any possible path and as few impossible ones as you can is wise.

Vin clamping of converters is fatal even with two batteries BECAUSE OF battery ORING - a S/C converter takes down 2 x batteries. Better a dud battery taking down 1 converter than a dud converter taking down 2 batteries.

A polyswitch resettable thermal fuse in each Vin may help - or non OR'd batteries - or a hard fault trip on high Iin for more than a set period.

Decide what protection circuits you need in your batteries. Do they need per cell high and low voltage and overcurrent and ... ?
These are unlikely failure points but not impossible ones.
You MAY be better off with 3 unprotected cells per back and then per pack protection circuitry tailored to what is liable to perhaps go wrong and perhaps avoiding what is unlikely to happen, if protecting against it may result in higher overall risk.

How high?
Cooling at even quite moderate altitudes 'gets worse" and at real-sounding-rocket altitudes converter cooling may need radical rethinking.

Note that water is a marvellous thermal sink - 850 litre-degrees_C per kWh.


Think MURPHY!
What would Murphy do to break this with minimum faults?
What WILL Murphy do to break this with minimum faults?


The big boys do it too:

Gemini 6A, October 25th 1965 (were you alive then? :-) ) failed to launch when an anomaly was detected 1.5 seconds AFTER engine ignition - but before clamps were released at 3.2 seconds, because "a plug fell out" in a connecting umbilical and created an unknown circuit condition. [THere was a second as then unknown fault that would probably have terminated launch at 2.2 seconds as someone had left a sealing cap in a gas generator and one engine would not have risen to launch power, probably !!!]

| improve this answer | |
\$\endgroup\$
1
\$\begingroup\$

What you've shown is a design that has both power supplies (trains) running at the same time. You need to be careful with that type of design to make sure that the power trains will share current equally, or nearly so, and that the control loops won't fight each other. [EDIT] You also need to ensure each power train can provide 100% of the current if needed.

I am not sure this is what you want. Sounds like you want a block-redundant power system, where only one of the two power supplies is operating. If that's the case, I recommend going with the isolation (ORing) MOSFETs on the output of each power train, and control them from an external point. Like this, from a multi-voltage power supply:

enter image description here

Something else to consider. For your mission, are you going to have time to detect a problem with the power train (supply) that is on-line (operating) and switch over to the other power supply?

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Thank you for your answer! This part is not a mission requirement. I only want to have redundancy in the case that the power supply fails (though the probability that this occurs is very small). So I thought it would be easiest to just have both power supplies running all the time (each on its own being able to provide all the current needed for operation: max 3A). If one fails, the other continues operating nominally. ORing MOSFETs require active control, how would I provide that, because that would then be my single point of failure, or can I also make this redundant? \$\endgroup\$ – lazerlini Dec 17 '19 at 23:21
  • \$\begingroup\$ You need to look at whether a MOSFET failure really constitutes an SPF. If that's the only failure (single point), then if it opens up, you can just switch over to the other power supply. If it shorts and that power supply is still operating correctly (remember, only one fault allowed at a time here), then you still have power to your system. \$\endgroup\$ – SteveSh Dec 18 '19 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.