μModule Regulator Powers and Protects Low Voltage μProcessors, ASICs and FPGAs from Intermediate Bus Voltage Surges

Intermediate bus voltages of 24V~28V nominal are commonplace in industrial, aerospace and defense systems where series-connected batteries may be a backup power source and 12V bus architectures tend to be impractical due to distribution losses. The widening voltage gap between the system bus and the power inputs of digital processors present design challenges relating to power delivery, safety and solution size.

If a single-stage non-isolated step-down DC/DC converter is used at the point of load, it must operate with extremely accurate PFM/PWM timing. Input surge events can stress DC/DC converters, presenting an overvoltage risk to the load. Erroneous or counterfeit capacitors introduced in manufacturing may cause output voltage excursions exceeding the load’s ratings potentially causing the FPGA, ASIC or microprocessor to ignite. Depending on the extent of the damage, the root cause may be difficult to find.

An overvoltage risk mitigation plan is absolutely necessary to prevent customer dissastifaction. Traditional overvoltage protection schemes involving a fuse are not necessarily fast enough, nor dependable enough, to protect modern FPGAs, ASICs and microprocessors, particularly when the upstream voltage rail is 24V or 28V nominal. Active protection at the POL DC/DC is necessary. The LTM4641 is a 38V-rated, 10A DC/DC step-down μModule^® regulator that defends against, and recovers from, many faults, including output overvoltage.

Importance of Accurate Switcher Timing Increases with Input Voltage & Surges

When a wide differential exists between the input and the output voltages, switching DC/DC regulators are favored over linear regulators for their much higher efficiency. To achieve a small solution size, a nonisolated step-down converter is the top choice, operating at high enough frequency to shrink the size requirements of its power magnetics and filter capacitors.

However, in high step-down ratio applications, a DC/DC switching converter must operate at duty-cycles down to 3%, demanding accurate PWM/PFM timing. Furthermore, tight voltage regulation is required by digital processors, and fast transient response is needed to keep the voltage within safe limits. At relatively high input voltages, the margin for error in the on-time of the top side switch of the DC/DC regulator is reduced.

Bus voltage surges, which are often present in aerospace and defense applications, pose a danger not only to the DC/DC converter, but also to the load. The DC/DC converter must be rated to regulate through the overvoltage surge with a fast control loop, so that sufficient line rejection is achieved.

If the DC/DC converter fails to regulate or survive a bus surge, an overvoltage is presented to the load. Overvoltage faults may also be introduced as the load’s bypass capacitors degrade with age and temperature, which results in looser transient load response over the course of the end product’s life. If the capacitors degrade beyond the limits of the control loop’s design, the load can be exposed to overvoltage by two possible mechanisms:

• First, even if the control loop remains stable, heavy transient load-step events will demonstrate higher voltage excursions than were expected at the onset of design.
• Second, if the control loop becomes conditionally stable (or, worse yet, unstable), the output voltage can oscillate with peaks exceeding acceptable limits. Capacitors can also degrade unexpectedly or prematurely when an incorrect dielectric material is used, or when fake components enter the manufacturing flow.

Cheap Counterfeit Components Generate Expensive Headaches

Gray market or black market counterfeit components can be enticing, but they don’t meet the standards of the genuine article (e.g., they may be recycled, reclaimed from electronic waste, or built from inferior materials). A short-term savings becomes a huge long-term expense when a counterfeit product fails.

Counterfeit capacitors, for example, can fail in a number of ways. Counterfeit tantalum capacitors have been seen to suffer internal self-heating with a positive-feedback mechanism to the point of reaching thermal runaway. Counterfeit ceramic capacitors may contain compromised or inferior dielectric material, resulting in an accelerated loss of capacitance with age or at elevated operating temperatures. When capacitors fail catastrophically or degrade in value to induce control loop instability, the voltage waveforms can become much greater in amplitude than originally designed, endangering the load.

Unfortunately for the industry, counterfeit components are increasingly finding their way into the supply chain and electronics manufacturing flow, even in the most sensitive and secure applications. A United States Senate Armed Services Committee (SASC) report released publicly in May 2012 found widespread counterfeit electronic components in military aircraft and weapon systems that could compromise their performance and reliability—systems built by the top contractors in the defense industry. Coupled with the increasing number of electronic components in such systems—more than 3,500 integrated circuits in the new Joint Strike Fighter—counterfeit components pose a system performance and reliability risk that can no longer be ignored.

Risk Mitigation Planning

Any risk mitigation plan should consider how the system would respond to and recover from an overvoltage condition. Is the possibility of smoke or fire resulting from an overvoltage fault acceptable? Would efforts to determine root cause and implement corrective actions be hampered by damage resulting from an overvoltage fault? If a local operator were to power-cycle (reboot) a compromised system,would even greater harm to the system result further hindering recovery efforts? What is the process and time required to determine the cause of the fault and resume normal system operation?

Inadequacies of Traditional Protection Circuit

A traditional overvoltage protection scheme consists of a fuse, silicon controlled rectifier (SCR), and Zener diode (Figure 1). If the input supply voltage exceeds the Zener breakdown voltage, the SCR activates, drawing sufficient current to blow open the upstream fuse.

 

 

This straightforward circuit is relatively simple and inexpensive, but there are drawbacks of this approach:

• Variations in the Zener diode breakdown voltage, SCR gate trigger threshold, and current required to blow the fuse result in inconsistent response times. Protection may engage too late to prevent hazardous voltage from reaching the load.
• The level of effort required to recover from a fault is high, involving physically servicing the fuse and restarting the system.
• If the voltage rail under consideration powers the digital core, an SCR’s protection capability is limited, since the forward drop at high currents is comparable to or above the core voltage of the latest digital processors.

Because of these drawbacks, the traditional overvoltage protection scheme is not suitable for high voltage to low voltage DC/DC conversion powering loads such as ASICs or FPGAs that could be valued in the hundreds if not thousands of dollars.

Combine Power and Fault Protection for Fast and Dependable Reaction and Recover

A better solution would be to accurately detect an imminent overvoltage condition and respond by quickly disconnecting the input supply while discharging excess voltage at the load with a low impedance path. This is possible with the protection features in the LTM4641.

At the heart of the device is a 38V-rated,10A step-down regulator with the inductor, control IC, power switches and compensation all contained in one surface mount package. It also includes extensive monitoring and protection circuitry to protect high value loads such as ASICs, FPGAs and microprocessors. The LTM4641 maintains a constant watch for input undervoltage, input overvoltage, overtemperature and output overvoltage and overcurrent conditions and acts appropriately to protect the load.

To avoid false or premature execution of the protection features, each of these monitored parameters has built-in glitch immunity and user adjustable trigger thresholds with the exception of overcurrent protection, which is implemented reliably, cycle-by-cycle with current-mode control. In the case of an output overvoltage condition, the LTM4641 reacts within 500ns of fault detection (Figure 2).

 

 

The LTM4641 responds nimbly and reliably to protect downstream devices, and, unlike fuse-based solutions, it can automatically reset and rearm itself after fault conditions have subsided. The LTM4641 uses an internal differential sense amplifier to regulate the voltage at the load’s power terminals, minimizing errors stemming from common-mode noise and PCB trace voltage drops between the LTM4641 and the load. The DC voltage at the load is regulated to better than ±1.5% accuracy over line, load and temperature. This accurate output voltage measurement is also fed to the fast output overvoltage comparator, which triggers the LTM4641’s protection features.

When an overvoltage condition is detected, the μModule regulator rapidly initiates several simultaneous courses of action. An external MOSFET (MSP in Figure 3) disconnects the input supply, removing the high voltage path from the regulator and the high value load. Another external MOSFET (MCB in Figure 3) implements a low impedance crowbar function, quickly discharging the load’s bypass capacitors (C_OUT in Figure 3). The LTM4641’s built-in DC/DC step-down regulator enters a latched-off shutdown state and issues a fault signal indicated by the HYST pin which can be used by the system to initiate a well managed shutdown sequence and/or system reset. A dedicated voltage reference independent of the control loop’s reference voltage is used to detect fault conditions. This provides resilience against a single-point failure, should the control loop’s reference happen to fail.

 

 

The LTM4641’s protection features are bolstered by its fault recovery options. In a traditional overvoltage fuse/SCR protection scheme, a fuse is relied upon to separate the power supply from the high value load. Recovery from a fuse-blowing fault requires human intervention—someone with physical access to the fuse to remove and replace it—introducing an unacceptable delay in fault recovery for high uptime or remote systems. In contrast, the LTM4641 can resume normal operation once the fault condition has cleared either by toggling a logic level control pin or by configuring the LTM4641 for autonomous restart after a specified timeout period. If fault conditions reappear after the LTM4641 resumes operation, the aforementioned protections immediately re-engage to protect the load.

Input Surge Protection

In some cases, output overvoltage protection alone is insufficient, and input overvoltage protection is required. The LTM4641’s protection circuitry can monitor the input voltage and activate its protection features should a user-configured voltage threshold be exceeded. If the anticipated maximum input voltage exceeds the 38V rating of the module, input surge protection can be extended up to 80V with the LTM4641 still fully operational by adding an external high voltage LDO to keep control and protection circuitry alive (Figure 4).

 

 

Conclusion

Mission critical electronics increasingly mix a distributed power bus in the range of 12V–28V with low voltage high performance digital ICs. Risk mitigation has become more important than ever, particularly when the power bus is susceptible to voltage surges. The latest, costly FPGAs, ASICs, and microprocessors demand supply voltages with an absolute maximum limit as low as 3%–10% of the nominal voltage, making them extremely susceptible to damage, even fire from an overvoltage fault. Faults can be caused by timing errors in the switching regulator, an input voltage surge or improper components introduced during manufacture.

Overvoltage protection in mission critical systems must be fast, accurate and consistent—at levels beyond the capabilities of the traditional SCR/fuse-based scheme. The LTM4641 combines an efficient 10A DC/DC step-down regulator with a fast and accurate output overvoltage protection circuit in one surface mount package to meet demanding sytem requirements.

Visit www.analog.com/LTM4641 for data sheets, demo boards and other applications information.

About The Authors