How to design modular DC-DC systems, Part 4: Safety protection systems

The previous tutorials in this series detailed the practical design considerations of utilizing power modules for designing power delivery networks (PDNs). Once a designer has chosen appropriate DC-DC modules, designed filters for the input and output of the modules, and provided for the overall stability of the system, the next area of concern is safety. Fuses and transient suppression circuits must be designed into the system to ensure protection from catastrophic failures without making the system unreliable or inefficient.

Figure 1: A well-designed power system needs to be protected; fuses limit thermal damage and isolate faulted systems, and a transient suppression circuit will tame surges and spikes that destabilize the system and endanger the power module. (click to enlarge)

Fuse requirements and functions
The starting point for fuse selection is the safety agency conditions of acceptability (CofAs) provided in the manufacturer’s DC-DC module documentation. Designers must consult the latest available documentation and select the appropriate type of fusing to ensure agency CofAs are met.

Fuses are a critical safety element of the system. They perform two main functions:

Limit the extent of thermal damage caused by overcurrent or a short-circuit event.
Isolate faulted subsystems.

First, thermal damage caused by a serious failure in an unfused system can be extreme: printed circuit boards can be burned to charcoal with every component completely destroyed, depending on the available fault current. Besides preventing fires, fuses also help preserve enough of the system in the event of a fault that failure analysis is possible. Second, fuses perform the role of isolating a faulted subsystem from the total system, preventing unnecessary downtime.

In order to ensure fuses adequately perform both functions and to satisfy safety agency requirements, each power module must have its own fuse placed at the input side. In Figure 2, a fault at either of the non-isolated point-of-load converters or in the input circuitry associated with it would cause that particular fuse to open while leaving the rest of the system capable of continued operation.

Figure 2: Fuse placements in a power system employing three DC-DC modules; note that each module has its own fuse for protection

Selecting a fuse
The first and most important parameter to consider when selecting a fuse is the current rating. The current rating must be greater than the maximum continuous operating current of the protected system. In a regulated DC-DC module, the maximum continuous operating current condition occurs at the minimum input voltage and at full-load power. Include an estimation of the module’s operating efficiency under these conditions to more precisely define the maximum continuous operating current.

Fuse manufacturers typically recommend that designers also include a 25 – 50% de-rating when calculating the fuse’s necessary rated current value. This accounts for normal fuse aging, but it also prevents nuisance tripping and frequent fuse replacement.

Once the basic fuse current rating is determined, designers need to consider the environmental conditions under which the system will operate. Fuse manufacturers’ data sheets include a temperature de-rating chart like the one shown in Figure 3. Depending on the application and expected ambient environment temperature, it may be necessary to modify the calculation of the required fuse current rating.

Figure 3: Example of a typical fast-acting fuse temperature de-rating chart; notice especially the additional de-rating for operation above 25°C.

Fuse manufacturers represent fuse current ratings at a typical temperature of about 25°C, but an elevated ambient temperature will lower the fuse’s effective current rating. Since the fuse will trip at a lower current when the ambient temperature is above 25°C, it is necessary to use this chart to apply an additional de-rating and raise the current rating of the fuse chosen for the system accordingly. The same recalculation is helpful for lower temperatures: if the environmental ambient temperature is typically below 25°C, select a fuse with a correspondingly lower current rating.

The fuse’s voltage rating is also a safety-critical design choice because it ensures the fuse remains an open circuit when tripped and does not allow for re-striking of an arc that would cause further damage in the system. It is crucial to select a fuse with an appropriate DC voltage rating that corresponds to the maximum withstand voltage the system can tolerate. In other words, the fuse’s voltage rating must meet or exceed the maximum voltage of the application.

Next, consider the maximum interrupt current rating of the fuse or the breaking capacity. This parameter, which must meet or exceed the maximum available short-circuit current of the protected circuit, dictates the maximum fault current that can be interrupted by the fuse during an overload condition at the rated voltage. This rating ensures that the fuse clears the fault from the system during an overcurrent event without experiencing damage to its own packaging. A clearing event that also damages the fuse packaging will likely cause damage to adjacent components on the circuit board and is an unsafe failure mode.

Note that the fuse voltage rating and interrupt current specification may or may not depend on whether the application is for an AC system or a DC system. Carefully read the fuse datasheet specifications to understand the manufacturer’s intended meaning.

Nominal melting I²t
Next, consider the nominal melting I²t rating for the fuse in order to accommodate some expected events that shouldn’t cause the fuse to trip. For example, DC-DC systems typically charge capacitance at startup and, therefore, might experience high peak inrush currents as part of the normal course of operation. These higher peak currents can also occur during externally introduced transients that are within the range of normal expectations for the system.

A fuse’s nominal melting I²t parameter corresponds with the thermal energy necessary to melt the internal fuse element itself. For example, in an application with DC-DC converters, pulse current overloads are a common occurrence and may actually exceed the rated fuse current of the selected component.

To calculate this value and select the appropriate fuse, consider the expected current waveform and its energy in joules. Figure 4 shows two representative waveform profiles and the pulse I²t of each. This calculation yields the expected energy that the fuse must pass without tripping, which means that the I²t rating of the selected fuse must be above this value.

Figure 4: Representative pulse shapes and I2t equations—sine (left) and lightning (right).

For increased design margin and to reduce the frequency of fuse replacements over the lifetime of the system, a pulse factor that accounts for the number of surge events the fuse must survive should be applied to the calculated I²t value.

Additional fusing considerations
There are other important factors to consider when designing fuses into a power system. Among the most notable are:

Fuses should be installed on the ungrounded side of the circuit to ensure uninterrupted connection to the low potential when the fuse opens.
Some advanced cooling solutions require that the placement of the fuse be reconsidered. For example, fuses should not be submerged in liquid-immersion cooling applications because the fuse element’s temperature will be so well controlled that an overload condition cannot produce sufficient heat to open the fuse.
Depending on the selected fuse’s size and rating, current-carrying conductors and PCB traces must be sized to safely carry 150 to 200% of the fuse current rating with acceptable temperature rise depending on applicable safety standards.
When a module is sourced by a dual-biased supply in which two series voltage sources are connected at the center to a common ground, separate fusing of both the positive and negative terminals is required. In this special case, a line-to-ground fault from either side of the system is possible, so protection on both sides is necessary.

Transient suppression circuits
Power modules will experience some adverse operating conditions during their lifetimes in any application. In particular, the power system and the power modules must be capable of withstanding surges or spikes, which are usually outside the specified operating range of the power modules.

Spikes and surges occur typically due to inductive load switching, motor speed changes in a system or the clearing of a fault, or a momentary power interruption. Spike-type transients are usually very short duration, but they can have a very high voltage peak. On the other hand, surges typically present somewhat lower peak voltages but may last for an extended period of time.

Figure 5: transient spike and surge profiles.

To qualify spikes and surges, consider the application type and the requirements of any applicable standards that deal with these transient events. With those parameters, it is then possible to design a two-stage protection circuit at the power module’s input, as in Figure 6.

The first stage uses transient voltage suppression (TVS) diodes to control spikes by providing fast transient energy damping on the order of 100μs. These protect against high-voltage and lower-energy spikes and may be coupled with a downstream LC filter that serves to integrate the transient energy.

There are four main parameters to consider when selecting TVS diodes: reverse standoff voltage of the diode, breakdown voltage, clamping voltage, and peak pulse current. The reverse standoff voltage (V_R) of the diode must be within the DC-DC converter’s range of operation. In other words, the maximum working voltage of the protected circuit should not be exceeded before the TVS diode enters reverse breakdown. Next, consider the two higher thresholds that dictate the TVS diode’s operation: breakdown voltage and clamping voltage, both of which need to be less than the maximum instantaneous voltage the DC-DC module can tolerate. The breakdown voltage threshold, typically 110 – 115% of V_R, is where the TVS diode will go into avalanche breakdown and shunt transient energy away from the power module. The second, higher clamping voltage threshold (typically 130 – 140% of V_R) is only reached when a large amount of current flows through the diode. Lastly, consider the peak pulse current rating, which is the maximum current the TVS diode can withstand.

Figure 6: Two-stage transient-suppression circuit example consisting of a TVS diode stage and an active clamp stage.

The second stage of the transient-suppression circuit deals with more prolonged-duration surge events. A series FET serves as a linear voltage regulator to actively clamp the module input voltage within an acceptable range. Again, the selection of this FET is dependent on the acceptable input voltage range of the module.

When selecting a FET, remember that it should be rated to withstand the peak surge voltage amplitude if the FET must be completely disabled. It must also be rated to conduct the full module input current when fully enhanced during normal operation. Additionally, the FET must be capable of conducting the full load current at the input side and ought to have the lowest R_DS(ON) possible to minimize power losses. Finally, evaluate the specified operating area (SOA) and transient thermal impedance against the specific clamping conditions the FET will perform for the circuit.

Now, with a system built and protected, the next area of concern is specific to the load the DC-DC module will supply. The next tutorial in this series will address some special considerations in this area.