Reliability Design of Spacecraft DC/DC Converter

The high reliability and long life of DC/DC converters for satellites are one of the basic conditions to ensure that they can complete their flight missions. However, people's understanding of the reliability of DC/DC converters usually focuses on the inherent quality of components or product assembly process defects, and often ignores the defects of system design (including technical solutions and circuit topology design, input/output interface design, environmental test condition adaptability design, etc.) and the impact of voltage, current and temperature stress on reliability.

According to statistics from the U.S. Navy Electronics Laboratory, the causes of machine failure and their respective percentages are shown in Table 1.

Statistics from Japan show that 80% of reliability problems are caused by design (Japan attributes the selection of components, the determination of quality levels, and the load capacity of components to design reasons). Although there has been no record of failure of domestic satellite DC/DC converters in on-orbit tests, there have been many reports of zero failures in ground tests, which are basically design defects.

The above statistics show that it is of great significance to control and reduce DC/DC converter failures caused by technical solution selection, circuit topology design and component design.

The selection of DC/DC converter power supply mode
The different DC/DC converter power supply modes have a significant impact on the reliability of the entire power supply system. There are generally two types of power distribution systems for DC/DC converters for satellites: centralized power supply and distributed power supply.

The advantage of centralized power supply is that the number of DC/DC converters is small, which is conducive to controlling and reducing the size and weight of the power supply, and simplifies the repeated wiring between the primary power supply and the DC/DC converter. The disadvantage is that the power supply has multiple loads, and it is difficult to ensure that the output volt-ampere characteristics of the power supply meet the requirements of each load.

The advantage of a distributed power supply system is that the DC/DC converter is close to the power supply load, which reduces transmission losses and improves dynamic response characteristics. This is the only and necessary technical approach to solve the problem of low voltage and high current (such as 2V/20A). The basic feature of this power supply method is to decompose the load power or load characteristics and share them among multiple power modules.

From the perspective of reliability model, multiple DC/DC converters in the distributed power supply system belong to a reliable parallel system, which can easily form N+1 redundant power supply and expand power relatively easily. Therefore, the use of a distributed power supply system can meet the reliability design requirements of aerospace power supply products. At present, the topology of domestic satellite DC/DC converters has basically achieved the transition from a centralized power supply method in which subsystems share a structural module power supply to a distributed power supply using universal, modular, and miniaturized "three-in-one" power supply products.

Therefore, comprehensively considering the specific needs of the power system and choosing a reasonable power supply method is of vital importance to improving the reliability of the DC/DC converter power supply system.

Selection and design of circuit topology
There are 8 basic circuit topologies available for satellite DC/DC converter power conversion, namely single-ended forward, single-ended flyback, dual single-ended forward, push-pull, dual forward, dual-tube forward, half-bridge, and full-bridge.

The power switch tubes of the first six topologies must withstand 2 times the input voltage when turned off. Considering the input voltage variation range and the electromagnetic interference voltage peak, and leaving a certain safety margin, the withstand voltage value of the power switch tube needs to reach more than 4 times the input rated voltage. For example, when the input bus voltage is +42V, the drain-source voltage of the power tube should be 200V.

The push-pull and full-bridge topologies may experience unidirectional magnetic bias saturation, which is mainly caused by the two power switches being not completely symmetrical when they are turned on in turn, making the two volt-second areas of magnetization and demagnetization unequal. Once this phenomenon occurs, one power tube will be damaged first. In recent years, in the special research on unidirectional magnetic bias of push-pull topology conducted abroad, it was found that the use of MOSFET with good performance parameter consistency in power switch can eliminate the unidirectional magnetic bias saturation phenomenon. The reason is that the conduction loss of MOSFET has a positive temperature characteristic, which can realize the function of automatic temperature balance and automatically maintain the equivalence of the volt-second area of ​​the two tubes. We have verified these conclusions in multiple satellite DC/DC converter tests. It should be said that as long as effective reliability technical measures are implemented, the advantages of high current, high efficiency and high reliability of push-pull topology will be fully utilized.

Theoretical analysis and practical results show that the half-bridge topology has the ability to automatically resist imbalance. It is generally believed that below 500W, the two-tube forward and half-bridge topologies have higher safety and reliability.

The single-ended flyback topology is not suitable for situations where the load current varies over a large range, and the output voltage will also increase significantly when it is not loaded. At present, external resistance loads are widely used at home and abroad to overcome the no-load runaway phenomenon, but this will reduce the power supply efficiency. Since the output power of the power supply is inversely proportional to the external resistance value, the single-ended flyback topology is only suitable for occasions with small output power.

Failure Mode and Effects Analysis (FMEA)
Failure Mode and Effects Analysis refers to the analysis of the impact of possible failures of all parts and components that make up the product during the product design process, and the planning of corrective measures.

The failure modes of components refer to the GJB Electronic Equipment Reliability Prediction Manual. The analysis does not consider unrelated double failures, but considers the chain effect caused by a single failure, that is, secondary failures.

Due to the high reliability requirements of spacecraft DC/DC converters, the power supply system does not allow single point failures, so backup redundancy design is generally considered. However, it does not mean that after considering backup redundancy, there will be no single point failure in the FMEA results. Because, often, failure modes that do not appear to be single point failures on the surface will be found to be single point failures due to the existence of common cathode mode after in-depth analysis.

For example, the main functional circuit of a DC/DC converter is shown in Figure 1.

Figure 1 DC/DC converter circuit block diagram

According to the DC/DC converter circuit principle block diagram shown in FIG1 , a corresponding reliability calculation model is established (see FIG2 ).

Figure 2 DC/DC converter reliability block diagram

Among them, λ1 and R1 are the failure rate and reliability of the input filter circuit; λ2 and R2 are the failure rate and reliability of the main circuit; λ3 and R3 are the failure rate and reliability of the output filter circuit. The functional circuits inside the main circuit in the reliability model are in series structure.

The reliability can be calculated according to Figure 2.

RS=R1·R2·R3 (1)
The reliability calculation result is (45℃, 3 years): 0.993 14.

If the DC/DC converter is designed with backup redundancy, its circuit is shown in FIG3 .

Figure 3 Block diagram of DC/DC converter circuit after backup redundancy

According to Figure 3, the corresponding reliability calculation model diagram is established (see Figure 4).

Figure 4 Reliability block diagram of DC/DC converter after redundant design

Among them, λ1 and R1 are the failure rate and reliability of the input filter circuit; λ2 and R2 are the failure rate and reliability of the main backup circuit; λ3 and R3 are the failure rate and reliability of the output filter circuit. The functional circuits inside the main circuit in the reliability model are in series structure.

According to FIG4 , its reliability can be calculated.

RS = R1 · [1-2 (1-R2)] · R3 (2)
The calculation result is (45°C, 3 years): 0.999 65.
It can be seen that after the backup redundancy design, the reliability of the DC/DC converter can be greatly improved.

Derating design
Since the reliability of electronic products is sensitive to electrical stress and temperature stress, derating design technology is particularly important for electronic products and has become an indispensable part of reliability design. According to the requirements of GJBZ35-93, all parameters of components used in spacecraft must be implemented with level I derating.
There are many types of components used in DC/DC converters, including resistors and capacitors, high-power semiconductor devices, inductors, relays, fuses, etc. All parameters that need to be derated should be analyzed for different devices, and comprehensive considerations should be made. Moreover, when derating different parameters of the same device, the mutual influence between the parameters should be considered, that is, when one parameter is adjusted, it will often bring

The change of other working parameters. For semiconductor devices, even if all parameters are derated, it ultimately comes down to whether the junction temperature meets the derated requirements.
The derated design should be based on a careful analysis of the circuit working state to confirm that the expected effect is achieved. For example, for the derated voltage of capacitors, due to the differences in device characteristics (such as leakage current, RSE, etc.), simple series connection cannot fully meet the derated requirements.

Thermal design
Product development experience tells us that the impact of thermal stress on power supply reliability is often no less than that of electrical stress. Local overheating of power devices inside the power supply, including the heating of the output rectifier tube, is likely to cause failure. When the temperature exceeds a certain value, the failure rate increases exponentially, and when it reaches the limit value, it will cause component failure. Foreign statistics point out that for every 2°C increase in temperature, the reliability of electronic components decreases by 10%, and the life of the device when the temperature rises by 50°C is only 1/6 of that when the temperature rises by 25°C, which shows the necessity of thermal design. There are two principles for power supply thermal design: one is to improve power conversion efficiency, select components with small conduction voltage drop to simplify the circuit and reduce heat sources. The second is to implement heat transfer and thermal balance measures to prevent and eliminate local heating.

Due to the influence of the space environment where the satellite is located, the only ways to dissipate heat are radiation and conduction. And due to the influence of the installation position, the DC/DC converter generally dissipates heat mainly through conduction, that is, the heat generated by the DC/DC converter is conducted to the device casing through the casing mounting surface through the device structure, and then conducted to the satellite casing from the device mounting surface, and the temperature of the entire satellite is controlled.

1 MOSFET heat loss control
The heat loss of MOSFET mainly comes from conduction loss and switching loss. The conduction loss is caused by the on-resistance of MOSFET, and the switching loss is caused by the turn-on and turn-off characteristics of MOSFET. The turn-on and turn-off characteristics of MOSFET depend on factors such as MOSFET device parameters (such as input capacitance), drive waveform, operating frequency, circuit parasitic parameters, etc.

The control of switching loss mainly includes the following points:
① Design gate drive for different MOSFETs to accelerate the opening and closing of MOSFETs. In addition, by driving the acceleration capacitor, the rising edge time of the driving waveform is shortened.

② Comprehensively consider and design a reasonable operating frequency.

③Through transformer winding process design, the leakage inductance of the transformer is controlled, thereby reducing the drain-source voltage spike of the MOSFET. For example, the flyback transformer design adopts the "sandwich" winding method, that is, the primary winding is wound halfway first, then the secondary winding, and then the remaining turns of the primary winding are wound, and finally the secondary winding is wrapped inside, so that the leakage inductance is minimized (see Figure 5).

Figure 5 Winding diagram of flyback transformer

④Through the design of the absorption circuit, the MOSFET drain-source voltage spike caused by the transformer leakage inductance is further controlled. The design principle is that the absorption circuit has a small loss and controls the voltage spike as effectively as possible.

Generally, through the above circuit design, MOSFET heat dissipation can achieve relatively ideal results.

2 Transformer heat loss control
Transformer heat loss mainly comes from hysteresis loss