Single point failures - University of Virginiagalileo.phys.virginia.edu/research/groups/hep/aag/nova/...(3) This analysis points to the need to be very careful about how the circuits

(1)

Fault analysis Single point failures for the 3-transistor current limiter

15-Oct-09

John Oliver

(2)

The faults considered in this document should really be considered “solder faults” of the sort expected during the assembly process of the Power Distribution Boards. The two categories of faults considered are

a) Open circuit in any solder pad in any device. b) Short circuit between adjacent pads in the design. It is assumed that pc layout will be

conservative and that “adjacent pads” will only exist within a single component.

All such fabrication faults are expected to exist at some probability and will be found in a rigorous QA/QC program for the boards. Seventeen fault conditions were analyzed and shown in the table below. Note that the analysis was done assuming the high voltage source to be current limited at 10 ma. Thus, we assume that if the circuit fault is such as to draw currents larger than this, the current will be limited to this value by the supply itself. Note also that the nominal limiting current has been set by resistor values to 300 uA.

Case Device Condition Current in load Breakdown 1 Normal operation 299 uA 2 Q3 Open base 10 mA 3 Q2 Open base 80 uA Q3 Vce 4 Q1 Open base 160 uA Q1 Vce 5a Q2 Open collector 166 uA Q1 Vce 5b Q1 Open emitter " " 6 Q1 Open collector 230 uA Q2 Vbe reverse 7 R2 Open 7 nA Q1 Vce 8 R3 Open 6 nA Q2 Vce 9 R5 Open 170 uA

10 R2 Short 473 uA Q2 Vce 11 R3 Short 375 uA Q1 Vce 12 R5 Short 10 ma 13 Q1 CB short 473 uA Q2 Vce 14 Q1 BE short 230 uA 15 Q2 CB short 10 ma 16 Q2 BE short 165 uA 17 Q3 BE short 10 ma

All of the fault conditions above result in an improper operation of the circuit in some way. Four of these conditions result in complete non-operation of the circuit and will deliver the full 10ma to a small load, taken in this analysis as a 100 Ohms to ground short. Ten of the faults will result in circuit voltages which exceed the transistor rating and can potentially destroy these devices. The result of damage to these devices was not analyzed further, so at this point it is not known what the final outcome in current delivered to the load will be in those cases. Finally, three of the fault cases resulted in a valid current limit at the load. In these cases, of course, normal circuit operation will be impaired, but the current will be limited and the components will all survive.

(3)

This analysis points to the need to be very careful about how the circuits are to be initially powered up for QA/QC. The tests must be done starting at values of HV low enough so that the fault can be identified while not damaging remaining components. The tests should then be performed at increasing voltage levels up to the maximum (or beyond) insuring a fully operational device.

Conclusions

The fault analysis describes mostly solder faults occurring during fabrication but could equally apply to faults in the generally non-prescreened components themselves. These faults are all discoverable during careful QA/QC procedures and are all repairable by re-soldering or component replacement.

Opinions

The analysis indicated that many of the initial fault conditions can damage remaining components. In many of these cases, those components may be protected by adding protective devices (diodes, extra transistors, etc). This however increases the complexity of the design. It is likely that the addition of just a few components can eliminate the possibility of a single point failure causing excess current in the load. It is not likely that we can prevent that situation with anything short of a complete duplication of the limiter. If complete elimination of this possibility is mandatory, then it seems the only solution is to use two such limiters in series.

In my opinion, this should not be a requirement for the following reasons.

a) The NOvA Experiment is not open to the public. Only trained technical staff will be allowed enter the area. All personnel should go through safety training before being allowed onto the detector.

b) The Power Distribution Boxes should be clearly labeled as a potential high voltage hazard. c) The limiters as currently designed should be 100% screened during careful QA/QC procedure. d) A burn in procedure which applies a short circuit condition to the limiters for extended time

periods can be considered. e) Once the devices are released for use in NOvA, the screening procedures will have reduced future

failure probabilities by many orders of magnitude. This, along with a) above, guarantees a safe situation on the detector.

f) Replacement of components in the design with higher voltage rated parts does in itself reduce the probability of single point failures during manufacturing. It does reduce the probability of damage occurring to those devices during a fault condition, but this does not seem to warrant the large cost and real estate increase these parts would require. In any case, a fault condition discovered on-detector will result in replacing the entire card. The faulty card will then be repaired and at that time all damaged parts replaced.

g) Whatever circuit is chosen should undergo torture testing by means of a pulsed high voltage relay to create shorts at the load. Several copies of the circuit should be so tested prior to incorporation into the PDBs.

h) Transient simulations were performed assuming a rapid (1 us turn on time) short to ground on the output. In this situation, transistor Q2 will see a transient Vce difference of the full 500V swing for several us. The Vce breakdown rating is, however, a dc rating only, as it corresponds to thermal damage of the collector. Transients of only a few us duration would not result in such

(4)

breakdown. This claim can be verified by torture testing as described in g) above. Furthermore, the “Human Body Model” is nothing like a short circuit and will not result in such rapid transients. In short, transients do not represent a fault mode of the circuit.

i) Use of one limiter per hv spigot would seem to be the best configuration from the safety point of view as a human body short would result in the lowest level of delivered current.

Appendix

Detailed results of each of the fault conditions are shown in the following pages.

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 1 : Normal operation

Note: Current source, transistor Q4, and battery are not real components. Theyare there to simulation a 10ma current limited voltage source

Note 2 -

Note 3:

N31.044V

N5

29.93mV

0V

0V

29.93mV

N4555.8mV

N0249.8V

Vhva

249.8V

N1249.3V

555.8mV

1.044V

499.3V500.0V

0V

0

0

Title

Size Document Number Rev

Date: Sheet of<Doc> <RevCode

<Title>

B1 1Tuesday, October 13, 2009

Title



<Title>


Title



<Title>


INCLUDE: D:\NOvA\Electronics\PowerGrounding\limiter\KSP44.libINCLUDE: D:\NOvA\Electronics\PowerGrounding\limiter\KSP44.lib

Rload100Rload100

INCLUDE: C:\Cadence\SPB_16.2\tools\pspice\library\BIPOLAR.LIBINCLUDE: C:\Cadence\SPB_16.2\tools\pspice\library\BIPOLAR.LIB

Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44

Q3

KSP44

Q3

KSP44

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1 KSP44Q1 KSP44

R31.5MEGR31.5MEG

R54kR54k

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 2 : Q3 open base

Note: Current source, transistor Q4, and battery are not real components. Theyare there to simulation a 10ma current limited voltage source

Note 2 - Voltage at HV input drops to 270V because HV supply cannotsupply more than 10 ma.

Note 3: 10 ma is delivered to load

N3

N51.000V

0V

0V

1.000V

N4

N0124.3V

Vhva

124.3V

N1123.7V

41.00V

41.62V

1.222V

499.3V269.9V

0

0

Title



<Title>


Title



<Title>


Title



<Title>



Rload100Rload100


Q4Q2N3904

Q4Q2N3904

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1 KSP44Q1 KSP44

R31.5MEGR31.5MEG

R54kR54k

R0

1000G

R0

1000G

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A


Note 2 - Q2 Vce exceeds Vces

Note 3:

280.7mV

N5

8.833uV

0V

0V

8.833uV

N4350.2uV

N0500.0V

Vhva

500.0V

500.0V

N1499.7V

350.2uV

499.3V500.0V

0V

N3

0

0

Title



<Title>

B1 1Wednesday, October 14, 2009

Title



<Title>


Title



<Title>




Rload100Rload100

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1 KSP44Q1 KSP44

R54kR54k

R31.5MEGR31.5MEG

R4

1000G

R4

1000G

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A


Note 2 - Q1 Vce exceeds Vces

Note 3:

N5

16.64mV

0V

0V

16.64mV

N4507.4mV

Vhva

250.5V

N1576.5mV

507.4mV

499.3V500.0V

0V

1.028V

N3

854.4mV

0

0

Title



<Title>


Title



<Title>


Title



<Title>




Rload100Rload100

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904

V1499.3V

V1499.3V

R6

1000G

R6

1000G

R21.5MEGR21.5MEG

I110mA I110mA

Q1 KSP44Q1 KSP44

R54kR54k

R31.5MEGR31.5MEG

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 5 : Q2 open collector/Q1 open emitter

Note 2 -

Note 3:

0V

0V

16.63mV

N4507.4mV

Vhva

250.5V

507.4mV

499.3V500.0V

0V

N3

250.5V

16.63mV

576.5mV

0

0

Title



<Title>


Title



<Title>


Title



<Title>


R81000GR81000G


Rload100Rload100


Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44

Q3

KSP44

Q3

KSP44

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1 KSP44Q1 KSP44

R31.5MEGR31.5MEG

R54kR54k

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 6 : Q1 open collector

Note 2 -

Note 3:

0V

0V

23.09mV

N4536.1mV

Vhva

153.7V

536.1mV

499.3V500.0V

0V

N3

153.7V

23.09mV

153.2V

153.2V

0

0

Title



<Title>


Title



<Title>


Title



<Title>



Rload100Rload100


Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44

Q3

KSP44

Q3

KSP44

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R31.5MEGR31.5MEG

R54kR54k

R91000GR91000G

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 7 : R2 open

Note 2 - Q1 Vcb exceeds Vcbs

Note 3:

0V

0V

703.6nV

N428.85uV

Vhva

259.7mV

28.85uV

499.3V500.0V

0V

N3

259.7mV

703.6nV

207.4mV

500.0V

0

0

Title



<Title>


Title



<Title>


Title



<Title>



Rload100Rload100


Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44

Q3

KSP44

Q3

KSP44

V1499.3V

V1499.3V

R21000GR21000G

I110mA I110mA

Q1KSP44

Q1KSP44

R31.5MEGR31.5MEG

R54kR54k

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 8 : R3 open

0V

0V

N3

274.3mV

N1500.0V

N5

6.555uV

N2

499.7V

6.555uV

500.0V

N4268.7uV

N0

500.0V499.3V

268.7uV

500.0V

0V

0

0

Title


Date: Sheet of

<Doc> <RevCod

<Title>

A

1 1Thursday, October 15, 2009

Title


Date: Sheet of

<Doc> <RevCod

<Title>

A


Title


Date: Sheet of

<Doc> <RevCod

<Title>

A


Q1KSP44

Q1KSP44

R54kR54k

Q3

KSP44

Q3

KSP44

R31000GR31000G


R21.5MEGR21.5MEG

V1499.3V

V1499.3V I110mA I110mA

Rload100Rload100

Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44


5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 9 : R5 open

Note 2 - Limits to 170uA, but current delivered by Q3, not Q2

Note 3:

0V

0V

16.94mV

N4543.1mV

Vhva

250.4V

543.1mV

499.3V500.0V

0V

N3

250.4V

16.94mV

250.0V

500.0V

0

0

Title



<Title>


Title



<Title>


Title



<Title>



Rload100Rload100


Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44

Q3

KSP44

Q3

KSP44

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R31.5MEGR31.5MEG

R51000GR51000G

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 10 : R2 short

Note 2 -

Note 3:

0V

0V

47.33mV

N4591.4mV

Vhva

500.0V

591.4mV

499.3V500.0V

0V

N3

1.067V

500.0V

47.33mV

499.5V

500.0V

0

0

Title



<Title>


Title



<Title>


Title



<Title>



Rload100Rload100


Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44

Q3

KSP44

Q3

KSP44

V1499.3V

V1499.3V

R21R21

I110mA I110mA

Q1KSP44

Q1KSP44

R31.5MEGR31.5MEG

R54kR54k

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 11: R3 short

Note 2 -

Note 3:

0V

0V

37.35mV

N4572.5mV

Vhva

1.096V

572.5mV

499.3V500.0V

0V

N3

1.095V

1.096V

37.35mV

652.0mV

500.0V

0

0

Title



<Title>


Title



<Title>


Title



<Title>



Rload100Rload100


Q4Q2N3904

Q4Q2N3904

Q2

KSP44

Q2

KSP44

Q3

KSP44

Q3

KSP44

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R31R31

R54kR54k

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 12 : R5 short

0V

0V

N3

1.620V

N184.27V

N5

1.000V

N2

83.66V

1.000V

229.9V

N41.001V

N0

84.27V499.3V

1.001V

229.9V

0V

0

0

Title


Date: Sheet of

<Doc> <RevCod

<Title>

A


Title


Date: Sheet of

<Doc> <RevCod

<Title>

A


Title


Date: Sheet of

<Doc> <RevCod

<Title>

A


Q1KSP44

Q1KSP44

R5.1R5.1

R31.5MEGR31.5MEG

Q3

KSP44

Q3

KSP44


R21.5MEGR21.5MEG

Rload100Rload100

I110mA I110mAV1

499.3VV1

499.3V

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904


5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 13 : Q1 CB short

Note 2 -

Note 3:

0V

0V

47.33mV

N4591.4mV

N0

500.0V

591.4mV

499.3V500.0V

0V

N3

1.067V

N1500.0V

N5

47.33mV

499.5V

500.0V

N0

N1

0

0

Title



<Title>


Title



<Title>


Title



<Title>


R40.1R40.1



Rload100Rload100

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R54kR54k

R31.5MEGR31.5MEG

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 14 : Q1 BE short

Note 2 -

Note 3:

0V

0V

23.09mV

N4536.1mV

N0

153.7V

536.1mV

499.3V500.0V

0V

N3

1.032V

N1153.7V

N5

23.09mV

N2

153.7V

500.0V

N2

N1

0

0

Title



<Title>


Title



<Title>


Title



<Title>


R40.1R40.1



Rload100Rload100

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R54kR54k

R31.5MEGR31.5MEG

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A

Case 15 : Q2 CB short

Note 2 -

Note 3:

0V

0V

1.000V

N41.635V

N0

2.792V

1.635V

499.3V85.70V

0V

N3

2.172V

N12.792V

N5

1.000V

N2

2.173V

85.70V

N2

N3

0

0

Title



<Title>


Title



<Title>


Title



<Title>


R40.1R40.1



Rload100Rload100

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R54kR54k

R31.5MEGR31.5MEG

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A


Note 2 -

Note 3:

0V

0V

16.65mV

N4507.6mV

N0

250.3V

507.6mV

499.3V500.0V

0V

N3

507.6mV

N1250.3V

N5

16.65mV

N2

250.1V

500.0V

N4

N3

0

0

Title



<Title>


Title



<Title>


Title



<Title>


R40.1R40.1



Rload100Rload100

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R54kR54k

R31.5MEGR31.5MEG

5

5

4

4

3

3

2

2

1

1

D D

C C

B B

A A


Note 2 -

Note 3:

0V

0V

1.000V

N41.001V

N0

84.27V

1.001V

499.3V229.9V

0V

N3

1.620V

N184.27V

N5

1.000V

N2

83.66V

229.9V

N4

N5

0

0

Title



<Title>


Title



<Title>


Title



<Title>


R40.1R40.1



Rload100Rload100

Q3

KSP44

Q3

KSP44

Q2

KSP44

Q2

KSP44

Q4Q2N3904

Q4Q2N3904

V1499.3V

V1499.3V

R21.5MEGR21.5MEG

I110mA I110mA

Q1KSP44

Q1KSP44

R54kR54k

R31.5MEGR31.5MEG

Documents

Single point failures - University of Virginiagalileo.phys.virginia.edu/research/groups/hep/aag/nova/...(3) This analysis points to the need to be very careful about how the circuits