This article was originally published in 2010. It is part of the ELMG redux series of articles that will be republished over the summer. These articles cover subjects in and around digital control of power electronics.
Redux – Safety Critical Digital Control – Planes in Fog
Just before Christmas 2006 I spent sometime (24 hours) in Copenhagen Airport as I waited for my plane after doing a week of meetings in Southern Sweden. I very nearly had a forced stopover in London at Heathrow as London fog shut that airport. This stranded almost eighty thousand people who could not go on their holidays.
My connecting flight into Heathrow was cancelled due to that very fog in London. As a result I did not ever get to London and so I missed my connection out of London. Luckily for me I was re-routed the next day directly through Hong Kong missing the crowds of delayed passengers at Heathrow. Thanks to all those that helped me.
As I waited at Copenhagen I thought about a number of things
The large numbers of people at Heathrow and how their holidays would go? My sympathy to all the people who were delayed in Europe at or around Christmas time.
Why, if an airliner can land itself at LAX in perfectly good weather, can an airliner not land itself in London in the fog? The pilot on my last flight to LA informed the passengers that the plane we were on would land itself at LAX. I cannot verify whether the plane did or did not land itself but we did get down safely.
What would my pre-school age daughter say if I did not get home for Christmas?
So if the plane can land on a sunny day in LAX why can it not land in the fog at London?
The guidance system on an airliner is an safety critical digital control system. It takes inputs from various guidance sensors (like GPS and inertial guidance) and produces outputs for the control surfaces like the elevators and ailerons. As such it will be a mixture of hardware and firmware software. The program code is most probably written in a safety critical digital control useful language (not C) such as ADA. The method to write the software is (hopefully) well defined and the code is well inspected and walked through. The guidance system is then certified along with the aircraft by the FAA and other suitable safety authorities.
A Sunny Day in LA.
So let me say that again – on a good sunny day in LA my pilot can let the machine land itself but in London my plane cannot land because of the fog. I thought about why this was and even asked a friend. He said that it was “All because of the labour unions” which I hadn’t even considered. I decided that it may well be something else. Labour unions may have something to do with it but I don’t have time to write about that.
Critical Failure Modes Analysis
Consider the failure mode of the plane landing in Heathrow in the fog. If something goes wrong with the part of the guidance/landing system that takes care of height, then the airliner hits hard into the runway and makes a mess. Consider the same failure mode in the good weather at LAX. The plane is at the wrong height and would dive into the runway. Instead the over riding backup system looks out the window and takes control of the plane.
Safety Critical Digital Control on a plane needs a Pilot
So here is the skinny – it is OK for the plane to land itself so long as the backup override system is working. This backup is the pilot and so long as she isn’t struck down by food poisoning and she can see the runway she will not let the plane crash.
I am glad my flight to London was cancelled.
There have been incidents where the pilot has attempted to stop the plane crashing but the embedded systems in the plane have refused to help out. That, though, is something for another time.
Since this article was written safety of airliners and their safety critical digital control systems has come into sharp focus. Apologies and condolences to all and everyone who have been touched by the failings of digital control systems in the airline industry.
The choice of control processor for your digital power converter is the most critical. Which one should you choose from the multitude of available options?
A good lunch is all it takes
An engineer at our recent digital control course told me that the answer at his company was all about whether the FAE had taken you out for a good lunch.
He then went on to say that they had recently changed their digital power electronics control processor late in a development because this lunch approach to selection had not worked out so well.
What is important in a processor?
In a recent survey and discussion in the exclusive members only ELMG LinkedIn Digital Control Group the most popular features and benefits of the digital power electronics control processor suggested were these. (not in any particular order of priority).
Number of bits
ADC sample and hold time
ADC aperture time
Tool chain flexibility and support
Interrupts? PWM capability?
There was no mention of interrupt capability and no mention of PWM precision or PWM peripheral capability. This may be because it is no longer the issue it was fifteen years ago.
Boundary scan and what we have always done
Surprisingly no one mentioned boundary scan for testing which we at ELMG find very useful.
Also surprising that the “we have used this processor forever and so will not change” was not mentioned in the Linkedin group discussion.
Will the purchasing department choose?
Before we get into technical details of processors it is useful to step back and remember that the supply chain for the chip needs to be secure. Typically to a purchasing person this means that
The supplier is not going to go out of business.
The supplier has committed to not discontinuing the part.
The supplier’s balance sheet is not a large risk.
The supplier does not present a geographic or political risk. If you are going to buy processors in large volumes natural disasters and revolutions can effect availability.
The supplier has good pricing.
If you are find yourself in the situation where there is no engineering choice of supplier best steps are to assess the proposed digital power electronics control processor against the “what is important” list above.
Some digital power electronics control processor options
There are a large number of processors that will do a good job.
A few stand out as having proved themselves useful over the years.
Microchip PIC and DSPic series
Luminary Stellaris Cortex M3
Ti C2000 Series
Microchip make great power control processors. The processors and the peripherals around them are a really good choice of control processors for power electronics. Typically purchasing departments love Microchip as a supplier.
Key strengths of the PIC and DSPic parts are the great support from Microchip and the microchip community. There are a large number of development kits that are available where the code, circuit and PCB layouts are all made available. Examples of these include a 200W microinverter design and digital power starter kit.
Luminary microprocessors are ARM Cortex M3 parts. The parts are excellent as they leverage the ARM eco-system of tools. Initially we were reluctant to use these as the Luminary balance sheet was not as strong as it could be. Then Texas Instruments (Ti) bought Luminary and integrated the products into the Ti range. It is possible that Ti are not as committed as they were to the Luminary M3 parts. Before you consider these parts make sure to ensure that the risk, or otherwise, of the processor being discontinued is clear.
Texas Instruments – C2000 series
Ti make very good digital power electronic controller processors. The C2000 series provide a wide range of processors for power electronics.
Key features of these parts that make them most useful are
Very flexible three phase PWM
Good ADCs with synchronized sampling for three phases
Good code protection
Good tool chain
A part numbering example is TMS320F2812. The TMS320 is the family. The F identifies the flash part and the 2812 is the model number. The part is referred to as the twenty eight twelve. This particular model is 32 bit with sixteen 12 bit ADCs and sixteen PWM channels. This twenty eight twelve processor has been the workhorse for many motor drives and power supplies. Other variants including the 2808 (twenty eight oh eight) are equally useful.
To extend the range upward Ti provide the Delfino range typified by the TMS320F28335 (twenty eight three three five). This is a floating point part. The lower end of the range is covered by the Piccolo which is typified by the TMS320F28027. (Twenty eight oh two seven).
Why is it called the C2000 series?
The entire family of the C2000 series use the same code tools, and, if the code is structured well it can be ported directly from one processor to the other.
And it is called the C2000 series because the first parts available were ROM parts which had a C in the part number (C is short for ROM) instead of the F for Flash.
Ti product support is good though it can be a little slow at times. Pre-release silicon, labelled TMX, is often available from your local Ti supply chain.
The part data sheets are comprehensive and the discussion forums hosted by Ti are useful and often very productive.
Ti has a number of my favorite digital power electronic controller parts including the 2812 and the 28027.
The Xilinx FPGAs are not strictly designed as power electronics control processors. They are Field Programmable Gate Arrays and so can do anything imaginable. FPGA’s suit power electronics control very well.
Often it is the peripherals in a power electronics processor that force the choice. Typically a requirement for ADCs with a certain sample rate and a PWM that can make a certain waveform without excessive processor load force a certain choice.
If the MCU with the exact right combination of peripherals that you want does not exist then extra hardware is required. Typically the selection process for an off the shelf processor part is always a compromise.
As an example, a peripheral set like
3 CAN Bus connections
3 Ethernet along with
A five level three phase converter switching control with dead time compensation
can be implemented in a FPGA but a processor at reasonable price with this exact feature set is unlikely.
The beauty of the FPGA in this situation is that it’s peripheral set can be made totally customisable. The design can be exactly as you need it.
Off the Shelf IP Core blocks
There are a number of off the shelf (OTS) IP Core blocks that can be used. HDMI, SATA, VGA, Quad SPI, I2C, USB, high-speed serial, PCIe, UART, SPI, I2C, Ethernet and industrial ethernet like Ethercat are all available off the shelf. There are even open source solutions for some of these blocks. These open source solutions come with very little support. Commercial and proven blocks with support from vendors are usually better.
When building a power electronic controller the ELMG power electronics Control IP Core Blocks such as space vector modulators, phase locked loops and resonant controllers can be used along with off the shelf Ethernet stacks, USB connections and CAN bus controllers. This gives a powerful custom digital power electronics control processor.
Extremely Complex Control – Too complex for the average engineer?
Complex control systems for power converters can be implemented using FPGAs. This allows maximum flexibility and it allows the controller to be put into an ASIC for cost down when sales volume increases.
This complexity is a perceived risk for many teams when approaching FPGA. However, since the FPGA is logic and a processor is a connection of logic gates – why not put one inside the FPGA? Then software engineers can use their existing expertise with the added power of the FPGA.
This processor in an FPGA is implemented in a soft core. A soft core, such as Xilinx’s Microblaze, is a micro built out of FPGA fabric.
The beauty of a soft core is that it can take any shape; small in size, really fast, an MPU or an MCU, with a multiplier or not. This allows you to size the softcore to your application.
Peripherals are then attached to the soft core. As an example, a custom three level PWM, 4 UARTs and 2 SPIs and you can then write C code for the soft core.
To take advantage of the FPGAs power add an ELMG Digital Power IP core block to accelerate the C code where it needs to be fast. This allows you to use your existing C coding capability.
As an example, perform data transfer from an ADC using C, filter it fast and efficiently in FPGA fabric and then use the soft core with C to send it to a DAC or a custom PWM.
Best digital power electronics control processor?
The best digital power electronics control processor platform depends on the application. Processors such as those from Microchip, Luminary and Texas Instruments are very good and are typically a good choice. The ADC, processing and PWM performance determines which processors are suitable. Additional communications and control peripherals then decide which processor part is best.
Successful power converter developments and products use and have used the Microchip, Luminary and Ti parts.
FPGA based controllers for digital power provide power and flexibility that is a level above these standard digital power electronics control processors. The ability to use soft core processors and FPGA off the shelf IP along with the Digital Power IP Core Blocks makes the controllers more flexible and more useful.
The ELMG Digital Power IP Core Blocks are planned for release in March 2015. See the list of proposed ELMG Digital Power IP Core Blocks blocks by clicking here…