Over-current and over-voltage protection

Imperix products are designed to prioritize safety, giving users the confidence needed to move straight to laboratory testing as soon as possible.

This article aims to provide insight into how embedded over-current and over-voltage protection work to ensure the safety of personnel and equipment during operation, and to point to relevant resources to ensure the correct configuration of these safety features.

Protection of imperix equipment

Imperix equipment can be easily integrated in compliance with safety requirements. With respect to equipment protection, imperix systems rely on two categories of devices and mechanisms.

External energy-limiting devices

Energy-limiting devices (circuit breakers, fuses, TVS, etc.) are implemented when required, typically with equipment meant to be connected to the utility grid. By essence, energy-limiting devices can break a fault (current or voltage), but cannot detect a fault early (i.e., before a critical energy level). This provides an indispensable layer of protection, but it is unfortunately too slow (a few milliseconds to hundreds of milliseconds) to avoid any damage, notably to power semiconductors.

In a power electronics environment, such safety devices can be considered as effective solely against risks of fire. For the vast majority of other purposes, they offer insufficient limitation of the fault energy, which can already significantly damage the equipment. Notably, supplementary mechanisms offering lower thresholds and/or faster reaction times are indispensable for protecting power semiconductors.

Fast threshold-based protections

Fast threshold-based protections guarantee reaction times in accordance with the typical current and voltage rise rates in power electronic systems (down to sub-microsecond time scales). These operate by blocking the semiconductor devices before a critical level is reached, leaving the currents to vanish naturally. This is very effective with voltage source converters (VSCs). However, such protections cannot cover all sorts of faults, notably due to the free-wheeling current paths that inevitably exist in most power switches.

Imperix equipment offers three distinct types of fast threshold-based protections:

• Fixed hardware protections inside imperix power modules. These implement non-configurable over-current, over-voltage, and over-temperature thresholds, set at the maximum admissible ratings of the modules. These represent last-resort protections, which can prove useful when imperix modules are used with third-party controllers. However, the pre-programmed thresholds may prove to be excessive with respect to the overall application or other pieces of equipment.
• Programmable hardware protections inside imperix controllers. These implement easily configurable thresholds, which can be adjusted closely to the planned operating points of the application. Different protection characteristics exist among imperix controllers (see below).
• User-defined software protections inside the application software. These do not exist by default, but can always be implemented inside the control algorithms, typically using software comparisons. Despite a slower reaction time (that is a function of the control execution rate), software protections can easily implement non-constant thresholds, or be activated/deactivated as a function of the operating state of the system (e.g. a minimum voltage protection on a DC bus is extremely inconvenient otherwise).

An example involving all three layers of protection is given further down the article.

Principles of use and operation

On all imperix controllers, safety limits operate as follows:

1. When an over-current or over-voltage occurs, the imperix controller instantly blocks all PWM outputs and switches its operating state to FAULT.
2. A log message is made available in Cockpit indicating on which channel the fault occurred. On B-Box 3 and 4 devices, the origin of the fault is also indicated by a steady orange LED on the corresponding RJ45 socket (see the individual product documentation for details).
3. Once the root cause of the fault is well understood by the operator, the fault can be acknowledged, reverting the system back to its BLOCKED state.
4. PWM outputs can then be re-enabled in Cockpit.

The protections available on imperix controllers are compared in the table below. Other differences between them are described in PN250. Product notes related to a specific imperix controller are linked here below:

1. Programming the protections on the B-Box 4
2. Programming the protections on the B-Box RCP 3.0
3. Programming the protections on the B-Box micro
4. Protections on the TPI 8032
5. Protections on the B-Board PRO

¹ The external analog inputs of the TPI 8032 do NOT offer hardware protections.
² Saving/restoring the protection configuration requires a USB key on the B-Box RCP3.0, as it is entirely independent of Cockpit.

Quick configuration guidelines

Selection of the protection thresholds

When working with imperix equipment, user-defined over-current and over-voltage thresholds shall be selected as to protect the imperix equipment but also the surrounding equipment.

Indeed, safety limits defined on the imperix controller also contribute to the protection of auxiliary equipment. An elementary but critical example of that is the over-voltage protection of a DC bus, which is fundamental to the protection of a DC power supply connected to that bus, especially if that source is unidirectional and/or rated for a lower voltage than the imperix modules. As such, imperix recommends to :

1. Always select protection thresholds as close as possible to the planned operating points.
2. Be very careful when including some margin in the selection of the thresholds. The overload capability of power electronic circuits is generally extremely limited.
3. Seek to constantly consider the weakest element in the system, as it may not necessarily be a power module, but a power supply, a cable, a resistor, etc.
4. Test protections with lower limits in case of any doubts.

Scaling of the protection thresholds

The quantities measured by imperix controllers go through the analog chain as shown in the figure below. The protection is acting on either the pre-conversion ADC value (B-Box RCP 3.0) or the post-conversion ADC values (B-Box 4, B-Box micro, TPI). In both cases, the ADC value can be computed using the following equation:

$$ \text{value for protection} = \text{true value} * \text{sensor sensitivity} * \text{programmable gain}$$

Configuration of the protection thresholds

B-Box 4

Detailed information regarding the configuration of analog I/Os is given in PN252. Regarding the configuration of the safety limits, two cases should be distinguished:

• B-Box 4 can automatically identify and read the sensitivity and offset information from compatible sensors (read more in PN255). In this case, safety limits can be configured in true value, i.e., typically as a voltage or current before the sensor (e.g., in hundreds of Volts, or Amperes).
• With older or third-party sensors, auto-identification is not available. In this case, safety limits must be configured based on the value for protection, i.e., taking the sensor sensitivity into consideration manually.

In order to configure the safety limits, two approaches are possible:

• In Cockpit, by accessing the “Analog I/Os” configuration. It can be reached through the “Targets” pane and by selecting the desired controller.
• Using the front-panel (LCD screen and rotary button) and similarly browsing to the “Analog I/Os” menu.

With B-Box 4, two safety-related settings can be configured:

• The safety limits themselves (HIGH and LOW thresholds) between -10V and +10V.
• The reaction speed: ULTRA-FAST (800ns) or FAST (1.6us). FAST is recommended, except for extremely fast switching applications with high dI/dt.

B-Box RCP 3.0

Detailed information on the analog input stage is given in PN105. This note also provides complete details regarding the configuration of the safety limits. In short:

• Limits can only be configured using the front panel (LCD screen and rotary button).
• Thresholds can either both be enabled or disabled. An ON/OFF setting is available for that.
• On B-Box 3, all safety limits must be configured as a voltage on the ADC, taking into account the programmable gain (G=1, 2, 4, or 8) if different than unity :

$$ \text{threshold} = \text{true limit}*\text{sensitivity}*\text{programmable gain}$$

B-Box micro

Configuration of the safety limits on B-Box micro must be done using Cockpit in the dedicated “Analog inputs” tab of the target information (“Targets” pane). More information is given in PN107.

With B-Box micro, safety limits must be configured as a voltage on the ADC, within -5V and +5V. Both thresholds can be either enabled or disabled simultaneously.

TPI 8032

The TPI 8032 has a built-in protection circuit against over-current, over-voltage, and over-temperature. The protection thresholds are dynamically configured based on the switching frequency and DC bus voltage, accounting for converter and EMC filter derating. The corresponding protection thresholds are therefore not user-configurable.

External analog inputs cannot implement protections.

Custom over-current or over-voltage detection mechanisms with more complex logic can nonetheless be implemented in the application-level software (e.g., Simulink/PLECS model).

Additional details can be found in the TPI8032 datasheet.

B-Board PRO

The B-Board PRO does not possess pre-implemented safety limits on analog inputs. However, fault line inputs allow integration of external fault flags/triggers into the fault manager, blocking PWM outputs accordingly. Such a fault automatically clears once the corresponding line is reset.

Additional details can be found in the B-Board PRO datasheet.

Example: protections in practice

The application note: Single-phase PV inverter with Fictive-Axis Emulation (AN003) provides an example of how the various protection mechanisms come together to provide comprehensive protection.

In this example, several measurements are key to the system protection:

With the B-Box 4, fault source identification is displayed on the screen, the RJ45 LEDs, and Cockpit. If the RJ45 cables are labelled with the signal they carry, this is a quick way to trace the fault back to its original cause.

In this picture, some over-current faults have been triggered, instantly placing the controller in FAULT state.