MOSFET's as safety switches - Page 1
Forum section: electronics / projects

author: Simon
author_rank: Unknown
timestamp: July 20, 2021, 08:42:43 am
content: I see that any battery BMS has MOSFET's as the primary protection switch. But most often when a MOSFET fails it fails closed circuit which offers no protection at all.So to take an example I have a little pack of cells, the protection PCB has 4 MOSFET's . 2 parallel pairs of back to back series pairs. I found the datasheet and they are 15A continuous and 80A repetitive pulse at 150C at the die. The battery datasheet states that the total internal resistance of the battery is 120mR including the protection PCB. The pack can supply 12V so that in 100A short circuit current.So the total rating of the protection MOSFET's is 30A continuous and 160A pulsed. How long it would take the silicon to get to 150C I don't know. So it looks like the MOSFET's have been rated to take a full short circuit current for an amount of time that is enough for the protection circuitry to react and turn them off.Are there any standard guidelines for designing this sort of thing? I think of things like smart MOSFET's and smart fuses that are literally one chip solutions to stop the worse that happens which would continue to happen should their own silicon fail.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: July 20, 2021, 09:49:32 am
content: Yes. You're looking for electronic fuses, limiters, hot-plug controllers, wired-OR controllers, and other power management, switching and protection devices.The MOSFETs can probably endure that for a few hundred microseconds, maybe a few ms. This can be calculated from the SOA curve, or transient thermal response curve. The calculation is inexact, unfortunately, because the waveform has to be integrated over time, including how power changes in that time (a hard shorted load, will likely see the current fall with time, partly due to the MOSFETs' own Rds(on) increasing as they heat up, and maybe the load or wiring has the same response as well).For design purposes, some safety headroom can be included by assuming a square pulse of maximum power, and rounding up pulse length to the next longer time scale. Then you have high confidence that, if the control operates in less than that time, operation will be safe and reliable.For hard saturated operation (MOSFETs hard on/off), typically you'll choose very low Rds(on), so that fault current is limited by circuit resistance, and rather high fault current can be drawn before protection has to operate -- this allows clearing external fuses, or on-board as the case may be. (What type, depends on how much the switches can handle. Note that polyfuses take a long time to open (~100s ms), while small fast-blow chip fuses can open in a few ms. Either is possible, though polyfuses are more likely to be practical at low currents (up to a few amperes), then conventional fuses take over from there. Whatever the case, check the time curves and I2t for the fuse in question.)For current limiting operation, significant voltage is dropped across the MOSFETs during fault, greatly increasing power dissipation. This sounds bad, but if the current is limited to say 10A instead of 100, at the cost of increasing voltage from 1V to 10, it's a wash, you get the same pulse width. Often, it doesn't scale as well, so you don't get much fault time (a few ms, even 100s us at high voltages), or you need a whole lot of MOSFETs in parallel to handle enough power.Can also do a buck or boost converter, where instead of cooking in the linear range, a hysteretic controller dithers the switch, keeping load current constant (i.e., near or below the maximum); power still has to be dissipated somewhere, but it can be something cheap and dumb, like a TVS (or stack thereof), or power resistor. Or nothing at all, if a supply is available to dump the excess into (which is relevant here, from battery -- it's just an ordinary current-mode buck regulator!).Tim

author: Simon
author_rank: Unknown
timestamp: July 20, 2021, 09:59:33 am
content: Thanks Tim. I was just curious about the rational of how the MOSFET's are sized and that presumably the MOSFET's are trusted as is the controller chip to react in time every time. On the one hand I am told that you should have a hard switch for protecting stuff like batteries but on the other hand the world is full of silicon protection devices on things that can go spectacularly wrong like the 3.6kWh batteries we have here.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: July 20, 2021, 10:31:10 am
content: I think you always want a hard fuse if nothing else; but as for how much semiconductors count, if any, I think you'll need to refer to a particular standard. Alas, I don't know any offhand...Tim

author: Berni
author_rank: Super Contributor
timestamp: July 20, 2021, 10:52:53 am
content: Pretty much all semiconductor based switches tend to fail into a short circuit state, since large overloads melt the thing into a solid blob of conductive metal.So yes it is always a good idea to have some form of backup protection like a fuse or disconnect switch or contractor or something.A lot of small battery protection circuits have a fuse on board in case the electronic protection fails. For larger packs its typically your own responsibility to insert some sort of fuse on the wires coming out. Very large battery packs like in EVs pretty much always have a contractor right at the battery pack since the voltages are so high that they pose a electrocution hazard.As for sizeing the MOSFET for the short circuit spike the most useful spec is the avalanche energy in Joules. This is simply your Power x Time that you are allowed to dissipate on a short timescale of a single switching transition. You can find this number in a SPICE simulation or measure it by recording both voltage and current with a scope. Most general purpose power mosfets have this figure in about 10 to 100 mJ, the larger ones might have >500mJ and the particularly good pulse withstanding ones have >1J. As suggested before, the SOA curve will also give you some insight in what is safe to do, as there are typically different SOA areas for different pulse durations. Having a large avalanche energy capability will typically require a large silicon die to provide the thermal mass for it, so these nice sturdy transistors tend to cost a good deal more than its more delicate equivalents that still have the same max current spec.

author: Simon
author_rank: Unknown
timestamp: July 20, 2021, 11:51:18 am
content: Well the big battery we have here indeed has a fuse as well and anything I do will, I'm just curious about the design considerations that get made and how we have smart MOSFET's and e-fuses that must literally walk the line as the device that an overload will hurt the most is the device protecting from that overload.Having said that I am struggling to find e-fuses although what they get called seems to be more of a matter of opinion.

author: Siwastaja
author_rank: Super Contributor
timestamp: July 20, 2021, 02:16:15 pm
content: Semiconductor switches fail short, but so do mechanical switches (they weld short). Of course, supersizing a contactor may be easier, but the principle is the same; know the specs, calculate if the thing is within specs in all edge cases.There's no way around careful analysis + additionally, some derating. Basically, look at SOA curves knowing how fast the driver can turn the MOSFET off. This can be an order of magnitude worse situation than some front page "peak current" spec implies.Too fast isn't good either because inductance is always present. A TVS may be needed to handle overvoltage spikes, additionally.I'm pretty sure many of the commercial designs are done without due diligence and just happen to work most of the time.Never forget classical fuse, with appropriate DC ratings (look at max DC voltage and max DC interruption current). It's the final layer of fire protection in case complicated semiconductor-based designs (or mechanical relays!) fail short. Nowadays, small SMD sizes are available for prices way less than the MOSFETs alone.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: July 20, 2021, 07:00:16 pm
content: TI's got a newish line of them:https://www.ti.com/lit/ds/symlink/tps25982.pdfNote the tiny die size -- the package is only 4x4mm QFN, but it has two middle pads and I'd be willing to bet it's a two-chip design, with the main MOSFET (with some additions for measuring temperature quickly, and current accurately) on the IN pad, and the control circuitry on the GND pad. So, the actual silicon dissipating power is pretty small, and accordingly, it responds fairly quickly, looks like 10s to 100s us depending on mode. (And it looks like they've implemented pretty much every possible mode, pretty cool!)Tim

author: Berni
author_rank: Super Contributor
timestamp: July 21, 2021, 05:14:51 am
content: For EFuses once you get to higher powers you typicaly need to look for a EFuse controller IC that switches an external MOSFET. The all in one solutions typically only go to a couple of amps. But with an external mosfet it can handle any current you like as long as you find a big enugh mosfet. Its also a factor that at very large currents PCB design becomes difficult so you need physicaly large packages that can spread out the current over a area on the board or use multiple parallel transistors to do the job.That TI EFuse is really nice tho, its rare to find such a high current and well featured one in a tiny chip like that.Also with batteries you often actually need a bidirectional fuse. Not only does it have to protect the battery from short circuits but it also has to protect it from chargers gone haywire and attempting to overcharge the battery(This is a very reliable way of setting Li Ion on fire). So in the case of a semiconductor efuse this means it needs 2 anti-series MOSFETs to prevent current flowing backwards.