Patent Description:
Power supplies are used aboard aircraft systems for producing a regulated direct current (DC) voltage for various electronic circuits. Typically, a loosely regulated bus provides the source of electrical power for various power supplies. Many electronic circuits are required to be redundant to enhance system availability and reduce failure rates to support system-level safety requirements. Often, these redundant control circuits and their associated power supplies are identical. Although redundancy can provide some level of failure mitigation in the event of random failures of either supply, identical redundant power supplies can be vulnerable to a common-mode failure that can affect both power supplies in a similar manner. Such failures can thereby interrupt the supply of power to both copies of the electronic circuit. Accordingly, there is a need for a redundant power supply controller architecture that reduces the risk of interrupting the supply of electrical power to a circuit by mitigating common-mode failure mechanisms. Examples of redundant controllers for converter could be found in patent documents <CIT> or <CIT>.

According to a first aspect, there is provided a power supply system for converting electrical power with redundant control according to claim <NUM>.

According to a second aspect, there is provided a method for converting electrical power with redundant control according to claim <NUM>.

<FIG> is a schematic block diagram of a redundant control system of the prior art. <FIG> is a schematic block diagram of a power supply controller in <FIG>. Shown in <FIG> are dual power supply <NUM>, aircraft power supply <NUM>, first power supply <NUM>, control electronics <NUM>, second power supply <NUM>, control electronics <NUM>, and airborne system <NUM>. Dual power supply <NUM> can be used for providing reliable electrical power to airborne system <NUM> by having separate first and second power supplies <NUM>, <NUM>, each of which receive input power from aircraft power supply <NUM> and produce a regulated supply voltage at the appropriate voltage level for airborne system <NUM>. First and second power supplies <NUM>, <NUM> each include the respective control electronics <NUM>, <NUM>, with exemplary first power supply <NUM> shown in <FIG>. In the illustrated embodiment, first and second power supplies <NUM>, <NUM> use pulse width modulation (PWM) for power conversion. Various means of selecting between the first and second power supply <NUM>, <NUM> can be used in the event that either first or second power supply <NUM>, <NUM> fails during operation. In some embodiments, a third or more power supply can be used with first and second power supplies <NUM>, <NUM> to achieve a desired level of redundancy. In other embodiments, other various means of power conversion can be used (e.g., including AC and/or DC supply voltages).

In a typical embodiment, first and second power supplies <NUM>, <NUM>, including associated control electronics <NUM>, <NUM>, are identical circuits that are made from commercial off-the-shelf (COTS) electronic components. Being identical in circuit design and manufacture, first and second power supplies <NUM>, <NUM> can typically be vulnerable to a common-mode fault and/or means of failure. Two separate circuits, each including circuits that share a common-mode fault, can produce erroneous outputs in response to a stress condition. Non-limiting examples of stress conditions include input voltage excursions, current load changes, electromagnetic interference, current overload, electrostatic discharge, mechanical shock, and the thermal environment. A common-mode fault can be known or unknown, and can be introduced into electronic circuits at any stage including, for example, during circuit design, chip fabrication, testing, or circuit assembly. COTS electronic components used in first and second power supplies <NUM>, <NUM>, and/or associated control electronics <NUM>, <NUM>, typically include integrated circuits (ICs) that are fabricated in large batches. A latent defect in ICs that are produced in the same batch can be an example of a common-mode fault. When dual power supply <NUM> is providing electrical power to airborne system <NUM> and a common-mode failure occurs, both first and second power supplies <NUM>, <NUM> can fail at or near the same time, thereby interrupting the supply of electrical power to airborne system <NUM>. This can be disadvantageous when it is desired that airborne system <NUM> remain energized during operation.

<FIG> is a schematic block diagram of a redundant power supply controller. Shown in <FIG> are aircraft power supply <NUM>, power supply input <NUM>, redundant power supply controller <NUM>, input filter <NUM>, startup supply <NUM>, controller selector circuit <NUM>, controller toggle input <NUM>, controller toggle flip-flop <NUM>, voltage monitoring input <NUM>, controller toggle flip-flop output <NUM>, startup controller selection input <NUM>, discrete input selector <NUM>, discrete input selector output <NUM>, exclusive OR gate <NUM>, exclusive OR gate output <NUM>, selected controller wrap-around signal <NUM>, controller selector <NUM>, controller selector output <NUM>, inverting gate <NUM>, controller selector inverted output <NUM>, gate drive circuit A <NUM>, gate drive circuit A enable <NUM>, channel A modulating input <NUM>, gate drive circuit A output <NUM>, MOSFET A <NUM>, gate A current path <NUM>, channel A current feedback device <NUM>, channel A current feedback signal <NUM>, gate drive circuit B <NUM>, gate drive circuit B enable <NUM>, channel B modulating input <NUM>, gate drive circuit B output <NUM>, MOSFET B <NUM>, gate B current path <NUM>, channel B current feedback device <NUM>, channel B current feedback signal <NUM>, power conversion unit <NUM>, power supply controller A <NUM>, controller A supply voltage <NUM>, controller A voltage feedback signal <NUM>, controller A current feedback signal <NUM>, controller A modulating output signal <NUM>, channel A current limiter <NUM>, power supply controller B <NUM>, controller B supply voltage <NUM>, controller B voltage feedback signal <NUM>, controller B current feedback signal <NUM>, controller B modulating output signal <NUM>, channel B current limiter <NUM>, power conversion unit supply current <NUM>, power conversion unit drain current <NUM>, internal supply diode <NUM>, housekeeping supply <NUM>, transformer <NUM>, power output rectifier <NUM>, power supply capacitor <NUM>, power supply output <NUM>, voltage monitoring circuit <NUM>, voltage level input terminal <NUM>, voltage feedback device <NUM>, voltage feedback device input <NUM>, voltage feedback device output <NUM>, and voltage feedback signal <NUM>. Controller toggle input <NUM> and startup controller selection input <NUM> can be referred to as external input signals.

During operation, aircraft power supply <NUM> provides electrical power at power supply input <NUM> to redundant power supply controller <NUM> via input filter <NUM>. In a typical embodiment, aircraft power supply <NUM> provides unregulated <NUM> Volt power input, which can be subject to voltage fluctuations during operation. As used in this disclosure, all voltages will be direct current (DC) voltages, unless stated otherwise. Startup supply <NUM> receives the unregulated voltage from power supply input <NUM> at input filter <NUM> and provides electrical power to the various electronic circuits within redundant power supply controller <NUM> prior to stable operation of redundant power supply controller <NUM>. As will be described, redundant power supply controller <NUM> includes two channels which are labeled as "A" and "B". Channel A can be referred to as a first channel (i.e., a first power supply controller, etc.), and channel B can be referred to as a second channel (i.e., a second power supply controller, etc.) Controller selector circuit <NUM> includes controller toggle flip-flop <NUM>, discrete input selector <NUM>, and exclusive OR gate <NUM>. Controller toggle input <NUM> provides an input to controller toggle flip-flop <NUM> that will instruct redundant power supply controller <NUM> to switch between controllers during system testing. For example, a built-in test (BIT) can invoke controller toggle input <NUM> to direct controller toggle flip-flop <NUM> to alternate between controllers. During normal operation of redundant power supply controller <NUM>, an input at controller toggle input <NUM> can also cause controllers to be switched. Voltage monitoring input <NUM> provides an indication of the output voltage level from redundant power supply controller <NUM>, as will be described. Controller toggle flip-flop <NUM> is a two-state logic device having an output that can be represented as a binary "<NUM>" or "<NUM>" (hereafter, <NUM> or <NUM>, respectively), and will switch states (i.e., either from <NUM> to <NUM>, or from <NUM> to <NUM>) in response to an input from either controller toggle input <NUM> or voltage monitoring input <NUM>, providing controller toggle flip-flop output <NUM> as an input to exclusive OR gate <NUM>. Startup controller selection input <NUM> provides an input to discrete input selector <NUM> that is indicative of which controller to be used during system startup, with discrete input selector <NUM> providing discrete input selector output <NUM> as a second input to exclusive OR gate <NUM>. Exclusive or gate <NUM> is a two-state logic device having an output of either <NUM> or <NUM> in response to controller toggle flip-flop output <NUM> and discrete input selector output <NUM>. Exclusive or gate output <NUM> from exclusive OR gate <NUM> is <NUM> if controller toggle flip-flop output <NUM> and discrete input selector output <NUM> are not the same value. In the illustrated embodiment, when exclusive OR gate output <NUM> is <NUM>, channel A is enabled. Alternatively, when exclusive OR gate output <NUM> is <NUM>, channel B is enabled. It is to be appreciated that the binary logic being represented in the present disclosure is exemplary, and that in other embodiments, different logic functions can be used to specify between the first and second channels.

Referring again to <FIG>, exclusive OR gate output <NUM> is supplied as selected controller wrap-around signal <NUM>, which can provide an indication of which controller is selected. Controller wrap-around signal <NUM> can be used to test controller selector circuit <NUM>. Controller toggle input <NUM> can be used as a built-in test command to verify that a proper response is being provided controller selector circuit <NUM>. Exclusive or gate output <NUM> is provided to controller selector <NUM>, thereby identifying which channel to be in operation (i.e., channel A or B). Controller selector <NUM> provides controller selector output <NUM> as either <NUM> or <NUM>, with controller selector output <NUM> being provided to gate drive circuit A <NUM> at gate drive circuit A enable <NUM>. Controller selector output <NUM> is inverted by inverting gate <NUM>, the inverted signal being provided to gate drive circuit B <NUM> at gate drive circuit B enable <NUM>. Accordingly, either gate drive circuit A <NUM> or gate drive circuit B <NUM> is enabled at any particular time, depending on the state of controller selector <NUM>.

Gate drive circuit A <NUM> receives channel A modulating input <NUM> from power supply controller A <NUM>, which is a signal indicative of the desired power supply voltage to be provided by redundant power supply controller <NUM>, as will be described. When gate drive circuit A <NUM> is enabled (i.e., <NUM> is input to gate drive circuit A enable <NUM>), gate drive circuit A output <NUM> is provided to MOSFET A <NUM>, thereby modulating the conduction of MOSFET A <NUM> in response to modulating input <NUM>. Accordingly, the modulated conduction of MOSFET A <NUM> modulates gate A current path <NUM>, thereby modulating current through power conversion unit <NUM>, thereby providing output power from redundant power supply controller <NUM> at the desired voltage, as will be described. Channel A current feedback device <NUM> monitors the current flowing through MOSFET A <NUM> (i.e., gate A current path <NUM>), providing channel A current feedback signal <NUM> to power supply controller A <NUM>.

Similar to the above description for channel A, gate drive circuit B <NUM> receives channel B modulating input <NUM> from power supply controller B <NUM>, which is a signal indicative of the desired power supply voltage to be provided by redundant power supply controller <NUM>, as will be described. When gate drive circuit B <NUM> is enabled (i.e., <NUM> is input to gate drive circuit B enable <NUM>), gate drive circuit B output <NUM> is provided to MOSFET B <NUM>, thereby modulating the conduction of MOSFET B <NUM> in response to modulating input <NUM>. Accordingly, the modulated conduction of MOSFET B <NUM> modulates gate B current path <NUM>, thereby modulating current through power conversion unit <NUM>, and thereby providing output power from redundant power supply controller <NUM> at the desired voltage, as will be described. Channel B current feedback device <NUM> monitors the current flowing through MOSFET B <NUM> (i.e., gate B current path <NUM>), providing channel B current feedback signal <NUM> to power supply controller B <NUM> if the current exceeds a specified threshold. In the illustrated embodiment, MOSFET A <NUM> and MOSFET B <NUM> are metal oxide semiconductor field effect transistors, which are known in the electrical art as electronic switches. In other embodiments, other types of switches can be used in place of MOSFETs, with a non-limiting example including an insulated-gate bipolar transistor (IGBT).

Referring again to <FIG>, power conversion unit <NUM> converts the input voltage at power supply input <NUM> to the desired voltage level to be produced from redundant power supply controller <NUM>, based on the modulation of gate A current path <NUM> or gate B current path <NUM>, depending on which channel is enabled. Power conversion unit <NUM> includes transformer <NUM>, which includes a primary winding and one or more secondary windings, whereby a current flowing through the primary winding induces a current in each of the one or more secondary windings by inductive coupling. Power conversion unit <NUM> includes power output rectifier <NUM> and power supply capacitor <NUM>, together which the desired DC voltage at power supply output <NUM>. In a typical embodiment, the desired output voltage is a value that is specified for the circuitry being supplied by redundant power supply controller <NUM> with non-limiting exemplary values being <NUM> V, <NUM> V, and <NUM> V. The desired output voltage can be referred to as a selected output voltage. All output voltage values are within the scope of the present disclosure. In the illustrated embodiment, transformer <NUM> is a fly-back transformer that includes a main secondary winding, for delivering output power, and an auxiliary secondary winding for providing electrical power via internal supply diode <NUM> to housekeeping supply <NUM>. When redundant power supply controller <NUM> is first energized, startup supply <NUM> provides electrical power to the various circuits within redundant power supply controller <NUM>, as described earlier. As the startup of redundant power supply controller <NUM> continues, with power conversion unit drain current <NUM> being modulated by MOSFET A <NUM> or MOSFET B <NUM>, housekeeping supply <NUM> provides electrical power to the various electronic circuits within redundant power supply controller <NUM>. In some embodiments, transformer <NUM> can be a transformer different from a fly-back transformer, with a non-limiting example including a forward-mode transformer. In other embodiments, an inductor can be used (e.g., as with a buck or a buck-boost circuit topology). In yet other embodiments, power output rectifier <NUM> can be a full-wave or bridge rectifier. In yet other embodiments, power conversion unit <NUM> can be a different circuit configuration that converts the input voltage at power supply input <NUM> to the desired voltage level to be produced from redundant power supply controller <NUM>, with non-limiting examples including buck converter, boost converter, buck-boost converter, forward converter, and single-ended primary-inductor converter (SEPIC).

Referring again to <FIG>, power supply controller A <NUM> receives controller A supply voltage <NUM> via channel A current limiter <NUM>, and power supply controller B <NUM> receives controller B supply voltage <NUM> via channel B current limiter <NUM>. Channel A and B current limiters <NUM>, <NUM> limit current flow through the respective power supply controller A or B <NUM>, <NUM>, as may occur during a fault condition, thereby not depriving the unaffected power supply controller A or B <NUM>, <NUM> of electrical power from housekeeping supply <NUM> or startup supply <NUM>, as applicable. Power supply controller A and B <NUM>, <NUM> each receive respective controller A or B voltage feedback signal <NUM>, <NUM> from voltage feedback device output <NUM>, in turn providing a respective controller A and B modulating output signal <NUM>, <NUM>. Power supply controller A and B <NUM>, <NUM> each receive respective controller A or B current feedback signal <NUM>, <NUM> in response to current flow through respective channel A or B current feedback device <NUM>, <NUM>, as described earlier. Controller A and B modulating output signal <NUM>, <NUM> is provided to respective gate drive circuit A and B <NUM>, <NUM>, as described earlier, in response to respective controller A or B voltage feedback signal <NUM>, <NUM> and respective controller A or B current feedback signal <NUM>, <NUM>.

In the illustrated embodiment, power supply controller A and B <NUM>, <NUM> each provide a respective controller A or B modulating output signal <NUM>, <NUM> using a pulse width modulation (PWM) scheme. PWM is used in a switching power supply to provide a regulated output voltage with a relatively high efficiency as compared to other voltage regulation schemes. In PWM, a rectangular pulse train is provided at a particular pulse rate (i.e., frequency) to power conversion unit <NUM>, with the width of each pulse being controlled to result in a desired output voltage level. A wider pulse generally results in more power being delivered to power conversion unit <NUM>, thereby providing a greater current output at power supply output <NUM> in response to a greater load. In the illustrated embodiment, power supply controller A and B <NUM>, <NUM> operate at a frequency that can range from about <NUM> - <NUM>. In some embodiments, the frequency that can range from about <NUM> - <NUM>. In other embodiments, the frequency can be lower than <NUM>. In yet other embodiments, the frequency can be higher than <NUM>. In some of these other embodiments, the frequency can be <NUM> or higher. In describing PWM, a duty cycle can be defined as the percentage of time that a pulse exists (i.e., MOSFET A or B <NUM>, <NUM> is conducting). It can be appreciated that a particular duty cycle can be dictated by the load on redundant power supply controller <NUM> with regard to the voltages of power supply input <NUM> and power supply output <NUM>, and in various embodiments, the duty cycle can vary. In alternative embodiments, power supply controller A and/or B <NUM>, <NUM> can use a modulation scheme other than PWM. Non-limiting examples of modulation schemes include pulse frequency modulation (PFM) and pulse density modulation (PDM). All modulation schemes for power supply controller A and/or B <NUM>, <NUM> are within the scope of the present disclosure.

Referring again to <FIG>, redundant power supply controller <NUM> includes several architectural fault mitigation techniques, as were described above. Channel A and B current limiters <NUM>, <NUM> limit current flow through the respective power supply controller A or B <NUM>, <NUM>, as may occur curing a fault condition, thereby not depriving the unaffected power supply controller A or B <NUM>, <NUM> of electrical power. Power supply controllers A and B <NUM>, <NUM> each receive respective channel A or B current feedback signal <NUM>, <NUM> from respective channel A or B current feedback devices <NUM>, <NUM>. Redundant power supply controller <NUM> includes controller selector circuit <NUM> and voltage monitoring circuit <NUM>, which directs redundant power supply controller <NUM> to switch to an alternate channel in the event of a fault on the current channel, while also allowing an external signal to result in a channel transfer. The automatic channel transfer by redundant power supply controller <NUM> will be described in detail later, in regard to FIGS.

Redundant power supply controller <NUM> includes COTS electronic components, which offer many advantages over the procurement of specialized electronic components, such as low cost, ready supply availability, and ease of integration. It is to be appreciated that any electronic component can be prone to failure when subjected to a particular stress. Accordingly, it is an object of the present disclosure to mitigate the possibility of a common-mode failure of power supply controller A and B <NUM>, <NUM> by providing an architectural mitigation technique that addresses common-mode design errors for complex COTS power supply components relative to a system's common mode analysis, while also eliminating or reducing the possibility of one power supply controller A or B <NUM>, <NUM> having an adverse impact on the other. As used in the present disclosure, an adverse impact can be defined as a fault by one controller that prevents the other controller from operating so as to provide voltage at power supply output <NUM> within the specified voltage tolerance. A non-limiting example of a specified voltage tolerance is +<NUM>%. For example, if a desired output voltage at power supply output <NUM> is <NUM> VDC +<NUM>%, the allowable tolerance band is <NUM> - <NUM> VDC. It is to be appreciated that in various embodiments, redundant power supply controller <NUM> can have various desired voltage output levels and various tolerance bands. Non-limiting examples of voltages include +<NUM> V, -<NUM> V, and +5V. In various embodiments, tolerance values can range from about +<NUM>% to +<NUM>%, however tolerance values outside of this range can also be used in some embodiments (i.e., narrower than +<NUM>% or wider than +<NUM>%). Moreover, in some embodiments, a particular tolerance band can be asymmetrical (e.g., + <NUM>%, - <NUM>%).

To achieve the objective of architectural common-mode fault mitigation, redundant power supply controller <NUM> utilizes a concept of power supply controller diversity, which can be achieved by one or more of several possible methods. As used in this disclosure, power supply controller diversity refers to a physical, structural, or operational difference between power supply controller A <NUM> and power supply controller B <NUM>. The following description provides non-limiting examples of power supply controller diversity (i.e., with regard to a first and second power supply controller).

Different minimum and/or maximum duty cycles: power supply controllers A and B <NUM>, <NUM> can each have a different specification for minimum and/or maximum operating duty cycle. This can be referred to as duty cycle diversity. The first power supply controller can have a first maximum operating duty cycle (i.e., measured as a percentage), and the second power supply controller can have a second maximum operating duty cycle (i.e., measured as a percentage). Accordingly, duty cycle diversity can be expressed as a percentage point (%p) difference between the first and second maximum operating duty cycle values. In an exemplary embodiment, duty cycle diversity can be at least <NUM>%p. It is to be appreciated that a specification for minimum and/or maximum operating duty cycle can be indicative of a design structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, duty cycle diversity can result in different chips that mitigate common-mode fault.

Different frequencies: power supply controllers A and B <NUM>, <NUM> can each operate at a different pulse modulation frequency. This can be referred to as frequency diversity. In a particular embodiment, an operating frequency (i.e., pulse modulation frequency) can be a result of a minimum and/or maximum frequency that is specified for a particular controller. A non-limiting example of different frequencies is <NUM> for a first power supply controller and <NUM> for a second power supply controller. In some embodiments, a frequency difference of about <NUM>% can be sufficient to provide power supply controller diversity. In these embodiments, one frequency is at least <NUM>% higher than the other (i.e., the ratio between the higher maximum frequency and the lower maximum frequency is at least <NUM>). In some embodiments, the frequency difference can be less than <NUM>%. In other embodiments, the frequency difference can be more than <NUM>%. It is to be appreciated that a specification for minimum and/or maximum frequency can be indicative of a design structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, frequency diversity can result in different chips that mitigate common-mode fault.

Different power supply requirement specifications: power supply controllers A and B <NUM>, <NUM> can each have a different specification for minimum and/or maximum startup voltage and/or minimum and/or maximum operating voltage. This can be referred to as power supply requirement diversity. A non-limiting example of different minimum startup voltages is <NUM> V for a first power supply controller and <NUM> V for a second power supply controller. In some embodiments, one controller can have a minimum or maximum specification voltage value that is at least <NUM> V different from that of another controller, with the particular specification voltage being any one or more of minimum startup voltage, minimum operating voltage, maximum startup voltage, maximum operating voltage. It is to be appreciated that a specification for minimum startup and/or operating voltage can be indicative of a design structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, power supply requirement diversity can result in different chips that mitigate common-mode fault.

Different power supply controller manufacturers: power supply controllers A and B <NUM>, <NUM> can each be supplied by a different manufacturer. This can be referred to as manufacturer diversity. Non-limiting examples of manufacturers of power supply controllers are ANALOG DEVICES™, TI™, MAXIM™, ST MICROELECTRONICS™, and ONSEMI™. It is to be appreciated a particular manufacturer can be indicative of a design structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, manufacturer diversity can result in different chips that mitigate common-mode fault.

Different power supply controller part numbers: power supply controllers A and B <NUM>, <NUM> can each have a different part number, even if supplied by the same manufacturer. This can be referred to as part number diversity. A non-limiting example of different part numbers supplied by ANALOG DEVICES™ is LT1241 for a first power supply controller and LT1243 for a for a second power supply controller. It is to be appreciated that a power supply controller part number can be indicative of a design structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, power supply controller part number diversity can result in different chips that mitigate common-mode fault.

Different semiconductor foundries: power supply controllers A and B <NUM>, <NUM> can each be manufactured at a different semiconductor foundry, even if supplied by the same manufacturer and/or having the same part number. This can be referred to as foundry diversity. It is to be appreciated that a semiconductor foundry can be indicative of a manufacturing (i.e., wafer fabrication) structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, foundry diversity can result in different chips that mitigate common-mode fault.

Different fabrication lines: power supply controllers A and B <NUM>, <NUM> can each be manufactured in a different fabrication line, even if supplied by the same manufacturer and/or having the same part number and/or manufactured in the same semiconductor foundry. This can be referred to as fabrication line diversity. It is to be appreciated that a semiconductor foundry can be indicative of a manufacturing (i.e., wafer fabrication) structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, fabrication line diversity can result in different chips that mitigate common-mode fault.

Different fabrication batches: power supply controllers A and B <NUM>, <NUM> can each be manufactured in different fabrication batches, even if supplied by the same manufacturer and/or having the same part number and/or manufactured in the same semiconductor foundry and/or manufactured in the same fabrication line. This can be referred to as fabrication batch diversity. In some embodiments, a date of manufacture (i.e., manufacturing date) can be indicative of a different fabrication batch. It is to be appreciated that a fabrication batch can be indicative of a manufacturing (i.e., wafer fabrication) structure of a particular chip (i.e., integrated circuit, silicon chip). Accordingly, fabrication batch diversity can result in different chips that mitigate common-mode fault. Moreover, manufacturing date diversity can result in different chips that mitigate common-mode fault.

The operation of redundant power supply controller <NUM> in response to a fault occurring in a particular power supply controller A or B <NUM>, <NUM> will be described in reference to the following figures. <FIG> is a waveform showing the output voltage from the redundant power supply controller. <FIG> is a waveform showing the in regulation status of the redundant power supply controller. <FIG> is a waveform showing the power good status of the redundant power supply controller. <FIG> is a waveform showing the startup controller selection status of the redundant power supply controller. <FIG> is a waveform showing the controller toggle bit status of the redundant power supply controller. Shown in <FIG> on a common time axis are output voltage graph <NUM>, controller A startup ramp <NUM>, minimum voltage <NUM>, target voltage <NUM>, controller A steady operation <NUM>, controller A fault occurrence <NUM>, controller A excursion phase <NUM>, maximum voltage <NUM>, controller B restoration phase <NUM>, target voltage <NUM>, controller B steady operation <NUM>, regulation signal graph <NUM>, not in regulation <NUM>, in regulation transition <NUM>, in regulation <NUM>, not in regulation transition <NUM>, not in regulation <NUM>, not in regulation period <NUM>, in regulation transition <NUM>, in regulation <NUM>, power good signal graph <NUM>, power not good <NUM>, power good delay period <NUM>, power good transition <NUM>, power good <NUM>, power not good transition <NUM>, power good delay period <NUM>, power good transition <NUM>, power good <NUM>, controller toggle bit graph <NUM>, use startup controller <NUM>, alternate controller transition <NUM>, use alternate controller <NUM>, controller enable signal graph <NUM>, controller A enabled <NUM>, controller B transition <NUM>, and controller B enabled <NUM>. In the exemplary embodiment shown in <FIG>, redundant power supply controller <NUM> is configured to provide an output voltage (Vout) of <NUM> V, with a tolerance of ± <NUM>% (i.e., <NUM> - <NUM> V).

After power supply input <NUM> is applied to redundant power supply controller <NUM> at t<NUM>, discrete input selector <NUM> programs discrete input selector output <NUM> to identify controller A as the startup controller. Accordingly, controller A is enabled as shown in controller enable signal graph <NUM>, and channel A (i.e., power supply controller A <NUM>, gate drive circuit A <NUM>, MOSFET A <NUM>) are supplying power to power conversion unit <NUM>, resulting in an increase in output voltage (Vout). Initially, regulation signal graph <NUM> indicates not in regulation <NUM>, and power good signal graph <NUM> indicates power not good <NUM>. Controller A startup ramp <NUM> occurs from a soft-start function programmed into power supply controllers A and B <NUM>, <NUM>, thereby limiting a starting current surge. In a typical embodiment, the duration of controller A startup ramp <NUM> can be about <NUM> - <NUM> msec. The output voltage achieves minimum voltage <NUM> (i.e., <NUM> V) at ti, thereby producing in regulation transition <NUM>. It is noted that power not good <NUM> remains on power good signal graph <NUM> because of power good delay period <NUM> in voltage monitoring circuit <NUM>. In a typical embodiment, power good delay period <NUM> can be about <NUM> - <NUM> msec. The output voltage continues to increase, achieving target voltage <NUM> (i.e., <NUM> V) at t<NUM>, resulting in controller A steady operation <NUM>. In the exemplary operation shown in FIGS. 4A - 4F, power not good <NUM> persists until after target voltage <NUM> at t<NUM>, as a result of power good delay period <NUM>. Thereafter, power good transition <NUM> occurs at t<NUM>, resulting in power good <NUM> status. In the absence of an internal fault or external signal, redundant power supply controller <NUM> can continue supplying power indefinitely, so long as power supply input <NUM> is applied.

Next, a fault occurring with controller A (i.e., channel A, power supply controller A <NUM>) will be described. At controller A fault occurrence <NUM>, controller A excursion phase <NUM> begins whereby the output voltage begins increasing. The output voltage achieves maximum voltage <NUM> (i.e., <NUM> V) at t<NUM>, thereby causing voltage monitoring circuit <NUM> to provide voltage monitoring input <NUM> to controller selector circuit <NUM> as described above in regard to <FIG>. This is reflected by not in regulation transition <NUM> and power not good transition <NUM> at t4, thereby triggering alternate controller transition <NUM> to use alternate controller <NUM>, and in turn controller B transition <NUM>, thereby directing controller B enabled <NUM>. Accordingly, controller A (i.e., channel A, power supply controller A <NUM>) is disabled and controller B (i.e., channel B power supply controller B <NUM>) is enabled, and controller B begins operation, resulting in controller B restoration phase <NUM>, and ultimately achieving target voltage <NUM> (i.e., <NUM> V) for controller B steady operation <NUM>. As shown in <FIG>, not in regulation <NUM> persists for not in regulation period <NUM>. In the exemplary embodiment shown in <FIG>, not in regulation period <NUM> can be about <NUM> - <NUM>µsec. In other embodiments, redundant power supply controller <NUM> can be configured to provide not in regulation period <NUM> either shorter than <NUM>µsec or longer than <NUM>µsec. As shown in <FIG>, power good delay period <NUM> delays power good transition <NUM> until t<NUM>. In the illustrated embodiment, power good delay period <NUM> can be about <NUM> - <NUM> msec, and can be similar to power good delay period <NUM> occurring at t<NUM>.

Claim 1:
A power supply system (<NUM>) for converting electrical power with redundant control, the power supply system comprising:
a power conversion unit (<NUM>) configured to provide a regulated output voltage;
a first power supply controller (<NUM>), configured to control the power conversion unit such that the regulated output voltage is within a selected range;
a second power supply controller (<NUM>), having a power supply controller diversity from the first power supply controller, configured to control the power conversion unit such that the regulated output voltage is within a selected range; and
a controller selector (<NUM>), configured to enable either the first power supply controller or the second power supply controller, in response to a control signal from a logic control circuit;
the power supply controller diversity is power supply requirement diversity; and
wherein the first power supply controller has a first controller power input requirement defining a first input voltage characteristic;
wherein the second power supply controller has a second controller power input requirement defining a second input voltage characteristic;
the power supply requirement diversity is diversity between the first controller power input requirement and the second controller power input requirement that is selected from the group consisting of minimum startup voltage, minimum operating voltage, maximum startup voltage, and maximum operating voltage; wherein
a difference between the first input voltage characteristic and the second first input voltage characteristic is at least <NUM> volts.