Patent Description:
A number of applications, such as safety critical avionics, make use of independent, redundant power input sources. In the event that one or more of the input sources fails, another of the available redundant power input sources is employed to ensure an uninterrupted supply of power.

In such systems, the two input voltages are typically connected in "OR" using diodes. To ensure that both input voltage are working, the input voltage of sources usually separately measured at input point (before the diode). That is, in prior art systems, voltage monitoring of two sources is done using two different voltage monitoring circuits. As background, <CIT> describes a power supply system comprising a main power supply and a sub power supply which is capable of diagnosing itself with a simple configuration. Additionally, XP093045964 describes a redundant power supply with diode ORing.

A voltage supply system is provided as defined by claim <NUM>.

In embodiments, the first gate driver includes a first enable input (EN1) and the second gate driver includes a second enable input (EN2), wherein the first gate driver causes the first switch to conduct when it receives a signal at EN1 and the second gate driver causes the second switch to conduct when it receives a signal at EN2.

In embodiments, the voltage monitor controller includes logic that controls the built in test.

In embodiments, the logic causes the system to operate in a first state where both the first and second gate drives are enabled to cause both the first and second switches to be conductive.

In embodiments, the logic determines that neither of the first and second voltage sources are operational when the voltage monitor measures a voltage below an expected voltage while the system is in the first state.

In embodiments, the logic determines that at least one of the first and second voltage sources are operational when the voltage monitor measures an expected voltage while the system is in the first state.

In embodiments, when the logic determines that at least one of the first and second voltage sources are operational, the logic cycles to a second state where the first gate driver is enabled and the first switch is conductive and the second gate driver is disabled.

In embodiments, the logic determines that the first voltage source has failed and returns the system to the first state if the voltage monitor measures a value that falls below an expected value.

In embodiments, the logic determines that the first voltage source is operational when the voltage monitor measures an expected voltage while the system is in the second state and then cycles into a third state wherein the first gate driver is disable, the second gate driver is enabled and the second switch is conductive.

In embodiments, the logic determines that the second voltage source has failed and returns the system to the first or second state if the voltage monitor measures a value that falls below an expected value.

Also provided is method of testing a voltage supply system with a single circuit as defined by claim <NUM>.

In embodiments, the method can also include determining that neither of the first and second voltage sources are operational when the voltage monitor measures a voltage below an expected voltage while the system is in the first state.

In embodiments, the method can also include determining that at least one of the first and second voltage sources are operational when the voltage monitor measures an expected voltage while the system is in the first state.

In embodiments, in the method, when at least one of the first and second voltage sources are operational, switching the circuit to a second state where the first gate driver is enabled and the first switch is conductive and the second gate driver is disabled.

In embodiments, the method can also include determining that the first voltage source has failed and returns the system to the first state if the voltage monitor measures a value that falls below an expected value.

In embodiments, the method can also include: determining that the first voltage source is operational when the voltage monitor measures an expected voltage while the system is in the second state; and cycling into a third state wherein the first gate driver is disable, the second gate driver is enabled and the second switch is conductive.

In embodiments, the method can also include determining that the second voltage source has failed and returning the system to the first or second state if the voltage monitor measures a value that falls below an expected value.

As discussed above, it is common for the two input voltages to be connected in an "OR" configuration using diodes. To ensure that both input voltage are working, the status of each voltage source is typically measured with its own voltage monitor. That is, voltage monitoring of two sources is done using two different voltage monitoring circuit.

Embodiments herein disclose a system which can detect the two different voltage sources with a single monitoring circuit. This can be done without interrupting the input power to the drive device (assuming at least one of the sources is operational).

<FIG> shows a prior art system <NUM> that has two sources V_1/V_2 connected in a so-called "OR" configuration. The diodes D1 and D2 provide a configuration that allows either or both of V_1/V_2 to drive the output line <NUM>. Also included is an output capacitor C1 to smooth the output at start up and in the event one of the sources fails. Other circuit elements are self-explanatory to the skilled artisan based on <FIG>. For completeness, it is noted that an output voltage monitor VM3 can also be provided that measures the voltage output.

To ensure that each voltage source V_1/V_2 is operating properly, each voltage source is connected to a separate, respective, voltage input monitor VM1 and VM2. Having separate monitor for each voltage source V_1/V_2 can increase cost and complexity. Further, as shown by leakage path <NUM>, in some instances diode leakage current can lead to an erroneous indication that V_2 is operational even if it has failed. Of course, the opposite leakage path could also present a V_1 error.

In addition to the abovementioned single circuit operation, embodiments herein may avoid the above-described operational error due to leakage current.

In the above and the below, V_1/V_2 can be provided by, for example, rectified generator voltages, batteries or both (e.g., V_1 can be rectified power from an AC supply and V_2 can be a battery).

<FIG> shows a simplified circuit <NUM> that can test two "OR" connected voltage sources V_1/V_2. The circuit <NUM> includes two series connected flow control devices connected to the output of each voltage source V1/V2. As illustrated, the combination is formed by a series combination of a diode and a switch. Of course, other combinations could be use such as two switches and, in particular, complementary switches. The output of the respective switches can be connected together for each voltage source resulting in "OR" connected dual power supply system. The point of connection is generally shown as ORing point <NUM>. It shall be understood that other circuit elements can be connected between the outputs of the switches and the ORing point <NUM> that is also connected to the output <NUM> of the circuit <NUM>. The voltage at the ORing point <NUM>/output <NUM> can be monitored by a voltage monitor/controller <NUM> that measures voltages at the ORing point <NUM> and controls the status of the switches. The voltage monitor/controller <NUM> can be single monitor in one embodiment.

As will be understood, having the combination of a diode and a switch helps to stop the flaw of leakage current from one source to another to overcome at least one the above discussed possible shortcomings of the prior art.

As illustrated, the circuit <NUM> includes first and second power supply branches <NUM>, <NUM>. Both have outputs connected to the ORing point <NUM> and, as will be understood by the skilled artisan, can either alone or combination drive the output <NUM>. The output <NUM>/ ORing point <NUM> can be coupled to ground via an output capacitor C1.

The first power supply branch <NUM> includes the first power supply V_1. V_1 connected to the output <NUM> via a series connection of a first diode D1 and first switch S1. The first power supply branch <NUM> also includes a first gate driver <NUM>. The gate driver controls the status of the first switch S1 and includes an input <NUM>, an output <NUM>, and an enable EN1. The output <NUM> of the gate driver <NUM> is connected to the first switch S1 and controls its condition/state (e.g., open or closed). In normal operation, the first gate driver <NUM> places the first switch S1 into a conductive or closed condition so that power from the first power supply V_1 can pass through the first diode D1 and the first switch S1 to reach the ORing point <NUM>.

As shown, the circuit <NUM> includes the voltage monitor/controller <NUM>. The voltage monitor/controller <NUM> is connected to enable EN1. This connection will allow for testing as discussed below.

The input <NUM> of the first gate driver <NUM> is connected to the first power supply V_1. When enabled by EN1 the first gate driver <NUM> uses input power from V_1 and enables the first switch S1. Of course, the first gate driver could be provided power from a different source.

The second power supply branch <NUM> includes the second power supply V_2. V_2 connected to the output <NUM> via a series connection of a second diode D2 and second switch S2. The second power supply branch <NUM> also includes a second gate driver <NUM>. The second gate driver <NUM> controls the status of the second switch S2 and includes an input <NUM>, an output <NUM>, and an enable EN2. The output <NUM> of the second gate driver <NUM> is connected to the second switch S2 and controls its condition/state (e.g., open or closed). In normal operation, the second gate driver <NUM> places the second switch S2 into a conductive or closed condition so that power from the second power supply V_2 can pass through the first diode D1 and the first switch S1 to reach the ORing point <NUM>.

Similar to the above, the voltage monitor/controller <NUM> is connected to enable EN2 of the second gate driver <NUM>. This connection will allow for testing as discussed below. As shown, the input <NUM> of the second gate driver <NUM> is connected to the second power supply V_2. When enabled by EN2 the second gate driver <NUM> uses input power from V_2 and enables the second switch S2. Of course, the second gate driver could be provided power from a different source. Thus, the first and second gate drivers can share a separate power supply or have their own as alternatives to what is shown in the <FIG>.

As noted above, the first and second gate drivers <NUM>, <NUM> are connected to and receive power from their respective power sources V-<NUM>, V_2. Thus, if the power sources are not providing power, the gate driver cannot cause its associated switch (S1/S2) to close regardless of the value of the associated enable signal.

The voltage monitor <NUM> can include testing logic <NUM> that can allow the monitor <NUM> to determine the status of each power supply V_1/V_2 with a single monitor. This is done, for example, by controlling the signals provided to EN1/EN2 and measuring the voltage at the output <NUM>. It shall be understood that because controlling EN1/EN2 can open switches S1/S2, the first and second power supply branches <NUM>, <NUM> can essentially be isolated from one another so error due to leakage current can be reduced or eliminated.

Reference is now made to <FIG> and Table <NUM> below. In one embodiment, the testing logic <NUM> of the voltage monitor/controller <NUM> can be programmed so that it can perform a built in test (BIT) to determine if the status of each power supply V_1/V_2. In particular, the testing logic can follow control the signals provided to EN1 and EN2. An example of such a sequence and related observations is shown in Table <NUM> below. It shall be understood that different sequences could be utilized.

As shown, the BIT sequence and observation result from each state is listed in Table1. Initial state is 'state <NUM>' in which EN1=<NUM> and EN2=<NUM>. The next state is state <NUM>. In 'state <NUM>' both switches S1 & S2 are enabled by making EN1=<NUM> and EN2=<NUM>. At this state there are two possibilities at ORing point <NUM>. If an expected voltage (e.g., 28V) is available then either or both input sources V_1/V_2 are available. If there is voltage, then neither voltage source V_1/V_2 is available. In such a case, a failure of both can be noted and the BIT can cease.

To check the individual source availability, the logic <NUM> cycles to the next state (state <NUM>). In this state, switches S1 is kept ON and switch S2 is turned OFF by making EN1=<NUM> and EN2=<NUM>. If the expected is available at ORing point <NUM>, then it is known that V_1 is functioning correctly as it is the only one providing power point <NUM> in this configuration. If V_1 is failed, then the voltage at point <NUM> will start to fall towards zero then it indicates that source V_1 is not available and voltage at 28V_OR should be monitored. As soon as voltage go below a critical lower limit (e.g., 16V), system should go back to state <NUM> which will ensure the power is not interrupted at 28V_OR point. The voltage drop is not instantaneous due to C1. This can allow for testing without interruption of the power to the output <NUM>.

In 'state <NUM>' switch S1 is turned OFF and switch S2 is turned ON by making EN1=<NUM> and EN2=<NUM>. If a desired voltage (e.g., <NUM> V) is available at point <NUM> then availability of V_2 is guaranteed and reading of voltage level is assigned to voltage level of source V_2. If, however, the voltage starts falling towards zero then it indicates that V_2 is not available. As above, in the event that voltage falls below a critical lower limit the system goes back to state <NUM> which will ensure the power is not interrupted at point <NUM>. State <NUM> can be referred to as a normal operational state herein.

It shall be understood that while the above table has the system cycle back to a state <NUM>, there could be instances where it cycles to either state <NUM> or <NUM> depending on which voltage source has failed without departing from the teachings herein.

It should be further noted that the results of any test performed can be conveyed to another device <NUM>. In one embodiment, the device <NUM> is a computer in an aircraft. The device can note the status of the voltages sources and create, if needed, a service request or take other remedial actions.

The circuit shown herein two input power sources using a single monitoring circuit, while the prior arts having two monitoring circuits. Further, occurrence of false indications due to leakage current can be eliminated. Also, the monitoring circuit also makes it possible to only one or both of the power sources V_1, V_2 periodically to optionally utilize power from both sources or to use it from both at the same time. Using both at the same time can be useful in improving thermal management of overall system by sharing power from both sources.

It should be understood that the monitor/controller <NUM> can include various sensors (e.g., voltage sensors <NUM>). The controller <NUM> can be formed as a processor that is a hardware device for executing software, particularly that stored in storage, such as cache storage, or memory. The processor can be any custom made or commercially available processor, a central processing unit (CPU), an auxiliary processor among several processors associated with the controller, a semiconductor based microprocessor (in the form of a microchip or chip set), a microprocessor, or generally any device for executing instructions stored in logic <NUM>. The logic <NUM> can also either access memory of the controller or have its own memory. Regardless it can be configured to either on command or automatically/periodically perform a self test of the power sources V_1, V_2.

The memory can include any one or combination of volatile memory elements (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, etc.)) and nonvolatile memory elements (e.g., ROM, erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), tape, compact disc read only memory (CD-ROM), disk, diskette, cartridge, cassette or the like, etc.). Moreover, the memory may incorporate electronic, magnetic, optical, and/or other types of storage media. Note that the memory can have a distributed architecture, where various components are situated remote from one another, but can be accessed by the processor.

The instructions in logic <NUM> may include one or more separate programs, each of which comprises an ordered listing of executable instructions for implementing logical functions as described above.

Claim 1:
A voltage supply system comprising:
a first power supply branch (<NUM>) that includes:
a first voltage supply (V_1);
a serially connected first diode (D1) and first switch connected between the first voltage supply (V_1) and an output (<NUM>) of the voltage supply system; and
a first gate driver (<NUM>) connected to the first switch (S1) to control operation of the first switch (S1);
a second power supply branch (<NUM>) that includes:
a second voltage supply (V_2);
a serially connected second diode (D2) and second switch (S2) connected between the second voltage supply (V-<NUM>) and the output (<NUM>) of the voltage supply system; and
a second gate driver (<NUM>) connected to the second switch (S2) to control operation of the first switch (S1); and
a voltage monitor/controller (<NUM>) configured to perform a built-in test of the system by controlling the state of the first and second switches (S1/S2) by controlling enable signals (EN1/EN2) provided to the first and second gate drivers (<NUM>/<NUM>);
wherein the first gate driver (<NUM>) is connected to and powered by the first voltage supply (V_1) and the second gate driver (<NUM>) is connected to and powered by the second voltage supply (V_2).