Building Block Details
The figure below shows the seven standard building block types. A single Controller block and multiple instances of the other types are combined to form a custom PCU architecture. Following the block descriptions, an architecture example is presented at the bottom of this page.
Controller
The core of the Controller block is the microcontroller (µC) itself with two RS422 interfaces to connect to the on-board computer (OBC) and/or a telemetry-telecommand unit (TTC). The µC-software includes configurable switching, monitoring, telemetry, event logging, status reporting and synchronization functions. The green circles marked with T, A and V within the blocks show where temperatures, currents and voltages are measured for the telemetry and monitoring functions of the Controller. Also, external temperature sensors can be connected if needed for thermal monitoring or more sophisticated thermal control functions. The blue C marks blocks which receive switching commands from the Controller.
The Controller block features additional functions that are implemented in hardware:
- The Autonomous-Reset (AR) circuit plays an important role for SEE mitigation and subsystem redundancy as introduced in the Features section on the Products page. The circuit is a timer that issues pulses in long intervals (from several days to weeks, depending on the mission). "Autonomous" in this context means, that this circuit cannot be influenced by the µC (which could be compromised by SEE). The interval length is hard coded through the choice of components for the oscillator. The pulse signal is connected to the reset pin of the µC and also sets all AR-Switches to "ON". It is best practice to also use the signal to reset the microcontrollers in any non-redundant TTC and OBC.
- The Deep-Discharge-Protection circuit (DDP) shuts down the spacecraft if the bus voltage falls below the batteries end-of-discharge voltage. Once the battery voltage reaches the wake-up-threshold voltage the system is powered on again. Note that during normal operations this shutdown is avoided by the PCUs monitoring function. It will switch off all secondary devices once the bus voltage is critically low.
Primary devices (PDs) are those that are vital for the spacecraft operation, namely PCU, OBC and TTC, all others are referred to as secondary devices (SDs). - The separation switch interface (SEP) allows to launch the spacecraft in a completely unpowered state, which is a standard requirement with most launchers. When the spacecraft separates from the launcher it is powered up automatically.
PGI
The Power-Group-Interface (PGI) typically connects one battery string with several solar cell strings to form a so called Power Group. These groups feature diodes that allow current flow from the group to the main power bus (MPB), but not in the opposite direction. Consequently, if a single cell shows an increased self discharge rate or even a short failure, only its own Power Group will be affected. All other groups will still be able to deliver the full nominal battery voltage. The capacity of one battery string is lost, but the satellite stays operational. The PGI includes a current measurement point through which its health can be monitored by the Controller.
Fuse
The Fuse block contains an ultrafast resettable electronic fuse. It is designed to work with low impedance batteries with nominal voltages up to 24 V. If a direct short occurs, it can break the current in under 2 µs.
It is typically placed between a branch of SDs (with Switches and optional DCDC) and the MPB. Its main task is to protect the spacecraft from a failure in the respective branch. For the devices in the branch the Fuse can only offer limited protection, as the trigger level margin needs to be generous with several devices sharing a single fuse. This is where the Controllers monitoring function steps in as software fuse for each individual device, with a very narrow trigger margin (that margin can be changed at any time during the mission via telecommand, should it turn out to be too narrow).
The Fuse receives switching commands from the Controller, either for a reset or to switch off an entire branch that is temporarily not needed. It also includes a current measurement point.
DCDC
The DCDC block is a switching step down converter which provides the required supply voltage for the devices downstream. Typical values are 12 V, 5 V or 3.3 V but the design allows tailoring to any voltage level below the batteries UEOD.
The DCDCs are isolated by grounded shields from all other circuits to eliminate radiated EMI and have input and output filters with outstanding performance against conducted EMI (details on the filter performance and other DCDC characteristics are listed in the Specifications section on the Products page). On the output side the DCDC features a voltage measurement point that the Controller can access for monitoring purposes.
Delatch Fuse
The Delatch Fuse (DL) is a fuse for PDs. Generally, PDs have to remain in a powered state permanently, otherwise the spacecraft cannot be operated. However, there are two exceptional cases where they are temporarily switched off: One is the shutdown of the entire spacecraft, which is initiated by the DDP to prevent a deep discharge of the battery (see Controller section). The other is a delatch action by the DL of the respective device. If the DL detects an SEL, it interrupts the current for a fixed duration of 20 s, allowing the affected component to regenerate. The DL also sends a latch-up counter pulse to the Controller that in turn files an SEL event to its event log.
In contrast to the Fuse block described above the DL cannot be switched off by the Controller. Another difference is, that each DL is assigned to a single device and has a narrow trigger margin to be able to detect an SEL. Since the trigger level is fixed through the choice of components on the PCU board, the maximum power consumption of the respective device has to be thoroughly determined before the PCBs for the PCU are assembled.
Switch
Typically, each SD has its own Switch block that turns it on or off. The Switch receives commands that are relayed or issued by the Controller. It also includes a current measurement point that can be monitored by the Controller to form the software fuse mentioned in the Fuse section.
The AR-Switch represents a modified version of the Switch block that is used for redundant PDs. It is connected to the Autonomous-Reset circuit and it automatically switches on when it receives an AR pulse. This offers the possibility to hold (redundant) PDs in cold redundancy. An example: If a spacecraft has two TTCs, one of them can be switched off to act as unpowered spare (largely safe from radiation damage). If the active TTC fails in this situation, the spacecraft will be temporarily not available, but the next AR pulse will wake up the spare TTC and the mission can continue.
The spare is activated in any case, also if there is no problem with the other TTC. In that (standard) case, the spacecraft operator simply switches the spare TTC off again to restore the cold redundancy. This procedure is repeated after each AR pulse.
Architecture Example
The figure below shows a PCU architecture that is based on the building blocks described above. The box in the center represents the PCU itself with the Controller block at the top.
The displayed architecture is generic: An element in the figure that is fading (towards the bottom or to the right) indicates, that there can be more instances of this particular element in that area of the diagram. For example, the number of connected Power Groups (PG), shown on the left side, can be two or more. The fading is also used inside the PG box to indicate, that the number of solar cell strings per PG is one or more and that the battery string and the solar cell strings can be longer.
In the PCU box, there is a column of PGIs on the left side, one for each PG. All PGIs are connected to the vertical MPB line. The blocks to the right of that line are arranged in branches. The one at the top is a typical PD type: It features DLs and AR-Switches. Since the latter is only used in combination with a redundant PD, there has to be another AR-Switch/TTC pair which is not explicitly displayed. The OBC at the top of the column of connected devices is a non-redundant PD in this example and therefore has no assigned AR-Switch, i.e. it cannot be switched off.
Below the PD branch, two typical SD branches are shown. Both connect to the MPB via a Fuse and both have several devices connected to them, each with its own Switch. The devices on the upper branch require a converted (5 V) supply voltage, so it contains a DCDC block.
The fading lower end of the MPB line indicates, that it can accommodate additional branches. Most of them will be SD branches. But typically, there is also more than one PD branch because the various PDs usually require different supply voltages. Also note that the PCU blocks themselves are supplied by what could be called an "internal" PD branch, which has been omitted for clarity. It features a DCDC and a DL.
As an orientation w.r.t. the total number of branches: The configuration mentioned in the Additional Remarks section on the Products page, for example, would have 2 PD- and 8 SD branches.
