IEEE TRANSACTIONS ON INDUSTRY APPLICATIONS, VOL. 52, NO.

2, MARCH/APRIL 2016

1785

Design and Control of Fault-Tolerant Nonisolated

Multiphase Multilevel DCDC Converters
for Automotive Power Systems
Michael Gleissner, Student Member, IEEE, and Mark M. Bakran, Senior Member, IEEE

AbstractIn this paper, a bidirectional, nonisolated dcdc converter with several interleaved phases of multilevel modules for
dual low-voltage automotive power systems is presented. Instead
of using a two-level stage with short-circuit protection elements, a
three-level module in a multiphase structure is proposed to achieve
improved fault-tolerance. The dimensioning of the required flying capacitor for multilevel dcdc converters is described. Further,
benefits such as ripple reduction, automatic fault current limitation, and enhanced efficiency are achieved. Moreover, the control
strategy for normal operation including the stability of the flying
capacitor voltage as well as reconfiguration after semiconductor
open- and short-circuit failure for ongoing degraded operation are
explained.
Index TermsDCDC power conversion, fault current limiters,
fault tolerance, multilevel systems, redundancy.

I. I NTRODUCTION

HE MAIN characteristics of automotive dcdc-converters

are efficiency, modularity, reliability, and fault-tolerance.
The electrification of vehicles implicates the linkage of different
dc power systems [1]. On one hand, power nets with identical
voltage levels are used to decouple sensitive loads from transient critical loads like the starter [2]. On the other hand, high
voltage traction power systems have to be linked with a lowvoltage 14 V power net [3], [4]. Power generation with 14 V
power nets is limited to about 3 kW. Hence and due to efficiency, the introduction of 42 V was intended in 2000 [5], but
a wide distribution failed because of expected high cost for the
changeover. Now, with changed emission restrictions for vehicles, a 48 V power net is planned [6]. An immediate adjustment
of all electric consumers is cost-intensive. Thus, as a first step,
only high power loads and the electric machine are transferred
to 48 V. The electric machine can be just an alternator or also
a starter or supply of a hybrid drive-train. A safe and sufficient
supply of still coexisting 14 V loads has to be fulfilled by a

Manuscript received May 25, 2015; revised August 25, 2015; accepted
October 18, 2015. Date of publication November 2, 2015; date of current
version March 17, 2016. Paper 2015-TSC-0281.R1, presented at the 2015
International Conference on Electrical Systems for Aircraft, Railway, Ship
Propulsion and Road Vehicles, Aachen, Germany, March 35, and approved
for publication in the IEEE T RANSACTIONS ON I NDUSTRY A PPLICATIONS
by the Transportation Systems Committee of the IEEE Industry Applications
Society.
The authors are with the Department of Mechatronics and Center of Energy
Technology, University of Bayreuth, 95447 Bayreuth, Germany (e-mail:
michael.gleissner@uni-bayreuth.de; bakran@uni-bayreuth.de).
Color versions of one or more of the figures in this paper are available online
at http://ieeexplore.ieee.org.
Digital Object Identifier 10.1109/TIA.2015.2497218

dcdc converter, which needs no galvanic isolation for voltages

below 60 V (see Fig. 1). The main energy transfer direction of
the converter is buck mode because of the 48 V alternator. But
a boost operation is also necessary, if only an external 14 V
charger is available for power management functions.
Converters have to be conformed with very high functional
safety requirements affected by standards like [7]. Functional
safety assessment is influenced by reliability and failure rates.
Redundant parts can fail, which is described as fault-tolerance.
After a single failure of a dcdc converter component, no
punch-through from the high- to the low-voltage power system may occur as otherwise low-voltage loads can be damaged by an over-voltage. Furthermore, a degraded operation
should be still possible with restrictions like less output power,
higher ripples, or less efficiency. Reduced functionality is better than a complete blackout and assures continuous operation
until replacement of the defect hardware. The need for faulttolerant dcdc converters is driven by applications such as
autonomous driving, electric power steering, or X-by-wire systems. Moreover, as in the automotive industry, cost and size are
very decisive, a multiple implementation to achieve redundancy
on system level like in an aircraft is unacceptable. Therefore,
a system design with inherent redundancy is necessary, which
means that further benefits like higher efficiency or power
density have also to be achieved by multiplying components.
The status quo for nonisolated automotive dcdc converters
are two-level multiphase systems with interleaved switching to
provide modularity and reduction of filter components [8], [9].
By deactivating phases, a higher efficiency can be achieved at
partial load [10]. The same principle is used to achieve faulttolerance after a semiconductor open-failure [11][14]. After
a short-circuit failure of the high-side switch, a punch-through
from the higher to the lower voltage system occurs. In order
to handle this failure, a punch-through protection switch Spt is
added. A short-failure of the low-side switch causes a shortcircuit of the low-voltage power system and to eliminate this,
the so-called short-circuit protection switch Ssc is applied [15],
[16]. These protection switches are normally always turned ON
and optimized for conduction. A disadvantage of these twolevel systems are the extra cost and efficiency decrease because
of the additional short-circuit protection switches.
The origin of multilevel converters is the high-voltage area,
where a series connection of semiconductors is necessary to
enable converter voltages higher than the switch blocking
voltage. However, multilevel dcdc converters have also been

0093-9994 2015 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

1786

IEEE TRANSACTIONS ON INDUSTRY APPLICATIONS, VOL. 52, NO. 2, MARCH/APRIL 2016

Fig. 1. Automotive dual low voltage power system with 48 V for high-power
loads and electrical machine as well as 14 V for light loads.

proposed for automotive power nets because they offer a reduction of the semiconductor voltage stress and inductor size
[17][21]. They are also advantageous for ideal short-ON failure devices by level reduction, as described in [22] and [23] for
a multilevel inverter. But, they are not tolerant for open-failures
and offer no modularity [24].
This paper presents a new beneficial combination of multiphase and multilevel structures to achieve fault-tolerance for
semiconductor open- and short-circuit failures. Instead of using
a standard two-level synchronous rectified buck/boost module
consisting of two active switches Shigh , Slow and two protection switches Spt , Ssc for handling short-circuit failures [see
Fig. 2(a)], several three-level modules each with four active
switches and an additional flying capacitor are paralleled in
several phases [see Fig. 2(b) and Fig. 3]. Thus, known benefits like current ripple or filter component minimization can be
achieved. Moreover, the efficiency can be increased because of
less switching loss. Section II describes the normal operation
and design of a multiphase three-level dcdc converter including flying capacitor sizing and balancing by a new and simple
control by adjusting the internal phase shift of switch pairs.
The fault-tolerant reconfiguration after different semiconductor
failures is described and validated with prototype measurement results in Section III. The three-level modules offer an
automatic fault-current limitation in case of switch short-ON
failures. Section IV will provide the final conclusion.

Fig. 2. Modules of a multiphase dcdc converter. (a) Two-level module with

protection switches. (b) Three-level module with flying capacitor.

here is 360
2N , because the switch pairs within one three-level
phase are shifted by 180 . Fig. 4 illustrates the switch control pattern and ideal current waveforms of inductors and flying
capacitors during one switching period for a three-phase threelevel converter. Fig. 5 exemplary illustrates the switching states
of a three-level module in buck mode with D < 0.5.
The number of phases depends on total converter power,
ampacity of employed semiconductors, and required degraded
power after a single failure. A typical power rating per phase
module is 200600 W.

II. N ORMAL O PERATION AND D ESIGN

A. Switch Control Pattern

B. Inductance and Current Ripple

According to [6], the specified normal low-voltage operation

range is 1214 V and the high voltage is 3652 V. Bidirectional
energy transfer is required. The voltage conversion ratio of
this flying capacitor multilevel converter is identical with a
two-level converter and can be adjusted by the duty cycle D
according to
Vlow = D Vhigh .

(1)

The duty cycle D is referred to the high-side switches and will

typically be in the range 0.20.4. The three-level phase internal
control pattern of switch pairs Shigh,a , Slow,a , and Shigh,b , Slow,b
requires a shift p, which is normally 180 [17]. Interleaved

switching of N -phase two-level modules applies a 360

N time
shift between the phases [9]. To minimize the total current ripple of an N -phase three-level converter, the optimal phase shift

The two-level single phase current ripple is

iph,2L = D (1 D)

Vhigh
.
Lf

(2)

The total two-level current ripple depending on the number of

phases N seen by the low-voltage filter capacitor is according
to [9]


Vhigh
n1
itot,2L = D
,
(n N D)
N
Lf
n
n1
< D ; n [1, 2, . . ., N ].
(3)
for
N
N
By increasing the level number, the effective operation frequency increases due to the additional active switches and the

GLEISSNER AND BAKRAN: DESIGN AND CONTROL OF FAULT-TOLERANT NON-ISOLATED MULTIPHASE MULTILEVEL DCDC CONVERTERS

Fig. 3. Proposed three-phase three-level dcdc converter with high faulttolerance.

inductor voltage decreases because of the additional voltage

level of the flying capacitor. The three-level single phase current
ripple is (see Section II-D)


 V
n 1 n
high
D
,
iph,3L = D
2
2
Lf
n
n1
< D ; n [1, 2].
(4)
for
2
2
The total three-level current ripple depending on the number of
phases N seen by the low-voltage filter capacitor is


 V
n 1 n
high
itot,3L = D
N D
,
2N
2
Lf
n
n1
<D
; n [1, 2, . . ., 2N ].
(5)
for
2N
2N
Fig. 6 depicts the total peak-to-peak current ripple for a twolevel and three-level converter with one, two, or three phases
normalized to the two-level single-phase current ripple. With
higher number of levels, a smaller current ripple can be
achieved with identical inductance. The other way round, a
smaller inductor can be applied for a specific current ripple with
three-level modules. The inductance can be reduced to 37.5%

1787

Fig. 4. Switching sequence for D < 0.5 and ideal current shapes of threephase three-level dc converter in buck mode.

of the two-level value to attain the same current ripples in the

typical duty cycle range.
C. Semiconductor Voltage Rating
The two-level module switches Shigh and Slow [see Fig. 2(a)]
must be able to block the high-side converter voltage. Due to
transient switching peaks and a safety margin, for the 48 V
power net, MOSFETs with 80100 V blocking voltage are targeted [25]. The punch-through protection switch Spt requires
the same voltage rating as it has to withstand the high-side voltage after disconnecting a short-circuit of Shigh . For the low-side
short-circuit protection switch Ssc , a 30-V rating is sufficient
as it has to block only the low-side voltage after disconnecting a short-circuit of Slow . These protection switches have to
be opened after detecting a short-circuit, e.g., by the drivers
of the active switches or by current monitoring. In the threelevel module, the switches Shigh,a , Shigh,b , Slow,a , and Slow,b [see
Fig. 2(a)] are only stressed with half of the converter high-side
voltage in normal operation mode. To avoid secondary failure
after a switch short-failure and to assure fault-tolerance, these
three-level switches require the same voltage rating like the two
active switches in the two-level module. If one switch fails

1788

IEEE TRANSACTIONS ON INDUSTRY APPLICATIONS, VOL. 52, NO. 2, MARCH/APRIL 2016

Fig. 7. Flying capacitor current in a three-level module during one switching

period T in buck mode: charging and discharging with low-side current Ilow .
Ideal and real current shape due to rise and fall time trf of MOSFET. Time
intervals specified by duty cycle D and internal phase shift p (normally 0.5).

short-ON, the other switch in the same path is stressed with

the high-side voltage and without sufficient high-side voltage
rating, a secondary failure would occur. Both modules need
three high-side and one low-side drivers.
D. Flying Capacitor Technology
The only additional component of the proposed three-level
module is the so-called flying capacitor, which has no fixed
ground connection. The ideal voltage of the flying capacitor in
stationary mode is
VFC =

Fig. 5. Switching states of a three-level phase in buck mode (D < 0.5) I

II III II. (a) State I: flying capacitor and inductor charging. (b) State II:
discharging inductor. (c) State III: flying capacitor discharging and inductor
charging.

Vhigh
.
2

(6)

The flying capacitor is charged and discharged with the lowside current at every switching period as illustrated in Fig. 7,
where Ilow is the mean low-side current, i0 is the current at the
beginning of a switching period T , iI-III are the inductor current ripples in each state, and trf is the mean current rise and
fall time, which is here combined in an average value and not
separated in rise and fall time because of simplification. This
current rise and fall time differs the ideal from the real measured current wave form. The equations for the inductor current
ripples in the switching states shown in Figs. 5 and 7 are
1
(Vhigh Vlow VFC ) D T
L
1
iII = Vlow (p D) T
L
1
iIII = (VFC Vlow ) D T.
L
iI =

(7)
(8)
(9)

In stationary mode, all current ripples are identical leading to

(4) for D < 0.5.
By equal charging and discharging, the capacitor voltage
stays constant with a voltage ripple (see Fig. 8) according to
(for i << Ilow )
Fig. 6. Peak-to-peak current ripple in low-voltage filter capacitor for two-level
and three-level converter with one, two, or three phases normalized to the twolevel single-phase current ripple.

vFC = D

Ilow
.
C f

(10)

GLEISSNER AND BAKRAN: DESIGN AND CONTROL OF FAULT-TOLERANT NON-ISOLATED MULTIPHASE MULTILEVEL DCDC CONVERTERS

Fig. 8. Measured variation of flying capacitor voltage ripple depending on load

current with 24 F capacitance.
FC
To achieve a small voltage ripple ratio of v
VFC = 0.05 at
switching frequency f = 100 kHz and duty cycle D = 0.3,
a typical capacitance of 100 F is required for a 500 W
three-level module.
The current stress leads to ohmic losses in the capacitor and
heating. Electrolytic capacitors are not suitable because of their
limited ripple current rating. The admissible current stress of
film and ceramic capacitors is defined by the maximum temperature, which also influences lifetime and reliability. Maximum
capacitor current ratings are either specified in data sheets or
have to be determined by practical testing. The RMS capacitor
current is (i << Ilow )

IRMS,FC = Ilow 2D.

(11)

The flying capacitors energy and power are specified according to

1
2
EFC = C VFC
(12)
2
PFC = IRMS,FC VFC .
(13)
The ratio of power to energy is defined as specific frequency

2
PFC
vFC
.
(14)
=f
2
fspec =
EFC
VFC
D
The specific frequency just depends on switching frequency,
duty cycle, and ratio of flying capacitor voltage ripple to nominal voltage. Fig. 9 illustrates in a Ragone plot the energy
and power density of typical film and ceramic capacitors
from EPCOS and WIMA. The capacitor values are extracted
from data sheets and laboratory measurements for temperature
rise-related maximum power estimation. DC-bias effects are
neglected. The diagonals represent the equivalent specific frequency. With a given switching frequency f = 100 kHz, duty
FC
cycle D = 0.3, and v
VFC [0.01, 0.1], the specific frequency
is in the range 552 kHz (see gray zone in Fig. 9). Most of the
selected capacitors are within this zone, but ceramic capacitors
offer the highest energy and power density for this application.
Hence, they are recommended for flying capacitor application
in automotive dcdc converters. The typical volume of a 50 V,
100 F ceramic capacitor is less than 1 cm3 and normally small
compared to the inductor. According to [8], total inductor volume of a 1 kW multiphase two-level converter is in the range
40100 cm3 .

1789

Fig. 9. Ragone plot of film and ceramic capacitors used as flying capacitor.
Gray area: dcdc with f = 100 kHz and typical voltage ripple.

E. Flying Capacitor Voltage Balancing

An important control aspect of three-level modules is the flying capacitor voltage balancing, which should comply with (6)
to assure a minimal current ripple and switch voltage stress.
There can be a deviation from this optimum, e.g., because
of input voltage variation or slight driver signal differences.
Several balancing techniques have been proposed in the literature. The natural balancing process, which can be influenced by
an additional RLC circuit, is described in [26] and [27]. Active
control methods by changing the duty cycles are explained in
[17], [19], and [28]. In this paper, a new active balancing technique by changing the phase shift between the two switch pairs
is suggested.
The flying capacitor charge difference during a switching
period can be calculated by the integration of real capacitor
current over a period shown in Fig. 7
QFC =

1
1
1
D T (2i0 + iI ) + trf (i0 + iI ) trf i0
2
2
2

1
D T [2 (i0 + iI + iII ) + iIII ]
2
1
1
+ trf (i0 + iI + iII ) trf (i0 + iI + iII + iIII ) .
2
2
(15)
By combining (7)(9) and (15) with the assumption that
vFC << VFC is achieved by a large enough capacitance, the
difference between charge and discharge during a switching
period can be calculated according to


1
trf D T
D T2
Vlow
p +
(Vhigh 2VFC ) .
QFC =
L
2
2L
(16)
The charge difference has to be zero to avoid flying capacitor
voltage drift and results in


1 DT 1
VFC
p .
(17)
=
Vhigh
2
trf
2
FC
The range of VVhigh
is [0, 1] as the minimum flying capacitor
voltage is zero and the maximum Vhigh . With normally applied
internal phase shift p = 0.5, the flying capacitor voltage automatically stabilizes at half of the high-side voltage. Due to

1790

IEEE TRANSACTIONS ON INDUSTRY APPLICATIONS, VOL. 52, NO. 2, MARCH/APRIL 2016

Fig. 11. Measured total module efficiency for two-level 100 kHz, three-level
100 kHz and three-level 50 kHz with 3, 3H resp. 10H inductor.
Fig. 10. Measured mean flying capacitor voltage depending on internal phase
shift p for Uhigh = 48 V. (a) Sensitivity of loadf = 50 kHz. (b) Sensitivity
of switching frequencyPlow = 200 W.

different control timing delays and parasitic effects, a deviance

from this optimal value is possible in practice. Consequently,
the flying capacitor voltage can be modified by changing the
internal phase shift p between the two switch pairs of a threelevel module. The sensitivity of this control method depends
especially on the switching frequency as well as average rise
and fall time trf of the semiconductor.
Fig. 10 shows the measured mean flying capacitor voltage
depending on the internal phase shift p, load, and switching
frequency. The sensitivity of internal phase shift seems to be
nearly independent from load situation [Fig. 10(a)], but depending on the switching frequency [Fig. 10(b)]. According to (17),
the flying capacitor voltage is mainly depending on the internal
phase shift and the ratio of period time to average rise and fall
time of the switch current. With fixed gate resistance and stray
inductance, the current rise and fall time is nearly constant, only
a little depending on load current. The equation is well satisfied,
if the converter works in continuous conduction mode and if the
current ripple is small enough to avoid zero current crossings.
Compared to known active balancing methods, which change
the duty cycle during the charging and discharging period of
the capacitor, this new phase shift balancing avoids run away
of the flying capacitor voltage, which occurs if the duty cycle
difference is applied too long. With this new control, the flying
capacitor voltage is linearly depending on the internal phase
shift. A control loop requires measurement of high-side and
flying capacitor voltage and adjustment of the internal phase
shift p. The flying capacitor voltage measurement, e.g., with a
differential amplifier, is also useful for fault-detection.
F. Efficiency
An important criterion of automotive dcdc converters is efficiency, which is mainly influenced by semiconductor losses.
Both active switches of the two-level module are stressed
with the high-side voltage. In contrast, the three-level module
requires four active switches, which see only half of the highside voltage. The double number of active switches for threelevel modules is equalized by the double-switching frequency

for two-level to achieve the identical output frequency. The

halved voltage minimizes capacitive switching loss related
to semiconductor output and possibly snubber capacitance.
Furthermore, turn-ON and turn-OFF switching loss are also
smaller with three-level modules because of the reduced voltage
stress. Moreover, the conduction loss is also reduced because of
the smaller current ripple with three-level modules compared to
two-level stages with identical inductor. The total module efficiency including filter loss in inductor and capacitors has been
measured with a LMG500 power analyzer at different levels,
semiconductor switching frequencies, and inductors. The hardware setup is a three-level structure with IRFS3207 MOSFETs.
The conduction loss is mainly influenced by the PCB resistance.
The two-level measurements have been achieved by turning the
upper and lower switches permanent ON. Fig. 11 shows that the
three-level modules always have the highest efficiency in the
measured power range. The three-level module with 50 kHz
switching frequency is better than 100 kHz, when the conduction losses are equal at similar small current ripples with the
10 H inductor.

III. FAULT-T OLERANT R ECONFIGURATION

A. Semiconductor Failure Scenarios
There are several single semiconductor failure scenarios
within a phase of a dcdc converter possible. They depend
on the switch location (high- or low-side) and failure characteristic (open-circuit with diode OK, total open-circuit and
short-circuit). Fig. 12 illustrates an overview of these active
switch failure scenarios for a two-level and three-level phase
modules. There is no distinction between the three-level switch
failure locations of Shigh,a and Shigh,b and Slow,a and Slow,b ,
because the failure behavior and reconfiguration is quite similar.
The only difference is that the flying capacitor is discharged to
zero in case of a short-circuit of Shigh,a , Slow,a or charged to Vhigh
in case of a short-circuit of Shigh,b , Slow,b . Furthermore, failures
of the two-level protection switches are neglected, as an openfailure is similar to an open-circuit of an active switch and a
short-circuit does not influence the normal two-level operation,
but offers no protection in case of a second short-circuit failure
of an active switch.

GLEISSNER AND BAKRAN: DESIGN AND CONTROL OF FAULT-TOLERANT NON-ISOLATED MULTIPHASE MULTILEVEL DCDC CONVERTERS

1791

Fig. 13. Prototypes of three-phase converters. (a) Three-level. (b) Two-level

with protection switches.

is implemented with a modular dSPACE 1007 system with

50 s cycle rate. The measurement signals for the control and
fault detection process have been filtered with a 100 sample moving average to eliminate switching disturbances. The
three-level switches have 50 kHz switching frequency and the
two-level switches have 100 kHz to achieve identical output frequency. Both prototypes have identical 10 H inductances per
phase.

B. Switch Open-Circuit Failures

Fig. 12. Semiconductor failure scenarios for two-level and three-level modules. Open-circuit with diode OK of (a) two-level Shigh , (b) three-level Shigh,a ,
(c) two-level Slow , and (d) three-level Slow,a . Total open-circuit of (e) twolevel Shigh , (f) three-level Shigh,a , (g) two-level Slow , and (h) three-level Slow,a .
Short-circuit of (i) two-level Shigh , (j) three-level Shigh,a , (k) two-level Slow , and
(l) three-level Slow,a .

Load failures are not discussed here. They have to be disconnected by separation elements such as fuses or semiconductor
switches, depending on the structure of the power system, and
location of batteries. The dcdc converter can just react on a
load short-circuit by stopping converter operation by opening
all switches.
The failure behavior of a three-phase dcdc converter with
two-level and three-level modules is analyzed with two prototypes for 4814 V buck operation (see Fig. 13). The control

An open-circuit failure with MOSFET body diode still working is possible after a driver or gate failure. Then, the MOSFET
body diode still enables current flow in reverse direction.
Depending on the energy transfer direction, an ongoing operation can be possible. After failure of a low-side switch with
diode still OK, buck operation is possible with increased loss,
because the body diode loss is higher than the loss of the active
MOSFET. After failure of a high-side switch with diode still
OK, boost operation is feasible. These failures can be achieved
with the prototypes by setting a single switch control signal to
always OFF. A total open-circuit failure is achieved by turning
all switches of the phase OFF. Fig. 14 illustrates the measured
switch always turned-OFF failures of the three-level converter
connected to a 48 V power supply and a constant 400 W electronic load. In Fig. 14(a), the gate signal of the active switch
Shigh,a3 is set to zero; in Fig. 14(b), the gate signal of the
switch Slow,a3 is set to zero; and in Fig. 14(c), the gate signals
of all switches Sx3 are set to zero, which corresponds a total
open-circuit. The measured low-side voltage, the three inductor currents, and the total low-side current are shown. After
gate turn-OFF at t = 0, the mean current of the failed phase
decreases, the dc-offset of the two healthy phase increases
due to the constant load, and the total low-side current ripple
increases. Open-faults are detected by measuring unbalances
of the phase currents, which are normally compensated by the
phase balancing control. The detection and reconfiguration is
achieved after less than 10 ms. With faster measurement sampling, this time can be further decreased. Otherwise, the converter voltages are stable and an uninterrupted power transfer is
possible.
Reconfiguration for open-failures means that after faultdetection, all switches of the failed phase are turned OFF to
exclude diode operation with increased loss, adjustment of

1792

IEEE TRANSACTIONS ON INDUSTRY APPLICATIONS, VOL. 52, NO. 2, MARCH/APRIL 2016

Fig. 14. Measured switch always OFF failures in phase three of the threelevel converter at t = 0 in buck mode, Plow = 400 W. The fault-detection
and reconfiguration is finished after less than 10 ms. (a) Switch Shigh,a3
always OFF [see Fig. 12(b)]. (b) Switch Slow,a3 always OFF ([see Fig.12(d)].
(c) All phase three switches always OFF [corresponding to an open-circuit, see
Fig. 12(f) and (h)].

the phase shift of the remaining phases, and reduction of the

total maximum power. The total maximum converter power is
reduced to two-thirds, if one of three phases fails. This is not
critical, if the converter operates mostly in part load operation.
The reconfiguration measurement results with 400 W show
no power decrease, because the rated total converter power is
1 kW. With higher number of phases, the maximum total power
degradation can be reduced. The external phase shift has to be

Fig. 15. Measured switch always OFF failures in phase three of the two-level
converter at t = 0 in buck mode, Plow = 400 W. The fault-detection and
reconfiguration is finished after less than 15 ms. (a) Switch Shigh3 always OFF
[see Fig. 12(a)]. Switch Slow3 always OFF [see Fig. 12(c)]. (c) All phase three
switches always OFF [corresponding to an open-circuit, see Fig. 12(e) and (g)].

adjusted accordingly, because two healthy phases remain. The

measured switch open-circuit failure behavior of the two-level
prototype is similar and depicted in Fig. 15.
C. Switch Short-Circuit Failures
Switch short-ON failures are forced by setting the gate
control signal to always ON and correspond to an ideal shortON failed switch. The two-level converter measurements are

GLEISSNER AND BAKRAN: DESIGN AND CONTROL OF FAULT-TOLERANT NON-ISOLATED MULTIPHASE MULTILEVEL DCDC CONVERTERS

1793

Fig. 16. Measured switch always ON failures in phase three of the two-level
converter at t = 0 in buck mode, Plow = 0 W. The fault-detection and reconfiguration is finished after less than 3 ms, but the fault-current is very high.
(a) Switch Shigh3 always ON [see Fig. 12(i)]. (b) Switch Slow3 always ON [see
Fig. 12(k)].

Fig. 17. Measured switch always ON failures in phase three of the threelevel converter at t = 0 in buck mode, Plow = 400 W. The fault-detection and
reconfiguration is finished after less than 20 ms, but the fault-current is very
small. (a) Switch Shigh,a3 always ON [see Fig. 12(j)]. (b) Switch Slow,a3 always
ON [see Fig. 12(l)].

performed at 0 W load, in order to protect the equipment due

to the high short-circuit currents. The principle of detection
and reconfiguration is also valid for higher loads. The resulting
short-circuit current after high- or low-side short-failure of the
two-level prototype increases until it is limited by the behavior of the connected source or a protection switch (see Fig. 16).
The two healthy phases are stressed by a circular current, and
the low-side voltage drops in both cases. For the high-side
switch failure, a voltage increase because of the punch-through
would be expected, but the current-limitation of the supply
source causes also a voltage drop. As the high current can
cause subsequent failures, a fast and safe interruption of the
short-circuit current is absolutely necessary. Short-failures are
detected by measuring the phase currents, which have to excess
a defined level. The detection and reconfiguration is achieved
after less than 3 ms. After short-circuit disconnection by opening the protection switches, the faulty phase behaves like an
open-circuit. The phase shift of the remaining phases has to be
adjusted to the optimal value to keep the total current ripple
minimal. Moreover, the total maximum output power is also
reduced.
The reaction of the three-level module high- or low-side
short-circuit is much less critical (see Fig. 17). It is operated
at 400 W in buck mode. The (dis)charging of the flying capacitor due to a switch short-circuit and closing of the opposite

switch leads to a relatively small transient balancing current,

which is not dangerous and can hardly be detected by the current sensor. If Shigh,b , Slow,b fail short, the flying capacitor is
charged to Vhigh ; if Shigh,a , Slow,a are shorted the flying capacitor
is discharged to zero, because after a single short-circuit failure
and closing of the complementary switch, which is still working, the capacitor cell is paralleled to the high-side capacitor
or shorted. Thus, three-level switch short-circuits are detected
by measuring the flying capacitor voltages, which are normally
set to Vhigh /2 by the control. The detection and reconfiguration is achieved after less than 20 ms. With faster measurement
sampling, this time can be further decreased. Otherwise, the
converter voltages are stable and an uninterrupted power transfer is possible. Afterward, the faulty three-level module works
as two-level module with increased current ripple, when the
short-ON failed semiconductor is very low-ohmic and capable of further conducting nominal current without increased
loss (ideal short-ON). The second pair of still healthy switches
avoids high short-circuit current by chopping. If the short-ON
failed switch is not low-ohmic and consequently leading to
increased conduction loss and heating (nonideal short-ON), the
still healthy switches are opened and thus the three-level phase
is deactivated and behaves like a total open-circuit (see Fig. 17).
The body diodes of the serial switches block current flow from
high- to low-side.

1794

IEEE TRANSACTIONS ON INDUSTRY APPLICATIONS, VOL. 52, NO. 2, MARCH/APRIL 2016

Fig. 18. Generalized fault-tolerant reconfiguration strategy for multiphase

three-level and two-level modules with protection switches.

The generalized fault-tolerant reconfiguration strategy for

multiphase three-level and two-level modules with protection
switches for switch open- and short-circuit failures is illustrated in Fig. 18. The open-failures are detected by a reduced
phase current compared to the mean current of all phases.
Short-failures of two-level modules are detected by exceeding a maximum current threshold of a phase current and for
three-level modules by monitoring the flying capacitor voltage.
After any failure, all remaining active and protection switches
are opened, the phase shift of the remaining phases as well as
the maximum total converter power are adjusted. The inherent three-level short-circuit current-limiting behavior is very
advantageous regarding avoiding further failure and applies for
ideal as well as nonideal short-ON failed switches.
IV. C ONCLUSION
Multiphase converters with either two-level modules and
protection switches or three-level modules offer converter
fault-tolerance regarding switch short- and open-failures with
degraded maximum total output power after these failures. Both
modules are identical regarding the number of semiconductor
switches, but the current ripple of three-level modules can be
significantly reduced to 37.5% of the two-level value with identical inductor. Regarding efficiency, the three-level module is
better than the conventional two-level structure because of the
reduced voltage stress. Design hints for dimensioning the flying
capacitor and implementing a control for optimal flying capacitor voltage balancing have been shown and verified by measurements. The behavior and reconfiguration in case of semiconductor open- and short-failures has also been measured with prototypes for both module types. Open-circuit failures are uncritical
for two-level and three-level modules. After a switch shortcircuit, the two-level modules require a very fast fault-detection
and opening of the protection switches, in order to limit the
severe fault-current and to minimize a voltage drop in the total
power system. However, the three-level modules enable an
intrinsic short-circuit current limitation by the additional active
switches and thus provide a much less critical short-failure
behavior. Thus, with the same amount of switches, an improved
efficiency as well as failure characteristic can be achieved.
R EFERENCES
[1] X. Zhang, K. T. Chau, and C. C. Chan, Overview of power networks
in hybrid electric vehicles, J. Asian Elect. Veh., vol. 8, no. 1, pp. 1371
1377, Jun. 2010.
[2] D. Polenov, T. Reiter, H. Prbstle, S. Knig, and J. Lutz, Cascaded
boost-buck DC/DC-converter for dual-voltage automotive power-nets
with overlapping voltage ranges, in Proc. Int. Exhib. Conf. Power
Electron. Intell. Motion Renew. Energy Energy Manage. (PCIM Europe),
2007, pp. 16.

[3] J. W. Kolar, M. Maerz, E. Wolfgang, and S. D. Round, Automotive

power electronics roadmap, in Proc. Integr. Power Syst., Mar. 1113,
2008, p. 1.
[4] A. Emadi, S. Williamson, and A. Khaligh, Power electronics intensive
solutions for advanced electric, hybrid electric, and fuel cell vehicular
power systems, IEEE Trans. Power Electron., vol. 21, no. 3, pp. 567
577, May 2006.
[5] J. G. Kassakian, Automotive electrical systems the power electronics
market of the future, in Proc. 15th Annu. IEEE Appl. Power Electron.
Conf. Expo. (APEC), 2000, pp. 39.
[6] T. Drsam, S. Kehl, A. Klinkig, A. Radon, and O. Sirch, The new voltage
level 48 V for vehicle power supply, ATZelektronik Worldwide, vol. 7,
no. 1, pp. 2025, 2012.
[7] ISO 26262Road vehiclesFunctional safety, 2011.
[8] O. Garcia, P. Zumel, A. D. Castro, and A. Cobos, Automotive DC-DC
bidirectional converter made with many interleaved buck stages, IEEE
Trans. Power Electron., vol. 21, no. 3, pp. 578586, May 2006.
[9] M. Gerber, J. A. Ferreira, I. W. Hofsajer, and N. Seliger, Optimal interleaving of DC/DC converters in automotive applications, in Proc. Power
Electron. Appl., 2003, pp. 110.
[10] P. Zumel, C. Fernandez, A. D. Castro, and O. Garcia, Efficiency
improvement in multiphase converter by changing dynamically the number of phases, in Proc. IEEE Power Electron. Spec. Conf., Jun. 1822,
2006, pp. 16.
[11] M. Shahbazi, E. Jamshidpour, P. Poure, S. Saadate, and M. R. Zolghadri,
Open- and short-circuit switch fault diagnosis for nonisolated DCDC converters using field programmable gate array, IEEE Trans. Ind.
Electron., vol. 60, no. 9, pp. 41364146, Sep. 2013.
[12] L. Thorsell and P. Lindman, Reliability analysis of a direct parallel connected n+1 redundant power system based on highly reliable DC/DC
modules, in Proc. Telecommun. Energy Conf., Oct. 30/Nov. 2, 1988,
pp. 551556.
[13] V. Choudhary, E. Ledezma, R. Ayyanar, and R. M. Button, Fault tolerant
circuit topology and control method for input-series and output-parallel
modular DC-DC converters, IEEE Trans. Power Electron., vol. 23, no. 1,
pp. 402411, Jan. 2008.
[14] E. Ribeiro, A. J. M. Cardoso, and C. Boccaletti, Open-circuit fault diagnosis in interleaved DC-DC converters, IEEE Trans. Power Electron.,
vol. 29, no. 6, pp. 30913102, Jun. 2014.
[15] C. Buhlheller, A. Krner, M. Nalbach, and J. Tlatlik, Technical
realization and implementation of an automotive DC/DC converter,
in Proc. Elektrik/Elektronik Hybrid- Elektrofahrzeugen Elektrisches
Energiemanage. IV, 2013, pp. 102117.
[16] B. Koeppl, M. Scheffer, R. Vuletic, and T. Roewe, 48V DC/DC
converter and 48V motor drive IFX solutions and test results,
in Proc. Elektrik/Elektronik Hybrid- Elektrofahrzeugen Elektrisches
Energiemanage. VI, 2015, pp. 112122.
[17] K. Jin, M. Yang, X. Ruan, and M. Xu, Three-level bidirectional converter
for fuel-cell/battery hybrid power system, IEEE Trans. Ind. Electron.,
vol. 57, no. 6, pp. 19761986, Jun. 2010.
[18] W. Qian, H. Cha, F. Z. Peng, and L. M. Tolbert, 55-kW variable 3X DCDC converter for plug-in hybrid electric vehicles, IEEE Trans. Power
Electron., vol. 27, no. 4, pp. 16681678, Apr. 2012.
[19] P. J. Grbovic, P. Delarue, P. Le Moigne, and P. Bartholomeus, A
bidirectional three-level DC-DC converter for the ultracapacitor applications, IEEE Trans. Ind. Electron., vol. 57, no. 10, pp. 34153430, Oct.
2010.
[20] P. J. Grbovic, F. Crescimbini, A. Lidozzi, and L. Solero, Multi-level
converters for low voltage high current applications: Issues, challenges
and limitations, in Proc. 16th Int. Power Electron. Motion Control Conf.
Expo. (PEMC), Sep. 2124, 2014, pp. 737744.
[21] D. Flores Cortez, G. Waltrich, J. Fraigneaud, H. Miranda, and I. Barbi,
DC-DC converter for dual-voltage automotive systems based on bidirectional hybrid switched-capacitor architectures, IEEE Trans. Ind.
Electron., vol. 62, no. 5, pp. 32963304, May 2015.
[22] M. Gleissner, M.-M. Bakran, and J. Marcinkowski, First fault-resilient
high-power 5-level flying capacitor DC-DC converter with ideal shorton failure IGBT modules, in Proc. Int. Exhib. Conf. Power Electron.
Intell. Motion Renew. Energy Energy Manage. (PCIM Europe), May 19
21, 2015, pp. 13381345.
[23] X. Kou, K. Corzine, and Y. Familiant, A unique fault-tolerant design
for flying capacitor multilevel inverter, IEEE Trans. Power Electron.,
vol. 19, no. 4, pp. 979987, Jul. 2004.
[24] M. Gleissner and M.-M. Bakran, Comparison of multiphase versus multilevel converters for automotive power, in Proc. Power Electron. Appl.,
Sep. 35, 2013, pp. 110.

GLEISSNER AND BAKRAN: DESIGN AND CONTROL OF FAULT-TOLERANT NON-ISOLATED MULTIPHASE MULTILEVEL DCDC CONVERTERS

[25] M. Puerschel, B. Koeppl, and M. Scheffer, The 48V power-system from

semiconductor perspective, in Proc. Elektrische Antriebstechnologie
Hybrid- Elektrofahrzeuge, 2013, pp. 177190.
[26] R. H. Wilkinson, T. A. Meynard, and H. du Toit Mouton, Natural balance
of multicell converters: The two-cell case, IEEE Trans. Power Electron.,
vol. 21, no. 6, pp. 16491657, Nov. 2006.
[27] R. Stala, The switch-mode flying-capacitor DC-DC converters with
improved natural balancing, IEEE Trans. Ind. Electron., vol. 57, no. 4,
pp. 13691382, Apr. 2010.
[28] L. F. Costa, S. A. Mussa, and I. Barbi, Multilevel buck/boost-type DCDC converter for high-power and high-voltage application, IEEE Trans.
Ind. Appl., vol. 50, no. 6, pp. 39313942, Nov./Dec. 2014.

Michael Gleissner (S12) received the Diploma

degree in electrical engineering and information technology from the University of Applied Sciences,
Ingolstadt, Germany, in 2010. He is currently working toward the Ph.D. degree in the Department
of Mechatronics, University of Bayreuth, Bayreuth,
Germany.
From 2005 to 2010, he was with the BMW Group,
Munich, Germany, as a Trainee. His research interests include fault-tolerant power electronics, fault
detection and isolation, failure behavior of semiconductors, and measures to increase the availability of power electronic circuits.

1795

Mark M. Bakran (M97SM04) received the

Diploma and Dr.-Ing. degrees in electrical engineering from the Technical University of Berlin, Berlin,
Germany, in 1992 and 1995, respectively.
From 1995 to 2011, he was with Siemens AG,
Germany. Within the Traction Division, he was
responsible for power electronics from auxiliary converters to hybrid buses and from light rail vehicles
to locomotives. In 2011, he became an Appointed
Professor with the University of Bayreuth, Bayreuth,
Germany, where he is the Head of the Department
of Mechatronics. He holds more than 20 patents and has authored more than
40 technical papers. His research interests include high-power electronics for
drives and energy transmission and high-power semiconductors.
Dr. Bakran is a member of the VDE and serves on the Technical Committees
of the European Conference on Power Electronics and Applications (EPE),
International Exhibition and Conference for Power Electronics, Intelligent
Motion, Renewable Energy and Energy Management (PCIM), and International
Conference on Integrated Power Systems (CIPS). In 2010, he received an
Honorary Professorship from the University of Hanover, Hanover, Germany.