Use of Hybrids for UK Nuclear New Build Instrumentation and Control

Size: px

Start display at page:

Download "Use of Hybrids for UK Nuclear New Build Instrumentation and Control"

Amice Arnold
5 years ago
Views:

1 New Build Instrumentation and Control Issue 1 Date March 2013 Publication Nuclear Future Volume 9 Issue 2 Ultra Electronics NUCLEAR CONTROL SYSTEMS Innovation House, Lancaster Road Ferndown Industrial Estate, Wimborne, Dorset, BH21 7SQ

2 Contents 1. INTRODUCTION BACKGROUND... ERROR! BOOKMARK NOT DEFINED.4 3. THE THREAT... ERROR! BOOKMARK NOT DEFINED.5 4. CYBER HARD I&C SYSTEM DESIGN.. ERROR! BOOKMARK NOT DEFINED.6 5. THE SYSTEM LIFECYCLE... ERROR! BOOKMARK NOT DEFINED Concept Phase... Error! Bookmark not defined Assessment Phase... Error! Bookmark not defined Design Phase... Error! Bookmark not defined Manufacturing Phase... Error! Bookmark not defined In-Service Phase... Error! Bookmark not defined Disposal Phase... Error! Bookmark not defined CONCLUSIONS... ERROR! BOOKMARK NOT DEFINED REFERENCES... ERROR! BOOKMARK NOT DEFINED.12 2

1. Introduction There are four main problems confronting the design and build of instrumentation and control systems for the UK nuclear new build.

3 1. Introduction There are four main problems confronting the design and build of instrumentation and control systems for the UK nuclear new build. The first of these is obsolescence due to a required service life of about 50 years. Secondly the problem of tin whisker growth which can impact the real safety of the system. A third problem is the disappearance of high reliability military specification electronic components. Lastly the problem of increasing amounts of sophisticated counterfeit components coming onto the market, especially for high reliability components of high value. All these problems can be solved by the use of microelectronic hybrid technology, and this paper details how this has been achieved. 1.1 Hybrid Microcircuits A hybrid microcircuit, or simply hybrid, is a miniaturised electronic circuit constructed of individual devices, such as semiconductor devices (e.g. integrated circuits and transistors) and passive components (e.g. resistors and capacitors), bonded to a substrate or printed circuit board (PCB). Hybrid microcircuits are well known in aerospace applications for safety critical products, where they are used primarily for their high reliability. This paper deals with the application of hybrids to safety critical nuclear reactor protection circuits. In order to understand why hybrids can be used to address the issues detailed in the introduction, it is necessary to understand their design and construction. 1.2 Hybrid Construction This paper considers a particular type of high reliability hybrid. Specifically one with a metal can, ceramic substrate and through hole printed circuit board connections via glass/metal hermetic seals. An example of this type of hybrid, without its metal lid fitted, is shown in figure 1. Figure 1: Hybrid built to Military Specifications 3

This type of hybrid is usually produced to a military standard such as MIL 883, MIL PRF 38534 or BS 9450. So effectively this type of hybrid is a large military metal can component.

4 This type of hybrid is usually produced to a military standard such as MIL 883, MIL PRF or BS So effectively this type of hybrid is a large military metal can component. Other types of hybrid are hermetically sealed ceramic bodied or dip coated (typically epoxy). Silicon die and passive components are mounted on a ceramic substrate within the metal can. This substrate is ceramic (typically alumina - aluminium oxide) about 0.6 mm thick. Onto this substrate electrical interconnection tracks are printed using an ink containing gold particles. The wet ink is baked at about 150 C to dry the ink, and then fired at 850 C to sinter the gold particles together and to the ceramic substrate. A borosilicate glass insulating layer is then printed over the first tracking layer and fired at 850 C. Then a second tracking layer is added. Typically up to 4 layers of tracking, separated by borosilicate glass insulating layers, can be used. Conducting metal coated holes in the substrate, called vias, are used as electrical interconnections between tracking layers. Then printed resistors (thick film) are added and fired at 850 C. These printed resistors are deliberately made lower resistance and then laser trimmed to the required value, as shown in figure 2. Figure 2: Printed Resistor Showing Laser Trimming Where close tolerance, low temperature coefficient resistors are required, thin film metal resistors are used. Gold pads, connected to tracks, are covered with silver-epoxy to retain components and provide an electrical connection. For example the rear face of a transistor die is often the collector and is connected to the pad by silver loaded epoxy. Metal plated ends of a surface mount capacitor are also connected to pads by means of silver loaded epoxy, an example of which is shown in figure 3. 4

Most electrical interconnections, to a complex semiconductor die, are by means of bond wires welded to aluminium pads on the die. An example of this is shown in figure 4.

Figure 3: Surface Mount Capacitor with Silver-Epoxy Connections Figure 4: Complex Semiconductor Die showing Bond Wires Two main types of wire bond welding are used.

5 Most electrical interconnections, to a complex semiconductor die, are by means of bond wires welded to aluminium pads on the die. An example of this is shown in figure 4. The other ends of the bond wires are welded to the gold interconnection tracks. Figure 3: Surface Mount Capacitor with Silver-Epoxy Connections Figure 4: Complex Semiconductor Die showing Bond Wires Two main types of wire bond welding are used. These are ball bonds and wedge bonds. Ball bonds are usually used with gold wire of typically mm in diameter. These are vertical bonded connections. Welding is performed using ultrasonics and heat, with the temperature at about 150 C. Wedge bonding is usually used on aluminium wires of typically mm in diameter. The wire is held at an angle of about 30 degrees to the surface, in the case of a wedge bond. Welding is performed using ultrasonics and applied pressure. Some high power dissipation or high current devices have their die mounted on molybdenum (moly) tabs to allow good thermal contact with the substrate. These moly tabs have the same thermal expansion coefficient as the silicon die. Physical attachment and electrical connection of the die to the moly tab is either by eutectic bonding or fluxless solder. 5

Electrical connection to the moly tab is usually via multiple bond wires, to provide sufficient current carrying capability, as shown in figure 5.

6 Electrical connection to the moly tab is usually via multiple bond wires, to provide sufficient current carrying capability, as shown in figure 5. Physical connection of the moly tab to the substrate is by means of silver epoxy. Figure 5: Power MOSFET on a Molybdenum Tab After the electronic circuits are complete, the metal lid is resistance welded on and the hybrid is filled with dry nitrogen gas. 6

7 2. Hybrid Testing Comprehensive testing of the hybrid is carried out both during build and after the build is complete. The most important testing during build is pulling of the bond wires to check the quality of the welded joints. These pull tests can either be done destructively or non-destructively. For the non-destructive tests a pull of a few grams force is exerted on the bond wire to check it does not become detached at the welds. Destructive testing is usually carried out on either a sacrificial hybrid, or on extra unused bond wires in a hybrid placed specifically for the purpose of testing. In destructive testing an increasing pull force is exerted until a weld fails, then the load at which failure occurs is recorded. In part, it is the ability to test the welds of bond wire electrical connections, which means high reliability of the final hybrid can be assured. Comparing this to soldered joints on a printed circuit board, it is usually impractical to physically test the soldered joints. Note that in the case of a printed circuit board, there are bond wires within the semiconductor packages as well as the soldered joints to consider in a reliability analysis. After the build of the hybrid, various testing is carried out as detailed in the following bullet points:- Fine and gross leak tests assess the quality of the hermetic seal, upon which the lifetime of the hybrid depends. This is because humid air leaking into the hybrid can eventually cause failure by corrosion. Acceleration to 5000g which tests that all semiconductor die and passive components are securely fixed to the substrate. Further it is another check on the quality of the bond wire welded joints. Rapid change of temperature cycling, for 10 cycles from -55 C to +150 C at 10 minutes per cycle. This stresses most of the joints within the hybrid, again to determine the quality of the build process. Particle impact noise testing checks that no debris, possibly from the previous testing, is present which could cause short circuits for example. Another approach is to fit a getter in the hybrid, to which small loose particles can stick. Rigorous electrical testing of the hybrid to ensure full functionality and performance. This even extends to measuring pico amps of leakage current on multiplexer inputs. 7

8 3. Obsolescence Proof Hybrids can be made effectively obsolescent proof, because semiconductor die can be stored indefinitely in dry nitrogen with no deterioration. So in twenty years time say, the die can be removed from storage and a new hybrid built to the original design. Hybrids are relatively expensive, compared to use of pre-packaged components on a printed circuit board. However, for the printed circuit board realisation, the circuits may have to be redesigned and requalified after twenty years due to obsolescence. This would be a very expensive exercise, in the case of safety critical nuclear reactor protection circuitry. By avoiding this redesign and requalification, the hybrid realisation of electronic circuitry is by far the least expensive in terms of through life cost. Objections have been raised as to whether there will still be a hybrid industry in twenty years to remake a hybrid from the die in storage. With hybrids used in defence, aerospace (large growth market), telecoms and motor industry this is judged a small risk. 8

9 4. Tin Whiskers Tin whiskers are now widely recognised as a serious threat to the correct functioning of safety critical protection circuitry. See for example Usually there is very little which is soldered in a hybrid. This is due to the majority of electrical connections being either by welded bond wires or by conductive adhesive (silver loaded epoxy). Therefore hybrid components do not require tin plated terminations, which are prone to producing tin whiskers, in order to be compatible with either unleaded or leaded soldering. Provided requirements are put in place to only allow essential soldering in the hybrid, and use solder with at least 5% lead content for any soldering, tin whiskers are not an issue. The 5% lead content effectively prevents tin whisker growth. Lead-free solder itself can give rise to tin whisker growth; however with none present in the hybrid, this is not a problem. 9

10 5. High Reliability Military Specification Components The rate at which high reliability military specification components are disappearing from the market place is ever increasing. This is due to the predominance of commercial components for consumer applications, for example mobile phones. As mentioned at the start of this paper, the type of hybrids detailed here are effectively high reliability components made to military specifications. Therefore this solves the problem of lack of availability of high reliability military specification components. Note that for the creation of high reliability hybrids, there are recognised standards, allowing commercial grade die to be screened to a military or space level, thus ensuring the required reliability is achieved. The only disadvantage to this approach is that semiconductor die are not available from all component manufacturers. However our experience at Ultra Electronics Nuclear Control Systems has been that the lack of suitable semiconductor die has not been insurmountable. For example many manufacturers make highly accurate Analogue to Digital Converters, so there is usually a choice of more than one manufacturer that supplies a die version. 10

11 6. Counterfeit Components When semiconductor die are purchased from manufacturers, data sheets are supplied which detail the size, shape and number/position of connection pads on the die. With this information the manufacturer has a very sound check that the die are not counterfeit. Further the end customer for the hybrid can also independently check that genuine die are being used before the lid is welded on the hybrid can. Further with the paperwork that comes with the semiconductor die, other aspects of the die can be checked. For example that the die are not from components that have already been in service for many years. Additional testing may be conducted to validate the authenticity of the die, for example constructional analysis, typically consisting of Scanning Electron Microscope (SEM) examination, radiographic examination and microsection analysis. With sophisticated counterfeiting of high reliability, high value components on the increase, the value of knowing exactly what is in the final hybrid cannot be underestimated for safety critical nuclear protection systems applications. 11

12 7. Other Advantages of Hybrids Hybrids built to military specifications are very reliable, which is why they are used in space applications, where repair is very difficult or impossible. Reliability is fundamental to safety, as the probability of failure on demand of equipment is basically the failure rate multiplied by the time to detect and fix a failure. In the case of nuclear applications, a guiding safety principle is to use the most reliable components available, so use of hybrids is a natural choice. The reliability of hybrids is due to the use of a hermitically sealed device with welded wire bonds and conductive adhesive (silver loaded epoxy) connections, both of which have been shown to be very reliable compared to soldered joints. Additionally the bond wire welds can be one hundred per cent non-destructively tested by pulling if required. With hybrids the end customer has full knowledge and control of design/build changes. Further, the hybrid manufacturers are told of any changes to the semiconductor die by the die manufacturers. This is very desirable for safety critical instrumentation used in the nuclear industry. When using components that come already packaged, there can be changes to either the die or the layout, and the customer could be unaware. Provided it still meets the minimum specification on the data sheet it is unlikely that the manufacturer will inform the customer. So, for example, the same type of transistor made today may oscillate in a circuit designed thirty years ago. This is due to the modern version of the transistor having smaller junction size and so higher frequency response, but still above the minimum requirement. Similarly logic families may have faster response times than in the past. Therefore timing is affected and a circuit that worked say 20 years ago, may not work correctly if the logic family components are replaced by modern versions of the same type. So the testing originally performed to validate the safety of the circuit is now invalidated. Voltage references and precision thin film resistors can be trimmed to a very close tolerance (e.g. 5.0V ±0.5mV). Trimming is usually performed by laser cutting of tracks in a binary array of small resistance values. A well laid out hybrid can have significantly better electromagnetic compatibility (EMC) performance than an equivalent printed circuit board, in terms of both emissions and susceptibility. Partly this comes from the circuitry being inside a metal can which acts as a shield (Faraday cage), and partly from the reduced track lengths. The reduced track lengths also means that stray capacitances and inductances are reduced and hence improve the frequency response of circuitry in hybrids. Compliant package leads, for example through hole, can be specified for the hybrid. This means there will be little sensitivity to fatigue of soldered connections due to thermal cycling. Hence a fatigue failure mode, often seen with leadless surface mount components, is removed. 12

13 Due to hybrids having a relatively large metal can and substrate, efficient cooling is relatively easy to achieve. Better cooling means lower semiconductor junction temperatures, which in turn means higher reliability and longer service lifetime. When we design hybrids for nuclear applications, the aim is an average semiconductor junction temperature of 78 C or below, to ensure a 25 year life. 13

14 8. Design Experience For nearly ten years Ultra Electronics Nuclear Control Systems have been designing and building nuclear instrumentation and control equipment using hybrid technology. Ultra Electronics not only have circuit design capabilities, but also a hybrid manufacturing facility. Given below is some of the design experience we have accumulated over the years. Although there are no component errors due to the thermal shock of soldering with hybrids, there is another error that is present when using hybrids. This error is due to the shrinkage of the epoxy silver on curing at about 150 C. For precision resistors (0.005% tolerance) this error is greater than that due to soldering of the same resistor in a leaded package. So for maximum accuracy, precision resistors used as references, are placed outside the hybrid. This also provides flexibility, since trip values and instrument ranges can be changed without having to open up the hybrid. The quality of semiconductor die and hybrid manufacturing has improved over the years. So now infant mortality of hybrids has effectively disappeared. We proved this to be the case by not burning-in a set of about 900 hybrids. Over the first year of operation, no hybrid failures due to infant mortality were recorded. As burn-in is done at high temperature, (usually 150 C) this can significantly reduce the lifetime of the hybrid. So leaving out burn-in, which is intended to catch component infant mortalities, provides a significant increase in the expected life of the hybrid. 14

15 9. Summary It has been shown that by the use of hybrids, four of the principal problems with design and build of nuclear reactor protection systems can be overcome. Further several other advantages of hybrids, especially in the field of safety, have been detailed. With respect to the UK nuclear new build, the benefit of realising either existing or new reactor protection system designs in hybrids has been demonstrated. Cyber security for nuclear plant has been a growing concern for many years. The discovery of Stuxnet1 brought home to plant operators and nuclear regulators the realisation that nuclear Instrumentation and Control (I&C) systems can be vulnerable, even if not directly connected to the internet. The cyber security threat is not a single issue. Threats can take many forms, and the consequential combination of disruption to normal plant operations with reputational damage means that today such threats are likely to feature high on the risk registers of almost all nuclear operators. Cyber disruption can use a large range of methods, including attacks on peripheral nuclear systems such as water and power systems, attacking the site Information Technology (IT) systems, or even personnel entry and checking systems. Due to their nature, reactor protection I&C systems must be considered as key targets for cyber threats, and hence cyber security is now seen as a vital element of safety system design. But unlike traditional safety system design, which attempts to identify the hazards at the outset and design systems to mitigate them, the cyber security threat is continually evolving and cannot be addressed in the same way. Where a safety case is approved at the outset and then rigorously maintained throughout the plant life, cyber security measures must be agile and on-going to enable the countermeasures to keep up with the threat. Best practice cyber security has many parallels to safety systems design and is based on a defence in depth approach. Threat and vulnerability analyses are used to identify security risks which are then quantified through formal risk assessments. Mitigations are then developed using organisational, process and technological strategies. However, in the case of safety systems, this approach to cyber security can create challenges through the introduction of complexity. In particular the cyber security industry has a tendency to focus efforts on technological solutions that may be wholly inappropriate since adding complexity is counter to good safety system design. Therefore to avoid unnecessary complication, whilst addressing the cyber threat, this paper proposes that security techniques be applied and continuously reviewed throughout the development and operational lifecycle of nuclear I&C systems. Such an approach is needed to counter these real and developing threats to a large range of nuclear I&C systems, from low integrity monitoring to the highest integrity safety protection systems. 15

The Next Generation in High Reliability COTS DC-DC Converters

APPLICATION NOTE The Next Generation in High Reliability COTS DC-DC Converters DC-DC CONVERTERS AND ACCESSORIES AN009 1.0 Page 1 of 9 Contents: Introduction... 3 Proven Design Heritage... 3 Lower Cost