Executive Summary

Industrial and railway power electronics is going through a quiet but decisive transition: the replacement of electromechanical components and manual trimming techniques with solid-state architectures and deterministic calibration processes. Three levers drive this transition — the progressive elimination of the potentiometer, the reduction or elimination of the electrolytic capacitor, and the introduction of laser trimming on thick-film technology as the precision adjustment method in production. Each one targets a specific failure mechanism that historically limited converter service life; combined, they explain why a well-engineered unit today can be committed to an MTBF an order of magnitude higher than its fifteen-year-old predecessor at the same power rating.

This article walks through the three levers, ties them together with the Design for Reliability (DFR) methodology applied at Premium SA — mission profile, derating, FMEA, HALT/HASS, burn-in, FRACAS — and connects the result with the RAMS requirements of railway (EN 50126 / EN 50128 / EN 50129) and of critical grid infrastructure. The thesis is simple: 40-year reliability cannot be bought, it has to be designed; and the technological advances described here are the tools that make such a design viable.

1. The Paradigm Shift: From Reliability as Outcome to Reliability as Design Decision

For decades, the reliability of a power converter was measured after the fact. A unit was designed against a functional specification, manufactured, delivered, and the field failure rate was observed in service. If the number was unacceptable, the design was reworked. This “test-and-fix” approach has a well-known structural cost: correcting a reliability problem scales roughly 1× at schematic stage, 10× at layout, 100× at qualification testing, and grows by several additional orders of magnitude when the issue surfaces in a deployed fleet. The economics simply do not work in sectors with 30-year vehicle or substation lifecycles.

Design for Reliability (DFR), originated at the Center of Reliable Power Electronics (CORPE, Aalborg University) and adopted as the internal standard at Premium SA, inverts this order: reliability is set as a quantitative target at project kickoff — mission profile, target MTBF, service life, environmental conditions, thermal cycling — and the entire development process is structured to meet that number. The associated paradigm shift is the migration from handbook statistical models (MIL-HDBK-217F) toward a Physics-of-Failure (PoF) approach, grounded in the actual physical failure mechanisms: thermal fatigue of solder joints and wire bonds (Coffin-Manson), electrolyte evaporation under Arrhenius, electromigration, corrosion, mechanical fatigue of fasteners.

2. Goodbye to the Potentiometer: Digital Adjustment and Laser Trimming

2.1 The potentiometer as a concentrator of failure modes

The mechanical potentiometer has been the standard component for production calibration and field maintenance adjustments in power converters for half a century. Its appeal is obvious: it allows fine tuning of an analogue value (a voltage reference, a protection trip point, a gain) without changing components or reprogramming anything. But that very flexibility hides a concentration of failure mechanisms unmatched by any other passive component on the converter: mechanical wear of the resistive track; sensitivity to vibration (EN 61373 Cat. 1B); sensitivity to humidity and contamination; single point of intermittent failure via the wiper contact; and human risk in the adjustment — any manual field intervention is an opportunity to introduce an untraced calibration error.

The question is not whether a potentiometer will fail, but when. In a unit with a 30-year service life and a railway or substation mission profile, the answer is invariably “before the end”.

2.2 Replacement strategy 1 — digital potentiometer and parametric calibration

The first replacement strategy moves the adjustment to the digital domain. The analogue reference no longer comes from a trim resistor divider but is generated by software from a parameter stored in the microcontroller’s non-volatile memory or in an external EEPROM. Calibration is performed once in production, on a calibrated and traceable test bench, and is recorded against the unit’s serial number, operator, date and process signature.

2.3 Replacement strategy 2 — laser trimming on thick film

Thick-film technology has matured to make laser trimming a standard industrial process. Modern resistive pastes (RuO₂ and advanced ceramic compounds) provide stable resistors up to 300 °C continuous operation, with temperature coefficients below ±25 ppm/°C in precision grades. Components produced this way are surge-resistant, mechanically robust and their value does not drift over time under normal operating conditions.

2.4 When to choose each strategy

The practical conclusion is that in a modern Premium SA control board there should be no physical potentiometer at all. Factory adjustments are laser or digital; field adjustments are digital-only, protected by signature; control loops are deterministic by design.

3. Reducing and Eliminating the Electrolytic Capacitor

3.1 The electrolytic as the Achilles heel of the DC bus

If the potentiometer is the Achilles heel of calibration, the aluminium electrolytic capacitor is the Achilles heel of the DC bus. It is typically the component that fixes the service-life ceiling of a power converter, because it combines five awkward properties: service life intrinsically limited by electrolyte evaporation (life ÷2 every +10 °C); ESR growing with ageing; capacitance decreasing to ~80 % at end-of-life; sensitivity to ripple current (P_dis = I_ripple² × ESR → self-heating → accelerated ageing); and mechanical sensitivity requiring rigid restraint under EN 61373.

3.2 Premium SA strategy — long-life 105 °C capacitors

The first line of defence, when an electrolytic is unavoidable due to capacitance density, is aggressive part selection. Premium SA standardises on aluminium capacitors rated to 105 °C (some ranges to 125 °C in critical applications) with manufacturer-declared service life of 8,000 to 12,000 hours at maximum temperature — equivalent, by Arrhenius, to over 100,000 hours when operated at 50 °C. Combined with the Premium SA derating policy — V_op ≤ 80 % of V_rated, I_{ripple_real} ≤ 80 % of I_{ripple_rated}, T_{a_cap} < 85 °C in worst case — this pushes the ageing curve well below the product’s service-life horizon.

But “pushing” is not “eliminating”. As long as there is an electrolytic on the DC bus, there is a wear-out component that defines the slope of the bathtub curve at end of life.

3.3 Why digital ripple control changes the rules

3.4 The measurable impact — MTBF, MTTR, reliability

Removing the electrolytic from the DC bus simultaneously moves all three metrics that matter in critical infrastructure. MTBF rises — we have observed typical 5× to 10× improvements in converters where the electrolytic was the limiting factor. MTTR drops because the LRU is replaced less frequently and the spare-parts catalogue is simplified. Reliability R(t) approaches 1 asymptotically over the full 30-year horizon, instead of degrading in the last 10 years due to electrolytic wear-out. These effects are particularly valuable where downtime carries contractual cost: an electrical substation where a fault triggers DSO penalties, or a rolling-stock fleet where a withdrawal from service breaks the operator’s timetable.

4. Design for Reliability — the Methodology that Ties the Advances Together

The two technological levers above are necessary but not sufficient conditions. 30-year reliability also requires a development process that integrates and verifies them. The Premium SA DFR methodology structures the design across four sequential gates — D2W (Design to Work), D2F (Design to Function), D4R (Design for Reliability) and D4Co (Design for Compliance) — each with quantitative exit criteria.

4.1 Mission profile and derating as non-negotiable input

The first artefact of any Premium SA project is the mission profile: maximum and minimum ambient temperature, daily thermal cycles, cyclic humidity, altitude, vibration, expected number of starts over the service life, frequency of S2 supply-interruption events. Without this input, no PoF calculation has any meaning. With it, derating decisions become quantitative.

4.2 FMEA, FTA and the failure-mode hierarchy

Once derating is set, reliability engineering concentrates on identifying and mitigating the dominant failure modes through two complementary analyses. FMEA (Failure Mode and Effects Analysis) works bottom-up: for each component and each interface, possible failure modes, their causes and their effects are enumerated, with a Risk Priority Number assigned (RPN = Severity × Occurrence × Detection, 1–10 scale). At Premium SA, any RPN > 80 triggers a documented action plan, and RPN > 100 blocks the D4Co gate. FTA (Fault Tree Analysis) works top-down: it starts from the system failure and decomposes the Boolean combinations (AND/OR gates) that can cause it, allowing the impact of redundancies to be quantified and improvements to be prioritised by sensitivity factor.

4.3 The bathtub curve — each phase calls for a different technique

4.4 HALT, HASS and burn-in — what each one does

These three techniques are often confused, and they tackle different problems at different moments. HALT (Highly Accelerated Life Testing) is a limit-exploration test in the design phase: combined stresses (temperature + vibration) are progressively applied beyond the specification, until the operational and destruct limits of the product are found. It is not a qualification test, it is a discovery test — the output is the knowledge of how much margin we hold. HASS (Highly Accelerated Stress Screening) is a production-phase variant, with stress levels chosen just below the operational limit, used to detect latent manufacturing defects without consuming the product’s service life. Burn-in operates the product under controlled temperature (typically +60 to +80 °C) and load for several hours to screen the infant-mortality phase. Premium SA standardises 4 h of burn-in per unit, extended to 8 h on programmes with long maintenance intervals.

The three are complementary: HALT explores; HASS screens in production; burn-in cuts the left tail of the bathtub curve. Applied together, the failure rate during the first year in service drops to a fraction of the value without these techniques.

5. The Other Component that Also Ages — the Software

Any modern converter with digital calibration, predictive ripple control, complex protections and communication with the network supervisor carries firmware of growing complexity. From the function-reliability standpoint, this firmware is just another component of the system — and like any other component, it can be the root cause of a failure that compromises availability. The difference is that software does not age physically, but confidence in it erodes if there is no disciplined verification and validation process.

5.1 V-Model and EN 50128 as the framework for railway firmware

The reference standard for railway-application software is EN 50128, part of the EN 5012x family (railway RAMS). Its central element is the V-Model: each level of specification (system requirements, software requirements, architectural design, module design, code) corresponds to a verification level (unit testing, integration testing, system testing, acceptance testing). Each SSIL (Software Safety Integrity Level, levels 1 to 4 plus Basic Integrity) imposes mandatory techniques: formal reviews, static analysis, specific coverage metrics.

5.2 MISRA C, MC/DC and why they matter

MISRA C:2012 is the de facto standard for embedded firmware in C in critical systems. Its 143 rules (16 mandatory, 111 required, 16 advisory) cover language patterns that have historically been a source of defects: pointer aliasing, implicit conversions, undefined behaviour, dynamic memory management. Applying MISRA with static analysis (PC-lint, Coverity, Polyspace) removes a whole class of defects before execution. MC/DC (Modified Condition/Decision Coverage) is the most demanding coverage criterion routinely applied in certification: it requires that each individual condition within a Boolean decision independently affects the result of the decision. For a decision with n conditions, the minimum number of MC/DC tests is n+1, against the 2ⁿ required by combination coverage.

5.3 HIL and firmware verification on real hardware

The technique that closes the verification loop is HIL (Hardware-in-the-Loop). The firmware runs on the real microcontroller, but the input signals (voltage, current and temperature sensors) are synthesised by a real-time simulator that emulates the behaviour of the DC bus, the transformer, the motor or the load. This allows thousands of scenarios to be executed — including sensor failures, mains transients, short-circuits — with no physical risk to the equipment or to the test bench. A well-designed HIL programme catches hardware/software integration defects that no unit test could capture.

6. RAMS — the Metric that Ties Everything Together

RAMS stands for Reliability, Availability, Maintainability, Safety — the four metrics a railway operator or a grid DSO uses to judge the suitability of a unit across its service life. EN 50126 is the framework standard; EN 50128 and EN 50129 cover software and functional safety respectively.

6.1 The full R-A-M-S quadrant

6.2 FRACAS — the continuous learning loop

FRACAS (Failure Reporting, Analysis and Corrective Action System) is the process by which every field return is analysed at the appropriate level — LRU, board, component — the root cause is identified, and the corrective action is propagated back to design and production. Premium SA runs FRACAS as a closed loop between Quality, Aftersales and R&D. The consequence is that the fleet population improves over time, rather than degrading: the issue detected in unit #150 is prevented in unit #151.

6.3 PHM and the move to predictive maintenance

The active technical frontier today is PHM (Prognostics and Health Management): the transition from fixed scheduled maintenance toward maintenance based on the actual condition of the equipment. In Premium SA converters we progressively implement: real-time T_j estimation of power semiconductors from V_{ce_sat} and current; cumulative power-cycle counting with the associated ΔT_j to predict RUL (Remaining Useful Life) via PoF models; capacitor ESR monitoring by ripple analysis; and periodic export of operational data to the operator’s supervisor over the communications bus. The result is that the operator no longer has to choose between excessive preventive maintenance and late corrective maintenance — the equipment reports how much life is left.

7. Synthesis: the Concrete Levers that Make 30-Year Reliability Viable