Executive summary

The custom power electronics project for critical sectors — railway, defence, energy, infrastructure — does not allow the iterative cycle of the catalogue product. Production runs are short, deadlines are contractually binding, and the first prototype delivered to the customer must operate within specification. Massive hardware iteration is not an economically or temporally viable option.

Premium SA has developed an integrated simulation and test chain that systematically reduces the risk of the first prototype. The philosophy is direct: each hour of well-formulated simulation saves between five and ten hours of physical bring-up, and every fault detected in the modelling phase prevents costs that multiply exponentially when they appear in production or in the field.

1. The custom project challenge: no second chance

Custom equipment is born from a tender specification: 15 kV DC in a railway substation, passive cooling in a deployable defence converter at −40 °C, a form factor for a traction cabin that does not allow a single additional millimetre. Each of these requirements eliminates entire families of catalogue solutions and forces design from the topology level upwards.

The operational consequence is severe: the first prototype delivered to the customer — typically between week four and week six of the project — is validated against the entire contract, not against a simplified version. Any deviation appearing in that validation has three possible outcomes, all costly: partial redesign with timeline replanning, acceptance of contractual penalties, or batch rejection with replacement.

Production runs are short — 50 to 500 units is a typical range in railway and defence — and the product learning curve runs out before it covers the cost of iteration. Success at the first prototype is not a desirable goal; it is the minimum threshold of economic viability.

2. The pre-prototype simulation chain

Pre-hardware verification is structured in four layers covering the four dominant fault vectors in power electronics: electrical behaviour in transients, thermal dissipation, electromagnetic compatibility and digital control. The four layers run in parallel and intersect at quantitative validation points.

2.1 Electrical modelling: SPICE / PLECS / Simulink

The first layer is the power circuit model. Standard tools — SPICE for detailed switching analysis, PLECS or Simulink for averaged models and full-system simulation — allow verification, before manufacturing the first PCB, that the closed control loop is stable across the full operating range, that waveforms at critical nodes do not exceed semiconductor voltage margins, and that calculated losses are consistent with the available thermal dissipation.

For topologies using wide-bandgap semiconductors (SiC, GaN), accurate modelling of packaging parasitic effects is decisive. A use case of the European ALL2GaN research project has documented how the parasitic inductance of the power loop conditions snubber sizing in 3 kW/48 V totem-pole rectifiers achieving 97.5% efficiency and 40 W/in³ density: without an electrical model that captures the inductance of the TOLL package versus PG-DSO-20, the sizing falls outside the optimum.

2.2 Thermal CFD simulation: from chip to system

The second layer covers the thermal domain. CFD simulation enables characterisation at three levels of detail: chip-level dissipation and junction-to-case of the semiconductor; air or liquid circulation in the complete product; and heat transfer with the environment — cabin, cabinet, outdoor. We cover this domain in more detail in our article on thermal design in power electronics.

For demanding power densities — current OCP servers for AI workloads must dissipate hundreds of kilowatts per rack, with the most demanding variants approaching local heat fluxes above 700 W/cm² in active areas — integrated liquid microchannel solutions with dielectric coolant, in fraction-of-a-millimetre channel geometries, are already production-ready technology.

Cross-validation between the electrical model (which delivers the loss map per component) and the thermal model (which delivers the temperature map) closes the first cycle: an operating point with plausible losses but unacceptable temperature forces a topology revision, not an oversizing of the dissipation.

2.3 EMC pre-compliance simulation

The third layer is electromagnetic compatibility. A pre-compliance session in a semi-anechoic chamber typically costs several thousand euros and consumes calendar days; discovering a radiated-emissions failure at that stage, with the product already wired, is one of the most damaging scenarios for a custom project.

Modern EMC simulation tools — Method of Moments (MoM) solvers for radiated emissions, cable-bundle models for conducted emissions, PCB-specific simulators for ground-plane resonances — allow prediction of product behaviour against the applicable standards (CISPR 32, EN 50121-3-2 for railway, MIL-STD-461 for defence) before manufacturing. The Premium SA criterion sets a minimum design margin of 6 dB with respect to the applicable limits; any spectrum point that falls inside that margin in simulation triggers a design iteration before manufacturing.

2.4 MATLAB / Simulink: digital control validation

The fourth simulated layer covers the digital control loop. MATLAB and Simulink allow verification of the stability of voltage, current and temperature loops across the full load range, identification of operating points with insufficient phase margin, and sizing of compensators before implementing them in firmware. Automatic C code generation from the Simulink model reduces the risk of discrepancy between what is simulated and what is deployed.

This layer becomes particularly relevant when control must be certified at functional safety level — SIL2 or SIL3 according to EN 50128 for railway, ASIL-B or ASIL-C according to ISO 26262 for automotive. Traceability between the safety requirement, the Simulink model, the generated code and the associated test is both a normative requirement and a quality practice.

3. Quantitative reliability analysis: D4R

Reliability is not only verified on the bench; it is designed. Quantitative reliability analysis — embodied at Premium SA in the D4R methodological block — makes it possible to commit to MTBF figures backed by model and evidence. Our white paper on reliability in critical power electronics develops this approach further.

3.1 MTBF calculation

MTBF calculation at Premium SA follows the standards accepted by each sector: Telcordia SR-332 (formerly Bellcore) and MIL-HDBK-217F for the Anglo-Saxon and defence markets; Siemens SN29500 for European industrial customers; IEC 61709 when required by the customer; FIDES for sectors with particular environmental severity requirements.

For topologies using wide-bandgap semiconductors, derating factors are particularly relevant. SiC allows junction operation at 200 °C, and GaN between 175 °C and 200 °C; however, standard practice in custom projects is to work with a derating of 30 to 50% on datasheet limits. The difference between operating a SiC MOSFET at T_j = 150 °C versus T_j = 175 °C, all else being equal, roughly doubles the failure rate.

3.2 FMEA: systematic risk ranking

FMEA is applied to both product design (Design FMEA) and the manufacturing process (Process FMEA). For each identified failure mode, three dimensions are assessed — severity, probable occurrence and detectability — giving a Risk Priority Number (RPN) as the product of the three. Premium SA practice sets two thresholds: no failure mode with severity 9 or 10 (out of 10) can leave the FMEA without documented corrective action, and any mode with an RPN above 100 enters the verification plan with a specific test.

3.3 FTA: top-down tree from the effect

Fault Tree Analysis works in the opposite direction to FMEA: it starts from a feared event — loss of power output, dangerous voltage emission to the load — and descends to identify the combinations of elementary failures that can produce it. The quantitative analysis, fed with component failure rates, allows calculation of the probability of the feared event and verification that it meets contractual or normative objectives — a PFH below 10⁻⁷ for SIL3, for example. FMEA and FTA are complementary: FMEA is exhaustive bottom-up; FTA is analytical top-down.

4. Physical testing: DVT, HALT and HASS

Simulation reduces uncertainty but does not eliminate it. The physical test plan closes the flow by verifying model predictions against reality and characterising the product against failure modes the model does not capture.

4.1 DVT: Design Verification Testing

DVT is the complete verification battery for the contractual product requirements: nominal and transient electrical behaviour, output regulation across the full load range, thermal behaviour under nominal and derating conditions, EMC margins with respect to the applicable standard, mechanical tests — vibration, shock, thermal cycling — and behaviour under simulated environmental faults. Standard practice runs DVT on three units; all three must pass all tests without rework.

4.2 HALT and HASS: accelerated filters

HALT (Highly Accelerated Life Testing) takes the product beyond operational conditions — temperature ramps between −80 °C and +120 °C with simultaneous six-axis vibration — to identify operational and destructive margins. The purpose is to dramatically accelerate the appearance of latent failures so they can be corrected before series production.

HASS (Highly Accelerated Stress Screening) applies the knowledge gained in HALT as a production filter: each manufactured unit is subjected to an accelerated profile (typically 50 to 80% of the operational margin identified in HALT) to discard units with latent defects before shipping. The HALT+HASS combination does not replace DVT; it complements it.

5. The D2x methodology as structural framework

The previous layers only add value if applied at the right time and with the right criterion. The D2x methodology structures this flow: each of the five phases has an assigned set of simulation and test activities, with quantitative stage-gates between phases that are crossed only when the criteria are met.

The V-Model that structures the methodology links each requirement in the descending branch with its corresponding verification phase in the ascending branch. For safety-critical software, the V-Model is a normative requirement: EN 50128 prescribes it for railway software classified SIL1 to SIL4; ISO 26262 for automotive ASIL-A to ASIL-D; and IEC 61508 is the umbrella standard for industrial functional safety.

6. Conclusion

The chain described — four layers of simulation, three quantitative reliability tools, two levels of accelerated testing, all structured by the D2x methodology — is Premium SA’s operational answer to a structural constraint: the first prototype must work.

For the customer engineer evaluating providers of custom power electronics, the relevant question is not whether the supplier knows how to design; it is whether the supplier knows how to verify.

References