CT X-ray High-Voltage Power Supply for Tube kV/mA Control
← Back to: Medical Imaging & Patient Monitoring
A CT X-ray HV PSU is the high-voltage power block that delivers stable, controllable kV and enforces fast protection, proven discharge, and fail-safe interlocks so exposure remains accurate and serviceable under real dv/dt and fault conditions. This page focuses on kV generation/feedback, isolated gate drives, arc shutdown logic, discharge evidence, interlock permissioning, and telemetry that makes validation and troubleshooting repeatable.
H2-1 · What it is: CT X-ray HV PSU in one screen
A CT X-ray HV PSU is the high-energy supply that drives the X-ray tube with regulated kV and controlled tube current.
It must keep kV/mA stable during exposure, survive high dv/dt stress with isolated drives, and respond to arc or interlock events
with fast shutdown, verifiable discharge, and diagnostic telemetry for service and compliance evidence.
What this subsystem must deliver (and how to prove it)
- kV stability under exposure disturbances — kV must ramp to target without overshoot that stresses the tube, then hold within a defined error/ripple budget across line, load, and temperature drift. Proof: log kV_set vs kV_meas, ripple metric, and “loop-in-regulation” flag per exposure.
- Tube-current control within a clear boundary — mA control must respect kV loop authority and enforce current/power limits without oscillation when setpoints change or an arc precursor appears. Proof: step-response captures (mA_set→mA_meas), limit-active indicators, and recovery behavior after limit release.
- Fast protection for arc/over-current/abnormal dv/dt — detection must be robust against noise while still reacting fast enough to limit energy into a fault. Proof: measured shutdown latency (event→power stage off), arc counter, and latched fault code with snapshot values.
- Verifiable discharge to a safe residual level — discharge must work not only in normal shutdown, but also after fault trips and after input power loss. Proof: a discharge-complete status that is backed by a measured residual-voltage (or equivalent) evidence field and timing window.
- Service-grade diagnostics and traceability — telemetry is not optional; it enables fault triage, trending, and audit evidence. Proof: time-stamped logs tied to exposure windows (start/stop), interlock cause, arc/shutdown reason, and key analog snapshots.
Scope fence: This page covers HV generation/regulation, protection, discharge, interlocks, and telemetry. CT detector/AFE chains,
image processing/reconstruction, and frame grabbing interfaces are intentionally out of scope here.
H2-2 · System placement & interfaces (who talks to whom)
A CT HV PSU sits between the gantry controller and the X-ray tube as a permissioned energy system.
Keep interfaces clean by separating hardwired safety permission (must fail to “HV OFF”) from functional control & telemetry
(setpoints, status, logs). If a signal can enable energy, it should be treated as a safety-path input with explicit default states and evidence logging.
Interface rules that prevent field failures
- Any “permit/enable” input: open-circuit or power loss must equal NOT permitted.
- Any digital command path: define timeout behavior (hold-last vs ramp-to-zero) and log the transition.
- Any safety decision: provide evidence (cause code + timestamp + key snapshots) for service and audit.
Interface port table (boundary + fail-safe defaults)
| Signal / Port | From → To | Type | Key requirements | Fail-safe default | Evidence / logs |
|---|---|---|---|---|---|
| Safety chain (permission inputs) — signals that can allow or deny high-energy operation. | |||||
| HV_ENABLE / PERMIT | Safety chain → HV PSU | Hardwired safety | Defined polarity, debounce, isolation as needed; separate from data bus. | Open/low/timeout = HV OFF | Permit drop timestamp + cause code |
| E-STOP | Safety chain → HV PSU | Hardwired safety | Immediate energy removal path; latch behavior defined. | Asserted or broken loop = HV OFF + latch | E-stop event + shutdown latency snapshot |
| DOOR / COVER OK | Safety chain → HV PSU | Hardwired safety | Defined wiring supervision (open circuit treated as unsafe). | Unknown/open = Not permitted | Interlock cause = door/cover |
| Coolant / thermal permission — treat as part of the interlock chain, not “just sensors”. | |||||
| COOLANT_OK / FLOW_OK | Coolant system → HV PSU | DI / hardwired | Debounce + plausibility; define what “OK” means (flow/pressure/temp). | Missing/invalid = Not permitted | Interlock cause = coolant + sensor state |
| TEMP_ALARM | Thermal monitor → HV PSU | DI / analog | Over-temp threshold + hysteresis; ensure no false trips from noise. | Asserted = HV OFF | Trip timestamp + temperature snapshot |
| Gantry controller control — setpoints and exposure window commands (must be gated by safety permit). | |||||
| EXPOSURE_CMD / X-RAY_ON | Controller → HV PSU | DI / hardwired | Edge timing defined; must be ignored if permit is false. | Timeout/permit false = Stop exposure | Exposure start/stop timestamps |
| kV_SET | Controller → HV PSU | Analog / serial | Range limits + ramp profile; define CRC/timeout if digital. | Invalid/timeout = ramp-to-safe (defined) | kV_set history + ramp mode |
| mA_SET / POWER_LIMIT | Controller → HV PSU | Analog / serial | Limit priority defined; avoid control-loop “fighting”. | Invalid = limit active or stop exposure | Limit-active flag + measured peaks |
| Tube-side monitoring & events — internal measurement paths used for regulation and protection. | |||||
| kV_FEEDBACK | Tube HV node → HV PSU (internal) | Divider + isolated ADC | Creepage/clearance design intent; drift & contamination awareness; plausibility checks. | Plausibility fail = disable HV | kV_meas + plausibility status |
| TUBE_CURRENT_MON | Tube return path → HV PSU (internal) | Sense + isolated readout | Bandwidth supports protection; avoid aliasing in trip detection. | Over-current = fast shutdown | Trip threshold + peak snapshot |
| ARC_EVENT | HV PSU → Controller | DO / latched status | Noise-robust detect; count + lockout policy defined. | Asserted = stop exposure + log | Arc count + shutdown latency |
| Status & telemetry — service and audit visibility (not a substitute for safety hardware). | |||||
| HV_READY | HV PSU → Controller | DO | Defined “ready” conditions (permit true, self-check pass, discharge ok). | Power loss = not ready | Ready asserted reason bits |
| FAULT_CODE / FAULT_LATCH | HV PSU → Controller | DO + serial log | Stable codes, versioned mapping, snapshot capture at trigger. | Fault = HV OFF until cleared | Fault code + analog snapshots |
| DISCHARGE_OK | HV PSU → Controller / Service | DO | Backed by residual evidence, not just a timer; valid after power-loss. | Unknown = treat as NOT safe | Residual reading + discharge duration |
Reading tip: When reviewing an interface, ask two questions: (1) Can this signal enable energy? If yes, it belongs to the safety/permit path.
(2) If the signal breaks or times out, does the system deterministically return to “HV OFF” and record the cause?
H2-3 · kV generation architecture (topology options without going off-page)
In a CT HV PSU, the kV generator is best viewed as a permissioned energy path: it must deliver repeatable kV ramps,
control delivered energy during exposure, and still behave predictably during faults and discharge. The mainstream route is
HF inverter → HV transformer → rectifier, with limited, CT-relevant options around switching style and optional stacking/multiplication.
Architecture decisions that matter most in CT
- Where energy is stored (output capacitors, stack capacitors, magnetics) determines arc severity and discharge time.
- How fast kV can be shaped (ramp and disturbance response) is limited by power-stage dynamics and measurement delay.
- How faults are terminated (fast shutdown and lockout policy) must remain deterministic under dv/dt and noise.
Resonant (LLC) vs hard-switched: CT-focused tradeoff table
| Dimension | Resonant / LLC (typical) | Hard-switched (typical) | CT engineering consequence |
|---|---|---|---|
| Efficiency & heat | Lower switching loss in many regimes; thermal headroom improves. | More switching loss; heat management and derating pressure grows. | Thermal margin impacts exposure repetition rate and lifetime of HV parts. |
| Dynamics (ramp & disturbance) | Control can be more coupled to operating point; transient tuning can be harder. | Control is often more direct; predictable response is easier to shape. | kV ramps must be repeatable; exposure disturbances must not trigger false protection. |
| EMI & dv/dt behavior | Often softer switching waveforms; spectral peaks can be easier to manage. | Sharper edges; dv/dt and ringing can increase sensing and interlock noise risk. | Measurement and interlock robustness must be designed for worst-case dv/dt. |
| Protection integration | Arc/OC handling must consider resonant tank energy and operating point. | Fast shutdown and current limiting can be more straightforward. | Fault energy and shutdown latency define tube and HV component stress. |
| Control complexity | More parameters; tuning and corner-case coverage can be heavier. | Often simpler tuning; easier to validate across operating space. | Validation burden matters: exposure repeatability + protection determinism. |
Multiplier / segmented stack: when it is used (and the risks)
A multiplier or segmented HV stack can be considered when the target kV makes single-stage insulation and component stress impractical.
In CT, this choice must be evaluated as an energy and discharge decision, not just a voltage decision.
- Energy storage increase — stack capacitors store fault energy; arc events can become harsher. Design focus: define how energy is limited during faults and how lockout/reset is handled.
- Discharge complexity — multiple nodes can retain residual voltage; a single bleeder may not guarantee a safe state everywhere. Design focus: discharge paths per segment and evidence that residual voltage is below the safe threshold.
- Equalization reliability — long-term drift, humidity contamination, and component tolerance can unbalance segments. Design focus: segment plausibility checks and maintenance indicators tied to telemetry trends.
H2-4 · kV feedback & regulation loop (accuracy + stability)
kV regulation quality depends on two layers: the measurement chain (divider → buffer/filter → isolated sampling) and the
control loop (bandwidth + compensation + ramp strategy). A CT HV PSU should also maintain reading credibility:
if the divider drifts or contamination causes abnormal leakage, the system must detect the condition and fall back to a safe state with evidence logs.
kV sampling chain: what can go wrong and what it looks like
- HV divider drift (tempco/aging): slow kV bias error, exposure-to-exposure inconsistency, calibration creep.
- Surface contamination / humidity leakage: noisy or step-like kV readings, false loop corrections, “random” protection trips.
- Partial discharge symptoms: sporadic spikes, non-repeatable jumps, correlation with humidity and high-kV corners.
- Isolated sampling delay & noise: reduced phase margin, higher ripple, and sensitivity to dv/dt coupling.
Control loop: bandwidth, ramping, and exposure disturbances
- Bandwidth target — set the loop fast enough to reject exposure disturbances, but slow enough to tolerate isolated-measurement delay and switching ripple. The goal is repeatable ramps and stable regulation across operating corners.
- Compensation strategy — shape phase margin around the dominant power-stage and measurement-chain poles, and avoid “fixing” ripple by adding so much filtering that delay destabilizes the loop.
- Start-up and kV ramp manager — treat ramp as a safety and stress-control tool: limit dv/dt to reduce overshoot, tube stress, and false arc detection, and keep the ramp policy tied to permit/interlock status.
- Exposure disturbances — handle setpoint steps, tube-current limiting events, and arc precursors without runaway correction. Use event-based overrides: protection must be able to bypass the normal controller to force shutdown deterministically.
Reading credibility: detecting divider drift, contamination, and abnormal behavior
A “kV number” is only useful if it is credible. Credibility checks should combine plausibility (does kV behavior match the commanded power state),
trend analysis (slow drift vs sudden jumps), and policy actions (safe fallback + evidence logging).
- Plausibility: kV change rate and direction should be consistent with the ramp command and power-stage state; implausible spikes are flagged.
- Cross-check: kV behavior should correlate with tube-current behavior and limit flags; mismatches suggest sensing faults.
- Trend: consistent bias under similar exposures suggests divider drift; sporadic steps suggest contamination or discharge activity.
- Policy: credibility loss triggers a defined safe state (stop exposure, disable HV, request service) and records cause + snapshots.
Error budget checklist (source → symptom → verification)
| Source | Visible symptom | Risk to CT operation | Verification method | Mitigation (HV PSU scope) |
|---|---|---|---|---|
| Divider tempco / aging | Slow kV bias shift | Exposure repeatability loss | Temperature sweep + periodic reference check | Calibration hooks + drift threshold alarms |
| Humidity / contamination leakage | Noisy/step-like kV readings | False corrections or false trips | Humidity corner testing + spike statistics | Plausibility checks + service indicators |
| Isolated sampling delay | Increased ripple / oscillation | Unstable regulation during exposure | Step response + loop stability margin tests | Bandwidth limiting + compensation tuning |
| Quantization / noise floor | kV readout jitter | Poor ripple metric and false trend alarms | Noise histogram + ripple metric repeatability | Averaging policy + threshold tuning |
| dv/dt coupling into sense | Synchronous spikes with switching edges | Wrong loop action or false protection | Time-aligned capture vs switching state | Filtering + plausibility gating under dv/dt |
H2-5 · Tube current control boundary (mA is not just “more power”)
In a CT HV PSU, tube current (mA) is a bounded, permissioned variable. It is shaped by exposure recipes and safety limits,
measured under high dv/dt conditions, and coordinated with the kV loop to prevent instability. The HV PSU’s responsibility is not
tube physics—it is deterministic control + protection + evidence for the current path it can influence.
Current sensing & protection inside the HV PSU
- Sensing goal split: a fast path for protection (spikes and arc precursors) and a stable path for control (average current during exposure).
- Threshold classes: instantaneous over-current (fast shutdown) versus sustained over-limit (current limit / derate / latch).
- Dynamic range policy: exposure recipes can vary widely; scaling and filtering must avoid false trips at high dv/dt and still catch real faults.
- Evidence logging: peak mA, duration-over-threshold, kV sag during limiting, and a cause code (OC, arc, plausibility fault).
kV ↔ mA coupling: avoid “two loops fighting”
kV changes can shift tube current, and current limiting can pull kV down. A CT HV PSU should keep regulation stable by using a
clear priority model: kV loop keeps voltage shape, while mA control enforces boundaries (limit, ramp coordination, fault override).
- Supervisor arbitration: an upper layer mediates between kV shaping and mA limiting (limit/permit wins when safety is involved).
- Anti-windup behavior: when limiting or protection intervenes, the kV controller must not integrate into a large recovery overshoot.
- Ramp coordination: kV ramps and mA targets must be consistent to prevent oscillation during exposure transitions.
Two mA control paths: boundary conditions comparison (HV PSU scope)
| Item | HV-side current regulation | Filament / grid-side modulation | Acceptance focus |
|---|---|---|---|
| What HV PSU directly controls | Energy delivered on the HV path (limit/shape current via the power stage). | A command boundary that influences current indirectly; HV PSU still owns hard shutoff. | Deterministic behavior across corners; current does not “wander” under dv/dt. |
| Coupling to kV loop | Strong coupling: limiting can create kV sag and loop interaction. | Often softer coupling on the HV stage, but kV changes can strongly affect current result. | No oscillation during ramps; anti-windup and ramp coordination verified. |
| Protection integration | Fast OC/arc response can be embedded into the HV stage (hard stop / latch). | Soft modulation is not sufficient for faults; HV PSU must still hard-stop energy. | Fault override path is independent from normal control and always wins. |
| Measurement stress | High dv/dt can inject spikes into sense; protection vs control paths must be separated. | Sense still sees dv/dt; stability depends on credible measurement and filtering policy. | Spike discrimination + correct thresholding across dynamic range. |
| Evidence logs | Limit state, peak mA, kV sag, shutdown latency, cause codes. | Command vs response delay, saturation events, HV-side override records. | Traceability: “why current was limited / stopped” with timestamps. |
H2-6 · Isolated gate drives (CMTI, dv/dt, timing)
In a CT HV PSU, isolated gate drives are a system-level reliability function: they must maintain correct switching behavior under high dv/dt,
prevent false turn-on/turn-off, and guarantee a safe default state under power loss, UVLO, or communication failure. Selection should be based on
how to verify, not on generic isolation theory.
Why isolation is required in the HV PSU switching domain
- High dv/dt common-mode transients can corrupt PWM interpretation and trigger false faults.
- Ground bounce and switching ringing can distort gate waveforms and create spurious pulses.
- Noise injection into sensing loops can destabilize kV/mA regulation if not contained.
- Deterministic fault action requires a hard, local shutdown path independent of software timing.
Gate-drive chain: end-to-end responsibilities
- PWM/FPGA timing source defines switching pattern and deadtime policy.
- Isolation barrier must tolerate dv/dt without data corruption and keep delay/skew within validated limits.
- Gate driver stage must provide strong, repeatable gate transitions and enforce UVLO-based safe-off behavior.
- Desaturation/OC protection must trip locally and report a latched fault back across isolation for traceability.
- Isolated bias supply is part of safety: loss or brownout must force a defined gate-off default state.
Key metrics: how to select and how to accept (verification-driven)
| Metric | Failure symptom in CT HV PSU | Acceptance / verification method | Design expectation (HV PSU scope) |
|---|---|---|---|
| CMTI / dv/dt immunity | False turn-on/turn-off, PWM glitches, spurious fault trips. | Apply worst-case dv/dt transients and log error rates, gate waveform integrity, fault codes. | No uncontrolled switching; any detected anomaly drives safe-off + evidence. |
| Propagation delay & matching | Shoot-through risk, efficiency loss, EMI spikes, unstable switching. | Measure delay/skew across temperature and supply corners; validate deadtime margin to worst skew. | Deadtime policy covers worst skew; timing remains repeatable. |
| Fail-safe default state | Gate remains on during UVLO/brownout; unsafe residual switching. | Pull permits, drop isolated bias, force UVLO; verify gate-off and latched fault behavior. | Any loss-of-control forces gate-off and prevents auto-restart without clearance. |
| Desat / OC trip latency | Excess fault energy; device stress; tube/HV component damage risk. | Controlled fault injection; measure shutdown latency and residual switching pulses. | Local trip dominates; override path is independent of firmware scheduling. |
| Noise resilience of fault return | Fault not reported or chatters; unclear serviceability. | dv/dt stress while tripping; confirm fault latch + stable reporting + timestamp logging. | Fault is latched, time-stamped, and requires explicit reset conditions. |
Verification checklist (practical, HV PSU focused)
- dv/dt stress run: confirm no PWM corruption and no false turn-on pulses.
- Delay/skew characterization across corners: validate deadtime margin to worst case.
- UVLO / bias drop tests: verify safe-off default state and lockout policy.
- Desat/OC injection: measure shutdown latency and confirm no uncontrolled restart.
- Fault evidence: cause code, timestamps, and key snapshot fields are consistent and complete.
H2-7 · Arc / over-current protection (fast shutdown logic)
Arc and over-current handling in a CT HV PSU must be faster than regulation and deterministic. The protection path should
bypass normal kV/mA loops, stop energy injection immediately, limit residual energy, and produce serviceable evidence (cause code,
timestamp, peak values and action sequence). The goal is consistent outcomes under worst-case dv/dt and noise, not a single-threshold trip.
Typical arc / discharge signatures (what the HV PSU can observe)
- Hard signatures: tube current spike (I_fast), kV collapse (ΔkV/Δt), desaturation/OC on the switch stage.
- Soft signatures: abnormal dv/dt or switching-node noise burst, repeated events in a narrow kV/mA region.
- Repeatability matters: recurring events across exposures should trigger lockout escalation rather than endless retries.
Detection channels: roles, credibility and false-trip control
| Channel | Primary role | Typical false-trip source | Mitigation / proof policy |
|---|---|---|---|
| I_fast (current spike) | Fast trigger for energy stop | dv/dt-injected spike, ground bounce | Short deglitch + confirm with kV collapse or desat; log peak and width |
| ΔkV/Δt (kV collapse) | Confirmation and classification | sampling artifact during switching transients | Windowed slope + persistence check; store pre/post samples |
| Desat / OC (driver-side) | Strong trigger (local) | noise coupling into sense pins | Latch at the driver; require explicit reset conditions; log trip latency |
| dv/dt / noise burst | Support signal for confidence | normal switching edges | Use abnormal pattern detection only; never alone as a trip cause |
| Optical event (optional) | Arc confirmation & diagnostics | sensor open/short, aging | Health monitoring; open-circuit drives a degraded mode with stricter thresholds |
| Bus anomalies | Disambiguate supply collapse vs arc | measurement delay / ripple coupling | Correlate with kV and current; store bus snapshots for service |
Protection actions: shutdown sequence, energy limiting, retry and lockout
- Shutdown sequence: gate-off/inhibit PWM → latch fault snapshot → isolate energy path (if applicable) → transition to DISCHARGE proof flow.
- Energy limiting intent: minimize both (1) injected energy before shutdown and (2) residual energy after shutdown by enforcing discharge proof.
- Retry policy: bounded retries with cooldown; ramp-limited restart; escalation to lockout when events repeat or confidence is high.
- Latch & manual reset: repeated arcs, desat-triggered trips, proof failures or interlock drops should require explicit service clearance.
State machine intent: RUN regulates and logs; ARC_DETECT fuses signals and captures evidence; SHUTDOWN stops energy; DISCHARGE proves safe;
RETRY restarts under tighter constraints; LATCH blocks restart until reset conditions are met.
H2-8 · Discharge path & “safe to touch” proof (engineering intent)
A discharge design is incomplete without proof. The CT HV PSU should define a discharge time window, residual voltage/energy targets,
and explicit scenarios (power loss, interlock, post-arc) that must end in a verifiable “safe state.” Proof must cover not only the main HV node
but also any segmented capacitors or multiplier stacks where local residual voltage can persist.
Discharge paths (principles only, HV PSU scope)
- Bleeder path: passive baseline discharge to prevent long-lived floating nodes; not sufficient alone for proof timing in fault cases.
- Controlled discharge: a commanded path (switch + resistor/network) that activates during shutdown and produces measurable proof.
- Service discharge port: maintenance-mode pathway intended for servicing and verification flows (principle-level only).
Acceptance matrix: scenario → path → proof → failure action
| Scenario | Discharge path used | Proof required | Failure action | Logged evidence |
|---|---|---|---|---|
| Normal stop | Controlled discharge + bleeder | Main node V_res ≤ target within window | Hold in DISCHARGE until pass; block re-enable | V_start, V_end, time-to-target, pass flag |
| Interlock / E-stop | Immediate shutdown + controlled discharge | Main + key segment points meet residual criteria | If timeout or sensor invalid → LATCH | Cause code, node list, timeout flag |
| Power loss | Bleeder + any available passive path | Proof on next power-up before enabling HV | Block HV enable; require service clearance if abnormal | Startup proof results; residual anomaly marker |
| Post-arc shutdown | Controlled discharge prioritized | Residual targets + “local residual” check for stacks | Proof fail → LATCH; no RETRY | Event snapshot + discharge curve summary |
Local residual voltage risk (segmented capacitors / multiplier stacks)
- A main-node measurement can look safe while a stack segment remains charged.
- Proof must include a defined set of “critical points” or an equivalent validated inference mechanism.
- Any proof failure should block RETRY and enter lockout until explicit service reset conditions are met.
H2-9 · Safety interlocks chain (permissioning & redundancy)
The interlocks chain is the HV PSU’s final veto. If an interlock is not satisfied, high-voltage must not be enabled
(fail-safe: loss of power or a broken wire means “disable”). A robust design separates a hardware inhibit path
(deterministic gating) from permissioning logic (clear reasons, evidence, and serviceable recovery), and adds redundancy and self-test
so the chain remains trustworthy under noise, dv/dt, and long-term drift.
Interlock classes (how they behave)
- Hard interlocks (immediate inhibit): E-stop, door/cover, safety chain open, critical fault latch.
- Operational permits (controlled inhibit/derate): coolant flow, rotor/fan OK, thermal headroom.
- Monitoring-derived inhibits (policy-based): insulation monitor inhibit, discharge proof failure, repeated arc lockout.
Interlock link table (signals → defaults → owners → evidence)
| Signal | Source | Class | Debounce | Default on fault | Latch policy | Owner | Evidence logged |
|---|---|---|---|---|---|---|---|
| E-stop | Safety chain | Hard interlock | None | Disable HV | Latch until manual reset | Hardware inhibit | Cause + timestamp + exposure ID |
| Door / cover | Safety chain | Hard interlock | Short deglitch only | Disable HV | Latch if drop during exposure | Hardware inhibit | Interlock bits + timestamp |
| Coolant flow OK | Thermal subsystem | Operational permit | Windowed | Disable or derate | Latch if repeated drops | Permission logic | Flow status + duration |
| Rotor / fan OK | Mechanical subsystem | Operational permit | Windowed | Disable or derate | Latch if drop during exposure | Permission logic | Status + speed (if available) |
| Thermal limit (hotspot) | Temperature sensing | Operational permit | Filtered | Derate → disable | Latch at critical overtemp | Permission logic | Temp + threshold state |
| Insulation monitor inhibit | IMD / leakage monitor | Monitoring-derived | Policy window | Disable HV | Latch until service clear | Final veto (safety) | Reason + trend marker |
| Discharge proof pass | HV PSU proof controller | Monitoring-derived | Time window | Block re-enable | Latch on timeout/fail | Final veto (proof) | V_start/V_end + time-to-safe |
| Fault latch active | Protection logic | Hard interlock (logical) | None | Disable HV | Manual reset required (policy) | Final veto (fault) | Fault code + snapshot + exposure |
Final veto ownership (who can say “NO”)
| Gate | Inputs that can veto | Software override? | Recovery conditions |
|---|---|---|---|
| HV enable | Hard interlocks + fault latch + discharge proof fail + insulation inhibit | No | All interlocks OK, fault latch cleared, proof OK |
| Exposure permit | HV enable satisfied + operational permits + readiness checks | Limited (cannot bypass HV enable) | Permits stable within policy windows |
| Fault latch clear | Service reset + interlocks OK + proof OK + event acknowledged | No (must be explicit) | Clear reason logged; reset procedure completed |
Fail-safe rule (simple but strict): if power is lost, a wire breaks, or self-test fails, the chain must fall back to HV disabled.
Redundancy (dual-channel for critical interlocks) and periodic self-test provide confidence that “permit” really means safe to enable.
H2-10 · Digital telemetry & diagnostics (serviceability)
Telemetry is not only “kV and mA.” A serviceable CT HV PSU reports operating values, stability/quality metrics, protection counters,
interlock reasons, and precise timestamps so a field engineer can reconstruct what happened during an exposure. Logs should be correlated
to exposure IDs and phases (ramp, exposure, shutdown, discharge) to support troubleshooting and compliance evidence.
Communication boundary (requirements only)
- Telemetry interfaces should be authenticated and protected for integrity and confidentiality.
- Boot/firmware integrity evidence should be available to the system controller (details belong on the Security page).
- This page defines fields and service intent, not protocol or cryptographic implementation.
Telemetry field table (field → purpose → abnormal rule → service action)
| Field | Use | Abnormal rule (system-defined) | Service action | Exposure correlation |
|---|---|---|---|---|
| kV_set / kV_meas | Verify regulation and delivered setpoint | |kV_meas − kV_set| > limit for N samples | Check divider drift/contamination; run calibration | Yes (phase-tagged) |
| mA_set / mA_meas | Tube current stability and limits | mA instability or saturation beyond limit window | Inspect coupling with kV loop; verify current sensing | Yes |
| ripple_rms / ripple_pp | Quantify kV quality (noise/instability) | Ripple metric exceeds system limit for N exposures | Check switching stage, filter network, divider pickup | Yes |
| droop_peak / droop_duration | Capture dynamic sag under load transients | Sag beyond allowed transient envelope | Review loop bandwidth, ramp, load steps | Yes (with phase) |
| arc_count / arc_rate | Track event frequency and escalation | Arc rate exceeds policy window | Lockout; inspect tube/cabling; validate protection timing | Yes (event-linked) |
| desat_count / oc_count | Switch-stage health and trips | Any desat trip during exposure or repeated events | Check gate drive immunity, timing, device margin | Yes |
| interlock_reason_bits | Explain why enable/permit was denied | Unexpected toggling or inconsistent channel states | Cable/sensor check; verify redundancy & self-test | Yes |
| temp_hotspot / coolant_state | Thermal headroom and derating evidence | Overlimit, fast rise rate, or missing coolant OK | Derate/disable; inspect thermal path and sensors | Yes |
| shutdown_ts / shutdown_latency | Prove action sequence timing | Latency exceeds protection budget | Review detect path, gating, driver trips | Yes (event-linked) |
| discharge_proof_time / proof_pass | Safe-state verification before re-enable | Timeout or proof invalid | Lockout; service inspection of discharge path & sensing | Yes |
Logging minimum set (event record): EventCode, Severity, Timestamp, ExposureID/Phase, Snapshot (kV/mA/bus/temp/interlock bits/proof bits), Result (retry/latch/cleared).
This turns telemetry into a reproducible service story rather than raw numbers.
H2-11 · Validation checklist (how to prove it works)
Evidence-based release criteria for CT X-ray HV PSU only: kV accuracy/stability, fast fault shutdown (energy limiting), discharge proof (“safe-to-touch”), interlock integrity, and production repeatability with traceable logs.
What “PASS” must demonstrate (engineering intent)
- kV is accurate and stable during exposure: ripple/droop are bounded under line/load/temperature variations.
- Protection is energy-limiting: fault detect → gate-off latency is controlled, retries are bounded, latching is intentional.
- Discharge is provable: residual voltage falls below the defined threshold within a verified time window for all stop paths.
- Interlocks cannot be bypassed: fail-safe default, redundancy consistency, and fault injection prove “no single fault enables HV.”
- Production is repeatable: calibration + firmware/hardware versions are locked and logs are consistent for serviceability.
Field-executable checklist (setup → procedure → pass + evidence)
| Test item | Setup | Procedure | Pass criteria + required evidence |
|---|---|---|---|
| kV static accuracy | Independent HV reference measurement (not the control divider), logged ambient T/RH. | Sweep kV setpoints across operating range; repeat at low/nominal/high input. | |error| ≤ ____%FS (define bandwidth/filter). Evidence: raw dataset + reference chain ID + environmental record. |
| Exposure ripple | Worst-case switching + layout config; measurement bandwidth explicitly stated. | Run representative exposure windows; capture kV waveform and ripple metric. | Ripple ≤ ____% p-p. Evidence: waveform screenshot + numeric ripple extraction method. |
| Load-step droop & recovery | Programmable load / exposure profile equivalent; synchronized logging. | Step between low/high mA commands (within HV PSU boundary); capture kV droop and settle time. | Droop ≤ ____% and settle ≤ ____ms. Evidence: annotated step response plot + time markers. |
| Temperature & humidity sensitivity | Temperature sweep + RH logging; same calibrated reference chain. | Cold start → hot steady → cool down; repeat key kV points; look for divider drift signatures. | Drift ≤ ____%FS over the profile. Evidence: drift vs time plot + RH correlation note (if any). |
| Arc / over-current detect-to-shutdown | Fault injection method (equivalent stimulus), capture digital + analog timestamps. | Trigger the detect path(s) (current spike / dv/dt / DESAT / bus anomaly); measure detect→gate-off latency. | Latency ≤ ____µs/____ms; shutdown order matches spec. Evidence: logic + waveform overlay + event code. |
| Retry / latch policy | Known retry parameters configured; logging enabled. | Force repeated fault conditions; verify retry count, spacing, and transition to latch if required. | Retry ≤ ____ times; spacing ≥ ____ms; latch requires manual reset. Evidence: state timeline + counters. |
| Discharge proof: normal stop | Measure at HV tank plus defined additional nodes (for segmented caps / multiplier stacks). | Command stop; record V(t) until below threshold; repeat across worst-case initial kV. | V ≤ ____V within ____s at all required nodes. Evidence: multi-channel discharge plots + node list. |
| Discharge proof: interlock trip & power loss | Interlock injection + AC/DC power removal scenario prepared; logging enabled. | Trip interlock during operation; then test complete power loss. Capture residual voltage timeline. | Same threshold/time window met; no “local residual” remains. Evidence: plots + event timestamps + interlock reason. |
| Interlock chain integrity | List each interlock input and redundancy channels; HV enable output monitored. | Inject open/short/bounce per input; validate fail-safe default and redundancy agreement logic. | Any single fault prevents HV enable. Evidence: injection matrix + enable state + audit trail. |
| Telemetry & logs for service | Telemetry export method defined; time base synchronized. | Create known events (interlock, arc, stop); verify fields, timestamps, counters, and traceability to versions. | Required fields present + consistent. Evidence: sample log file + field dictionary + FW/HW/Cal IDs. |
| Production repeatability | Defined calibration SOP; version locking enabled. | Run on multiple units and across critical BOM/process changes (divider batch, coating, assembly). | Variation within limits; recalibration triggers are defined. Evidence: lot summary + control charts (if available). |
Tip: Always state measurement bandwidth and filtering for ripple/accuracy metrics; uncontrolled bandwidth is a common source of “false instability.”
H2-12 · IC/BOM selection cues (what to ask suppliers)
This is not a parts encyclopedia. It is a supplier question list: the few specs that routinely fail in CT HV PSUs, how to accept them with evidence, and example part numbers for RFQ benchmarking.
1) Isolated gate drive chain (CMTI · dv/dt · timing · fault default)
- Ask for CMTI with conditions: not just a headline number—require test dv/dt, common-mode profile, and output behavior.
- Ask for delay + matching: channel-to-channel skew affects stress balance; request max skew and how it is tested.
- Ask for short-circuit handling: DESAT blanking time, DESAT threshold, soft turn-off strategy, and how latch/reset works.
- Ask for fail-safe default state: loss of bias, loss of input, or broken wire must end in “gate-off” behavior.
- Acceptance evidence: dv/dt immunity run with mis-trigger counter + DESAT injection waveforms showing detect→gate-off latency.
Example part numbers (benchmarks for RFQ)
- TI: UCC21750 (isolated gate driver w/ DESAT class feature set)
- TI: ISO5852S (isolated gate driver family used in high dv/dt environments)
- Analog Devices: ADuM4135 (isolated gate driver family)
Note: Verify package, isolation rating, and protections against the exact inverter voltage and switching profile.
2) kV feedback & isolated sensing (drift · contamination · latency)
- Divider drift is a system-level risk: ask for VCR/TCR data, humidity/contamination sensitivity, and pulse-stress durability evidence.
- End-to-end latency matters: ask for analog→isolation→digital reconstruction delay (worst-case), not just ADC resolution.
- Ask how errors look: request guidance to distinguish divider drift vs true loop instability (symptoms + diagnostic flags).
- Acceptance evidence: temperature/RH cycling with “return-to-point” drift plots + a defined bandwidth for ripple metrics.
Example part numbers (benchmarks for RFQ)
- TI: AMC1311 (isolated amplifier class for high-noise sensing chains)
- TI: AMC1301 (isolated amplifier class for current/voltage sense variants)
- Analog Devices: ADuM7701 / AD7403 (isolated ΣΔ modulator class, when bitstream + digital filtering is preferred)
- Vishay: HVR25 / HVR37 series (high-voltage resistor series often used as divider building blocks)
3) Digital isolation + isolated bias power (EMC co-existence)
- Ask for EMC evidence: EFT/ESD/surge immunity results and how the device fails (glitch vs latch vs safe state).
- Ask for default states: in fault/power-loss scenarios, signals that could enable HV must default to “disable.”
- Isolated bias noise can leak into control: ask for light-load behavior, ripple spectrum, and startup transients.
- Acceptance evidence: stress the isolation links while switching at worst dv/dt, and record bit error / mis-trigger counters.
Example part numbers (benchmarks for RFQ)
- TI: ISO7721 (digital isolator family benchmark)
- Analog Devices: ADuM1401 (multi-channel digital isolator family benchmark)
- TI: SN6505A (transformer driver for isolated bias generation)
- TI: UCC12050 (isolated DC/DC module class benchmark)
4) Telemetry & event log: the fields that reduce service time
| Field | Why it matters | Suggested thresholds / notes | Service action |
|---|---|---|---|
| kV, mA (timestamped) | Correlates exposure command to actual output behavior. | Define sampling rate and bandwidth; store min/max and RMS. | Compare to calibration; isolate drift vs transient instability. |
| Ripple/droop metrics | Catches “weak loop” or noise injection earlier than hard faults. | Store bandwidth definition; track trend across time. | Investigate divider contamination, bias noise, or EMI coupling. |
| Arc count + last arc timestamp | Turns “random shutdown” into an actionable diagnosis. | Define counter reset policy and lifetime storage. | Inspect HV path, tube interface, insulation condition. |
| Interlock reason code | Fast root cause: coolant/door/E-stop/IMD/thermal, etc. | Reason codes must be versioned and stable. | Resolve the specific veto input; verify redundancy agreement. |
| Shutdown latency | Confirms protection is energy-limiting in the field. | Store detect time + gate-off time; worst-case window. | If latency drifts, check isolators/drivers and logic timing. |
| Calibration ID + FW/HW IDs | Prevents “same symptom, different meaning” across builds. | Bind CalID to firmware hash and hardware revision. | Decide recalibration vs replacement using traceability. |
Keep security implementation details on the dedicated Security page; here only the HV PSU service fields and traceability are defined.
Example part numbers are RFQ benchmarks. Final selection must match your kV range, switching dv/dt, isolation coordination, creepage/clearance, and the defined failure default state.
Request a Quote
FAQs (CT X-ray HV PSU)
Practical answers focused on HV PSU boundaries: kV generation and feedback, isolated gate drives, arc protection, discharge proof, interlocks, telemetry, validation, and supplier evidence.
1) What does “kV stability” really mean during exposure?
kV stability is not one number. It must be split into static accuracy (setpoint error), exposure-window ripple (with a stated
measurement bandwidth), and load-related droop with a defined recovery time. A result is only comparable when the filter/bandwidth,
exposure profile, and reference measurement chain are documented.
2) How can HV divider drift mimic loop instability?
Divider drift often appears as a slow kV offset that correlates with temperature/humidity or contamination, not with command steps.
True loop instability typically shows repeatable oscillation or overshoot tied to load changes and control bandwidth. A fast check is
a return-to-point test using an independent reference chain and a controlled T/RH sweep to expose drift signatures.
3) What loop bandwidth is realistic without chasing switching noise?
The kV loop bandwidth must be set by exposure dynamics and the sensing chain delay, not by a desire to “make it fast.” If bandwidth
approaches switching-noise content or the reconstruction/filter delay, the loop will react to noise and look unstable. Define the
ripple measurement bandwidth first, then target a loop response that meets droop and settle-time requirements with margin.
4) Is tube current (mA) controlled by the HV PSU or elsewhere?
In many systems, fine mA regulation is handled outside the HV power stage, while the HV PSU guarantees a stable kV rail and enforces
current limits and fast protection. The boundary must be explicit: which block owns the mA setpoint, where current is measured, and
how over-current thresholds behave during ramps and transients. Clear ownership prevents control loops from fighting each other.
5) How can kV control and mA control avoid “fighting” each other?
Avoid loop conflict by defining priority and separating bandwidths: one loop acts as the master reference while the other is rate-limited.
Use explicit ramp limits for kV and mA commands, and ensure protection thresholds account for transient energy. Validation requires combined
step tests (kV and mA changes) with logged settle time, overshoot, and any protection counters to confirm stable interaction.
6) Why can CMTI matter more than isolation rating for gate drives?
Isolation rating addresses long-term insulation strength, but HV PSUs often fail in practice due to dv/dt-driven common-mode transients
that cause mis-triggering, false DESAT events, or noise injection into control. A suitable gate-drive chain is qualified by CMTI under
stated test conditions, propagation delay matching, and a fail-safe default state when bias or input is lost.
7) Which arc signatures are most reliable: current spike, dv/dt, DESAT, or kV collapse?
No single signal is universally reliable. Robust detection typically cross-checks at least two domains: a fast current signature
(spike or abnormal slope) plus an HV behavior change (kV collapse or abnormal ripple), optionally reinforced by DESAT or bus anomalies.
The detection window and filtering must be tuned to avoid confusing normal exposure transients with faults, and mis-trigger counters
should be logged during EMC stress testing.
8) What shutdown order best limits energy during faults?
Energy is minimized by stopping energy injection first, then executing a controlled discharge plan. In practice, that means gate-off
(or equivalent power-stage inhibit) with a defined detect-to-gate-off latency, followed by the discharge path that drives residual
voltage below the threshold. The policy must specify retries, cooldown timing, and latch conditions, and it must default to “disable”
on loss of power or missing interlock.
9) How is “safe-to-touch” discharge proven with segmented capacitors or multiplier stacks?
A single measurement node can be misleading when energy storage is segmented. Local residual voltage can remain on internal nodes of
capacitor stacks or multiplier segments even after the main output collapses. Proof requires a defined threshold and time window, and
multi-node V(t) measurements for normal stop, interlock trip, power loss, and post-arc scenarios. The node list and test method must be repeatable and documented.
10) Who has final veto in the safety interlock chain?
The interlock chain must have a clear final veto that disables HV enable regardless of exposure commands. Fail-safe behavior should be
explicit: loss of power, broken wire, or failed self-check must result in “HV disabled.” When redundancy is used, the agreement rule
must be defined (both channels healthy to enable). Validation is performed by fault injection (open/short/bounce) per input and confirming deterministic disable and logged reason codes.
11) Which telemetry fields actually reduce service time?
Serviceable telemetry focuses on actionable context: timestamped kV and current, ripple/droop metrics with a defined bandwidth, arc
counters, interlock reason codes, detect-to-shutdown latency, temperature, and traceability IDs (calibration ID plus firmware/hardware
identifiers). Fields must share a consistent time base and reason codes must be versioned and stable, otherwise “data” becomes ambiguous and cannot shorten diagnosis. Only list security requirements at the interface level without detailing implementation.
12) What supplier evidence should be demanded for gate drives and sensing chains?
Ask for evidence tied to acceptance tests: CMTI results with stated dv/dt conditions and mis-trigger counts, DESAT injection waveforms
showing detect-to-gate-off latency and soft turn-off behavior, worst-case delay matching data, sensing-chain end-to-end latency including
reconstruction/filtering, and divider drift plots across temperature/humidity and pulse stress. Prefer suppliers who provide a repeatable test method and clear failure-default behavior over datasheet-only claims.
