How we validated the VoltPak 1000 push-pull inverter - and why open-loop isn't good enough

The push-pull topology has been the workhorse of low-cost portable inverters for twenty years. It's cheap, efficient on paper, and easy to build. It's also how you end up with a $399 "1000 W" inverter that shuts down at 600 W, clips its output waveform under load, and cooks its own MOSFETs when you short the wrong wire.

We didn't want to ship that. This post walks through how we validated the VoltPak 1000 push-pull stage, the closed feedback loop we layered on top, and the three hardware safety rails - OVP, OCP, and UVLP - that keep the unit alive when the real world does what it does.

The problem with open-loop push-pull

A classic open-loop push-pull stage looks something like this: two N-channel MOSFETs alternately switch the primary of a center-tapped transformer, producing an AC square wave on the secondary. With a fixed duty cycle $D = 0.5$ and a fixed input $V_{in}$, the RMS output is deterministic:

That's fine on a bench. In the field, $V_{in}$ is a battery that sags under load. Every 100 mV of sag propagates straight to the output with no correction. A 5 % droop at the battery becomes a 5 % droop on your 120 V rail, and your laptop brick starts chirping.

The closed loop

On the VoltPak 1000 we sample the secondary through a resistor divider and a Hall sensor, feed both into an STM32 ADC pair running at 200 kHz, and close the loop in firmware with a digital PI compensator. The control law is straightforward:

where $e[k] = V_{ref} - V_{sense}[k]$ is the voltage error and $T_s = 5\,\mu s$ is the sample period. The PWM duty cycle driving the push-pull gates is clipped to $[0.05,\, 0.48]$ to preserve dead-time and stop shoot-through.

Tuning targets were:

• Steady-state regulation: $\pm 1\%$ of nominal from 0 to 1000 W
• Phase margin: $\geq 45^\circ$ at crossover
• Transient response: $\leq 3$ mains cycles to settle after a full-load step

We hit all three. The measured open-loop gain and phase across load are in the technical manual; the short version is the compensator keeps a clean unity-gain crossover around 2 kHz.

Safety rail 1 - OVP (overvoltage protection)

Firmware can fail. The microcontroller can lock up. A bug can get deployed. None of that is allowed to put 400 V across a user's laptop.

The OVP on the VoltPak 1000 is implemented in hardware only, downstream of the firmware control loop. A TVS-diode-fed comparator monitors the output through an independent divider; if the rectified peak exceeds the threshold for more than 50 µs, a latching SCR crowbar pulls the gate drive rails to ground and opens the output relay.

The threshold is:

Chosen so that nominal surge transients (think a motor starting on the same bus) don't trigger a false cut, but any true runaway is clamped well before device limits. We verified this by injecting square-wave disturbances at the sense node and measuring time-to-trip on the scope - mean 32 µs across 500 trials.

Safety rail 2 - OCP (overcurrent protection)

The output inductor current is sampled every switching period. The OCP responds in two tiers:

The math for Tier 1 is the standard sensorless limit through the current sense resistor:

Safety rail 3 - UVLP (undervoltage lockout / protection)

The inverter refuses to start below $V_{bat} = 10.5\,\text{V}$ and shuts down cleanly at $V_{bat} = 10.0\,\text{V}$. Below that threshold, the push-pull stage's peak MOSFET current spikes nonlinearly - you'll destroy a FET before you deliver any useful output. The UVLP threshold is pre-compensated for the IR drop across the battery sense cable so the cutoff is accurate to ±50 mV regardless of load.

The test plan

Every VoltPak 1000 comes off the line through a 14-station validation jig that reproduces the full qualification suite we used during design:

1. Open-circuit regulation - 0.1–1.0 kW resistive sweep, 120.0 ± 1.0 V
2. Inductive transient - 1 HP motor startup, peak-current monitored
3. Short-circuit survival - 50 ms and 250 ms output shorts, OCP must fire in every trial
4. OVP injection - artificial fault at the sense node, trip time logged
5. Thermal soak - 45 min at rated load, TI hotspot must stay below $110^\circ C$
6. EMC - FCC Part 15 Class B sweep, all bands

Full numbers and plots live in the technical manual.

What this looks like on your bench

If you're curious, the easiest thing to do is plug the unit into a dummy load, scope the output, and step the load from 200 W to 900 W. You'll see the output droop for about 40 ms while the PI loop catches up, and then snap back to a clean sine within $\pm 1\,\text{V}$. Open-loop competitors don't snap back - they just stay drooped.

That's the difference. It's the whole reason we built it this way.