Impact of electromagnetic interference on the functional safety of smart power devices for automotive applications
- 88 Downloads
Integrated smart power devices gain more and more importance in the field of automotive systems. In addition to power transistors such devices usually contain several integrated diagnostic and protection functions. In the event of a fault these functions enable the connected control unit to react appropriately and to protect the application and thus the people. Smart power devices are often responsible for important tasks within a vehicle and are nowadays more and more used to substitute conventional elements like fuses, relays and switches. During the operation they are often exposed to harsh environmental conditions such as high operating temperatures, mechanical stress, etc. At the same time different electromagnetic interferences (EMI) may occur, which can affect their normal functionality. Especially in safety-critical applications such as the airbag control module or the Anti-lock Braking System their correct function is very important to avoid dangerous operating conditions and to ensure functional safety. Based on EMI investigations on a representative smart power high side switch it is shown in this paper to what degree of electromagnetic interference smart power devices are still able to correctly detect critical fault conditions and remain in their fail-save state.
Keywordssmart power semiconductor radio frequency interference (RFI) functional safety electromagnetic compatibility (EMC) electromagnetic interference (EMI) ISO 26262 direct power injection (DPI) IEC 62132 autonomous driving
Einfluss von elektromagnetischen Störungen auf die funktionale Sicherheit von Smart Power Devices in Automobilanwendungen
Im Bereich der Leistungselektronik werden in modernen Kraftfahrzeugen zunehmend so genannte ”Smart Power Devices“ eingesetzt. Sie beinhalten neben den Leistungstransistoren meist mehrere integrierte Diagnose- und Schutzfunktionen. Im Fehlerfall ermöglichen diese Funktionen dem angeschlossenen Steuergerät, entsprechend zu reagieren und die Anwendung und damit die Menschen zu schützen. Smart Power Devices sind oft für wichtige Aufgaben innerhalb eines Fahrzeugs verantwortlich und werden heutzutage immer häufiger eingesetzt, um herkömmliche Elemente wie Sicherungen, Relais und Schalter zu ersetzen. Während des Betriebs sind sie oft rauen Umgebungsbedingungen – wie hohen Betriebstemperaturen, mechanischen Belastungen usw. – ausgesetzt. Gleichzeitig können zusätzlich unterschiedliche elektromagnetische Störungen auftreten, welche die normale Funktionalität dieser Geräte beeinträchtigen können. Gerade in sicherheitskritischen Anwendungen wie dem Airbag-Steuermodul oder dem Antiblockiersystem ist ihre korrekte Funktion sehr wichtig, um gefährliche Betriebszustände zu vermeiden und die funktionale Sicherheit zu gewährleisten. Auf der Grundlage von Störfestigkeitsuntersuchungen an einem repräsentativen Smart Power High Side-Schalter wird in diesem Beitrag gezeigt, bis zu welchem Ausmaß an elektromagnetischen Störungen Smart Power Devices kritische Fehlerbedingungen immer noch korrekt erkennen können und somit die funktionale Sicherheit des Kraftfahrzeugs gewährleisten.
SchlüsselwörterSmart Power-Leistungshalbleiter Elektromagnetische Störbeeinflussung RFI funktionale Sicherheit elektromagnetische Verträglichkeit (EMV) elektromagnetische Interferenz ISO 26262 IEC 62132 autonomous driving direct power injection (DPI)
Since the introduction of the first electronic control units (ECUs) in vehicles more than forty years ago, their number has multiplied. The increasing trend in the development of automobiles away from a completely mechanical towards an increasingly electric-dominated vehicle is unstoppable. So it is not surprising that modern vehicles have up to 150 electronic control units and contain a dozen or more processors to control and regulate the functions of the car. Such electronic systems range from applications like engine management, transmission control, and interior entertainment systems to security related systems such as break or airbag deployment control. For example smart electronic systems help us in keeping the distance to vehicles ahead, automatically park the vehicle in a parking space, or warn us in case of dangerous situations in traffic. The prerequisite for this, however, is that the various control units function properly and are not affected in their function by e.g. EMI. Ensuring this places very high demands not just on their electromagnetic compatibility (EMC), but especially on their functional safety [1, 2, 3]. The systems and employed electronic components have therefore to be designed in a way that critical errors are detected and dealt with within a very short amount of time in order to minimize the risk of dangerous situations and failures. Safety-relevant electronic systems must be developed in accordance with the applicable regulations such as the international standard ISO 26262 that defines the demands on functional safety for automotive components [4, 5, 6]. This standard describes the entire product life-cycle of safety related electrical/electronic systems from the concept phase until its decommissioning. To ensure compatibility of automotive components and vehicles various EMC standards must be met. Compliance with the required limit values of ECUs with regard to their maximum permissible electromagnetic emission or their electromagnetic immunity to interference has to be verified by a large number of characterization methods, such as those defined in CISPR 25 or ISO 11452 [7, 8]. But also the ICs that are used within the ECUs are subject to strict requirements regarding their emission and immunity. Several EMC test methods for ICs can be found for example in international IC-level emission and immunity standards such as IEC 61967 and IEC 62132, respectively [9, 10].
Failure to comply with or the inappropriate application of these standards can not only result in serious legal and economic consequences such as product cancellations or product recalls, but may also endanger the lives of individuals.
Although the normative requirements for compliance testing of single ECUs are very strict, many car manufacturers are nowadays faced with challenges and issues when combining all these ECUs together as a complete electronic system into a vehicle. Newly arising issues with these complex electronic systems led to many vehicle recalls during the last years. Especially EMC issues of ECUs now force vehicle manufacturers to rethink their system designs and further focus on increasing the electromagnetic immunity and functional safety of the used ECUs.
The increase in recalls of about 300% over the last years together with the significant rise in affected vehicles since the year 2014 further gives an impression on the severity of the above mentioned problems. In view of the still persistently high recall rates from the year 2017, which are mainly due to the still ongoing “Takata Airbag Recall”  which affects several models of almost all major car manufacturers, this trend seems to continue indefinitely.
Potential reasons for the large amount of recalls are not just related to EMC issues, they range from a broad variety of issues such as mechanical problems due to aging of the used materials, improper design, chemical problems in batteries and airbag combustion cells to general electronic and software related issues. However, according to  “Almost one in two recalls today is related to electronic components”.
To further demonstrate that EMC problems in electronic components can seriously harm or kill people, a few examples of recent EMC issues that led to vehicle recalls are listed.
In 2012 Chrysler was forced to call back vehicles due to airbag problems as transient electrical spikes to the Occupant Restraint Control (ORC) module led to unintentional triggering of the airbags .
Comparable airbag problems existed also in early 2013 as Toyota had to recall more than one million Corolla-series vehicles due to EMC issues with ASICs in the airbag control unit (ACU) . Information from the NHTS defect information report says that an internal short-circuit due to inductive interference can subsequently trigger the airbag. This issue led to 18 confirmed injuries in the US due to faulty airbag deployment.
In May 2015 Mitsubishi also had to bring back 53,400 vehicles after EMC problems with an electronic control module for lighting control and the windshield wipers .
Probably the best-known recall in recent history was the Toyota recall of approximately 9 million vehicles from all over the world as unintended acceleration of vehicles occurred in the years 2009–11 . Apart from officially acknowledged problems with the floor mats, issues related to deficiencies in the Electronic Throttle Control System were determined as root causes of uncontrollable acceleration putting the driver and passengers at great risk and leading to 37 confirmed fatalities .
These exemplary cases show that EMC is a challenging and prevalent problem in automotive design and should be of great interest to IC, ECU and car manufactures, as the lack of adequate EMC validation can have devastating financial effects, due to recalls and expensive product redesigns. Furthermore, without sufficient EMC validation humans are being put at risk of being injured or even killed.
Therefore today’s electronic systems must provide highest reliability and robust operation also in the presence of EMI. Especially autonomous driving vehicles with their advanced control systems have to reliably interpret sensory information to identify appropriate and secure navigation paths.
Most of the EMC standards only specify how an ECU must behave in its normal operation condition during the EMC tests, but not necessarily treat the EMC behavior while the device under test (DUT) is in a fault state, such as for example over temperature. Furthermore, regarding the temperature, which is an important general test parameter, the EMC standards usually require keeping the environmental temperature during the tests at 23 ∘C \(+/-\) 5 ∘C [8, 9, 10, 19]. However, as ECUs can finally be exposed to a wide temperature range once they are installed in a vehicle, drifts in the EMC behavior arise and should be considered in the functional safety and EMC considerations [20, 21, 22]. Additionally the demanding environmental conditions, experienced in automotive applications, might lead to functional failures during the lifetime of automotive ECUs. For example the output wire of a high side switch might break and cause a short of the load current to the chassis. In this condition the high short circuit current might bring the smart power switch easily into over temperature condition and therefore to change from the normal operation mode to a fault state mode. Usually in case of smart power devices their integrated diagnostic and protection functions should protect the device from thermal destruction, as the device automatically turns off and passes an over temperature failure signal to a controller unit. As in the automotive industry the highest possible level of reliability is required, the correct temperature measurement in case of over temperature is one of the most important functions to reduce the risk of the device destruction as well as of fire in the vehicle.
Will the smart power high side switch still turn off and protect itself?
Will the smart power high side switch still provide the correct over temperature sense/failure signal to a controller unit?
Is the functional safety still ensured?
What can be done to improve the immunity and keep the functional safety in case that the questions above are answered with “No”?
2 Device under test—smart power devices—smart high side switches
Smart power switches are often used in automotive applications such as power distribution (relay and fuse replacement), lighting (car front and back light, bulb/LED, interior, …), heating systems in vehicles (seat, auxiliary, glow plug, …) or for applications related to motor control (DC brush motor, pumps, fans, …). Generally there are two basic switching topologies used, low side and high side switching. They differ in the relative position of the switch, where in case of high side switches, they are directly connecting the load to the power supply, whereas for low side switching the load is connected by the switch to the common ground potential.
In automotive applications, where the chassis of the vehicle often acts as the common ground reference, fault conditions such as a short to ground due to e.g. wearing down of the cable isolation because of mechanical stress can easily occur. In this case high side switches are often the appropriate choice when high currents and large cable harnesses demand security and robustness against short faults. This was also the reason for choosing an automotive smart power high side switch for the investigations in this paper.
Typical diagnostic and protection functions of modern smart power high side switches
• High-precision proportional load current sensing
• Short circuit to GND
• VCC sensing
• Over temperature sensing
• Thermal shutdown indication
• Open load detection
• Power limitation indication
• Fast over load/short to ground detection
• Latching diagnostics in SPI register
• Load current limitation
• Short circuit protection
• Over temperature shutdown
• Over voltage protection (incl. load dump)
• Under voltage shutdown
• Reverse battery protection
• Protection against loss of GND and loss of VCC
• Fast inductive energy demagnetization
• Electrostatic discharge (ESD) protection
Usually such circuits are able to accurately measure temperatures, but very often lack robustness to interferences. Especially the used bandgap circuit that should provide the temperature stable reference voltage can easily be interfered by EMI and cause instable reference voltages . But also operational amplifiers or comparators which are often used in such temperature monitoring systems often suffer from a high electromagnetic susceptibility [28, 29].
In order to analyze the behavior of the over temperature monitoring under EMI of smart power high side switches, several commercially available automotive devices from different IC manufacturers were investigated.
One representative device was a single channel high side driver designed for high current applications to drive 12 V automotive grounded loads through a 3 V and 5 V CMOS-compatible interface. The actual junction temperature of the N-channel power MOSFET stage can be provided by a multiplexed analog sense output pin that delivers a current proportional to a selected internal diagnostic, in our case the chip temperature. This output was used to monitor the diagnostic function during the EMI injection. In case that the junction temperature of the device exceeds the maximum allowed threshold of type 175 ∘C the device automatically goes into thermal shutdown mode.
3 Electromagnetic interference investigation of smart power high side switches
3.1 The direct power injection test method
To characterize the susceptibility of the smart power high hide switches temperature monitoring and over temperature shut down behavior under electromagnetic interference, the so-called direct power injection (DPI) method was used. This measurement technique, as it is defined in the IC-level IEC 62132-4 standard, is based on injecting conducted interferences in a frequency range of 150 kHz to 1 GHz into the pins of an IC under test . Usually continues wave, amplitude modulated or pulse modulated signals are used to characterize the immunity of ICs. These signals are coupled by means of a simple coupling capacitor (e.g. 6.8 nF) into specific pins of the IC.
The “Generic IC EMC test specification”, that provides additional special requirements for automotive applications, divides the pins of the DUT into two different pin groups; such as “global pins”, that carry signals or power which enters or leaves the application board without any active component in between and “local pins”, that carry signals or power which does not leave the application board .
In case of the investigated smart power high side switches, only global pins like power supply pins as well as output pins were used to inject the disturbance signals. These pins usually have a direct connection to the automotive cable harness and different disturbances can be conducted along the cable harness to the pins of the IC as the harness acts as a receiving antenna for electromagnetic interferences.
Example of immunity level ranges (Zone 1: Requirement for smart power devices)
It is important to note, that the power level at each frequency and amplitude step shall be kept long enough to allow the IC under test to react to the disturbance signal. In order to perform such tests a specially designed EMC test board that follows the PCB design requirement specified in  is needed.
According to the additional requirements defined in  for testing of high side switches a broadband artificial network consisting of a 5 μH coil and a 150\(\Omega\) matching network for impedance fixing was added to all global pins in addition to the basic test configuration defined in .
The output pin was connected to a representative load in order to ensure that the high side switch is operated within its nominal load current range. According to  the high side switch should be tested in toggle mode, where it is turned on and off with the typical frequency and switching time as it is specified in the ICs data sheet. Thereby the duty cycle of the switching signal should be set to 50%. Optionally the switch can also be tested in a permanent on- and/or off-state.
To investigate the EMI performance of over temperature monitoring, the temperature of the DUT was gradually increased by the use of a special PCB convection heater until its junction temperature reaches over temperature range and the corresponding diagnostic indication is triggered. In this defined over temperature fault state the disturbance signal was injected to investigate if the over temperature shut down protection and diagnose is working in the presence of EMI.
3.2 Monitoring of the DUT
Unfortunately the standard only says that all functions of the IC should be used during the test, but it does not really require that also these functions have to be monitored during the test and that the IC should remain within the desired monitoring criteria during the test in all operation modes.
“Any function inside an IC can be affected even if it is not connected to the pin under test. Therefore the operation mode(s) of the IC shall be chosen in a way that all functions of the IC are used during the test.” 
In terms of fault monitoring for all operation modes of the IC, also  only gives some general information about monitoring the functionality directly at the output pin of the high side switch as well as at another functional module output port of the IC to detect cross coupling effects.
4 Immunity measurement results
The following diagrams show some representative smart high side switch immunity characteristics based on the DPI test method. The maximum applied forward power in dBm where the first violation of the defined monitoring criteria occurs is shown over the frequency range from 1 MHz to 1 GHz. The applied disturbance signal was set to continues wave (CW) mode and injected into the output pin of the IC. It is important to mention that no additional protection circuits or filter capacitors were used during the EMC tests. Only the recommended external devices were used according to the manufacturer’s recommendations in the IC datasheet.
The expected result is that in case of over temperature the DUT should turn off automatically and signal it’s over temperature state to a control unit.
4.1 Over temperature test (incorrect indication of fault state)
4.2 Over temperature test (incorrect turn on in over temperature condition)
The next investigation was based on the question if the smart power high side switch will remain in over temperature shut down mode under EMI. For this test we have used the same test configuration and setups as before, just the monitoring of the IC under test was changed.
In this case the temperature of the device was again raised above the over temperature where the switch usually automatically turns off without any DPI. Step by step the amplitude of the disturbance signal was increased until the switch was turned on unintentionally by the interference of the DPI signal.
Power electronic systems are omnipresent in today’s modern vehicles. They can be found in nearly all electronic systems such as for example anti-lock braking, airbag and engine management. Due to their internal diagnostic and protection features smart power high side switches are more and more used in such systems to replace mechanical switches, relays or fuses. Fault conditions such as over temperature, short circuit or loss of load must therefore be reliably diagnosed by these devices and any kind of errors must be dependably reported to a controller unit. In this paper, the susceptibility of smart power high side switches during electromagnetic interference has been investigated. Based on the IC-level direct power injection method where electromagnetic interferences are coupled into the pins of a device under test, the ability of the device to correctly diagnose an over temperature as well as to remain in over temperature shut down mode was examined. It is shown that there are significant deviations from the immunity limits that are commonly requested for ICs used in automotive applications. For example, it could be observed, that an over temperature of the smart high side switch might not be correctly detected by a control unit in the presence of electromagnetic interference and in a wide frequency range of the disturbing signal the device leaves its safe over temperature shut down mode and turns on again. The latter especially endangers the functional safety of the motor vehicles. Future autonomous driving cars will have to rely tremendously on reliable and functional safe electronic systems that will work properly also in the presence of electromagnetic interferences, therefore special care should be taken in order to ensure the electromagnetic compatibility of the electronic systems used in vehicles.
Open access funding provided by Graz University of Technology.
- 1.Ogunsola, A. (2008): EMC and functional safety requirements for integrated electronics systems. In Electronics system-integration technology conference, ESTC 2008, Sept. 2008 (pp. 69–74). Google Scholar
- 2.Nelson, J. J., Taylor, W., Kado, R. (2012): Impact on EMC for electrical powertrains with respect to functional safety: ISO 26262. In 2012 IEEE international electric vehicle conference, Greenville, SC (pp. 1–7). Google Scholar
- 3.Jaekel, B. W. (2007): Recent developments in standardisation related to EMC and functional safety. In International symposium on electromagnetic compatibility (pp. 1–6). Google Scholar
- 4.ISO 26262 (2011): Road vehicles—functional safety. 1st ed. International Electrotechnical Commission, November 2011. Google Scholar
- 5.Greb, K. (2012): Functional safety and ISO 26262. In The applied power electronics conference and exposition, industry sessions, APEC (p. 9). Google Scholar
- 6.Franken, T. (2009): Mehr Sicherheit durch Functional Safety. In HANSER automotive (pp. 40–43). Munich: Hanser Verlag. Das Branchenmagazin für den Formen- und Werkzeugbau, 1–2.2009. Google Scholar
- 7.CISPR 25 Ed. 3 (2008): Vehicles, boats and internal combustion engines—radio disturbance characteristics—limits and methods of measurement for the protection of on-board receivers, I.E. Commission Std. Google Scholar
- 8.ISO 11452-1 (2015): Road vehicles—component test methods for electrical disturbances from narrowband radiated electromagnetic energy, part 1: general principles and terminology. 4th ed. June 2015. Google Scholar
- 9.IEC 61967 Part 1 (2002): Integrated circuits: measurement of electromagnetic emissions, 150 kHz to 1 GHz, part 1: general conditions and definitions, International Electrotechnical Commission, March 2002. Google Scholar
- 10.IEC 62132 Part 1 (2006): Integrated circuits: measurement of electromagnetic immunity, 150 kHz to 1 GHz, part 1: general conditions and definitions, International Electrotechnical Commission, January 2006. Google Scholar
- 11.P. Kastner (2018): RF interference of smart high-side switches. Bachelor’s thesis, Graz University of Technology, January 2018. Google Scholar
- 12.Consumer Reports (2018): Takata airbag recall—everything you need to know. https://www.consumerreports.org/cro/news/2016/05/everything-you-need-to-know-about-the-takata-air-bag-recall/index.htm.
- 13.Allianz S.E. (2012): Chrysler recalling over 900,000 Jeeps over airbag issue. http://www.agcs.allianz.com/insights/expert-risk-articles/record-year-for-car-recalls.
- 14.O. Smith (2015): Expert risk articles record year for car recalls. http://money.cnn.com/2012/11/09/autos/chrysler-recall/index.html.
- 15.A. Becker (2013): Toyota issues vehicle recall due to electrical interference. https://interferencetechnology.com/toyota-issues-vehicle-recall-due-to-electrical-interference/.
- 16.The Associated Press (2015): Mitsubishi recalls 130,000 cars, citing electrical problems, faulty defrosters. https://www.ctvnews.ca/autos/mitsubishi-recalls-130-000-cars-citing-electrical-problems-faulty-defrosters-1.2366512.
- 17.Wikipedia (2018): Toyota vehicle recalls. https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recallsm/.
- 18.B. Stasiukiewicz, A. Becker (2014): UPDATE: Toyota documents show EMI as possible root of sudden acceleration problem. https://interferencetechnology.com/experts-toyota-documents-show-emi-in-electronics-as-possible-root-of-sudden-acceleration-problem/.
- 19.ZVEI (2017): Generic IC EMC test specification. German Electrical and Electronic Manufacturers’ Association, Electronic Components and Systems Division, Version 2.1, May 2017. Google Scholar
- 20.Fernandez-Garcia, R., Gil, I. (2012): Impact of temperature on the electromagnetic susceptibility of operational amplifiers. In Progress in electromagnetics research symposium proceedings Moscow, Russia, August 19–23, 2012 (pp. 1063–1065). Google Scholar
- 21.Boyer, A., González Sentís, M., Ghfiri, C., Durier, A. (2017): Study of the thermal aging effect on the conducted emission of a synchronous buck converter. In 11th international workshop on the electromagnetic compatibility of integrated circuits, EMC Compo, July 2017. Google Scholar
- 22.Boyer, A., Huang, H., Ben Dhia, S. (2014): Impact of thermal aging on emission of a buck DC–DC converter. In International symposium on electromagnetic compatibility, Tokyo, Japan, May 12–16, 2014. Google Scholar
- 23.Zitta, H. (1994): Smart power circuits for power switches including diagnostic functions. In Proc. of workshop AACD, Eindhoven. Google Scholar
- 24.Pribyl, W. (1996): Integrated smart power circuits technology, design and application. In Proceedings of the 22nd European solid-state circuits conference, ESSCIRC ’96, 17–19 Sept. 1996. Google Scholar
- 25.Reinmuth, K., Lorenz, L. (1992): The new generation of power semiconductors. In ICPE, ISPE, April 1992 (pp. 62–69). Google Scholar
- 26.Glogolja, M. (1988): TEMPFET—a device one step closer to an ideal power semiconductor switch. In Smart power economics technology and applications by Intertec communications, October 1998. Google Scholar
- 29.Lavarda, A., Deutschmann, B. (2015): Effects of single tone RF interferences on chopped operational amplifiers. In IEEE international symposium on electromagnetic compatibility, EMC. Google Scholar
- 30.IEC 62132 Part 4 (2006): Integrated circuits: measurement of electromagnetic immunity, 150 kHz to 1 GHz, part 4—measurement of conducted immunity, direct power injection method, International Electrotechnical Commission, February 2006. Google Scholar
- 31.Lavarda, A., Deutschmann, B., Haerle, D. (2017): Enhancement of the DPI method for IC immunity characterization. In 11th IEEE international workshop on the electromagnetic compatibility of integrated circuits, EMCCompo. Google Scholar
Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.