How chip manufacturers can help automakers quickly achieve ISO26262 safety certification

The ISO 26262 standard is a globally recognized automotive functional safety standard that covers the entire product life cycle, including functional safety management, concept stage development, system stage development, hardware stage development, software stage development, support processes, safety analysis, product release and other aspects.

ASIL (Automotive Safety Integration Level) is a classification system based on the ISO26262 standard. There are four levels: A, B, C, and D. The higher the level, the stricter the development process.

At present, ISO26262 is only a recommended standard, not a mandatory one. However, with the development of electric vehicles and the continuous growth of power demand, the bus voltage is evolving from 400V to 800V. Therefore, the demand for safety and reliability will become higher and higher. It is believed that the value of ISO26262 will increase accordingly.

New opportunities brought by ISO26262

If automotive OEMs want to achieve ISO26262 for the entire vehicle, their components must also achieve the corresponding functional safety level, which brings new challenges to the development and production of suppliers.

At present, although ISO26262 has been implemented for a period of time, there are still many people in the market who do not know much about it, and the certification process is too complicated. Therefore, strengthening the understanding and awareness of ISO26262 and simplifying the certification process are not only the efforts of vehicle manufacturers, but also the efforts of component suppliers.

In recent years, power supplier PI (Power Intergration) has seen that the continuous deepening of the ISO26262 standard has brought new differentiated competitive points to the automotive electronics industry - that is, simplifying customers' safety designs through various innovative means. PI has also developed a series of applications around safety and achieved outstanding results.

Yan Jinguang, senior technical training manager of PI, said that different subsystems in a car have different requirements for functional safety. For example, systems related to driving control, power or safety need to meet ASIL-C and ASIL-D standards, and PI is investing in application scenarios with more stringent functional safety requirements.

For example, for the 800V emergency power supply, PI has launched the latest InnoSwitch3-AQ, which integrates a 1700V voltage-resistant silicon carbide FET.

Inverter drive and functional safety requirements

Recently, PI has set its sights on the traction inverter drive market and launched the first SCALE EV series gate driver board for Infineon EconoDUALTM modules. As can be seen from the name of the product series EV, this is a product specifically for electric vehicles. The new driver board has passed automotive-grade certification and ASIL B certification, and can realize ASIL C/D traction inverter design. It is worth noting that this product is the first and only automotive-grade certified gate driver board on the market, so it can greatly simplify the user's product development and certification process, thereby accelerating time to market. Manufacturers can directly purchase the control board, driver board and corresponding power module for assembly to easily realize the hardware design of the inverter's electronic control system.

Since PI acquired CT-Concept, a Swiss high-voltage IGBT driver and module supplier, in 2012, it has rapidly expanded its product line from AC/DC conversion to industrial motor drives, renewable energy generation, electric trains and trams, high-voltage DC transmission, electric vehicles, and medical equipment, and has launched a variety of medium and high voltage driver ICs and driver boards. So this is not the first time PI has crossed over as a chip supplier. In fact, PI has always been positioned to provide key components for the clean energy ecosystem. Therefore, as long as it can solve the pain points of clean energy technology, it is the direction of PI's investment.

The popularity of third-generation semiconductors and the severe shortage of IGBTs show that the power supply and inverter market has been hot in the past two years, but the design of the inverter system, especially the drive part, is not that simple. The main reason is that for IGBT, the drive part must include many functions such as gate drive, power monitoring, protection, electromagnetic compatibility, enhanced isolation, and real-time communication with MCU. It should also meet ASIL certification requirements, which is the biggest difference compared to other fields.

Yan Jinguang introduced the functional safety requirements of traction inverters using active discharge and active short-circuit protection modes as examples. In normal state, the traction inverter is powered by the high-voltage bus, and the high-voltage DC is converted into AC to drive the motor by driving and controlling the IGBT switch. In an emergency, the high-voltage battery will be disconnected from the bus and switched to the emergency power bus. At this time, a discharge path needs to be constructed in a short time to quickly discharge the high-voltage capacitor of the bus to avoid damage to the human body or the system.

In addition, the function of active short circuit (ASC) is to quickly reduce the speed of the motor to 0. The specific description of this scenario is that when the drive signal is lost (similar to brake failure), the motor will continue to rotate. At this time, the electromotive force generated by the coil requires the upper tube or lower tube of the inverter to be turned on, so that the energy of the motor is quickly consumed by short circuit. In addition, the reverse electromotive force generated by the short circuit can also provide reverse torque for the motor, so that the motor can decelerate quickly.

SCALE EV Product Analysis

As shown in the figure above, SCALE EV mainly includes two ASICs, which are responsible for driving the upper tube and the lower tube respectively. It also adopts PCB openings and ASIC built-in FluxLink isolation to achieve enhanced insulation between the low-voltage side and the high-voltage side, meeting the 5,500-meter altitude requirement.

At the same time, two drivers are used to drive the upper tube and the lower tube respectively, and a dual connector configuration is adopted to ensure that if one arm is damaged, it will not affect the entire half bridge, thereby achieving functional safety requirements.

This driver board may seem ordinary, but these two ASIC drivers integrate many functions to ensure that the driver module meets the functional safety requirements. Taking active discharge as an example, the traditional solution for capacitor discharge requires 50-100 devices to construct a circuit and smooth the power consumption. PI pioneered the use of active short circuits formed by turning on the upper and lower tubes of the IGBT at the same time, so as to quickly turn on and minimize the circuit structure. However, when turned on at the same time, it is easy to have the so-called "explosion" phenomenon, so it is necessary to carefully control the opening of the power tube so that it can discharge quickly and will not damage the power tube due to overheating. According to Yan Jinguang, the driver board can use low duty cycle turn-on control (pulse width 1-2μS) and ensure that the peak current of the IGBT is less than 50% of the maximum withstand current, so that the junction temperature of the IGBT can be better controlled to avoid damage. The control mode of active short circuit is similar. While ensuring that the IGBT will not be damaged, the power is discharged as much as possible.

In addition to active discharge and active short circuit, the driver board also features advanced overvoltage control with soft shutdown, Dsat detection (de-saturation detection), isolated NTC temperature measurement, gate signal flip monitoring and bitstream telemetry reporting.

Taking the digital telemetry port as an example, as shown in the figure, the bit stream can provide rich content, including transmitting temperature data, alarming or reporting faults, thereby achieving complete protection and monitoring. The separate status output pin can enable the system to respond to faults more quickly, improving the system's fault response time.

Thanks to the high level of integration of the new driver IC, the size of the entire driver board (including gate power supply) fits perfectly into the power module while still providing the spacing required for reinforced insulation in accordance with IEC 60664. This is very helpful for the design of compact inverters. The ASIC package provides 11.4mm of creepage and clearance, safely meeting the requirements of 800V automotive system voltage.

Not only Infineon, not only IGBT, but also more than EV

Yan Jinguang said that the SCALE EV product this time chose the popular Infineon EconoDUAL 900A 1200V IGBT half-bridge module. In the future, PI will also develop products that support power modules of other brands based on market demand.

In addition, PI's technical accumulation in protection, isolation and driving can also develop applications based on SiC modules to meet the requirement that the short-circuit and overcurrent response time of SiC MOSFET switches is less than 1 microsecond.

At the same time, Yan Jinguang also said that in addition to electric vehicle traction inverters, other power conversion application scenarios using IGBT modules can choose PI's driver board, especially for hydrogen fuel cell converters, battery energy storage or other applications that require higher automotive certification reliability requirements.