1 Introduction

Since the introduction of the first electronic control units (ECUs) in vehicles more than forty years ago, their number has multiplied. The increasing trend in the development of automobiles away from a completely mechanical towards an increasingly electric-dominated vehicle is unstoppable. So it is not surprising that modern vehicles have up to 150 electronic control units and contain a dozen or more processors to control and regulate the functions of the car. Such electronic systems range from applications like engine management, transmission control, and interior entertainment systems to security related systems such as break or airbag deployment control. For example smart electronic systems help us in keeping the distance to vehicles ahead, automatically park the vehicle in a parking space, or warn us in case of dangerous situations in traffic. The prerequisite for this, however, is that the various control units function properly and are not affected in their function by e.g. EMI. Ensuring this places very high demands not just on their electromagnetic compatibility (EMC), but especially on their functional safety [1–3]. The systems and employed electronic components have therefore to be designed in a way that critical errors are detected and dealt with within a very short amount of time in order to minimize the risk of dangerous situations and failures. Safety-relevant electronic systems must be developed in accordance with the applicable regulations such as the international standard ISO 26262 that defines the demands on functional safety for automotive components [4–6]. This standard describes the entire product life-cycle of safety related electrical/electronic systems from the concept phase until its decommissioning. To ensure compatibility of automotive components and vehicles various EMC standards must be met. Compliance with the required limit values of ECUs with regard to their maximum permissible electromagnetic emission or their electromagnetic immunity to interference has to be verified by a large number of characterization methods, such as those defined in CISPR 25 or ISO 11452 [7, 8]. But also the ICs that are used within the ECUs are subject to strict requirements regarding their emission and immunity. Several EMC test methods for ICs can be found for example in international IC-level emission and immunity standards such as IEC 61967 and IEC 62132, respectively [9, 10].

Failure to comply with or the inappropriate application of these standards can not only result in serious legal and economic consequences such as product cancellations or product recalls, but may also endanger the lives of individuals.

Although the normative requirements for compliance testing of single ECUs are very strict, many car manufacturers are nowadays faced with challenges and issues when combining all these ECUs together as a complete electronic system into a vehicle. Newly arising issues with these complex electronic systems led to many vehicle recalls during the last years. Especially EMC issues of ECUs now force vehicle manufacturers to rethink their system designs and further focus on increasing the electromagnetic immunity and functional safety of the used ECUs.

The National Highway Traffic Safety Administration (NHTS) of the United States is responsible for creating and enforcing vehicle safety standards and accompanying legislation. Every year the NHTS publishes detailed vehicle recall information. Based on this information the annual number of vehicle recalls, as well as the number of affected vehicles over the past 21 years is shown in Fig. 1.

Fig. 1.
figure 1

Annual vehicle recall data by the National Highway Traffic Safety Administration (NHTS) [11]

Full size image

The increase in recalls of about 300% over the last years together with the significant rise in affected vehicles since the year 2014 further gives an impression on the severity of the above mentioned problems. In view of the still persistently high recall rates from the year 2017, which are mainly due to the still ongoing “Takata Airbag Recall” [12] which affects several models of almost all major car manufacturers, this trend seems to continue indefinitely.

Potential reasons for the large amount of recalls are not just related to EMC issues, they range from a broad variety of issues such as mechanical problems due to aging of the used materials, improper design, chemical problems in batteries and airbag combustion cells to general electronic and software related issues. However, according to [13] “Almost one in two recalls today is related to electronic components”.

To further demonstrate that EMC problems in electronic components can seriously harm or kill people, a few examples of recent EMC issues that led to vehicle recalls are listed.

In 2012 Chrysler was forced to call back vehicles due to airbag problems as transient electrical spikes to the Occupant Restraint Control (ORC) module led to unintentional triggering of the airbags [14].

Comparable airbag problems existed also in early 2013 as Toyota had to recall more than one million Corolla-series vehicles due to EMC issues with ASICs in the airbag control unit (ACU) [15]. Information from the NHTS defect information report says that an internal short-circuit due to inductive interference can subsequently trigger the airbag. This issue led to 18 confirmed injuries in the US due to faulty airbag deployment.

In May 2015 Mitsubishi also had to bring back 53,400 vehicles after EMC problems with an electronic control module for lighting control and the windshield wipers [16].

Probably the best-known recall in recent history was the Toyota recall of approximately 9 million vehicles from all over the world as unintended acceleration of vehicles occurred in the years 2009–11 [17]. Apart from officially acknowledged problems with the floor mats, issues related to deficiencies in the Electronic Throttle Control System were determined as root causes of uncontrollable acceleration putting the driver and passengers at great risk and leading to 37 confirmed fatalities [18].

These exemplary cases show that EMC is a challenging and prevalent problem in automotive design and should be of great interest to IC, ECU and car manufactures, as the lack of adequate EMC validation can have devastating financial effects, due to recalls and expensive product redesigns. Furthermore, without sufficient EMC validation humans are being put at risk of being injured or even killed.

Therefore today’s electronic systems must provide highest reliability and robust operation also in the presence of EMI. Especially autonomous driving vehicles with their advanced control systems have to reliably interpret sensory information to identify appropriate and secure navigation paths.

Most of the EMC standards only specify how an ECU must behave in its normal operation condition during the EMC tests, but not necessarily treat the EMC behavior while the device under test (DUT) is in a fault state, such as for example over temperature. Furthermore, regarding the temperature, which is an important general test parameter, the EMC standards usually require keeping the environmental temperature during the tests at 23 ∘C \(+/-\) 5 ∘C [8–10, 19]. However, as ECUs can finally be exposed to a wide temperature range once they are installed in a vehicle, drifts in the EMC behavior arise and should be considered in the functional safety and EMC considerations [20–22]. Additionally the demanding environmental conditions, experienced in automotive applications, might lead to functional failures during the lifetime of automotive ECUs. For example the output wire of a high side switch might break and cause a short of the load current to the chassis. In this condition the high short circuit current might bring the smart power switch easily into over temperature condition and therefore to change from the normal operation mode to a fault state mode. Usually in case of smart power devices their integrated diagnostic and protection functions should protect the device from thermal destruction, as the device automatically turns off and passes an over temperature failure signal to a controller unit. As in the automotive industry the highest possible level of reliability is required, the correct temperature measurement in case of over temperature is one of the most important functions to reduce the risk of the device destruction as well as of fire in the vehicle.

But what happens if such a high side switch is in such a failure condition and at the same time an electromagnetic interference occurs?

  • Will the smart power high side switch still turn off and protect itself?

  • Will the smart power high side switch still provide the correct over temperature sense/failure signal to a controller unit?

  • Is the functional safety still ensured?

  • What can be done to improve the immunity and keep the functional safety in case that the questions above are answered with “No”?

In order to answer such questions the robustness of several state of the art smart power devices under EMI were investigated and the results are presented in the following chapters.

2 Device under test—smart power devices—smart high side switches

Smart power devices are after microcontrollers among the most commonly used ICs within ECUs. One of the most prominent smart power devices is the smart power switch that includes a power semiconductor transistor that is merged with additional functional units in order to increase its functionality [23, 24]. The additional functions, that range from various control and diagnostic functions such as over load protection, over- and under-voltage shutdown and auto-restart, current limitation, short circuit protection, thermal shutdown and many more are nowadays being realized together with the power electronic devices within one single microchip. A block diagram of a typical representative smart power high side switch is given in Fig. 2.

Fig. 2.
figure 2

Typical block diagram of a smart power high side switch with power MOS transistor as well as protection and diagnostic functions

Full size image

Smart power switches are often used in automotive applications such as power distribution (relay and fuse replacement), lighting (car front and back light, bulb/LED, interior, …), heating systems in vehicles (seat, auxiliary, glow plug, …) or for applications related to motor control (DC brush motor, pumps, fans, …). Generally there are two basic switching topologies used, low side and high side switching. They differ in the relative position of the switch, where in case of high side switches, they are directly connecting the load to the power supply, whereas for low side switching the load is connected by the switch to the common ground potential.

In automotive applications, where the chassis of the vehicle often acts as the common ground reference, fault conditions such as a short to ground due to e.g. wearing down of the cable isolation because of mechanical stress can easily occur. In this case high side switches are often the appropriate choice when high currents and large cable harnesses demand security and robustness against short faults. This was also the reason for choosing an automotive smart power high side switch for the investigations in this paper.

A list of typical diagnostic and protection functions is given in Table 1.

Table 1. Typical diagnostic and protection functions of modern smart power high side switches
Full size table

One of the first realized integral protective function of high side switches was the over temperature shut down [25, 26]. An additional controller chip that was placed on top of the power transistor was used to clamp the gate voltage when the power transistor becomes overheated. Nowadays special temperature sensors are built into the smart power devices at appropriate locations e.g. right in the center of the power transistors cell array together with a small circuit that monitors the chip temperature. In Fig. 3 a simple circuit of such a temperature sensor is shown. The Base-Emitter-voltage (\(V_{\mathrm{BE}}\)) of the bipolar transistor T1 depends linearly on the temperature, with a value of −2 mV/K, and is therefore very well suited to act as a temperature sensor. A temperature stable reference voltage such as it is provided by a bandgap reference can be used to set the temperature threshold. As \(V_{\mathrm{BE}}\) also depends on the collector current \(I_{\mathrm{C}}\), different temperature thresholds can be set by changing the collector current \(I_{\mathrm{C}}\). This is e.g. done with the help of the P-MOS transistor Q1 which adds a temperature hysteresis to the circuit.

Fig. 3.
figure 3

Temperature sensor circuit to monitor the temperature inside of a smart power device

Full size image

Usually such circuits are able to accurately measure temperatures, but very often lack robustness to interferences. Especially the used bandgap circuit that should provide the temperature stable reference voltage can easily be interfered by EMI and cause instable reference voltages [27]. But also operational amplifiers or comparators which are often used in such temperature monitoring systems often suffer from a high electromagnetic susceptibility [28, 29].

In order to analyze the behavior of the over temperature monitoring under EMI of smart power high side switches, several commercially available automotive devices from different IC manufacturers were investigated.

One representative device was a single channel high side driver designed for high current applications to drive 12 V automotive grounded loads through a 3 V and 5 V CMOS-compatible interface. The actual junction temperature of the N-channel power MOSFET stage can be provided by a multiplexed analog sense output pin that delivers a current proportional to a selected internal diagnostic, in our case the chip temperature. This output was used to monitor the diagnostic function during the EMI injection. In case that the junction temperature of the device exceeds the maximum allowed threshold of type 175 ∘C the device automatically goes into thermal shutdown mode.

3 Electromagnetic interference investigation of smart power high side switches

3.1 The direct power injection test method

To characterize the susceptibility of the smart power high hide switches temperature monitoring and over temperature shut down behavior under electromagnetic interference, the so-called direct power injection (DPI) method was used. This measurement technique, as it is defined in the IC-level IEC 62132-4 standard, is based on injecting conducted interferences in a frequency range of 150 kHz to 1 GHz into the pins of an IC under test [30]. Usually continues wave, amplitude modulated or pulse modulated signals are used to characterize the immunity of ICs. These signals are coupled by means of a simple coupling capacitor (e.g. 6.8 nF) into specific pins of the IC.

The “Generic IC EMC test specification”, that provides additional special requirements for automotive applications, divides the pins of the DUT into two different pin groups; such as “global pins”, that carry signals or power which enters or leaves the application board without any active component in between and “local pins”, that carry signals or power which does not leave the application board [19].

In case of the investigated smart power high side switches, only global pins like power supply pins as well as output pins were used to inject the disturbance signals. These pins usually have a direct connection to the automotive cable harness and different disturbances can be conducted along the cable harness to the pins of the IC as the harness acts as a receiving antenna for electromagnetic interferences.

A basic test setup with some of the needed measurement instruments for the DPI test which include a signal generator to provide the test signals, a power amplifier, a directional coupler and a coupling and decoupling network to connect the IC under test is shown in Fig. 4.

Fig. 4.
figure 4

Direct power injection method: measurement of conducted electromagnetic immunity of an IC from 150 kHz to 1 GHz

Full size image

Within the defined frequency range the forward power of the disturbance signal is gradually increased at each frequency position until the specified test level is reached or a malfunction of the device is observed (monitoring criteria is violated). Table 2 gives an example of commonly used immunity test level ranges for DPI testing. For high side switches the table shows that forward power levels of 30 to 37 dBm should be used. These values are typically requested by car manufacturers for immunity testing of automotive ICs. For the following investigations in this paper also 37 dBm was used as the maximum forward power level.

Table 2. Example of immunity level ranges (Zone 1: Requirement for smart power devices)
Full size table

It is important to note, that the power level at each frequency and amplitude step shall be kept long enough to allow the IC under test to react to the disturbance signal. In order to perform such tests a specially designed EMC test board that follows the PCB design requirement specified in [31] is needed.

According to the additional requirements defined in [19] for testing of high side switches a broadband artificial network consisting of a 5 μH coil and a 150\(\Omega\) matching network for impedance fixing was added to all global pins in addition to the basic test configuration defined in [10].

The output pin was connected to a representative load in order to ensure that the high side switch is operated within its nominal load current range. According to [19] the high side switch should be tested in toggle mode, where it is turned on and off with the typical frequency and switching time as it is specified in the ICs data sheet. Thereby the duty cycle of the switching signal should be set to 50%. Optionally the switch can also be tested in a permanent on- and/or off-state.

To investigate the EMI performance of over temperature monitoring, the temperature of the DUT was gradually increased by the use of a special PCB convection heater until its junction temperature reaches over temperature range and the corresponding diagnostic indication is triggered. In this defined over temperature fault state the disturbance signal was injected to investigate if the over temperature shut down protection and diagnose is working in the presence of EMI.

3.2 Monitoring of the DUT

According to part 4 of the IEC 62132 standard

“Any function inside an IC can be affected even if it is not connected to the pin under test. Therefore the operation mode(s) of the IC shall be chosen in a way that all functions of the IC are used during the test.” [30]

Unfortunately the standard only says that all functions of the IC should be used during the test, but it does not really require that also these functions have to be monitored during the test and that the IC should remain within the desired monitoring criteria during the test in all operation modes.

In terms of fault monitoring for all operation modes of the IC, also [19] only gives some general information about monitoring the functionality directly at the output pin of the high side switch as well as at another functional module output port of the IC to detect cross coupling effects.

In our case the monitoring of the devices was performed using an oscilloscope’s mask test, which was used to check if the output signal remains within a predefined tolerance range (e.g. ±10% of its nominal signal in the corresponding operating mode). Additionally the information about the chip temperature that is provided by a signal at the sense output pin was monitored. As recommended in the IC’s datasheet the voltage drop caused by the sense current over a 1 k\(\Omega\) sense resistor was used to identify over temperature failure signals (sense voltage <5 V no failure indication, sense voltage ≥5 V indicated failure). In Fig. 5 the DPI test bench setup that was used for the immunity measurements is shown.

Fig. 5.
figure 5

Picture of the DPI test setup used to investigate the over temperature behavior of smart power high side switches under EMI

Full size image

4 Immunity measurement results

The following diagrams show some representative smart high side switch immunity characteristics based on the DPI test method. The maximum applied forward power in dBm where the first violation of the defined monitoring criteria occurs is shown over the frequency range from 1 MHz to 1 GHz. The applied disturbance signal was set to continues wave (CW) mode and injected into the output pin of the IC. It is important to mention that no additional protection circuits or filter capacitors were used during the EMC tests. Only the recommended external devices were used according to the manufacturer’s recommendations in the IC datasheet.

The expected result is that in case of over temperature the DUT should turn off automatically and signal it’s over temperature state to a control unit.

4.1 Over temperature test (incorrect indication of fault state)

The first investigation that was performed is based on the question if an attached controller unit will still be able to correctly detect an over temperature condition by reading the corresponding sense signal at the sense output pins of the smart power high side switch under EMI. The DPI test result of the smart high side switch in over temperature condition is shown in Fig. 6. For this measurement the disturbance signal was injected into the output pin of the high side switch and the monitoring criteria was the correct indication of over temperature via a voltage at the sense output. As can be seen, over a wide frequency range the DPI characteristic is far below the required automotive forward power levels of 30 to 37 dBm. Especially at an injection frequency of 2.2 MHz the needed disturbance signal at which the control unit that monitors the DUT will not be able to correctly detect an over temperature condition anymore is around 13 dBm.

Fig. 6.
figure 6

DPI characteristic of a smart high side switch in over temperature condition (incorrect indication of an over temperature of the DUT by a controller unit)

Full size image

4.2 Over temperature test (incorrect turn on in over temperature condition)

The next investigation was based on the question if the smart power high side switch will remain in over temperature shut down mode under EMI. For this test we have used the same test configuration and setups as before, just the monitoring of the IC under test was changed.

In this case the temperature of the device was again raised above the over temperature where the switch usually automatically turns off without any DPI. Step by step the amplitude of the disturbance signal was increased until the switch was turned on unintentionally by the interference of the DPI signal.

The DPI characteristic of this investigation is shown in Fig. 7. As can be seen at an injection frequency of 2.5 MHz and a forward power level of the disturbance signal of around 13 dBm the smart high side switch leaves it’s over temperature shut down state and turns on again during over temperature condition! Especially this case might be very safety critical as the temperature of the device, which already has over temperature, might further increase due to the load current that is flowing if the switch turns on.

Fig. 7.
figure 7

Forward power where the DUT incorrectly turns on in over temperature condition

Full size image

5 Conclusion

Power electronic systems are omnipresent in today’s modern vehicles. They can be found in nearly all electronic systems such as for example anti-lock braking, airbag and engine management. Due to their internal diagnostic and protection features smart power high side switches are more and more used in such systems to replace mechanical switches, relays or fuses. Fault conditions such as over temperature, short circuit or loss of load must therefore be reliably diagnosed by these devices and any kind of errors must be dependably reported to a controller unit. In this paper, the susceptibility of smart power high side switches during electromagnetic interference has been investigated. Based on the IC-level direct power injection method where electromagnetic interferences are coupled into the pins of a device under test, the ability of the device to correctly diagnose an over temperature as well as to remain in over temperature shut down mode was examined. It is shown that there are significant deviations from the immunity limits that are commonly requested for ICs used in automotive applications. For example, it could be observed, that an over temperature of the smart high side switch might not be correctly detected by a control unit in the presence of electromagnetic interference and in a wide frequency range of the disturbing signal the device leaves its safe over temperature shut down mode and turns on again. The latter especially endangers the functional safety of the motor vehicles. Future autonomous driving cars will have to rely tremendously on reliable and functional safe electronic systems that will work properly also in the presence of electromagnetic interferences, therefore special care should be taken in order to ensure the electromagnetic compatibility of the electronic systems used in vehicles.