Autonomous devices are being integrated into our homes due to the expansion of IoT and robotic equipment into the consumer mass market. One of the challenges for developers is fulfilling all the applicable requirements from certification authorities to meet compliance regulations. For instance, standard IEC60335-1 defines safety requirements and is mandatory for all consumer goods coming into a mass market. For autonomous unattended devices, such as motor-operated IoT controllers (solar controllers, automatic pet feeders, window controllers, and others) or mobile robots (vacuum cleaners or similar), it is required to prevent DC motors from overheating during a stall event. Regulation IEC60355-1 (chapter 19.11) specifies compliance standards for a single failure in electronics that can happen during normal operation. This article provides an elegant power switch solution using the High Voltage GreenFET technology device for both, switching off the power if required, as well as performing current sensor functionality verification.
System Architecture
Most systems nowadays contain a microcontroller with an application program running on it for functionality implementation. If the system contains parts, which may be unsafe for the end-consumer, like motors, linear drives, heating systems, or similar, this controller is also typically used for safety-relevant functionality implementation. Requirements for consumer-grade goods are set by relevant standards, like IEC60335-1 for household appliances. The sample architecture of the DC motor driver circuit is shown in Figure 1. DC motor here is being driven by a motor controller, which is powered from a power supply unit through the backup power switch, which is the second layer of deactivation protection for the motor controller. The switch can also be used as a power-saving element to deactivate the motor controller during the inactivity period.
For compliance, it is also important to provide a validation capability for a sensor subsystem in parallel with having a backup switch for the emergency motor drive deactivation. Useful here is a feature of the SLG59H1x High Voltage GreenFET family: the current monitor output. Almost all of them, except SLG59H1127V, have this output signal, so it is relatively easy to select a proper part, which can deliver the necessary current for the required system voltage.
Table 1 shows an extraction from the selection guide [GreenFET™ Ultra-Low RDSON Load Switch Selector Guide] for a quick overview of High Voltage GreenFET parts with the current monitor output capability. The FAULT output may be an interesting function, which allows using the built-in overcurrent, overvoltage, or over-temperature protection. All the switches are sharing an STQFN-18 package, which dimensions are only 1.6 mm x 3.0 mm. This saves space on PCB. However, it requires additional attention be paid to PCB layout to fulfill cooling requirements.
High Voltage GreenFET Concept and Capabilities
Renesas’ High Voltage GreenFET is not only a classic load switch combining MOSFET and a driver but is a fully protected overvoltage, overcurrent, and over-temperature device. It has extended sensing capability which can be accessed externally. A conceptual block diagram of the High Voltage GreenFET SLG59H1120V [Datasheet] in an application example diagram is shown in Figure 2.
SLG59H1120V consists of a main N-MOSFET working in switching mode driven through a charge pump and linear ramp control module. State machine defines the state of MOSFET according to the ON input and considering possible overrides from protection units: VIN OVLO – adjustable through SEL0/SEL1 overvoltage lockout, overcurrent – adjustable through the resistor settings on RSET input. MOSFET’s current is also mirrored to IOUT output and through a pull-down resistor can be transformed into a voltage signal, which can be used in the host system. FAULT shows the system state and allows easy detection of any protection event during the system operation. The combination of all these advanced features directly results in BOM (bill-of-material) component and cost reductions as well as increasing system reliability and reduced board size.
Application Circuit and Example Module
The DC motor driver circuit used in this article is shown in Figure 3. Here U4 is a DC motor driver. The A4950 or any other pin-compatible driver is commonly used. Shunt resistor R7 serves for current measurement purposes, whereas its voltage drop is amplified by U2A. The driver is powered through U3 SLG59H1120V connected to the host system and providing ON/OFF, fault output, and current sense functionality. LDO U1 delivers a secondary 3.3 V power supply for OPAMP U2A and sets the reference voltage for motor driver U4. Second OPAMP U2B is bypassed and could be potentially used in other parts of the system. LED D2 indicates the power supply state taken from the 3V3 node, while D3 indicates the power state of the motor driver.
Total capacitance on VD_IN is built up from the filtering capacitor C3 and additional capacitors from the host system in total 470uF (finally it was also placed on the experimental module). It was found during the testing, that an overcurrent event on U3 can be triggered quite easily due to the high starting current of the DC motor, thus an additional capacitor 220uF was placed on the power input of U4. There are two overcurrent thresholds set on the module, which will be triggered in hardware if an overcurrent event occurs. The first one is set for U3 by R5 connected to RSET pin and adjusted to be 5 A. The second one is set for U4 by applying 3.3 V to VREF pin and adjusted to be:
Hardware limits are set for protecting electronic components from overcurrent. The power switch U3 could be driving more than a single motor driver. Applications like robotics, where more than 2-3 motors are normal. It makes sense to ensure no current throttling by the power switch to set limits higher.
Safety-related limit, which are set in firmware lower than the max current provided by the motor driver U4 in order to avoid current limiting from hardware below safety limits. This also guarantees clear order of overcurrent protection triggering, being first – in firmware, second – motor controller and the last – power switch. So, the hierarchical structure, which is recommended to support a safety architecture of the system is shown in Figure 5. DC motor current limit is defined by measuring a winding temperature while the motor is being stalled and comparing the temperature value with such, given by IEC 60335-1 chapter 19.7 shown in Table 2.
Two different current sense signals IOUT and I2OUT are essential for IEC60335 compliance, as the standard requires a plausibility check for the sensor subsystem, which is preformed by the firmware comparing two current measurement signals of two different nature in the current sensor verification block (see Figure 6Figure 6). The application circuit was implemented as an experimental module PCB for testing and functionality verification. The module is shown in Figure 4Figure 4. It is implemented on two-layer PCB and provides pinout headers for a host system, DC motor, and power supply.
Test Setup
For testing the circuit in the application, the host system was simulated through an Arduino-based controller, which was used for the activation/deactivation PWM of the motor, validation of sensing and backup power deactivation in case the main one doesn’t work. Despite the fact, that the tester’s software was not implemented in accordance with IEC60335-1 Annex R (Software evaluation), as this is not the main focus of the article, the main principle of operation is well shown and can be re-used in a real application without significant additional effort.
Test Software Algorithm
The Test software algorithm is shown in Figure 6. Operation starts with enabling of VD power supply by setting VD_ON active. The Current sensor verification block sets a sample PWM for the motor and checks, whether the current measurement of the motor driver, I2OUT is in line with the measurement coming from High Voltage GreenFET IOUT. If not, then the system is considered broken, the driver power is set to deactivated, and the system state lands into Eternal STOP. This is the state where all system functions are deactivated, and a user notification is set. If current sensor verification is successful, then the motor operation is allowed.
During the operation, the current measurement I2OUT is being regularly checked and in the event of overcurrent, the PWM is deactivated. To make the system robust against short-term transitions, a counter is used to signal the overcurrent if the DC motor current is higher than the set limit during T = 1.5 seconds. This value must be selected after motor evaluation to ensure a big enough margin over transients and to guarantee, that winding temperature is not coming close to the limiting values from Table 2. Averaging for ∆T = 300ms is used during the current sense signal acquisition, thus T has a tolerance up to ∆T, which, considering slow thermal processes of DC motor winding heating is perfectly acceptable. Shaft lock threshold must be low enough to ensure lock event detection within the whole range of the PWM but must not be triggered during normal transient overloads.
In the application example, the threshold is set for Ilock = 700mA. If the current is going lower after shaft lock detection and PWM deactivation, then the system is set for a “RETRY”, to restart the operation. The dangerous event is not necessarily permanent. In case of current sensor measurement are still staying high – i.e. the current is still flowing through the motor despite PWM being set OFF and not decreasing within 300 ms – power of the motor driver is cut by deactivating VD through the backup power switch and system lands into “Eternal STOP” (see Figure 13 for an example).
Hardware Test Setup
An example host system and the experimental module for the backup power switch based on SLG59H1120V (Figure 4) were build in one system on a standard prototyping PCB card and shown in Figure 7. Core of the host system – Arduino PRO Mini is connected through the USB ↔ UART adapter to a development computer. The experimental module is connected to the host system as listed in Table 3 A Failure insertion switch is interrupting PWM signal routed to IN2 and connects it to a permanent 3.3 V of the Experimental Module, simulating a short circuit on the PCBA causing a hardware failure. A typical DC Motor 500-size (no load current is about 50-100mA, stall current is about 2.5A) is connected to the output of the experimental module and is used for the load simulation. Power input is connected to the laboratory power supply unit setup for 12V.
Tests
Test Procedures
To ensure the functionality of the module following tests were performed:
- Turn ON timing check
- Current sensor verification check
- Overcurrent event with operational PWM deactivation function
- Overcurrent event with a malfunction of the PWM deactivation function.
Test Results
Turn On timing check
According to the datasheet of SLG59H1120V, ON Delay time shall be in the range of 0.7 to 1.2 milliseconds.
As it is visible from Figure 8 timings are inline with the datasheet definition. On timing check is important for the system bootup sequence setup.
Current Sensor Verification Check
Current sensor verification is done by comparing the current coming from the U3 SLG59H1120V current sense output (IOUT) and low-side H-bridge measurement of U4 A4950 (I2OUT). It is important to ensure proper re-scaling of the current measurement, as the low-side H-bridge current may also include extra current caused by a back EMF of the DC motor (this is also dependent on the decay settings of U4) and thus has to be recalculated as following:
U4 used in the application operates in the mixed mode, thus the back EMF induced current is not routed via low side current measurement resistor and recalculation is not necessary. Looking at Figures 9 – 11 one can notice the effect of current measurement differences due to the nature of measurement circuits. Scaling factor of IOUT set to be 1 V/A and the scaling factor of I2OUT is:
where:
(1+R11/R13) is the amplification factor of U2A, and R7 is the value of the current sense shunt resistor. At the same time measurements are very much inline with each other, which allows simple verification in the beginning of operation by comparing the data from two circuits after calibrating them. According to the standard requirements the verification shall be done once in the operation cycle, so in the beginning of the algorithm (Figure 6) about 1s averaged samples are compared and in case of matching values current measurement circuits are assumed to be functional.
Overcurrent Event with Operational PWM Deactivation Function
In Figure 12 the signal diagram of an overcurrent event with an operational PWM deactivation function is shown. Zone A corresponds to a normal operation, Zone B to the shaft lock event, and Zone C to deactivation time for a retry, which starts in Zone D. For perception simplicity, this and the following test are done with PWM level set to 100%, which allows easier displaying of signal diagrams. For the system operation, the PWM level is generally irrelevant as the system only checks current measurements and does not use PWM as an input for the state transition.
Overcurrent Event with Malfunctional PWM Deactivation Function
In Figure 13 the signal diagram of an overcurrent event with a malfunction PWM deactivation function is shown. Zone A corresponds to a normal operation, Zone B to an event of PWM line damage (failure insertion switch is ON), and Zone C – shaft lock event and as PWM was not deactivated and resulting overcurrent is still there. As a result, the system is landing in “Eternal STOP” where the deactivation of VD happens, which is shown in Zone D.
Considering a dual deactivation and a dual current measurement, the backup switch keeps the system safe even if a single hardware error occurs.
Conclusion
This article shows the implementation of a backup power switch for a DC motor driver intended for unattended consumer use. A clear advantage of High Voltage GreenFET products in this application is PCB real estate and BOM cost savings due to multiple functions integrated into a miniature single device. A system built with the help of an SLG59H1120V device can perform current sensor functionality verification and backup power deactivation when normal ways of deactivation fail. During the system planning, additional attention must be paid to the total capacitance on power lines to avoid sudden overcurrent switch-offs due to DC motor current spikes.
