Magnetic Sensor ICs Offer Integrated Diagnostics for ASIL Compliance
By Gary Pepka, Allegro MicroSystems, LLC
Abstract
The current revolution in intelligent vehicle control systems relies substantially on the rapidly developing physical detection technology called magnetic sensor integrated circuits (ICs). The complexity, reliability, flexibility, and functionality of these non-contacting, magnetic sensor ICs have all but dispelled the need for electromechanical switches in just about every application in latest generation automobiles. Yet, accompanying this increase in usage of complex electronic devices, is a heightened concern over difficult-todetect, system-level risks. This, in turn, has led the automotive industry to focus on automotive functional safety. The ISO 26262 functional safety standard outlines a development process including predictive analysis to minimize risk. This process, in turn, requires advanced diagnostics capabilities integrated directly into magnetic sensor IC systems. An examination is made of a new type of magnetic sensor IC that implements integrated diagnostics, using an innovative embedded solid state coil for end to end system test.
Overview
Open the door of any recent-model automobile and you are immediately surrounded by an invisible network of electronic sensors. They detect seat belt buckling, window or sunroof pinching, gear shifter position, engine transmission rotational speed and direction, and camshaft position, to name only a few applications. The penetration of real time sensing into these applications has been made practical by developments in various types of non-contacting magnetic detectors (i.e. Hall effect, Giant Magnetoresistive (GMR), Anisotropic resistive (AMR)). In addition to having very small form factors, these state-of-the-art, solid-state, semiconductor ICs are cost effective, power efficient, non-contacting, and gather a pervasive data stream in the harshest environment of vehicle engines with the subtlety to respond to the slightest of changes in vehicle conditions.
These detection systems provide an advanced level of computing sophistication, providing a high degree of output permutations. This has presented a challenge in achieving functional safety per ISO 26262, because the combination of device state complexity and the almost infinite variety of vehicle operating conditions makes it unlikely that all usage scenarios and failure modes can be anticipated by design or discovered in testing programs. Given that almost instantaneous response may be required to protect passengers and preserve the vehicle, these ingenious detection systems must be able to self-diagnose, and often even correct themselves, when they are functioning improperly.
Traditional solutions use electromechanical switches with limited operational states (operating or not), so failure detection is straightforward. Welded reed switch contacts present a short. Broken switch springs prevent output state change. System level failures are difficult to anticipate. Preventive maintenance is often based on generic Mean Time to Failure (MTTF) data, with switches over-designed to accommodate all reasonable circumstances without adjustment.
Figure 1: Magnetic Hall-effect Based Sensor ICs Provide Compact Data Gathering in Restricted Locations Such as Gear Shifters and Seat Belt Buckles
ICs can provide suboptimal outputs, so automotive use requires additional safety measures to avoid unreasonable residual risk according to Automotive Safety Integrity Levels (ASIL), ISO 26262. ASIL assigns safety goals, rather than characterizing entire systems or components. The rigorous ASIL level D requires manufacturers follow strict development guidelines, including Failure Modes Effects and Diagnostics Analysis (FMEDA) to quantify even very low risks of failures. These complexities require comprehensive diagnostics to ensure detection of system level failures and enable safe (limp home) modes.
Redundancy in Safety Critical Applications
For safety critical functions, a feasible option is redundancy in the system. Electromechanical designs are typically bulky and in-line, so they cannot accommodate fail-over redundancy, where alternative controls can be brought on line. Magnetics-based control systems accommodate fail-over redundancy by allowing automatic swapping of control circuits in place, because magnetic sensor ICs do not require contact or direct electrical connection with the mechanical target or electrical circuit being detected.
Redundancy has many forms. A system can include a pair of non-contacting, magnetic sensor ICs in close proximity to each other. Each sensor IC has its own power, ground, and outputs, so if one fails, the other takes over after diagnostics detect a failure. A complementary sensor IC may be used simply to inform a controller that its cohort is not switching when it should. Moreover, there are sensor ICs capable of self-diagnosis, able to inform the controller when it is not operating properly, without the assistance of additional sensor ICs.
Enabled Diagnostics in Electronic Magnetic Sensor ICs
Magnetic sensor ICs may require monitoring to ensure that the device itself is operating properly and also to ensure switching occurs at the appropriate time with respect to a change in magnetic field.
One approach is to supply a single self-diagnosing sensor IC, which can be less costly, requires less PCB space, and is easier to manufacture in the application than two complementary sensor ICs. This solution also assists design engineers with meeting their targeted functional safety requirements, by addressing the complexity of determining proper electrical performance and magnetic switching.
A recent advancement in self-diagnostics, in particular with the phase involving applied magnetic field analysis, is the use of embedded detector coils on magnetic sensor IC chips. An example is shown in Figure 2, where Hall elements are surrounded by an embedded coil in the Allegro MicroSystems A1160 unipolar Hall-effect switch. This provides a cost effective and space saving solution, eliminating the need for external magnetic field conditioning structures to concentrate and guide the ambient magnetic field.
Figure 2: Detection of Magnetic Field Fluctuations
The detection of magnetic field fluctuations is enhanced by an innovative coil structure that surrounds the Hall elements in the Allegro MicroSystems A1160. The coil and Hall elements are embedded in the IC substrate.
The device follows the typical unipolar Hall-effect switch behavior: the device output turns on when the embedded Hall elements sense a perpendicular south polarity magnetic field of sufficient strength to cross the internal comparator switch point. The unique aspect of the device is the on-chip coil embedded in the silicon of the IC. The coil wraps around the Hall elements. When a logic I/O pin, called the Diagnostic Enable pin, is pulled high, the device passes 10 mA of current through the coil. The energized coil generates a field, which, due the close proximity of the coil to the Hall elements, is sufficient to turn on the device and evaluate the entire signal path of the device (including the sensing elements). While the Diagnostic Enable pin is high, the device outputs a pulse width (PW) signal. If the PW signal has a 50% duty cycle, the device is deemed functioning properly. If the PW signal has a 0% or a 100% duty cycle, then the device is deemed functioning improperly (see Figure 3).
Figure 3: Self-diagnostics in the Allegro MicroSystems A1160
When the Diagnostic Enable pin is pulled high, the device outputs a diagnostic signal. A 50% duty cycle indicates proper operation.
To enable self-calibration for these diagnostics, the number of coil turns is fixed and the amount of current is regulated .Therefore, the amount of field generated by the coil is precisely repeatable and if the diagnostic magnetic field changes for some reason (i.e. due to time or stress), the diagnostic mode can detect it. The comparator is the same for both diagnostic mode and normal operation, and what changes is the offset (mV) between diagnostic mode and normal operation (see Figure 4). As a result, when the device is in diagnostics mode, the operation of the diagnostics signal from the regulator to the energized coil and all the way to the output provides an end-to-end test of the full signal path (see Figure 4).
Figure 4: Matched Comparators
Matched comparators ensure self-diagnostics mode validates normal mode operation in the Allegro MicroSystems A1160.
To prevent incidental effects of shifting external magnetic fields, this particular integrated coil concept provides the additional benefit of the coil being sensed differentially by the sensing elements. This means that the diagnostics function may be used at any time, even if the device is in the presence of an external magnetic field of sufficient strength to switch-on the device under normal operation mode. Additionally, as the sensing elements are reconfigured during diagnostics mode to be sensitive to the differential field, any external fields are rejected directly at the sensing elements.
Additional Applications Being Discovered
This pioneering device design provides modal diagnostics in response to an ECU polling signal, and devices in development also run diagnostics at startup. A typical application circuit for the A1160 is shown in Figure 5, and a variety of output options (2-wire or 3-wire) are being developed, with sensing technologies for position, travel, speed, and direction change. Initially for enhancing the ability to achieve functional safety requirements for the automotive market, applications are limitless, including industrial automation and white goods.
Figure 5: Typical Application Implementing a Magnetic Sensing IC Solution.
Summary
The ever-evolving requirements of the automotive, industrial, and commercial markets for increased reliability and functionality will continue to drive demand for electronic content, including non-contact magnetic sensor ICs with diagnostics. The innovative Allegro diagnostic switch with its integrated coil provides design engineers with a unique, cost-effective and user-friendly solution to satisfy almost any safety requirement.
The information contained in this document does not constitute any representation, warranty, assurance, guaranty, or inducement by Allegro to the customer with respect to the subject matter of this document. The information being provided does not guarantee that a process based on this information will be reliable, or that Allegro has explored all of the possible failure modes. It is the customer’s responsibility to do sufficient qualification testing of the final product to insure that it is reliable and meets all design requirements.
Originally published in Design News, February 2014, Copyright ©2014 UBM Electronics. Reprinted with permission.
Portions not copyrighted by UBM Electronics, Copyright ©2014 Allegro MicroSystems, LLC. All rights reserved.