Digital Instrument Clusters: Why Functional Safety is Important

Today’s advanced vehicles have fewer knobs and buttons, relying instead on taps and swipes on a touchscreen to control a variety of functions. You can adjust mirrors and lights, turn on windshield wipers, set up your route, and much more from displays are getting larger and increasing in resolution. Modern vehicles can have as many as 10 displays inside providing safety-critical information. The digital instrument cluster, center information display (CID), smart back mirrors, side mirror replacements, and heads-up displays are a few examples. That’s why it’s critical for these displays to comply with functional safety standards.

ISO 26262, an international standard, dictates the functional safety of automotive electronic/electrical systems. An integral part of this standard is the Automotive Safety Integrity Level (ASIL), which classifies the inherent safety risk in an automotive system. Of the four ASIL levels, ASIL D mandates the most safety-critical process and testing, based on severity (of injuries), exposure (probability), and controllability. Windshield wipers, electric power steering, side-view cameras (mirror replacements), airbag deployment, braking, and engine management are examples of automotive systems that typically require ASIL D compliance.

Automotive displays generally fall under the parameters of ASIL B. Specifically, within the instrument cluster display, there are a few blocks that should meet ASIL B criteria. Two of these blocks are the thin film transistor (TFT) bias for power management and the light-emitting diode (LED) backlighting driver. The TFT bias is typically comprised of AVDD and NAVDD voltages for the TFT source driver, VGON and VGOFF voltages for the TFT gate driver and, in some cases, VCOM voltage for the liquid-crystal display (LCD) backplane. I²C and a fault pin provide the communications mechanism with the host microcontroller unit (MCU). A TFT bias block that meets ASIL B specifications should have these features:

• I²C (the data signal and the clock signal) and the fault pin for performing setting adjustments and diagnostics on each rail.
• Undervoltage and overvoltage on each rail.
• Internal resistors with fixed or adjustable voltage through I²C (external resistors aren’t a popular choice because they can present more points of failure).
• Redundant reference.
• Open enable to provide additional redundancy. When the enable is open, the chip will look at another pin to determine whether it is on or off.

The center information display is just one of many safety-critical screens inside today’s sophisticated vehicles.

As for fault scenarios, here are three to keep in mind for the TFT bias: 1) when VCOM voltage goes out of range; 2) when VGON voltage is in an overvoltage situation; and 3) during fail-safe operation with open enable pin. In the first two scenarios with VCOM and VGON voltages, the fault pin will alert the MCU of the situation. The MCU will then read the register to validate the fault scenario and use I²C to adjust the voltages accordingly. In the fail-safe operation scenario, when the enable pin is open while FEN is still high, the output voltages will fall back to the default settings. The MCU can adjust the voltage via I²C.

An example of a TFT bias IC that meets the criteria outlined is the MAX20067 TFT-LCD bias IC with VCOM buffer, level shifter, and I²C interface. This PMIC provides the industry’s first integrated power solution for TFT-LCD with synchronous boost, gate shading, and I²C. The I²C interface provides settings control, diagnostics, and monitoring. The IC also has spread-spectrum modulation in the AVDD boost converters to reduce peak interference and enhance electromagnetic interference (EMI) performance.

Now, let’s consider ASIL B features for the LED backlighting driver. Here, the input typically connects directly to the car battery, which has voltage protection when the output is short. Based on the number of LEDs per string, the output can either be a boost or single-ended primary-inductor converter (SEPIC). I²C and a fault pin are needed to communicate with the MCU.

An LED driver that meets ASIL B criteria would need to have these features:

• I²C (the data signal and the clock signal) and fault pin for performing setting adjustments and diagnostics on each rail
• Open or short LED per-string detection
• Output voltage measurement
• LED current measurement per string
• Internal resistors with fixed output or adjustable output through I²C
• Open enable
• A redundant reference to monitor the output

The fault scenarios involving LED drivers include:

• If string 1 has an LED open. In this case, the fault pin will alert the MCU, and the MCU will read the I²C register to know which LED string has an open. The MCU will then pump more current to the other strings to achieve the same brightness.
• If string 2 has an LED short. As with the string 1 scenario, the fault pin in this case will alert the MCU, and the MCU will read the I²C register to know which LED string has the short. To save power, the LED driver will shut down the string with the short. The MCU will then pump more current to the other strings to produce the same brightness.
• If boost output voltage is low. The fault pin again alerts the MCU, and the MCU reads the I²C register to know that the boost voltage is low. Usually, the out capacitor is short to ground, or the LED is short to ground. A front protection device, such as PGATE, will be open. When this scenario is in place, the dashboard displays only important messages like speed or engine temperature.
• Fail-safe operation with open enable pin. When the enable pin is open while FEN is still high, the LED driver current falls back to the default settings. The MCU can adjust the current via I²C.

The MAX20446 6-channel, I²C LED driver with high-voltage DC-DC controller and battery disconnect provides an example of an LED driver that meets the criteria discussed. The IC features an integrated current-mode switching DC-DC controller that supports boost or SEPIC topologies, providing the voltage needed for multiple strings of high brightness (HB) LEDs. I²C offers settings control as well as diagnostics and monitoring to support ASIL B requirements. Spread spectrum with phase shifting and hybrid dimming enhances EMI performance. The IC also offers a very high dimming ratio, which makes displays easier to read in very bright sunlight as well as pitch-dark environments.

As automotive displays become more prominent in modern vehicles, their ability to adhere to functional safety standards is essential. Automotive-grade ICs aligned with ASIL B specifications can help make it a little easier to create reliable, high-performing vehicle displays.

This blog post was adapted from an article on the topic that appeared in Power Electronic Tips.