Dual / Half-Bridge Isolated Gate Drivers: Interlock & Dead-Time
← Back to: Digital Isolators & Isolated Power
Core idea
A dual/half-bridge isolated driver is the most direct way to guarantee non-overlap switching in a half-bridge by enforcing interlock + dead-time + per-side UVLO + clear fault signaling across an isolation barrier.
In practice, it is chosen when the project needs repeatable bring-up, predictable protection behavior, and timing symmetry under high dv/dt stress.
H2-1. What a Dual / Half-Bridge Isolated Driver Is
A dual / half-bridge isolated driver is a two-channel isolated gate driver that coordinates
high-side (HO) and low-side (LO)
switching with hardware interlock, dead-time control,
and per-side UVLO/fault behavior to prevent shoot-through and simplify half-bridge validation.
Scope guard (hard boundaries)
- Covered here: HO/LO coordination, interlock priority, dead-time budgeting, per-side UVLO defaults, fault/reporting and half-bridge bring-up checks.
- Not expanded here: extreme dv/dt immunity mechanisms and “CMTI deep dive” (reserved for the dedicated high-CMTI driver page).
- Not expanded here: isolated bias topology design (flyback/push-pull/transformer driver) beyond the driver’s bias interface requirements.
When to use (must-have triggers)
- Hardware shoot-through prevention is mandatory: interlock must remain safe even if inputs glitch (EMI / firmware error / reset event).
- Dead-time must be defined and verifiable: a measurable timing budget is required (tPD, skew, temperature drift), not “best-effort” software timing.
- HO/LO symmetry matters: channel matching impacts loss, thermal balance, and dv/dt behavior; consistent delay/skew is required across conditions.
- Per-side UVLO defaults are needed: high-side and low-side supplies can brownout differently; outputs must fall into explicit safe states.
- Per-side fault attribution is needed: HS vs LS faults must be diagnosable (DESAT/OC/OT path, report type, latch/retry policy).
When NOT to use (avoid scope collision)
- Only one switch is driven: a single-channel isolated driver is typically sufficient; half-bridge coordination features may be unnecessary.
- Primary goal is extreme dv/dt immunity: the design priority becomes CMTI mechanisms, clamp behavior, and injection paths (handled in the dedicated high-CMTI driver topic).
- Primary goal is integrated isolated bias: if the driver must generate its own isolated secondary bias, the integrated-bias driver topic is the correct focus.
- Power topology design is the main problem: selecting and designing isolated DC-DC/bias topologies belongs to the isolated power section, not this driver page.
- The work is protocol isolation (SPI/I²C/CAN/USB/Ethernet): that belongs to the isolated interfaces cluster, not gate-drive coordination.
30-second decision check
- Is hardware interlock required to guarantee “never both ON” under glitches?
- Is a dead-time budget (tPD + skew + drift) required for validation and production gating?
- Is per-side UVLO/fault reporting needed to diagnose HS vs LS events?
If two or more answers are Yes, a dual / half-bridge isolated driver is typically the correct class to evaluate first.
Diagram · Half-bridge topology map (objects + isolation boundary)
H2-2. System Architecture & Signal Partitioning
This section partitions signals, supplies, returns, and the fault domain so later topics (interlock, dead-time, UVLO, layout)
do not repeat fundamentals. The key system risk is that the HS reference moves with switching and can inject common-mode disturbances into logic and sensing paths.
Signals (control → driver → power stage)
- PWM inputs: define how the driver behaves if PWM_H and PWM_L overlap (ignore / force-low / fault). Overlap behavior must be deterministic.
- Enable / Shutdown: define whether EN gates both channels or can gate each channel independently; safe default must be explicit.
- Configuration (optional): if SPI/CFG exists, decide whether configuration is static (set once) or runtime (changes during operation).
- Minimum closed loop: PWM_H, PWM_L, EN, FAULT, READY provides a complete control + diagnostics loop without over-exposing the system to pin complexity.
Design rule: treat “input conflict behavior” as a testable requirement (inject overlap, verify output forced safe within X µs, log a fault or ignore by design).
Supplies (what each rail means)
- VDD1 (primary): logic/control side supply for input conditioning and isolation transmit/receive.
- VDD2L (low-side): low-side driver power referenced to the driver-side return; its UVLO defines LO default behavior under brownout.
- VDD2H (high-side): high-side driver power referenced to HS (moving reference). Source can be bootstrap or isolated bias; only the interface requirements are defined here.
Design rule: for every rail, define: operating range, startup time, UVLO threshold/hysteresis, and output default state while below UVLO.
Grounds & returns (no unintended return across the barrier)
- Primary return ≠ driver-side return: keep controller ground and driver-side power return partitioned; crossing the barrier via copper defeats isolation intent.
- HS reference is a moving node: any measurement or control referenced incorrectly to “GND” will appear random under switching dv/dt.
- Return path priority: minimize gate drive loop area, then minimize power loop, then protect sense/monitor loops from HS node coupling.
Design rule: mark the “do-not-cross” isolation keepout region and enforce it in layout review (copper, vias, stitching, and test pads).
Fault domain (detect → act → report → clear)
- Fault detect: per-side events should be attributable (HS vs LS) where possible; ambiguous fault signals slow bring-up and field diagnostics.
- Fault action: define whether the driver forces outputs low, tri-states, or performs soft turn-off, and which condition overrides PWM.
- Fault report: specify output type (open-drain / push-pull), latch behavior, and timing (fault valid within X µs of event).
- Fault clear: define clear policy (pin clear, power cycle, timeout retry). Without a clear policy, “auto-retry storms” occur during marginal events.
Design rule: treat fault reporting as a measurable interface: inject UVLO/OC events and verify report + output-safe behavior meets the pass criteria.
Interface sanity checklist (quick)
- Input overlap behavior is explicitly defined and testable (force-safe / ignore / fault).
- EN semantics are explicit (global vs per-side gating) with a safe default on reset/brownout.
- VDD2H source is identified (bootstrap vs isolated bias) and the allowed operating window is documented.
- HS reference point is defined and used consistently in measurement, probing, and validation.
- Fault type and clear policy are fixed (open-drain/push-pull, latched/auto-retry) before bring-up.
- Isolation keepout region is enforced in layout review (no copper/test pads crossing by accident).
Diagram · Domain partition (signals, supplies, returns, fault path)
H2-3. Interlock Logic & Shoot-Through Prevention
Interlock is the half-bridge safety foundation. It must be defined as a testable behavior:
when inputs conflict or supplies degrade, the driver must force a safe output state with a clear priority order and a diagnosable fault response.
Interlock types (what is guaranteed)
1) Hardware interlock
- Guarantee: HO and LO cannot be commanded ON simultaneously, even if IN_H and IN_L overlap.
- Engineering value: protects against input glitches (EMI, reset, firmware faults) without relying on software timing.
- Must define: overlap handling result (force both low / prefer one side / raise fault) and response timing.
2) Logic / programmable interlock
- Guarantee: interlock policy and timing may be configurable (dead-time insertion, masks, fault policies).
- Engineering value: adapts to different power stages and timing budgets, but configuration correctness becomes a safety requirement.
- Must define: power-up default policy, configuration validity checks, and safe fallback behavior.
3) Input overlap handling
- Guarantee: deterministic behavior when IN_H and IN_L overlap (ignore / force-safe / fault).
- Engineering value: simplifies acceptance testing because overlap injection is easy and repeatable.
- Must define: minimum pulse width and glitch filtering assumptions as measurable rules.
Priority ladder (what overrides PWM)
- FAULT (highest): forces a safe state; defines latch / retry and reporting behavior.
- UVLO_H / UVLO_L: per-side undervoltage forces that side to a safe state; must not be bypassed by PWM.
- EN / SD: global gating that can disable both channels and define safe defaults during reset.
- PWM inputs (lowest): normal switching commands, valid only when higher-priority conditions are clear.
Design rule: treat “priority order” as a requirement: for each override source, specify output state (forced-low or tri-state),
response time (≤ X µs), and recovery condition (clear policy + delay).
Safe defaults (power-up, brownout, fault-latch)
Power-up
- Entry: VDD rails ramp, isolation link initializes, configuration may be invalid or default.
- Output: HO and LO must remain forced safe until EN is valid and UVLO windows are satisfied.
- Exit: explicit enable condition + optional startup delay to avoid transient overlap at first switching.
Brownout / UVLO chatter
- Entry: VDD2H or VDD2L dips below UVLO threshold, possibly with repeated crossings.
- Output: affected side must go forced safe; interlock must prevent any partial command that could create overlap.
- Exit: hysteresis + debounce/time qualifier to avoid rapid toggling between safe and active states.
Fault-latch (diagnostics-friendly behavior)
- Entry: protection trigger (DESAT/OC/OT) asserts a fault condition.
- Output: HO and LO go forced safe (and optionally soft turn-off); fault is reported deterministically.
- Exit: clear policy is explicit (pin clear / power-cycle / timed retry) to prevent uncontrolled auto-retry storms.
Acceptance (how to prove “never both ON”)
Measurement points
- HO and LO at driver output pins and at gate nodes (to catch board-level distortion).
- HS node synchronized with HO/LO to represent the real dv/dt environment.
- FAULT / READY timing relative to trigger events and output forcing.
- VDD2H / VDD2L to inject and observe UVLO thresholds and chatter behavior.
Injection vectors (minimum)
- Overlap injection: IN_H and IN_L overlap for X ns/µs across operating corners.
- Glitch injection: sub-minimum pulses on one input to validate filtering assumptions.
- EN gating: deassert EN mid-cycle; outputs must force safe within ≤ X µs.
- UVLO_H / UVLO_L: dip each rail separately; verify per-side behavior is deterministic.
- Fault latch: trigger protection input; verify forced-safe + report + clear policy.
Pass criteria (placeholders)
- Never both ON: HO and LO overlap time ≤ X ns (or below measurement resolution).
- Force-safe response: override-to-safe latency ≤ Y µs under overlap/UVLO/fault conditions.
- Fault reporting: FAULT asserted within ≤ Z µs of event, with defined latch/retry behavior.
Diagram · Interlock state machine (simplified, testable behavior)
H2-4. Dead-Time Control & Timing Budget
Dead-time is not “the bigger the safer.” It is an engineered margin that must cover worst-case propagation mismatch,
jitter, and drift while avoiding excessive body-diode conduction and EMI penalties.
Dead-time contributors (what consumes margin)
Controller-inserted dead-time
- Source: PWM generator settings and quantization/resolution limits.
- Risk: discrete step sizes can under-cover worst-case skew at temperature/voltage corners.
- Measure: compare IN_H/IN_L edges across corners and confirm the programmed gap matches expectations.
Driver-inserted dead-time
- Source: fixed or configurable internal insertion tied to interlock logic.
- Risk: configuration errors or defaults may differ from assumptions; verify power-up defaults.
- Measure: time-align HO/LO edges to IN edges and extract inserted delays directly.
Propagation delay mismatch and drift
- Source: tPD_H vs tPD_L mismatch, plus temperature/voltage drift.
- Risk: worst-case skew can flip sign across conditions, reducing effective dead-time on one transition.
- Measure: sweep Tmin/Tmax and VDD2 min/max; extract worst-case skew and drift margins.
Power-stage edge differences (interface view)
- Source: different effective gate charge and turn-off dynamics between HS and LS.
- Risk: edge-rate changes shift the real “safe off” moment even if logic edges appear aligned.
- Measure: compare gate node waveforms to driver outputs to confirm board-level edge realism.
Trade-off (engineering consequences)
Dead-time too small
- Likely outcome: shoot-through risk, overcurrent events, repeated faults, and potential device damage.
- Fast check: inject worst-case corners (high temperature, low VDD, high dv/dt) and verify HO/LO overlap remains ≤ X ns.
Dead-time too large
- Likely outcome: longer body-diode conduction time, higher reverse-recovery loss, worse EMI, lower efficiency, higher temperature.
- Fast check: compare temperature rise and EMI pre-scan at two dead-time settings; verify improvement without margin violation.
Timing budget template (field-level, measurable)
tPD_H
Propagation delay from IN_H edge to HO edge (define measurement threshold, e.g., 50% crossing).
tPD_L
Propagation delay from IN_L edge to LO edge (same threshold definition as tPD_H).
Skew (worst-case)
Worst-case absolute mismatch between channels: |tPD_H − tPD_L| across temperature and supply corners.
Jitter
Edge timing variation under repeated switching (define metric: peak-to-peak or RMS) and sample size N.
Drift margin
Additional margin for temperature, supply, and aging effects that shift tPD/skew relative to nominal conditions.
Budget rule (core equation)
Required dead-time ≥ |skew_worst| + jitter_margin + drift_margin + safety_margin
Field symptoms → fastest sanity checks
Symptom: overheating or repeated faults
- First check: HO/LO overlap margin under worst-case corners; confirm interlock forces safe in conflicts.
- Fix direction: increase dead-time to cover skew/drift; ensure priority ladder blocks PWM during UVLO/fault.
- Pass: overlap ≤ X ns; fault rate ≤ Y per hour during stress run.
Symptom: poor efficiency or worse EMI
- First check: dead-time length vs timing budget; compare two dead-time settings with temperature and EMI pre-scan.
- Fix direction: reduce dead-time while maintaining required margin; re-validate skew/jitter across corners.
- Pass: temperature improves by X°C and EMI/efficiency metrics meet targets without margin violation.
Diagram · Dead-time timing (IN vs HO/LO, tPD, skew)
H2-5. UVLO & Power-Up/Power-Down Behavior (Per-Side)
Power-up and power-down misfires are usually UVLO boundary problems: rails cross thresholds in different orders,
the high-side supply may hover near UVLO during bootstrap refresh limits, and brownout chatter can repeatedly force and release outputs.
This section defines per-side UVLO behavior as testable rules.
Behavior definition (engineering rules)
MUST
- Per-side UVLO gating: when UVLO_H asserts, HO is forced safe; when UVLO_L asserts, LO is forced safe.
- Deterministic safe output: define the safe state as forced-low or tri-state for each channel, and keep it consistent across power-up/down.
- Override priority: UVLO must override PWM and any normal control path (no PWM bypass under undervoltage).
- Response time: UVLO-to-safe latency ≤ X µs (placeholder) with a defined measurement threshold and timing reference.
- Corner coverage: verify behavior at Tmin/Tmax and VDD min/max; the worst-case corner sets acceptance margins.
SHOULD
- Debounce / hysteresis usage: qualify UVLO clear with hysteresis and a time window to reduce chatter during brownouts.
- Startup inhibit window: keep outputs forced safe until both per-side rails are above UVLO clear and isolation/control signals are valid.
- Diagnosable behavior: report UVLO_H and UVLO_L distinctly (separate flags/codes) for field debugging.
- Controlled recovery: define whether recovery is automatic or requires enable re-assertion; avoid uncontrolled retry storms.
FORBIDDEN
- No output release under UVLO: do not allow HO/LO to follow PWM while the corresponding side is below UVLO clear.
- No ambiguous power-up state: do not drive outputs based on undefined inputs when control/isolated domain validity is not guaranteed.
- No rapid toggling: do not allow repeated forced-safe/release cycles without a defined debounce/recovery policy under brownout conditions.
Per-side UVLO (what to define and verify)
UVLO_H (high-side)
- Threshold + hysteresis: define assert/clear behavior as a window, not a single value.
- Safe state: HO forced safe; define whether LO is also forced safe or remains per system policy.
- Typical root cause: bootstrap refresh limitations can keep VDD2H near UVLO during startup or special PWM modes.
UVLO_L (low-side)
- Threshold + hysteresis: define assert/clear behavior as a window for noise and droop tolerance.
- Safe state: LO forced safe; define whether HO is also forced safe or remains per system policy.
- Typical root cause: load steps and auxiliary rails can dip VDD2L and create chatter if recovery is not qualified.
Power-up / Power-down (sequence-aware)
- Power-up: keep outputs forced safe until (1) the relevant side rail is above UVLO clear, (2) enable is valid, and (3) control/isolated signaling is valid.
- Power-down: on UVLO assert, force safe deterministically and report the reason; do not “pulse” outputs during rail collapse.
- Brownout chatter: qualify recovery with hysteresis + debounce + (optional) re-enable gating to avoid repeated on/off transitions.
Verification (minimum test set)
Injection waveforms
- Supply ramps: controlled ramp-up and ramp-down for VDD1, VDD2L, and VDD2H (different ordering).
- Brownout dips: repeated dips around UVLO threshold to validate chatter handling.
- Start-mode corners: low refresh PWM conditions where VDD2H may approach UVLO (interface-level validation).
Pass criteria (placeholders)
- Force-safe: UVLO assert → output safe within ≤ X µs.
- No pulses: during rail collapse or chatter injection, outputs must not produce repetitive short pulses beyond defined policy.
- Recover policy: recovery requires clear conditions (UVLO clear + debounce + enable) and is repeatable across corners.
Diagram · Supply ramps + UVLO windows (per-side forcing)
H2-6. High-Side Supply: Bootstrap vs Isolated Bias Interface
This section is interface-focused: it does not design the power supply.
It defines when bootstrap is acceptable and when an external isolated bias is required,
based on duty/hold-time/refresh constraints and the driver’s bias interface requirements.
Comparison (selection logic)
Bootstrap
- Works well when: HS can refresh periodically and HS ON hold time stays within the recharge/leakage limits.
- Fails when: near-DC HS hold, very high duty, low refresh frequency, or special light-load modes reduce refresh events.
- What to verify: worst-case VDD2H margin above UVLO_H clear across temperature and operating modes.
- Pass (placeholders): VDD2H_min ≥ UVLO_H_clear + X; max HS hold ≤ Y; min refresh ≥ N.
External isolated bias (interface view)
- Required when: HS hold-time is long, duty is high, DC hold is needed, or refresh cannot be guaranteed in all modes.
- Key benefit: stable HS rail independent of refresh events, improving UVLO margin and startup determinism.
- What to verify: bias rail meets the driver’s range, transient current, ripple, and startup time requirements.
- Pass (placeholders): Vbias within X_min..X_max, ripple ≤ Y mVpp, startup ≤ N ms.
Bias interface requirement checklist (driver-facing)
Vbias operating range
Ensure Vbias remains within X_min..X_max during steady-state and transients, with UVLO thresholds treated as window constraints.
Transient current demand
Bias source must support switching bursts without droop: peak current X A for Y ns/µs (placeholder), including internal gate-drive consumption.
Ripple tolerance
Allowable ripple at the driver supply pins ≤ X mVpp (placeholder); validate with the same probe point definition used for UVLO testing.
Startup time to UVLO clear
Bias must reach UVLO clear within ≤ X ms (placeholder) to prevent prolonged forced-safe behavior and startup mis-sequencing.
UVLO coordination with gating
Define how EN/SD interacts with UVLO clear (debounce window, release delay). Prevent brownout chatter from causing repeated switching bursts.
Validation (interface-only, no power topology)
- Mode coverage: verify bias margin across startup, steady-state, light-load, and recovery modes where refresh may change.
- Worst-case hold: test the maximum HS hold-time condition; VDD2H must remain above UVLO clear with margin.
- Transient stress: apply switching bursts; confirm bias droop does not trigger UVLO or output forcing.
- Pass (placeholders): UVLO events ≤ N in T minutes; no forced-safe chatter during validated modes.
Diagram · HS supply decision tree (bootstrap vs isolated bias)
H2-7. Per-Side Monitoring & Protection Signaling
Per-side protection is only useful when it forms a closed loop:
Trigger → Action → Report → Reset.
This section defines protection behavior as interface-level, testable rules without diving into power-device physics.
Fault signaling semantics (define before debugging)
Output electrical type
- Open-drain: requires pull-up; easy wired-OR; check rise-time budget and default level during brownout.
- Push-pull: clear logic levels; verify compatibility with controller I/O domain and power sequencing behavior.
Hold behavior
- Latched: stays asserted until cleared; best for post-mortem; requires explicit reset policy.
- Auto-retry: re-enables after a delay; must limit retries to avoid stress and “retry storms”.
- Pulsed / timed: indicates transient fault; requires sampling/interrupt handling and event capture.
Per-side reporting granularity
- HS fault: high-side channel / high-side supply / high-side sense path.
- LS fault: low-side channel / low-side supply / low-side sense path.
- Combined fault: single pin indicates “something happened”; define how the source is distinguished (separate flags, status read, or controlled injection test).
Protection loop cards · Fast protection
DESAT / Short-Circuit (SC) (interface behavior)
Trigger
DESAT/SENSE input crosses threshold X and persists for Y (placeholder). Define sense reference and blanking window (if used).
Action
Gate drive enters a deterministic safe action: gate-off (optionally soft turn-off) and PWM is blocked. Define whether the opposite side is forced safe or remains per policy.
Report
Fault output asserts as HS, LS, or combined. Define electrical type (open-drain/push-pull) and hold behavior (latched/auto-retry/pulsed).
Reset
Reset via clear pin or power-cycle or timeout retry. If auto-retry is used, limit attempts to ≤ N and add a backoff window of T (placeholders) to avoid repeated stress.
Over-Current (OC) (interface behavior)
Trigger
OC input crosses threshold X for ≥ Y (placeholders). Define whether the threshold is instantaneous, filtered, or blanked during switching edges.
Action
Enter safe state for the associated side: HO or LO forced safe. Define whether the action is immediate shutdown or a controlled reduction mode (if available).
Report
Fault pin asserts with per-side source where possible. For combined reporting, define how OC is differentiated from UVLO/OT (status flags or injection test).
Reset
Define recovery: manual clear vs timed retry. If timed retry is enabled, require a cool-down window of T and a maximum retry count N (placeholders).
Protection loop cards · Thermal protection
Over-Temperature (OT) (interface behavior)
Trigger
OT threshold crossing (or warning threshold if exposed) with a defined filter time Y (placeholder). Treat warning vs shutdown as distinct interface states.
Action
On OT shutdown, drive outputs to safe state and block PWM. On warning (if available), report without forcing shutdown, enabling controlled derating policies upstream.
Report
Fault output indicates OT explicitly where possible (separate flag). For combined fault, define OT diagnostic priority relative to OC/SC/UVLO.
Reset
Recovery requires temperature hysteresis plus a minimum cool-down time T (placeholder). Avoid immediate auto-retry at the boundary to prevent cyclic heating.
Protection loop cards · Integrity monitoring
Gate Monitoring / Drive Integrity (interface behavior)
Trigger
Detect abnormal gate condition (stuck, missing transition, or monitor threshold X for Y) via monitor pin or internal logic (placeholders). Treat as interface-level health fault.
Action
Force the affected output safe and block further switching until reset conditions are met. Define whether the opposite side is also forced safe to maintain half-bridge safety.
Report
Report as HS or LS integrity fault if per-side reporting exists; otherwise report as combined with a documented diagnostic lookup path.
Reset
Reset through clear pin or power-cycle. Auto-retry is discouraged unless the root cause is known to be transient and bounded by retry limits N and T (placeholders).
Acceptance checks (closed-loop verification)
- Injection: trigger HS and LS faults separately (DESAT/OC/OT equivalents) and confirm per-side reporting matches the declared semantics.
- Action timing: trigger-to-safe latency ≤ X µs (placeholder) with a defined probe point and threshold.
- Hold behavior: latched faults remain asserted until reset; auto-retry faults follow a bounded retry policy (≤ N retries, backoff ≥ T).
- Reset outcome: after reset, outputs remain safe until enable and validity conditions are satisfied (no spontaneous pulses).
Diagram · Protection loop (Trigger → Action → Report → Reset)
H2-8. dv/dt Immunity, False Turn-On, and Layout Priorities
In half-bridge systems, the highest-risk false event is LS false turn-on driven by HS node dv/dt and Miller injection.
This section focuses on half-bridge-specific coupling paths and layout priorities (P0/P1/P2), without duplicating “high-CMTI driver” selection deep-dives.
Half-bridge false turn-on causal chain (testable)
Source
HS node transitions with high dv/dt during switching. The HS node region becomes an aggressive coupling source.
Coupling
Miller coupling and loop parasitics lift the LS gate potential. Weak return paths and large gate loops amplify the spike.
Result
LS gate crosses an unintended threshold and produces a short conduction event, risking shoot-through, heating, EMI degradation, or protection trips.
Verification placeholders
- Gate peak: LS gate peak ≤ X V above intended off level at worst dv/dt.
- Event count: false-turn-on events ≤ N over M switching cycles.
- Corner set: highest bus voltage, fastest edges, hottest temperature, tightest dead-time.
Layout priorities (P0 / P1 / P2)
P0 (must fix first)
- Gate loop minimization: keep HO/LO gate loop area small; route gate and return as a tight pair.
- Clean gate return: ensure driver return does not share high di/dt power-loop current paths.
- Sense loop hygiene: keep DESAT/OC sense return clean and referenced correctly; avoid crossing the HS node keep-out zone.
P1 (large improvement)
- Power loop tightness: minimize DC-link-to-switch loop; keep the commutation loop compact and planar.
- HS node keep-out: minimize HS copper area; keep sensitive traces away; avoid parallel runs near HS copper.
- Damping control: use gate resistance/damping as a verified knob (measured gate peak + false events as criteria).
P2 (situational)
- Miller clamp / negative gate bias: use when dv/dt and parasitics push LS gate close to unintended threshold; verify with gate peak + event counts.
- Common-mode path control: manage return paths and shielding; if Y-cap is used, validate leakage constraints and EMI improvement as a system-level trade-off.
Measurement setup (practical, layout-driven)
- Probe points: measure gate-to-source at the device pins, not at the driver output pad; use a low-inductance method.
- Worst dv/dt condition: highest bus voltage and fastest edge settings; evaluate at hot and cold corners.
- Pass (placeholders): LS gate peak ≤ X V; false-turn-on count ≤ N per M cycles; no repeated protection trips during validated mode.
Diagram · Half-bridge current loop map (gate / power / sense)
H2-9. Isolation Ratings & Safety Compliance for Half-Bridge Drivers
This section focuses on driver-relevant isolation decisions that affect half-bridge designs:
working voltage (VIORM), creepage/clearance, and pollution/altitude.
It avoids turning into a regulation encyclopedia by staying at the system implementation and manufacturing evidence level.
Ratings that matter (system-impact view)
VIORM / working voltage
- Meaning: long-term working stress across the isolation barrier (not the same as impulse or hi-pot).
- Use: match bus voltage + tolerance + expected common-mode swing to the declared lifetime model.
- Half-bridge note: HS node switching drives common-mode stress patterns that must stay within the working-voltage envelope.
Creepage vs clearance
- Creepage: surface distance along PCB/materials; strongly affected by slots, coatings, and keep-out rules.
- Clearance: air gap distance; more sensitive to altitude and local geometry.
- System truth: package ratings alone do not guarantee the board-level path meets the required separation.
Pollution degree & altitude
- Pollution: drives surface contamination assumptions; can force longer creepage or stricter surface control.
- Altitude: reduces air breakdown margin; can force larger clearance in high-altitude installations.
- Implementation knobs: slotting, conformal coating policy, and an enforced copper keep-out corridor.
Board-level knobs that change the compliance outcome
Slot
A PCB slot can extend creepage by forcing the surface path around the slot. Slot geometry must be consistent across manufacturing lots.
Coating
Conformal coating can reduce surface contamination risk, but introduces process controls and inspection requirements. Treat coating as a controlled safety process, not an afterthought.
Keep-out corridor
Enforce a no-copper/no-via corridor across the isolation boundary. Prevent silkscreen, solder mask openings, and test pads from unintentionally shortening the effective separation.
Manufacturing evidence and test interfaces
Certificates and reports
- UL/VDE certificate identifiers and report summary pages.
- Declared insulation category and relevant standard names (without reproducing clauses).
- Factory/production location and any published process consistency statement (if available).
Lot traceability
- Date code / lot code policy for traceability.
- Incoming inspection plan aligned to the critical isolation parameters.
- Change notification expectations (package mold compound, assembly, test flow).
Hi-pot / PD test path
- Hi-pot: define voltage X, time Y, and leakage limit N (placeholders) with a board-level fixture strategy.
- Partial discharge (PD): define PD threshold X and test duration Y (placeholders) when required by the compliance plan.
- Board interface: reserve test pads on both sides of the isolation corridor without violating keep-out rules.
What to ask the vendor (copy-ready checklist)
Working voltage and lifetime
- Provide VIORM (working voltage) and the lifetime assumptions (temperature, years, duty profile).
- Provide the mapping between working voltage and expected insulation lifetime model.
Certificates and applicable standards
- Provide UL/VDE certificate IDs and report summary pages.
- Confirm insulation type (basic/reinforced) and the test evidence coverage for the package family.
Production consistency and traceability
- Describe lot/date traceability and change notification policy.
- Provide any published process controls related to isolation barrier integrity.
Hi-pot / PD test conditions
- Provide recommended hi-pot conditions (X/Y/N placeholders) and fixture guidance for board-level testing.
- Provide PD test conditions and pass/fail thresholds when PD is part of the compliance plan.
Diagram · Creepage/clearance footprint concept (slot / coating / keep-out)
H2-10. Key Specs & Selection Logic (for Dual/Half-Bridge)
Selection should converge through a funnel: first confirm topology compatibility, then timing symmetry, then protection/reporting behavior, and finally dv/dt/EMC survivability.
The goal is an executable filtering order, not a product catalog.
Selection funnel (hard gates by stage)
Stage 1 · Topology fit
- Half-bridge capability: native HO/LO channel structure with deterministic safe behavior on invalid inputs.
- Gate voltage interface range: compatible drive amplitude and reference for the intended device class (interface-level match).
- Supply scheme compatibility: supports the intended HS supply approach (bootstrap-capable or external isolated bias compatible).
- Per-side UVLO: HS and LS UVLO supported when the system requires independent supply validity checks.
Evidence to ask: datasheet block diagram + supply pin requirements + stated safe-state behavior.
Stage 2 · Timing fit
- Propagation delay: HO/LO delays meet the timing budget and are stable across temperature.
- Skew / symmetry: channel-to-channel mismatch ≤ X ns (placeholder) to preserve half-bridge symmetry.
- Dead-time strategy: compatible with system dead-time insertion (internal insertion or external insertion alignment).
- Input conditioning: deterministic behavior for conflicting inputs or invalid PWM edges.
Evidence to ask: delay/skew tables across corners + timing diagrams + stated input conflict behavior.
Stage 3 · Protection fit
- Per-side reporting: HS fault / LS fault granularity (or a defined combined-fault diagnostic path).
- Soft turn-off: available when required to reduce stress during fault shutdown events.
- Reset policy: clear pin / power-cycle / bounded retry support consistent with system recovery strategy.
- Fault output type: open-drain or push-pull compatibility with controller domain and power sequencing.
Evidence to ask: fault truth table, latch/retry behavior, and reset conditions declared for each fault class.
Stage 4 · EMC / dv/dt fit
- dv/dt / CMTI class: meets the half-bridge environment requirement (≥ X kV/µs placeholder).
- Barrier coupling sensitivity: lower coupling generally reduces injected noise; confirm with recommended layout guidance.
- Layout tolerance evidence: reference layouts and validation notes showing stable behavior under realistic switching edges.
Evidence to ask: CMTI/dv/dt test conditions, evaluation board notes, and stability data under high dv/dt switching.
Quick filter checklist (use before deep evaluation)
- Must-have: HO/LO structure + deterministic input conflict behavior + safe power-up/power-down defaults.
- Timing: skew ≤ X ns and consistent across temperature; dead-time strategy matches the control chain.
- Protection: per-side fault (preferred) or a clear combined-fault diagnostic path; bounded reset policy.
- dv/dt: meets ≥ X kV/µs; confirmed with layout guidance and realistic switching validation notes.
Diagram · Selection funnel (Topology → Timing → Protection → EMC)
H2-11. Engineering Checklist (Design → Bring-up → Production)
This checklist is written for execution: each item is framed as Item / Why / How / Pass so it can be used as a design gate, a bring-up script, and a production test record.
Gate rule: If any “Pass” criterion fails, stop and fix upstream (power domain, interlock, dead-time, or layout) before tuning EMI or software policy.
Threshold placeholders: X / Y / N are intentionally left as system-specific acceptance limits.
Design Checklist (Schematic → Supplies → Interlock/DT → Protection → Layout)
Item: Define HO/LO safe states for power-up, UVLO_HS, UVLO_LS, and FAULT.
Why: Half-bridge failures often originate from ambiguous defaults during ramp/brownout.
How: For each state, document output mode (LOW / HI-Z / clamp) and the controlling priority (EN/FAULT/UVLO vs PWM).
Pass: A one-page “default-state table” exists and matches lab observations within X ms of each event.
Item: Budget propagation delay mismatch and pulse-width distortion across HO vs LO paths.
Why: Channel asymmetry converts into shoot-through margin loss or excessive diode conduction time.
How: Allocate a timing budget: tPD_H, tPD_L, skew, temp drift, and measurement jitter; reserve margin ≥ X%.
Pass: Worst-case computed overlap margin ≥ X ns and validated with scope timing delta ≤ Y ns error.
Item: Lock interlock behavior for conflicting inputs (IN_H=1 and IN_L=1).
Why: Real systems see glitches, MCU reset states, and cable/connector transients.
How: Specify conflict resolution: force both OFF, or “last-valid” hold, plus deglitch (≥ X ns) if supported.
Pass: Conflict injection cannot produce simultaneous HO+LO ON for N trials at dv/dt ≥ X kV/µs.
Item: Validate per-side UVLO threshold/hysteresis against driver-side supplies.
Why: UVLO chatter is a common root cause of false turn-on during brownout and boot refresh.
How: Simulate and measure supply ramp slopes; ensure UVLO hysteresis > noise ripple by ≥ X.
Pass: No repeated output toggling when supply is swept around UVLO by ±X% for Y seconds.
Item: Close the protection loop definition (Trigger → Action → Report → Reset) for HS and LS separately.
Why: “Fault pin toggles” is not actionable unless the side and reset policy are deterministic.
How: For each mechanism (OC/OT/DESAT/VDS sense if present), define: soft turn-off, latch vs retry, and reset pin/power-cycle rules.
Pass: Fault event produces a single, repeatable signature: outputs OFF within X ns, report within Y ns, reset within N steps.
Example BOM snippets (driver + bias)
Dual/half-bridge isolated gate drivers (examples): TI UCC21220, TI UCC21520, TI UCC21530; ADI ADuM3223, ADI ADuM4223; Infineon 2EDF7275K, Infineon 2EDS8265H; Skyworks Si8233 family.
Isolated bias modules (pairing examples): Murata Power Solutions MGJ2D051505SC (gate-drive DC-DC); RECOM R15P215S (2W isolated DC-DC).
Bootstrap interface examples: fast diode (e.g., Nexperia BAS21 series) + low-ESR bootstrap capacitor (X7R, ≥ X µF, ≥ Y V).
Bring-up Checklist (Power sequence → Waveforms → Fault injection → Thermal & thresholds)
Item: Verify power-up ordering and HO/LO behavior before connecting the power stage.
Why: Most “mystery shoot-through” events are born during initial ramp or reset release.
How: Scope VDD1, VDD2H, VDD2L, EN, IN_H/IN_L, HO/LO with the power stage disconnected.
Pass: HO/LO remain forced OFF (or HI-Z per spec) until EN and valid PWM are present for ≥ X ms.
Item: Measure dead-time at the driver outputs (HO/LO) across duty and frequency extremes.
Why: Controller-inserted dead-time can be erased by driver asymmetry and propagation drift.
How: Use time cursors on HO/LO edges; log min/typ/max dead-time across temperature points.
Pass: Measured dead-time ≥ X ns at all corners; skew stays within Y ns across temp sweep.
Item: Inject input conflicts and glitches to prove interlock resilience.
Why: Real systems see simultaneous asserts during reset, brownout, and EMI bursts.
How: Drive IN_H/IN_L with a pattern generator; intentionally overlap by X ns and step dv/dt stress.
Pass: No overlap at HO+LO for N runs; fault/report behavior matches definition within Y ns.
Item: Brownout sweep around UVLO_HS and UVLO_LS to check chatter and recovery.
Why: UVLO chatter can look like random switching, heating, or EMI spikes.
How: Programmable supply sweeps with controlled slope; record HO/LO, fault pins, and restart timing.
Pass: Outputs remain stable (OFF) during UVLO; recovery does not oscillate more than N cycles.
Bring-up logging fields (store per unit)
Timing: tPD_H, tPD_L, skew, min dead-time (X ns), max dead-time (Y ns).
UVLO: UVLO_HS trip/release, UVLO_LS trip/release; chatter count (N).
Faults: HS fault count, LS fault count, combined fault count; reset method used.
Thermal: driver package temp rise at nominal switching and worst-case load.
Production Checklist (ICT/Functional → Hi-pot/PD → Traceability → Calibration record)
Item: Add test points for VDD1, VDD2H, VDD2L, HS reference, EN, IN_H/IN_L, HO/LO, FAULT.
Why: Without access points, production tests degrade into “power on and hope”.
How: Place labeled pads; ensure isolation keep-out is respected; define probe fixtures.
Pass: Fixture can measure all rails and toggles within X seconds; no probe crosses isolation gap.
Item: Run isolation proof test (hi-pot) and optional partial discharge (PD) where required.
Why: Isolation rating is a system property: component + PCB structure + process.
How: Define test nodes, dwell time, and leakage limits; record results per serial number.
Pass: Leakage ≤ X µA at Y Vrms for N seconds; PD below threshold (if applicable).
Item: Functional test: confirm interlock and dead-time at a known PWM profile.
Why: A unit can pass ICT yet fail timing or default-state behavior.
How: Apply a scripted PWM pattern; measure HO/LO timing; verify FAULT pin behavior.
Pass: Dead-time within X…Y ns; fault signature matches definition; no unexpected toggles.
Traceability pack (vendor + lot + certificates)
Store: driver IC lot code, isolated bias lot code, PCB revision, conformal coating status.
Attach: UL/VDE/CB documents (as applicable), hi-pot log, production functional log.
Pass: Any field return can map to a bounded population within X minutes by serial number.
Validation flow (bench → stress → production gates)
H2-12. Applications & IC Selection (placed near the end)
This section focuses on deployment: for each application bucket, it lists must-have driver behaviors, power interface choice (bootstrap vs isolated bias), and example part numbers to form a workable pairing.
Bucket A · Motor inverter / servo drive half-bridge
Must-have: deterministic interlock, tight HO/LO skew, per-side UVLO, clear fault signaling (HS/LS).
Supply choice: isolated bias preferred when high-side on-time is long or duty is high; bootstrap requires frequent refresh.
Monitoring priority: HS/LS fault separation, soft turn-off (if available), brownout immunity.
Driver IC examples: TI UCC21530 (programmable dead-time), TI UCC21520; ADI ADuM4223; Infineon 2EDS8265H.
Isolated bias examples: Murata MGJ2D051505SC; RECOM R15P215S.
Bucket B · PFC / LLC / DC-DC half-bridge power stage
Must-have: stable timing over temperature, predictable enable/disable behavior, fault reporting that matches the controller policy.
Supply choice: bootstrap works when switching is continuous; isolated bias preferred for low-frequency burst modes or long hold times.
Monitoring priority: UVLO chatter resistance, clean fault latch vs retry decision.
Driver IC examples: Infineon 2EDF7275K (dual-channel isolated); TI UCC21222 (programmable dead-time); ADI ADuM3223.
Isolated bias examples: RECOM R15P215S; Murata MGJ2D051505SC (if gate-drive rails are needed).
Bucket C · Battery HV switch / industrial actuator half-bridge
Must-have: robust default-off states, strong interlock under resets, clear HS/LS fault identity.
Supply choice: bootstrap acceptable when duty and hold-time limits are respected; isolated bias improves deterministic behavior under brownout.
Monitoring priority: per-side UVLO thresholds that match the available bias rails; predictable recovery after faults.
Driver IC examples: TI UCC21220 (dual-channel isolated); TI UCC21520; Skyworks Si8233 family (HS/LS isolated).
Isolated bias examples: RECOM R15P215S (simple isolated rail); Murata MGJ2D051505SC (gate-drive oriented).
IC Selection tiers (with example part numbers)
Tier 1 · Cost-optimized
Use when: functional isolation is sufficient and timing margins are moderate.
Check first: interlock behavior, UVLO per-side, basic skew and PWD limits.
Examples: TI UCC21220 · ADI ADuM3223 · Skyworks Si8233 family.
Tier 2 · Robust industrial
Use when: higher insulation level or wider margin against dv/dt noise is needed.
Check first: channel-to-channel mismatch, default-off under faults, predictable enable.
Examples: TI UCC21520 · ADI ADuM4223 · Infineon 2EDF7275K.
Tier 3 · High-dv/dt premium
Use when: half-bridge switching is very fast and timing symmetry must be maintained across corners.
Check first: programmable dead-time (if desired), fault determinism, high CMTI headroom.
Examples: TI UCC21530 · Infineon 2EDS8265H (reinforced isolated) · TI UCC21222 (DT control in 3 kVrms class).
Application pairing matrix (needs → driver behaviors)
Request a Quote
H2-13. FAQs (Field Troubleshooting & Acceptance Criteria)
Each FAQ uses a fixed, testable format: Likely cause / Quick check / Fix / Pass criteria.
Placeholders X, Y, N represent project-specific thresholds (time/margin/count).
HO/LO are OFF, but the HS node rings badly — UVLO chatter or input conflict?
Likely cause: VDD2H/VDD2L hovering near UVLO (chatter) or IN_H/IN_L conflict forcing a high-impedance/undefined output state while the power stage floats.
Quick check: Single-shot capture of VDD2H/VDD2L, EN, IN_H/IN_L, HO/LO, and FAULT/READY around the event; confirm whether HO/LO ever produces short pulses during the ring window.
Fix: Add margin against UVLO (raise rail headroom / reduce droop), add input deglitch or enforced “both-off” gating during invalid rails, and provide a defined discharge/bleed path for the HS node if it is left floating.
Pass criteria: HO=LOW and LO=LOW throughout a rail sweep window of X ms around UVLO; VDD2 rails stay above UVLO_release by Y V (or Y%); HS ringing decays within N cycles (project spec).
Occasional shoot-through at power-up — dead-time missing or propagation skew?
Likely cause: PWM becomes active before rails/enable are valid, or HO/LO path asymmetry reduces effective dead-time during the first few cycles.
Quick check: Trigger on the first HO/LO transition after EN release; measure any HO–LO overlap and compare tPD_H vs tPD_L during the first X ms after power-up.
Fix: Gate PWM with “rails-valid” (explicit enable sequencing), enforce minimum dead-time in one place (controller OR driver), and require “both-off” on reset/invalid rails.
Pass criteria: Measured HO–LO overlap time ≤ X ns (target: 0); effective dead-time ≥ Y ns on first-cycle capture; 0 shoot-through events across N consecutive power cycles.
False turn-on is worse at high temperature — Miller injection or UVLO drift?
Likely cause: Reduced gate pull-down strength / higher impedance at temperature increases Miller-induced Vgs bumps, or rail margin shrinks so UVLO transitions become noisy.
Quick check: Thermal sweep while monitoring Vgs (off-state bump), VDD2 margin to UVLO_release, and FAULT timing; correlate false events to dv/dt edges.
Fix: Strengthen turn-off control (lower Rg_off, add Miller clamp if available, ensure solid return of gate loop), and increase VDD2 headroom to keep UVLO well away from switching ripple.
Pass criteria: Off-state Vgs bump amplitude ≤ Y V and width ≤ X ns across temperature; 0 false turn-on events in N minutes at representative dv/dt (project spec).
Low-side is fine, but high-side occasionally misses pulses — bootstrap refresh or HO reference drift?
Likely cause: Bootstrap supply (VDD2H–VS) droops below UVLO during long on-time/high duty, or the HO reference (VS) is bouncing so the driver’s local thresholds shift.
Quick check: Measure VDD2H–VS with a floating measurement method; log minimum value during the “missing pulse” window and compare with UVLO thresholds; observe VS bounce relative to driver return.
Fix: Ensure bootstrap refresh (minimum off-time), increase bootstrap capacitance within datasheet limits, reduce VS bounce via tighter power/return loop, or switch to isolated bias when hold-time exceeds bootstrap capability.
Pass criteria: VDD2H–VS remains ≥ UVLO_release + Y V during a hold of X ms; missed HO pulses = 0 over N switching cycles at the worst-case duty pattern.
Same PWM, but changing the power device increases false triggers — Qg or gate-loop inductance?
Likely cause: Different Qg/Miller plateau increases susceptibility to dv/dt, or the effective gate loop inductance/ringing shifts due to package/layout interaction.
Quick check: Compare Vgs overshoot/undershoot and ringing frequency before/after the device swap; check whether false events align with ringing peaks.
Fix: Re-tune gate resistors (separate Rg_on and Rg_off if possible), add a small gate stopper near the device, and minimize gate loop + return inductance; use clamp features if available.
Pass criteria: Vgs overshoot/undershoot stays within Y V (project spec) and ringing decays within X ns; false trigger events ≤ N in the worst-case stress run.
DESAT false trips — blanking too short or parasitics in the sense path?
Likely cause: DESAT blanking does not fully cover switching transients, or the sense loop picks up dv/dt/coupled spikes through parasitic capacitance/inductance.
Quick check: Probe DESAT node (or equivalent sense input) together with gate output; verify whether the trip happens inside the intended blanking interval.
Fix: Increase blanking (or add RC filtering per datasheet guidance), shrink the DESAT/sense loop area, and separate sense routing from noisy switching nodes.
Pass criteria: DESAT/sense stays ≥ Y V away from the trip threshold during switching; 0 false trips in N cycles; real fault is detected and shuts down within X µs (project spec).
Fault clears, then immediately faults again — auto-retry storm or reset conditions not met?
Likely cause: Auto-retry restarts while the underlying condition still exists (rail below release/hysteresis, still hot, or latch-clear not satisfied).
Quick check: Observe FAULT pin pattern (pulsing vs latched), confirm VDD2H/VDD2L exceed UVLO_release + hysteresis, and verify reset/clear pin timing relative to rails.
Fix: Enforce a minimum OFF time (cooldown) and require explicit clear only after rails/temperature are valid; reduce retry aggressiveness and ensure deterministic “both-off” during fault.
Pass criteria: After a fault clear, FAULT does not re-assert for at least X s; retry count ≤ N per Y minutes under worst-case load and temperature.
Increasing dead-time makes EMI worse — diode conduction or steeper dv/dt edges?
Likely cause: Longer dead-time forces more body-diode conduction, increasing reverse-recovery stress and resulting EMI; edge interactions can also shift dv/dt hotspots.
Quick check: Measure diode conduction interval and the HS node transition behavior when the opposite switch turns on; compare EMI peaks before/after dead-time change.
Fix: Reduce dead-time to the minimum safe margin, tune turn-on/off edges (Rg_on/Rg_off), and add a targeted snubber only after timing is correct.
Pass criteria: Dead-time remains ≥ X ns margin without overlap; dominant EMI peak improves by ≥ Y dB at the target band; results repeat across N runs.
Delay mismatch between channels causes current imbalance — measure skew first or temperature drift first?
Likely cause: Static skew (tPD mismatch) shifts switching symmetry, and temperature drift can move the skew outside budget under load.
Quick check: Start with room-temperature skew measurement (HO vs LO edges referenced consistently), then repeat at hot/cold points to quantify drift.
Fix: Use a driver with tighter matching if needed, match external gate networks and routing symmetry, and allocate margin so drift does not consume dead-time.
Pass criteria: Skew ≤ X ns at 25°C and drift ≤ Y ns across temperature range; current imbalance ≤ Y% with ≤ N imbalance events (project spec).
Changing gate resistor dramatically changes heating — focus on turn-off or turn-on edge control first?
Likely cause: Switching loss redistribution: turn-on affects dv/dt and reverse recovery stress; turn-off affects voltage overshoot, ringing, and tail energy.
Quick check: Capture Vgs and Vds transitions for both turn-on and turn-off; correlate temperature rise to which edge shows larger overlap (V·I) region.
Fix: Split Rg_on and Rg_off (if supported) to control edges independently; keep dead-time minimal-safe; ensure clamp/return integrity before adding snubbers.
Pass criteria: Device temperature rise improves by ≥ Y °C at the same power point; edge transition time stays within X ns limits; stable operation for N minutes without faults.
Works on the bench, but false-triggers in the cabinet — common-mode return path or shield/Y-cap setup?
Likely cause: Cabinet/chassis bonding creates new common-mode current paths; shield termination and Y-cap placement alter CM injection into the isolation barrier and gate loops.
Quick check: Compare behavior with chassis bond/shield connection variations; measure common-mode current (or proxy via clamp) and correlate with false events and dv/dt transitions.
Fix: Establish a controlled shield bonding strategy (single-point vs multi-point per system spec), optimize Y-cap value/placement to balance EMI vs leakage, and tighten return paths near the driver.
Pass criteria: 0 false triggers across N stress shots (ESD/EFT or equivalent); CM current ≤ Y mA RMS (project spec); no fault asserts during a dwell of X minutes in the cabinet.
Hi-pot passes, but the field sees more faults — partial discharge margin or pollution/creepage reality?
Likely cause: DC hi-pot may not expose partial discharge susceptibility under real dv/dt and humidity; contamination and pollution degree reduce effective creepage/clearance margin.
Quick check: Inspect for residues and moisture sensitivity; run a humidity soak + insulation resistance trend; if available, run a PD screening (or equivalent margin test) at representative stress.
Fix: Improve creepage/clearance with slots/keep-outs, add conformal coating or controlled cleaning process, and add PD-oriented screening for production when required.
Pass criteria: PD ≤ Y pC at X Vrms (project spec) and IR ≥ Y MΩ after humidity soak; field-equivalent fault rate ≤ N events over the qualification window.
