Intent: Define DESAT in one minute: it detects an abnormal rise of VCE/VDS during conduction (loss of saturation / hard fault), then initiates a controlled turn-off and fault reporting.

Core idea: detection is only meaningful when the switch is expected to be fully on. Therefore, blanking/filtering is treated as part of the detection chain—not an optional add-on.

This page covers / does NOT cover

• Covers: DESAT chain blocks (sense network → compare/logic → turn-off behavior → report/disable path).
• Covers: programmable knobs (threshold, blanking, filter, soft turn-off current/shape, latch/auto-retry policy).
• Covers: driver/isolator/controller interfaces (fault propagation, safe disable, recovery handshake).
• Does NOT cover: device physics lectures (carrier dynamics / deep VCE(sat) theory). Only engineering decision variables are used.
• Does NOT cover: full layout handbook. Only minimum placement/return-path constraints are stated; detailed routing belongs to the Layout/Gate Loop page.

Must-answer questions (engineering view)

Q1 — What faults does DESAT target, and why is it broadly used?
DESAT targets faults where the switch cannot maintain low VCE/VDS while commanded on (hard short, severe over-current, or loss-of-saturation conditions). It is widely used because it monitors a device-centric symptom (abnormal on-state voltage) that remains meaningful across many power stages, while avoiding dependency on a single current-sense element’s bandwidth/placement.

Q2 — When is monitoring allowed, and when must it be blocked?
Monitoring is allowed after the turn-on transient where VCE/VDS is expected to settle to a low value. Monitoring must be blocked during the turn-on interval where normal VCE/VDS overshoot exists and dv/dt injection is strongest; this is the purpose of blanking and complementary filtering.

Protection chain overview (Detect → Decide → Turn-off → Report)

Intent: classify short-circuit behaviors by time scale and waveform shape to explain why blanking is mandatory and why false trips occur without a controlled decision window.

Key outcome: blanking separates “normal turn-on overshoot” from “fault-driven sustained high VCE/VDS,” so the protection chain can be both fast and noise-robust.

Event taxonomy (engineering view, no terminology debate)

• Turn-on into fault: the switch is commanded on while the load path is already shorted (worst case for energy rise).
• Short during conduction: the switch is already on; VCE/VDS rises abnormally as the device loses saturation margin.
• Half-short / false turn-on: dv/dt and Miller coupling create unintended current while the system “believes” it is off.

Out-of-scope reminder: detailed SOA derivations are not expanded here. The page uses decision variables: response window, overshoot peak, and repeatability.

Must-answer questions (risk framing)

Q1 — Why is peak current not the only danger?
The dominant risk is energy accumulation within the protection response window plus overvoltage during turn-off. Two designs with similar peak current can have very different outcomes if t_detect + t_turnoff differs or if the turn-off di/dt is uncontrolled.

Q2 — Why does VCE/VDS rise at turn-on even in normal operation?
During turn-on, current rises before the device reaches its lowest on-state voltage region; VCE/VDS can show a normal overshoot and settling behavior. A DESAT comparator would interpret this as a fault unless the decision is blocked by blanking and shaped by filtering.

Blanking design intent (decision window logic)

• Purpose: ignore the interval where normal turn-on VCE/VDS behavior is expected.
• Too short: false trips at turn-on, especially under high dv/dt and temperature-dependent leakage.
• Too long: missed or delayed detection; energy grows before soft turn-off begins.
• Engineering rule: blanking is defined by a waveform region, not by a preference—its boundary must be validated by fault injection and repeatability checks.

Intent: clarify what the DESAT circuit truly “sees.” VCE/VDS is mapped through a high-voltage diode and a shaping network into a comparator input, forming a practical de-saturation decision.

A DESAT pin does not observe raw VCE/VDS. It observes a low-voltage node waveform that includes diode behavior, RC dynamics, bias/leakage, and reset conditions—these determine both false trips and missed trips.

Mechanism decomposition: Sense → Level shift → Compare

Must-answer questions

Q1 — What waveform does the DESAT pin see?
The DESAT node typically cycles through three phases: reset/blanking (decision blocked, node forced to a known state), monitoring (node stays low under normal conduction), and fault escalation (node rises beyond the effective threshold when VCE/VDS remains abnormally high).

Q2 — Why is an HV diode and a discharge/reset path required?
The HV diode isolates the comparator node from high-voltage energy and defines a one-way mapping from VCE/VDS into the sense node. A discharge/reset path prevents residual node charge from corrupting the next switching cycle, preserving repeatability across temperature and tolerance.

Pass criteria template (placeholders)

• Repeatability: DESAT node starts each cycle from a known state within X µs.
• Normal immunity: no false trip across dv/dt stress up to Y kV/µs (system-defined).
• Fault detectability: a sustained abnormal VCE/VDS condition forces a trip within N µs after monitoring is enabled.

Intent: make the external DESAT network engineering-ready: how the effective trip level is formed, how temperature/tolerance shift it, and how reset guarantees a clean start for the next switching cycle.

The network must satisfy two constraints simultaneously: fast detectability (fault crosses threshold within the target window) and false-trip immunity (dv/dt and leakage do not trigger trips during normal operation).

Effective threshold = stacked contributors (engineering budget)

The trip decision is driven by an effective threshold at the DESAT node, influenced by: diode Vf(T), comparator threshold, bias currents through resistance, leakage at high temperature, junction capacitance injection, and RC dynamics.

HV diode selection: key parameters and failure risks

• Reverse voltage: must exceed the worst-case node swing with margin (system-defined).
• Leakage vs temperature: leakage can lift the node and cause false trips at high temperature.
• Junction capacitance (Cj): a dv/dt injection path that can spike the DESAT node during switching.
• Recovery behavior: impacts transient behavior under fast switching; verify under real dv/dt conditions.

R/C trade-off: noise filtering vs response speed

• Larger R/C: better attenuation of spikes, but slower fault escalation → higher missed-trip risk.
• Smaller R/C: faster detectability, but higher sensitivity to dv/dt injection → higher false-trip risk.
• Engineering rule: pick R/C inside a feasibility window defined by response budget (X µs) and immunity stress (Y kV/µs).

Parameter → Impact → Risk → How to decide (placeholders)

Initial sizing flow (stepwise, repeatable)

1. Define response budget: total allowed detect + turn-off window = X µs (system requirement).
2. Define monitoring start: decision begins after blanking ends (from turn-on waveform characterization).
3. Build a threshold budget: include Vf(T), comparator Vth, bias/leakage, and RC dynamic error (placeholders).
4. Select HV diode: prioritize reverse voltage margin, low leakage(T), and manageable Cj for dv/dt conditions.
5. Select R/C: satisfy the response budget first, then tune to avoid false trips under dv/dt stress.
6. Implement reset/bleed: ensure the DESAT node returns to a known start state before the next cycle.
7. Validate by injection: confirm both no-false-trip under normal switching and reliable trip under sustained fault.

Notes: numeric values remain system- and device-dependent; placeholders (X/Y/N) are intended for project-specific limits.

Intent: set blanking and filtering so the DESAT decision remains stable under dv/dt injection, switching noise, and Miller coupling—without hiding real short-circuit events.

Blanking and filtering are part of the decision chain. The goal is to reject short-lived injected spikes while preserving sensitivity to sustained abnormal VCE/VDS.

Must-answer questions

What happens if blanking is too short or too long?
Too short: turn-on transient + dv/dt spikes can exceed the effective threshold → false trips and nuisance shutdowns.
Too long: real faults remain masked inside the blanking window → detection is delayed while short-circuit energy accumulates.

What does filtering remove, and how to avoid filtering real faults?
Filtering primarily targets very short spikes and high-frequency ringing. Real de-saturation faults are typically sustained (remain high long enough to exceed the filter’s time constant). Filtering must keep the total response budget within X µs after monitoring is enabled (system-defined).

Where does dv/dt injection enter the DESAT node?
Typical paths include parasitic capacitance coupling from the switch node, diode junction capacitance, ground bounce/common impedance, isolation barrier capacitance, and supply/reference disturbance.

Symptoms → priority suspects → fastest checks

Setting flow (blanking → filter → injection validation)

1. Set blanking first: exclude the normal turn-on region where VCE/VDS and dv/dt artifacts are expected.
2. Set filtering next: attenuate narrow spikes and ringing without pushing total response beyond X µs.
3. Stress injection: validate under worst-case dv/dt (Y kV/µs), temperature, and operating corners.
4. Re-validate real faults: confirm sustained faults still trip within N µs after monitoring is enabled.

Placeholders: X/Y/N depend on device short-circuit limits, system dv/dt, and protection policy.

Intent: explain soft turn-off as a controlled response to a detected fault: limit di/dt to manage VCE/VDS overshoot, while keeping short-circuit energy inside the system budget.

The goal is not “slower by default.” The goal is a shaped discharge that prevents destructive overvoltage and ringing, coordinated with clamp elements and Miller control.

Must-answer questions

Why soft turn-off?
A hard turn-off can create excessive overshoot through loop inductance and resonance. Soft turn-off uses a controlled discharge path to limit di/dt and reduce peak overvoltage.

What if soft turn-off is too soft?
If gate discharge is overly gentle, the device remains in a high-stress region longer: short-circuit energy increases, temperature rises faster, and secondary failure risks increase. The soft stage must complete within X µs and keep overshoot below Y V (placeholders).

Boundary and coordination (interface-only):
Two-level turn-off and active Miller clamp are treated as cooperative blocks: fast exit from danger + gentle overshoot control + suppression of Miller-induced re-turn-on. Detailed implementation parameters remain outside this chapter.

Coordination map (what connects to what)

Intent: define what happens after a valid DESAT event: latch vs auto-retry, retry spacing and cooldown, and deterministic handshakes using /FLT, /EN, and /RDY.

The priority is a safe gate state during the entire fault interval, including across isolation: loss of control or missing signals must default to Gate OFF.

Must-answer questions

When must the fault be latched, and when is auto-retry allowed?
Latch: energy/safety cannot be bounded or the fault is likely persistent. Auto-retry: only when the system tolerates interruption and the retry policy prevents repeated energy injection.

How to prevent retry storms?
Use backoff (retry spacing), a retry budget (count limit), and a cooldown window gated by voltage/temperature/UVLO-clear conditions.

How to guarantee a safe gate state across isolation?
A hardware disable path must override software and must remain effective during signal loss. Gate output must remain in a defined OFF state until recovery criteria are met.

Handshake signals (definition and minimum behavior)

Auto-retry policy template (placeholders)

• Retry count limit: N attempts → then latch.
• Backoff schedule: Δt = X → Y → Z (stepwise or exponential).
• Cooldown gate: (Vbus > A) AND (Temp < B) AND (UVLO clear).
• Exit-to-latch: persistent fault time > T or retry budget exceeded.

Verification targets: no retry storm under persistent fault; recovery time bounded after fault clears; gate remains OFF during fault interval.

Intent: explain why high-side and isolated implementations are more prone to false trips: larger common-mode steps, reference drift, isolation parasitics, and bias-supply noise coupling into the DESAT decision.

This chapter focuses on principles and verification criteria. Detailed layout rules and isolated power topologies are intentionally out of scope.

Must-answer questions

Why does high-side trip more easily?
High-side domains experience larger switching common-mode movement; parasitic capacitances inject this movement into the DESAT node, shifting the effective threshold and creating edge-correlated false triggers.

Which reference should the DESAT return follow?
The DESAT comparator measures a node relative to its local reference. The return must follow the local (Kelvin) reference of the measured domain; mixing HS/LS references is a common failure mode.

How to manage coupling from isolated bias supplies?
Bias ripple and transients can disturb the comparator reference and DESAT baseline. Validation requires worst-case dv/dt, temperature, and bias-load corners with explicit false-trip metrics.

Common mistakes → fastest checks (field-oriented)

Validation criteria (placeholders)

• dv/dt immunity: no false trip up to Y kV/µs at worst-case temperature.
• Baseline stability: DESAT baseline drift ≤ X (node units) during bias load steps.
• Fail-safe across isolation: signal loss forces Gate OFF within N µs.

Intent: standardize validation as a repeatable engineering process: classify fault-injection coverage, capture the minimum waveforms, and freeze measurement definitions and pass criteria using X/Y/N placeholders.

This section describes test criteria and measurement definitions. It intentionally avoids hazardous procedural details.

Fault injection methods (criteria only)

Waveforms to capture (minimum set)

Trigger discipline: use a consistent time reference such as /FLT assert or monitor enable end. Avoid mixed triggers across runs.

Measurement definitions (freeze start/stop) + pass criteria placeholders

All measurement start/stop definitions must be documented alongside captured waveforms to prevent cross-lab interpretation drift.

Debug playbook (symptom → first checks → minimal verification)

Intent: convert DESAT design and validation into checkable gates. Each gate requires evidence artifacts (definitions, logs, waveforms, and limit templates) to prevent ambiguous sign-off.

Design gate (Gate 1)

Bring-up gate (Gate 2)

Production gate (Gate 3)