Fault Reporting & Disable: /FLT, /RDY, Safe Fault Paths Across Isolation
Define /FLT, /RDY, and EN/nDIS as a measurable safety contract: local gate-off first, then fail-safe reporting across isolation, then hardware-backed inhibit.
Definition & Scope: What “Fault Reporting & Disable” Really Means
What This Page Owns
This topic covers the external safety interface of a gate driver: how faults are reported (/FLT), how readiness is declared (/RDY or PG), and how switching is prevented (EN / nDIS / SD). The focus is end-to-end reliability, especially when signals must cross an isolation barrier.
Makes the driver’s safety state externally visible (fault present, latched, retrying). It must remain interpretable under noise, wiring faults, and loss of power.
Declares that prerequisite conditions are met (often bias rails above UVLO). It is not automatically equivalent to “safe to enable PWM” unless the semantics explicitly guarantee it.
Forces a defined safe state (no gate drive). A correct design makes disable hardware-backed and fail-safe under single-point failures.
“Safe Fault Path” as a Verifiable Contract
A safe fault path is not a concept; it is a chain of obligations that can be tested and documented:
- Detect: A fault is detected (by internal comparators/logic).
- Act locally: Gate outputs transition to the safe state locally (must not depend on firmware).
- Report: Fault state is exported as /FLT (and optionally /RDY changes) across isolation in a fail-safe manner.
- Inhibit: A hardware-backed system inhibit prevents re-enabling switching until the recovery policy is satisfied.
Each link must be measurable (timing), resettable (defined clear method), and diagnosable (detect stuck-at/open-wire/short-to-rail behaviors).
Signal Classifiers That Change Real-World Behavior
Four orthogonal attributes determine how /FLT, /RDY, and disable behave in the field:
- Latched vs Auto-retry: lockout until clear vs periodic restart attempts (risk of “retry storms”).
- Level vs Pulse: static assertion vs brief notifications (pulses are easier to lose across isolation).
- Static vs Toggling: constant state vs heartbeat/toggle patterns (toggling supports stuck-at diagnostics).
- Polarity & Output type: active-low vs active-high, open-drain vs push-pull (defines whether open-wire becomes safe or dangerous).
Common Naming Map (Do Not Assume Semantics)
Vendors reuse names with different meanings. A design must treat pin labels as hints, then validate the truth table:
- /FLT, FLT, FAULT, nFAULT — fault indication; often active-low; frequently open-drain.
- /RDY, RDY, PG, PGOOD — readiness; may mean “bias OK,” “fault clear,” or “internal checks passed.”
- EN, nEN, nDIS, SD, SHDN — enable/disable; may affect input logic only, output stage, or both.
- RST, CLR, FLT_CLR — clearing latched states; method and timing are device-specific.
Out of Scope (One-Line Boundary)
- DESAT thresholding, blanking, and soft turn-off tuning (owned by the DESAT topic).
- Deadtime generation and cross-conduction interlock truth tables (owned by the deadtime/interlock topic).
- Active Miller clamp mechanisms (owned by the Miller clamp topic).
- Layout/grounding and parasitic suppression (owned by the design hooks topic).
System Safety Goal: What Must Happen When a Fault Occurs
Safety Objectives (Three Layers)
Fault handling is successful only when all three layers are satisfied:
- Power-stage safe state: gate outputs transition to a defined safe condition (typically OFF) without depending on software.
- Controller awareness: the safety domain receives a reliable, interpretable fault state (including wiring faults and loss-of-power scenarios).
- Restart policy: re-enabling switching follows a defined policy (latched clear procedure or controlled retry with cooldown).
Action Levels: Stop Switching vs Force-Off vs Limited Operation
Stops PWM activity at the controller, but may not guarantee the gate is clamped. It is insufficient as the only protection path for high-energy faults.
The driver actively forces the output stage to the safe state. This is the default for dangerous faults, and it must occur locally before external reporting completes.
A controlled degraded mode (derating/limiting) may be valid for non-dangerous warnings, but requires explicit entry/exit conditions and diagnostic coverage.
Shutdown Priority (Hard Rule)
- Local hardware shutdown must act first (driver-level gate-off).
- Isolated fault reporting must remain fail-safe and diagnosable across the barrier.
- Hardware-backed inhibit must prevent re-enabling switching (PWM kill / gate) even if firmware is stalled.
- Digital telemetry and firmware logic are helpful for logging and recovery orchestration, but must not be the only safety barrier.
Timing Budget: Make the Chain Measurable
A correct specification defines timing in segments that can be measured on the bench:
- t_detect: fault occurs → driver recognizes it.
- t_gateoff_local: recognition → gate outputs reach the safe state locally (critical safety segment).
- t_report_iso: /FLT assertion → receiver sees it across isolation.
- t_inhibit_system: receiver sees fault → hardware inhibit prevents re-enable.
For review and validation, timing claims should reference t_gateoff_local explicitly; reporting latency alone can hide unsafe behavior.
Minimum Acceptance Criteria (Field-Proof Baseline)
- Gate outputs reach the defined safe state within X µs of fault detection (independent of firmware).
- /FLT remains interpretable under dv/dt and EMI, with false trips below X events / Y hours.
- Open-wire or missing pull-up on the fault line resolves to a safe outcome (design target: default-to-fault).
- Re-enable behavior is deterministic: either a defined latched clear procedure or a bounded retry + cooldown policy.
Pin & Output Types: Open-Drain, Push-Pull, Current Source, and Their Failure Modes
Why Output Type Is a Safety Decision
/FLT and /RDY are safety I/Os, not generic GPIOs. Output type determines whether common wiring faults become safe-by-default or dangerous-by-default.
Open-drain (OD) vs push-pull (PP) vs current source/sink (special cases).
Where the pull-up lives (safety domain vs isolated domain) sets the default state during brownout and power sequencing.
Open-wire, short-to-GND, short-to-VDD, missing pull-up must map to a defined safe outcome.
If multiple drivers share a fault bus, the wiring must be “wired-OR safe” and non-contentious.
Open-Drain (OD): Wiring Rules That Prevent Nuisance Trips
- Pull-up is mandatory: /FLT is frequently OD and cannot drive high without an external pull-up.
- Pull-up must be in the safety logic domain: this makes “loss of isolated-side power” and “open-wire” easier to map to a safe state.
- Pick pull-up strength by edge integrity: too-weak pull-up creates slow edges and noise sensitivity; too-strong can violate sink capability.
- OD enables wired-OR: multiple /FLT pins can share one bus when each output is OD and the pull-up is shared.
Acceptance baseline: /FLT asserted must pull below Vil(max) under worst-case temperature and leakage; deasserted must rise above Vih(min) within a defined time window (X ms) for the receiver.
Push-Pull (PP): Fast, but Easy to Make Fail-Dangerous
- No wired-OR by default: tying multiple PP outputs together can cause contention and undefined states.
- Default state depends on power and reset: “unpowered” or “resetting” behavior can look like “OK” unless explicitly specified and tested.
- Crossing isolation needs a truth-table check: PP polarity and isolator fail-safe behavior must match the system’s “default-to-fault” goal.
Acceptance baseline: any single wiring fault (open-wire or short-to-rail) must not create an “OK” indication that allows switching.
Current Source/Sink & Open-Collector Special Cases
- Current-mode outputs need an external resistor: the receiver threshold depends on resistor value and compliance voltage.
- Sink capability limits pull-up strength: if the pull-up is too strong, “fault asserted” may not reach a valid LOW level.
- Leakage and temperature matter: current-mode signaling must be validated across temperature and worst-case input leakage.
Acceptance baseline: guaranteed Vlow and Vhigh at the receiver with worst-case current capability, resistor tolerance, and leakage.
Polarity: Why Active-Low Is Common for Safety
- Active-low + OD supports a “default-to-fault” philosophy.
- Open-wire can be designed to look like fault (preferred) rather than “OK.”
- Receiver should treat unknown as unsafe: if the signal becomes floating or invalid, switching must be inhibited.
Failure-Mode Outcomes (Convert Into Test Cases)
Preferred outcome: receiver interprets as fault (or disables enable path) by design choice of polarity, pull-up placement, and input qualification.
Should be interpreted as fault asserted; verify sink-path robustness and do not allow “stuck-low clears on retry” behavior to re-enable PWM.
Must not create a permanent “OK” that defeats safety; require redundant inhibit or line-health diagnostics when this risk exists.
Often appears as floating/noise; receiver must treat invalid as fault and provide a clear diagnostic signature in validation.
Fault Logic Inside the Driver: Latch, Auto-Retry, Blanking, and Deglitch
Behavior Contract: What the Outside World Must Observe
Fault logic determines field behavior. External signals (/FLT, /RDY, enable state) must remain consistent with a verifiable contract:
- Local gate-off first: the output stage enters the safe state before system-level actions complete.
- Stable reporting: /FLT represents a coherent state (fault present, latched, retrying), not random toggling under noise.
- Deterministic recovery: clear method and timing are defined (latched clear) or bounded (retry + cooldown).
Latch: Why It “Locks” and How It Clears
- Latched fault prevents repeated re-energizing of a damaged or unsafe power stage.
- Common clear methods: RST/CLR pin, toggle EN/nDIS with a minimum low time, or power-cycle.
- Clear is not valid unless prerequisites are satisfied (bias above UVLO, temperature below OTP recovery, etc.).
Acceptance baseline: a documented clear sequence returns /FLT and /RDY to expected states within X ms under defined conditions.
Auto-Retry: When “Chattering Restart” Happens
- Retry period and max attempts shape whether recovery is controlled or becomes a retry storm.
- Cooldown and qualification windows are required to prevent re-enable on marginal bias rails or noisy environments.
- In brownout conditions, retry can oscillate between “almost ready” and “fault,” repeatedly stressing the power stage.
Acceptance baseline: bounded attempts (N) per window (Y s) and a deterministic lockout path after limit is reached.
Blanking & Deglitch: False Trip vs Missed Fault
An intentional ignore window around known noisy intervals (switching edges, recovery transitions). Too long can hide real faults; too short increases false trips.
A time-consistency check that rejects short spikes (dv/dt coupling). Larger filtering improves immunity but increases detection latency.
When multiple faults occur, a fixed priority can mask the initiating cause; “first-fault capture” is required for meaningful logs.
Observable Symptoms: Fast Mapping to Root Cause
- /FLT low but gate already OFF: reporting is correct, but the receiver path (pull-up/domain/isolator) may be wrong if the controller never sees it.
- /FLT toggling: retry policy interacting with UVLO hysteresis or deglitch too small under dv/dt events.
- /RDY flicker: marginal bias rail or semantics mismatch (“bias OK” does not mean “safe to enable”).
- Clear does nothing: latch clear method or minimum disable timing not met.
The Disable Path: EN/nDIS/SD—How to Make “Disable” Truly Safe
Disable Is a Hardware Safety Gate (Not a GPIO)
In isolated power systems, the disable path is the final hardware barrier that must stop switching even when firmware, communications, or timing assumptions are no longer trustworthy.
On power-up, brownout, or open-wire, the system must bias toward “disabled” unless an explicit enable condition is satisfied.
Disable must force a defined safe state at the driver output stage, not merely stop input toggling.
Define release conditions, minimum assert time, and interactions with /FLT and /RDY as testable requirements.
Default State: “Disabled Unless Proven Safe”
- Power-up default: prefer “disabled by default” until the safety domain asserts enable.
- Open-wire default: missing/invalid enable wiring must resolve to “disabled.”
- Power sequencing: if the control domain is unpowered while the power stage is energized, disable must still keep the driver OFF.
Acceptance baseline: any loss of the enable command (open-wire, missing pull, unpowered control side) must not result in continued switching.
Input Details That Matter: Thresholds, Pulls, RC, Schmitt
- Input thresholds: define VIL/VIH margins for the actual logic voltage domain.
- Internal pull-up/down: verify the true default state if the pin is left floating during bring-up or harness faults.
- Schmitt behavior: required when RC or long wiring creates slow edges; otherwise, the input can hover in the undefined region.
- RC delay: use only for controlled sequencing or debouncing; it must not be the only safety mechanism.
Acceptance baseline: under slow-edge and noise stress, disable must not accidentally release; invalid/unknown levels must map to “inhibit.”
Three Disable Layers (Do Not Confuse Them)
Stops input toggling, but may not guarantee the output stage is actively driven to a safe state.
Forces gate outputs into a defined safe state. This is the preferred “hard disable” for safety closure.
Removes driver power or isolated bias. Strong safety impact, but it changes /RDY semantics and reset behavior.
Interaction With /FLT and /RDY (Avoid Hidden States)
- Disable asserted: confirm whether /RDY is expected to drop (power-good semantics) and whether /FLT remains meaningful (fault visibility).
- Fault while disabled: the reporting path must not become a “black box” where faults disappear because disable is asserted.
- Clear and re-enable: define the minimum disable time and a qualification window for /RDY stability before allowing switching.
Safe Fault Path Across Isolation: Default-to-Off, Single-Fault Tolerance, and Wired-OR
Core Goal: Any Single Fault Must Not Allow Switching
The isolated fault path must be a closed safety loop: faults are reported across isolation in a fail-safe way, and the safety domain enforces a hardware inhibit that prevents re-enable.
Active-low OD /FLT with pull-up in the safety domain: open-wire or missing pull-up must bias toward fault/inhibit.
Multiple drivers must only share a fault bus if each output is OD/open-collector; push-pull cannot be tied together.
Pull-up open, isolator stuck, lost isolated power, and wiring shorts must not create a false “OK.”
Default-to-Off Design Rules (Practical)
- /FLT: prefer active-low OD and place the pull-up in the safety domain to control behavior during power sequencing and wire faults.
- Disable loop: make enable conditional on a valid “not-fault” state; invalid/unknown states must map to inhibit.
- Receiver qualification: treat floating or invalid levels as fault; Schmitt inputs or qualification windows are recommended for long wiring or slow edges.
Single-Point Failures (SPOF): Convert to Validation Cases
Fault bus becomes floating; the receiver must interpret invalid as fault and keep inhibit asserted.
Preferred outcome: fault/inhibit by default; verify that the isolation receiver cannot output a stable “OK” from a floating input.
High risk: can appear as permanent “OK.” Require independent hardware inhibit logic that does not solely trust a single static level.
System must not re-enable switching; the safety domain should lock out until a valid ready/enable qualification is satisfied.
Isolation Channel Selection (Only What Matters for Fault Paths)
- Fail-safe default output: define output state when input is floating, unpowered, or invalid.
- Glitch immunity: reject short pulses and slow-edge ambiguity on the fault bus.
- dv/dt robustness: the channel must not self-toggle during high dv/dt events.
Acceptance baseline: across power sequencing and dv/dt stress, the isolation receiver must not produce a false “OK” that allows enable.
Timing & Coordination: Fault Prop Delay, Skew, and “Who Turns Off First”
Hard Rule: Local Gate-Off Must Happen First
In half-bridge, 3-phase, and multibridge systems, the first safety layer is local hardware gate-off. Remote shutdown (through isolation and firmware) is a second layer that must never be the primary barrier.
Driver output stage enters a defined safe state (local gate-off).
/FLT becomes valid at the pin and is transported across isolation.
Safety logic disables PWM and locks EN/nDIS until re-qualification.
Define Measurement Points (Avoid Lab Disputes)
- T0: fault is confirmed (after blanking/deglitch).
- T1: gate outputs enter the safe state (HO/LO OFF or clamp state).
- T2: /FLT is valid at the pin (meets receiver threshold).
- T3: PWM is effectively inhibited (input toggling is stopped by hardware/logic).
Acceptance baseline: record t(T0→T1), t(T0→T2), and t(T0→T3) as separate buckets, not a single ambiguous number.
/FLT Propagation Delay Budget (Bucket Model)
Fault confirmed → local output stage safe.
Local safe → /FLT meets pin threshold at receiver.
Isolation propagation (TX conditioning + RX output).
Controller-side capture + qualification + logic/firmware decision.
Inhibit asserted → PWM input stops toggling.
Total budget: t_total = t_local_off + t_pin_valid + t_pd_iso + t_ctrl_in + t_decide + t_pwm_stop (use X/Y placeholders for system-specific limits).
Skew: “All Stop” vs “Staggered Stop”
- Complementary pair first: within a half-bridge, HO/LO must reach a safe state without creating overlap risk.
- Phase skew: 3-phase or multibridge stop behavior must stay within a defined skew window (X) to avoid asymmetric energy stress.
- Recovery discipline: re-enable requires a stability window; fault-cleared alone must not restart switching.
/RDY (Ready/PG) Semantics: When It’s Trustworthy and When It Lies
/RDY Is Evidence, Not a Key
/RDY can mean “bias OK,” “self-test pass,” “no-fault,” or a combination. Treating /RDY as a direct PWM gate can cause false start, restart storms, or unsafe enable during boundary conditions.
UVLO cleared for one or more supply rails.
Fault latch is not active (or fault is cleared).
Bias OK + internal checks + fault cleared (vendor-specific).
Power Sequencing: /RDY and /FLT Must Be Interpreted Together
- RDY=1 does not guarantee “safe to switch” unless the vendor definition includes fault-cleared and output-stage readiness.
- RDY glitches can occur during brownout, isolation noise, or floating inputs.
- Recommended rule: /RDY enters a safety state machine with a stability window, not a direct PWM gate.
Reset, Clear, and Diagnostics: How to Prove Fault Coverage in Review/Production
Goal: Fault Coverage Must Be Provable
Review, acceptance, and production care about provability: faults must be injectable, observable, clearable, and recordable with a consistent definition of time and pass criteria.
Trigger a representative fault in a controlled way.
Output safe state + /FLT asserted + /RDY interpreted correctly.
Clear method must be deterministic and documented.
Record reason, latch state, clear method, and qualification result.
Clear / Reset Methods (Define the Allowed Set)
- EN toggle: disable → clear latch → re-arm (preferred for controlled restart).
- RST pin: explicit reset/clear input when available; define what resets and what remains latched.
- Power cycle: strongest reset, slowest method; acceptable for production but not ideal for field recovery.
- Time-based retry: increases availability, but requires qualification windows to avoid restart storms.
Rule: Only documented clear mechanisms are allowed in system behavior.
Why: Undocumented clears create “false recovered” states and audit disputes.
Verify: Force each clear path and confirm /FLT and output behavior.
Pass: Clear is deterministic; re-enable requires /RDY qualified and /FLT released (X/Y).
Diagnostics Coverage: Convert SPOFs into Tests
Invalid level must map to fault/inhibit; must not be interpreted as “OK”.
/FLT stuck-high or isolator output stuck must not allow enable.
In test mode, force fault assertion and verify the full closure to PWM inhibit.
Rule: Every single-point failure on the fault path must be testable.
Why: Untested SPOFs become “field-only” failures.
Verify: Inject open-wire / stuck-at conditions on /FLT and isolator outputs.
Pass: Any abnormal condition results in WAIT/LOCKOUT, never “OK” (X/Y).
Production Script: Inject → Observe → Clear → Qualify
- Inject UVLO-like: bias dip or equivalent stimulus; observe output safe and /RDY behavior.
- Inject SC/DESAT-like: controlled input stimulus; observe /FLT and local gate-off timing buckets.
- Inject OT-like: temperature stimulus or equivalent test mode; observe latch/clear policy.
Rule: Scripts must validate output safe state and reporting simultaneously.
Why: /FLT without output safe (or vice versa) indicates broken closure.
Verify: Observe HO/LO safe + /FLT asserted within defined windows.
Pass: t(T0→T1), t(T0→T2), t(T0→T3) recorded and within X/Y.
Logging Contract (Minimum Fields)
Record T0 and observed bucket times (T0→T1/T2/T3).
UVLO / OT / SC / comm / unknown (enumerated).
latched=1/0 and the clear method used.
qualified=1/0 for /RDY stability window and re-arm result.
Engineering Checklist: Implementation Rules That Prevent 80% Field Failures
Design Gate (Schematic/PCB Rules)
Rule: Prefer OD /FLT; place pull-up in the safety domain.
Why: Enables wired-OR and makes open-wire bias to fault/inhibit.
Verify: Remove pull-up / open the wire and check receiver behavior.
Pass: Invalid conditions map to WAIT/LOCKOUT, never “OK” (X/Y).
Rule: Disable must cut the output stage (or equivalent safe state), not only PWM input.
Why: Firmware/logic can stall; safety must remain enforceable.
Verify: Freeze firmware and assert disable; confirm gate outputs safe.
Pass: Output enters safe state within X; enable cannot resume without re-qualification.
Rule: Never tie push-pull fault outputs together.
Why: Output contention causes false OK, damage, or unpredictable levels.
Verify: Ensure any shared fault bus is OD-only (wired-OR).
Pass: Multi-driver aggregation remains functional under single-node faults (X/Y).
Bring-up Gate (Prove the Closure)
Rule: Validate output safe and /FLT assertion in the same test case.
Why: A reporting-only pass can hide a broken output-stage shutdown.
Verify: Inject a fault stimulus and measure T0→T1/T2/T3 buckets.
Pass: Output safe, /FLT asserted, PWM inhibited within defined windows (X/Y).
Rule: /RDY must be qualified (stable window) and used as a state-machine input.
Why: RDY glitches cause false start and restart storms.
Verify: Disturb bias/isolator inputs and confirm PWM does not gate directly from RDY.
Pass: Under RDY toggling, system stays in WAIT/LOCKOUT (X/Y).
Production Gate (Minimal Coverage, Maximum Value)
Rule: Include open-wire and stuck-at checks in production screening.
Why: Wiring and isolation failures dominate field return rates.
Verify: Simulate pull-up loss and forced-level faults on /FLT bus.
Pass: Any anomaly drives inhibit/lockout and is logged as a diagnosable event (X/Y).
Rule: Enforce a fixed logging schema for fault reason and clear actions.
Why: Inconsistent logs prevent root-cause closure.
Verify: Repeat the same fault injection and compare logged reason stability.
Pass: Reason and latch state are stable; unknown rate is bounded (X/Y).
Applications & IC Selection for Fault Reporting & Disable
Selection is about safety semantics, not feature count
A “fault reporting & disable” path is only valid when it is default-to-off, survives single-fault conditions, and can be proven in review and production (inject → observe → clear → re-arm).
- Pick an application bucket (below) using only the fault-path view.
- Lock the safety goal (latched vs retry, local gate-off priority, allowed restart policy).
- Filter by FLT / READY semantics (output type, default state, clear method).
- Filter by disable safety (default state, thresholds, noise immunity, hard-off behavior).
- Validate the isolation behavior (no-power/default output state must be safe for the system).
Map the system safety goal to FLT / READY / DISABLE requirements
Traction inverter / industrial drive
Safety goal: deterministic stop; no uncontrolled auto-restart.
Must-have: latched fault or system lockout; clear requires explicit re-arm.
Disable strategy: redundant disable concept (local gate-off + controller inhibit).
Verification focus: inject faults; confirm gate-off first; then system-level inhibit.
SiC / GaN fast switching (high dv/dt)
Safety goal: no false faults; no retry oscillation under dv/dt noise.
Must-have: deglitch/blanking clarity; FLT behavior stable at worst dv/dt.
Disable strategy: noise-robust input semantics (thresholds + filtering strategy).
Verification focus: fault/RDY must not glitch into “enable PWM” decisions.
Multiphase VR (many drivers)
Safety goal: any phase fault must pull the whole system to a safe mode.
Must-have: wired-OR friendly fault output (open-drain preferred).
Disable strategy: fast global inhibit; optional controlled derating policy.
Verification focus: line open / stuck-at must default conservative (fault/lockout).
Integrated isolated bias (READY dependence)
Safety goal: never start PWM on “bias-only OK”; qualify real readiness.
Must-have: READY meaning must be explicit (bias OK vs qualified-ready).
Disable strategy: re-enable only after READY stable + fault cleared + re-armed.
Verification focus: power-up/down corners; READY/FLT truth-table must be handled.
Must-have vs nice-to-have (fault/disable view only)
Must-have (fail if missing)
- FLT output type + default state: open-drain preferred; line open/no-power behavior must be predictable and safe.
- Fault persistence policy: latched vs retry must be controllable and reviewable (clear method is explicit).
- Disable safety: default state is safe; thresholds/noise behavior are known; “disable” actually forces a safe output state.
- Isolation behavior for fault path: default output state during input power loss must not falsely enable the system.
Nice-to-have (reduces field risk)
- READY pin with clear semantics: “qualified-ready” beats “bias-only OK”.
- Deglitch / blanking details: documented timing windows reduce dv/dt-induced false faults.
- Fault reason visibility: coded reasons or clear pin-level observables improve diagnostics and production test.
- Consistent propagation and skew: helps multi-bridge coordination when system-level inhibit is involved.
Concrete parts to anchor the selection checklist
The part numbers below are examples to tie requirements to datasheet terms. Always confirm the latest datasheet options, suffixes, and safety certifications for the target standard.
Isolated gate drivers with FAULT / READY semantics
- TI UCC21750 — reinforced isolated driver; open-drain FLT fault reporting.
- TI UCC21710 / UCC21710-Q1 — reinforced isolated driver; open-drain FLT fault reporting.
- ADI ADuM4135 — isolated IGBT driver; open-drain FAULT and a READY indication (datasheet-defined).
- Skyworks (Silicon Labs) Si8281/Si8282/Si8283/Si8284 — isolated drivers; push-pull RDY and open-drain FLTb.
- Infineon 1EDC20H12AH — isolated driver family references include a multifunction RFE concept (fault / clear / enable on one pin, per selection guides).
Digital isolators for the fault line (default output matters)
- TI ISO7721 / ISO7721F — reinforced digital isolator; suffix selects the default output state on input power/signal loss.
- TI ISO7741 / ISO7741F — channel default output behavior is selectable by suffix family (verify safe state for the system).
- ADI ADuM110N0 / ADuM110N1 — digital isolator with two fail-safe options for default output state.
- Skyworks Si86xx family (example: Si861x/Si862x) — digital isolators with ordering options for default output state during power loss.
Aggregation / qualification helpers (optional)
- TI SN74HCS21-Q1 — logic device often used in practice to combine multiple open-drain fault signals with a defined pull-up and RC filtering strategy.
- Pull-up resistor network (example strategy: 4.7 kΩ–10 kΩ to the safe domain) — keep the “default-to-off” behavior anchored on the controller/safe side.
Request a Quote
FAQs: Fault Reporting & Disable (Field Debug & Acceptance)
01
/FLT never asserts, but the driver definitely shut off—why?
Likely cause: /FLT is open-drain with missing/too-weak pull-up, or pulled to the wrong domain/ground reference.
Quick check: Measure /FLT idle voltage, pull-up resistance, and receiver reference ground/domain.
Fix: Add a correct pull-up to the safety logic rail; keep OD wiring and a clean return.
Pass criteria: /FLT reaches valid LOW/HIGH within X µs under injected fault, across N trials.
02
/FLT chatters during high dv/dt switching, causing nuisance shutdowns.
Likely cause: CMTI-induced glitch, insufficient qualification at receiver, or noisy routing/return.
Quick check: Correlate chatter with switching edges; probe the fault line with short ground spring.
Fix: Add RC + Schmitt/qualified input; route /FLT as a quiet net; use fail-safe isolator channel.
Pass criteria: False trips < X events/hour at dv/dt = Y kV/µs and load = N.
03
MCU sees /FLT, but the power stage keeps switching for a while—dangerous delay.
Likely cause: PWM is disabled by firmware only; no hardware-level inhibit/kill closure exists.
Quick check: Time-stamp fault-to-gate-off latency; confirm local driver outputs go safe immediately.
Fix: Implement hardware PWM kill using /FLT wired-OR into enable/kill; firmware becomes secondary.
Pass criteria: Gate outputs go safe within X µs of fault, independent of firmware (repeat N times).
04
RDY is HIGH, but enabling PWM causes an immediate fault.
Likely cause: /RDY indicates bias UVLO cleared, not “fault cleared” or “channels enabled/qualified.”
Quick check: Read /FLT state and latch status; confirm EN/nDIS state during RDY=HIGH.
Fix: Use RDY as a state-machine input; require “RDY=1 AND FLT=deasserted AND EN valid.”
Pass criteria: Enable succeeds with 0 unexpected faults over N power cycles and Y corners.
05
After a fault, toggling EN doesn’t clear it.
Likely cause: Fault is latched and needs RST/power-cycle, or EN low time is shorter than clear window.
Quick check: Verify datasheet-defined clear method; measure EN low time vs required reset window.
Fix: Implement correct clear procedure (RST/power-cycle if required) and meet minimum disable time.
Pass criteria: Fault clears within X attempts using defined procedure across N repeats.
06
Multiple drivers share a fault line and it stays stuck LOW forever.
Likely cause: One contributor is holding low, or a push-pull output is fighting a wired-OR bus.
Quick check: Isolate contributors one-by-one; confirm OD vs PP on every device.
Fix: Ensure all contributors are open-drain; keep one common pull-up in safe domain; avoid PP tie.
Pass criteria: Fault bus returns HIGH within X ms after all faults cleared, across N trials.
07
Line break on /FLT doesn’t trigger a shutdown—unsafe.
Likely cause: Active-high scheme or pull-up on wrong side makes open-wire look “OK.”
Quick check: Simulate open-wire; observe receiver logic level and system action.
Fix: Use active-low OD + pull-up in safety domain so open-wire → fault/lockout.
Pass criteria: Open-wire forces shutdown/lockout within X ms and logs a diagnosable event (N).
08
/FLT crosses isolation but looks inverted or wrong polarity.
Likely cause: Channel inversion or inconsistent “asserted level” assumptions between domains.
Quick check: Inject a fault and verify end-to-end truth table (pin → isolator → receiver → inhibit).
Fix: Standardize “fault asserted = LOW” system-wide; fix inversion in hardware/logic and document.
Pass criteria: Polarity matches documentation across all channels with 0 mismatches over N checks.
09
RDY toggles during brownout and causes repeated restarts.
Likely cause: UVLO hysteresis too small, RDY not qualified/debounced, or retry policy oscillates.
Quick check: Capture bias rail and RDY waveform; measure hysteresis and transition timing.
Fix: Add debounce/time qualification and cooldown; require RDY stable for Y ms before enable.
Pass criteria: ≤ X restarts during a Y s brownout profile over N repeats.
10
/DIS pin is noisy and occasionally disables the driver.
Likely cause: Long routing with poor return reference, missing hysteresis/qualification, or weak pull.
Quick check: Scope /DIS during switching; temporarily force strong pull and compare event rate.
Fix: Add RC + Schmitt/qualified input; route with solid return; tighten pull resistor.
Pass criteria: Spurious disable < X/day under EMI level Y across N runs.
11
Driver asserts /FLT, but the controller never sees it (or sees random levels).
Likely cause: Isolator default output state is unsafe, receiver input floats, or pull-up is in wrong domain.
Quick check: Check isolator “no-power/input-loss” default; measure receiver bias with isolator unpowered.
Fix: Use a fail-safe isolator option that defaults to safe state; add defined pull-up/pull-down at receiver.
Pass criteria: With isolator unpowered or input missing, receiver enters WAIT/LOCKOUT within X ms (N).
12
Fault clears, but RDY never comes back.
Likely cause: Bias rail still below UVLO, EN/nDIS not re-armed, or device is in post-fault lockout mode.
Quick check: Measure bias vs UVLO thresholds; verify EN/nDIS/RST timing and READY qualification window.
Fix: Restore bias headroom; follow clear/re-arm sequence; require RDY stable before enable decision.
Pass criteria: RDY returns within X ms after recovery + procedure across N cycles and Y corners.
