Overcurrent Protection — Multi-Tier OCP Architecture for Automotive SiC Inverters

Overcurrent protection addresses two distinct failure modes that share the same symptom (excessive phase current) but differ by three orders of magnitude in timescale. To keep device-level and system-level numbers consistent, this page fixes one reference plant: a 100 kW / 400 V SiC inverter, 20 kHz, phase peak current Ipk = 250 A, whose each switch position is realised as a SiC module equivalent to N ≈ 10 paralleled SCT3080AL dies (ID = 30 A at 25 °C, 21 A at 100 °C each). Per-die current is therefore the phase current divided by N.

Short-circuit failure (μs scale) occurs when a load fault or shoot-through places the full bus voltage across a conducting transistor. Each die saturates at its transconductance-limited peak. Aligned with topic-gate-driver-protection-chain, the per-die saturation current is ISCpk ≈ 150 A (≈ 5× the 30 A rating), and the short-circuit energy deposited into one die over its withstand window is:

with a representative SiC SCSOA (SCWT) of 3 μs at 400 V (SCT3080AL gives no SC spec; the 2–4 μs SiC range and 180 mJ figure are the SSOT values from the gate-driver chain page and topic-sic-mosfet-short-circuit-withstand-deep). DESAT handles this tier: gate off within ≈ 1.22 μs, 59 % margin against the 3 μs window (see §2).

Sustained overcurrent failure (ms scale) occurs when the leg draws 1.3–2.5× rated current continuously — a stalled motor, a partial winding fault, or a control runaway. Here the SiC MOSFET stays in ohmic saturation (Vds does not reach the DESAT threshold at these moderate currents, see §9 G1), so DESAT is silent. Failure is thermal. Take one die at a 2× overload, Idie = 60 A, with the datasheet-typical hot on-resistance:

The junction rise follows the transient thermal impedance Zth(t). SCT3080AL publishes a 3-stage Foster network (Rth1/Rth2/Rth3 = 0.117/0.729/0.013 K/W, Cth1/Cth2/Cth3 = 6.82e-4/5.28e-3/6.78e-1 Ws/K), from which:

giving Zth(100 μs) ≈ 0.10 K/W, Zth(1 ms) ≈ 0.28 K/W, Zth(3 ms) ≈ 0.52 K/W, Zth(10 ms) ≈ 0.80 K/W (steady-state RthJC = 0.86 K/W). Then ΔTj = Poc·Zth: at 1 ms ΔTj ≈ 118 °C, at 3 ms ≈ 213 °C, at 10 ms ≈ 332 °C. From a baseline Tj ≈ 100 °C the die crosses its 175 °C limit when ΔTj = 75 °C, i.e. Zth = 75/414 = 0.18 K/W. Inverting the same 3-stage Foster network (τ = 79.8 μs / 3.85 ms / 8.81 ms) for Zth(t) = 0.18 K/W by bisection gives t ≈ 0.36 ms for this 2× overload (a linear-in-log interpolation between the 100 μs and 1 ms tabulated points overshoots, because Zth rises fast early). An OCP trip well below that gives large margin.

Diagnostic separation: if Iphase > SCSOA boundary (≈ 5× rated per die) → SC (DESAT fires on Vds). If Iphase > OCP threshold (≈ 1.2–2.5× rated) but DESAT is silent → sustained OC (OCP tier 2 or 3 fires). The two failure times (SC ≈ 3 μs vs OC ≈ 0.36–10 ms) span three decades — exactly why SC must be caught in hardware and sustained OC can be handled by a slower software loop.

An automotive-grade inverter requires three protection tiers to span the full current–time failure envelope. Each tier is autonomous (hardware or firmware), not dependent on a higher-level task.

The thresholds are deliberately staggered so that the most sensitive tier trips first for graceful handling and the fastest tier is reserved for the most severe fault: T3 (300 A, software) fires earliest to initiate derating; T2 (400 A, hardware) is a fast hard-trip; T1 (DESAT, on Vds) is the last-resort microsecond catch for true short circuits. Tier 1 was fully derived in topic-gate-driver-protection-chain (worked example 816 + 210 + 209 = 1235 ns; the topic-hv-inverter-iso26262-concept §4.3 decomposition 816 + 100 + 304 = 1220 ns is the same chain with a different sub-split — both land at ≈ 1.22 μs and 59 % margin). This page derives Tier 2 and Tier 3.

Threshold selection is a two-sided constraint: the lower bound is the false-trip floor (must survive regenerative transients), and the upper bound is the thermal-protection ceiling.

False-trip floor: during hard switching at 20 kHz, the current-sensor output rings on each SiC edge; switching-transient spikes can reach 1.5–2× the steady-state peak for 200–500 ns. The HW OCP threshold must sit above these spikes, or an RC filter must attenuate them below the comparator reference (see §4).

Thermal-protection ceiling: from §1, a 2× per-die overload reaches Tj,max in ≈ 0.36 ms; at the milder threshold multiples used here the die time-to-limit is a few ms. Setting Itriphw = 400 A (60 % above Ipk = 250 A) makes Tier 2 fire well before the leg approaches the thermal knee. Setting Itripsw = 300 A (20 % above Ipk) gives an early warning that can initiate controlled derating rather than an immediate trip.

Margin stack:

A 60 % HW margin absorbs ±15 % current-sensor tolerance, ±20 % Rdson batch spread, and regenerative transients up to 1.3× Ipk.

The Tier 2 path converts a phase-current measurement into a sub-microsecond FAULT signal without software involvement.

Current sensor: INA240A1 (G = 20 V/V, Rsh = 0.5 mΩ, bidirectional, 400 kHz bandwidth). Output voltage swing at phase current I:

At I = 400 A (OCP threshold): ΔVsens = 400 × 0.0005 × 20 = 4.0 V above the INA240A1 output midpoint.

Comparator: TLV3501A-Q1 (automotive high-speed comparator, tpd = 4.5 ns typ, Vs = 2.7–5.5 V, 6 mV internal hysteresis, AEC-Q100, TI markets it explicitly for HEV/EV inverter use). A precision resistor divider from a 5 V reference sets Vref = 4.0 V; the comparator asserts on Vsens > Vref.

RC input filter (false-trip rejection): SiC switching spikes at the INA240A1 output last 200–500 ns. A first-order RC low-pass with time constant

attenuates a 500 ns spike only partially: because τ_f < the 500 ns pulse width, the output peak still charges to A = 1 − e^(−500/300) ≈ 81 % of the input (i.e. only ~19 % attenuation). Shorter (< 200 ns) edges are suppressed far more strongly — a 200 ns spike charges to 1 − e^(−200/300) ≈ 49 %. So this single pole rejects the common short switching edges but only weakly trims a full-width 500 ns transient, at the cost of 300 ns added detection latency.

Comparator hysteresis: the TLV3501A-Q1 6 mV internal hysteresis maps to ≈ 0.6 A in phase-current units (6 mV / (0.5 mΩ × 20)), preventing chatter at the threshold.

Output FAULT signal: the comparator push-pull output drives (through the OR combiner in §7) the TC397 CTRAP input.

The TC397 AURIX provides a hardware emergency-stop path via the CCU6 (Capture/Compare Unit 6) trap mechanism. When the external CTRAP pin is asserted, the CCU6 Output Modulation blocks force all six PWM outputs to their passive (safe) state without CPU intervention.

CTRAP latency: the passive-state drive happens within about one CCU6 module clock (fCCU6 ≈ 100 MHz → tCTRAP ≈ 10 ns), a fully asynchronous hardware path. The exact routing and pin mapping (CTRAP vs the GTM Emergency-Stop feature, and which EXTIN maps to the trap on a given TC397 variant) must be confirmed against the AURIX TC39x reference manual CCU6 chapter for the chosen device — but the order-of-magnitude (ns-class hardware trap) is not on the critical path, which the RC filter dominates.

Gate-drive fall time: after the disable, 1EDI3035AS turns off each SCT3080AL die via Rgoff = 4.7 Ω in series with the internal RG = 13 Ω. Using the Miller-charge estimate with the datasheet-verified Qgd = 25 nC and a 20 V gate swing:

Total Tier 2 latency:

This 337 ns is well below 1 μs and far below the 3 μs SCSOA — so Tier 2 can also serve as a backup SC-detection path (e.g. for an SC that arrives while DESAT is inside its blanking window), subject to the sensor-bandwidth limit noted in §9 G7.

Tier 3 runs in the TC397 current-control ISR, once per PWM period at 20 kHz (50 μs update). The INA240A1 → TC397 ADC measurement is already used for FOC; OCP is a threshold check added at the top of that ISR.

The threshold check compares each phase current against Itripsw and, on any breach, drives the control FSM to a FAULT state, disables PWM via the hardware PWM-stop, and latches a fault flag for the external watchdog:

if (Ia > Itripsw || Ib > Itripsw || Ic > Itripsw):
    FSM -> FAULT state
    disable PWM (hardware PWM-stop, ~5 us for FSM + PWMSP)
    set FAULT flag for TLF35584 watchdog

Total Tier 3 latency: 50 μs (ADC sample interval) + 5 μs (ISR + FSM overhead) + 1 μs (gate drive) ≈ 56 μs.

Functional-safety integration: Tier 3 is a safety mechanism with a diagnostic-coverage contribution per ISO 26262-5 §8.4. Its standalone DC is moderate (software ADC path), but combined with the Tier 1 and Tier 2 hardware paths the OCP function reaches a high aggregate SPFM (see §7 Step 5). The TC397 Lockstep CPU pair covers single-point faults in the ADC-ISR path.

This worked design uses the consistent reference plant of §1: TC397 + 1EDI3035AS + a SiC module (≈ 10 paralleled SCT3080AL dies), 100 kW / 400 V, 20 kHz switching, phase peak Ipk = 250 A.

Step 1 — Define OCP tiers and timing budget

The motor-torque safety goal (SG-01, ASIL D) has FTTI = 200 ms. A 56 μs SW OCP trip gives > 3500× margin — Tier 3 is not on the FTTI critical path; it exists for early derating, not for meeting FTTI.

Step 2 — INA240A1 output at OCP thresholds

Both sit inside the INA240A1 linear output range (0.1 V to Vs − 0.1 V, i.e. 0.1–4.9 V at Vs = 5 V).

Step 3 — Comparator reference and RC filter

Reference divider for T2: Vref = 4.0 V from a precision voltage reference (±0.1 %). RC filter: Rf = 60 Ω, Cf = 5 nF, τ_f = 300 ns. Check: because τ_f = 300 ns is shorter than the 500 ns spike, the filter output peak charges to 500 × (1 − e^(−500/300)) = 500 × 0.81 ≈ 406 A — still just above the 400 A threshold, so a worst-case full-width 2× (500 A / 500 ns) spike is not rejected by this single pole. The common shorter edges are safe (a 200 ns / 500 A spike → 500 × 0.49 ≈ 243 A, well below 400 A); to also cover the full-width worst case, either raise τ_f (a longer time constant, trading detection latency) or add a second RC pole. This is why the threshold is set with margin above the 250 A phase peak rather than relying on the filter alone. For T3 the TC397 ADC averages 4 samples at 1 MHz (4 μs effective averaging), rejecting switching noise by > 40 dB, so no separate RC filter is needed on the software path.

Step 4 — TC397 CTRAP wiring

Each phase comparator (push-pull output) feeds a 3-input OR combiner (e.g. 74LVC1G32-class logic, one gate per any-phase-trips path); the OR output drives the TC397 CCU6 CTRAP pin so that any single phase overcurrent shuts all six switches. CCU6 is configured to force all PWM outputs to the passive state within one module clock on the CTRAP edge. Confirm the CTRAP-to-EXTIN pin mapping for the specific TC397 variant against the TC39x RM CCU6 chapter.

Step 5 — Functional-safety integration

OCP is entered in the safety concept as SM-OCP-001, decomposed into three sub-mechanisms:

• T1 DESAT: SM-DESAT-001 (hardware, high DC per 1EDI3035AS safety manual [established])
• T2 HW OCP: SM-OCP-HW-001 (hardware; illustrative DC ≈ 95 %, pending FMEDA)
• T3 SW OCP: SM-OCP-SW-001 (software on Lockstep CPU; illustrative DC ≈ 90 %, pending FMEDA)

Treating the three paths as independent detectors of the same overcurrent hazard, the residual undetected fraction is the product of the individual misses:

which clears the ASIL D requirement of SPFM ≥ 99 % (and, with the DESAT/STO path, supports PMHF < 10 FIT for the overcurrent contribution). This series-independence formula is optimistic: it ignores common-cause failures (shared sensor, shared supply, shared reference), so the signed-off number must come from a full FMEDA with a β-factor for common cause — the DC values above are placeholders for that analysis, not the final claim.

Three corner conditions can shift OCP behaviour beyond the nominal assumptions.

C1 — Low temperature (−40 °C): sensitivity and false-trip risk. SCT3080AL has a positive Rdson temperature coefficient above room temperature (80 mΩ at 25 °C rising to 115 mΩ at 150 °C, datasheet typ); at −40 °C Rdson is modestly lower than the 25 °C value, so the same overcurrent produces a lower Vds and DESAT is less sensitive. Meanwhile the INA240A1 offset widens at cold; a ±3 mV offset shifts the effective threshold by:

which is negligible (0.3 A on a 400 A threshold). A cold-start magnetisation inrush up to 1.3× Ipk = 325 A stays below the T2 threshold but can nick the 300 A T3 threshold. Mitigation: inhibit T3 OCP for the first ~100 ms after gate enable (power-up sequencing).

C2 — End-of-life: threshold drift from shunt aging. A precision shunt (e.g. Isabellenhütte ISA-PLAN class, 0.5 mΩ) drifts on the order of ±0.5 % per 1000 h at rated current. Over a 15-year life (~5000 h of active power) the drift stays within a few percent, shifting Itriphw by roughly ±10 A. The 60 % margin above Ipk absorbs this without recalibration.

C3 — High bus voltage (500–800 V platforms). Raising Vdc does not raise the SC saturation current proportionally — the die saturation current is set by Vgs and transconductance and is nearly Vds-independent. What scales with Vdc is the SC energy Esc = Vdc·ISCpk·tSCSOA: at 800 V the per-die SC energy roughly doubles versus 400 V, tightening the SCSOA/DESAT budget, and the higher dv/dt worsens turn-on noise coupling into the comparator. Mitigation: for 800 V platforms re-verify DESAT timing against the (shorter, energy-limited) SCSOA and stiffen the RC/EMI filtering on the OCP path; the phase-current OCP thresholds themselves scale with the current rating of the higher-voltage device chosen (e.g. a 1200 V part such as the Wolfspeed C3M0016120K).

Engineering traps that reliably appear in OCP design for automotive inverters.

G1 — DESAT is temperature-dependent for SiC OC: not a reliable OCP substitute (highest danger). Unlike an IGBT, whose Vce,sat is a flat 2–3 V nearly independent of current, a SiC MOSFET has Vds = I·Rdson(Tj), so the DESAT-equivalent trip current moves with temperature. For SCT3080AL (Rdson 80 mΩ at 25 °C, 115 mΩ at 150 °C, datasheet typ), Vds reaches the 6 V DESAT threshold at I ≈ 6 V / 0.115 Ω ≈ 52 A when hot (≈ 1.7× rated) but only at I ≈ 6 V / 0.080 Ω ≈ 75 A when cold (≈ 2.5× rated). At rated 30 A the die sits at Vds = 30 × 0.115 = 3.45 V hot, well below threshold. So DESAT alone will nuisance-trip near 1.7× rated when hot yet stay silent at the same current when cold — the effective OCP trip current is temperature-dependent. A dedicated current-sensor OCP (INA240A1 + TLV3501A-Q1) gives direct, temperature-independent phase-current detection and is mandatory as an independent OCP tier.

G2 — RC filter adds to the FTTI budget. The 300 ns false-trip filter is not free: it adds directly to Tier 2 latency. If a specific safety goal imposes a tight FTTI, put τ_f explicitly in the timing table (here tT2 = 337 ns leaves 663 ns to a 1 μs budget). Never omit the filter from the latency stack.

G3 — Three-phase OR vs AND logic. OR (any phase trips → all switches off) is correct for phase OCP but false-trips if one sensor has an offset; AND (3-of-3 vote) prevents false trips but misses single-phase faults. Correct choice: OR logic with per-phase hysteresis and RC, and invest in sensor calibration — do not paper over sensor error with AND voting.

G4 — INA240A1 reference must be tied to a defined potential. If the INA240A1 REF/IN− pin floats or is referenced to the wrong node during a ground fault, the output can rail — either a permanent trip or a missed OC. The bidirectional-sensing reference potential must be fixed in the schematic and exercised in the fault-injection test plan.

G5 — SW OCP threshold vs current-controller anti-windup. If Itripsw (300 A) sits below the current controller's anti-windup limit (say 350 A for aggressive acceleration), the controller keeps integrating to the windup limit and re-triggers SW OCP without the system recognising a fault. Fix: set the SW OCP threshold above the anti-windup limit, or trip on N consecutive breaches rather than a single sample.

G6 — TLV3501A-Q1 power sequencing. The comparator can output a brief spurious LOW (a false FAULT) during its supply ramp. If the gate-driver 15 V rail powers up before the comparator's 3.3/5 V logic rail, PWM can be enabled while the comparator asserts a false fault. Fix: sequence the logic rail up before enabling the gate-driver VCC.

G7 — OCP latency vs INA240A1 bandwidth. INA240A1 bandwidth is 400 kHz (−3 dB), a rise time of tr = 0.35 / 400 kHz = 875 ns. The RC filter (τ_f = 300 ns) is faster, so the sensor bandwidth — not the filter — sets the floor for fast events. A genuine SC Type II rises in tens of ns (Lstray/Vdc dynamics), far faster than 875 ns, so T2 HW OCP cannot catch a fast short in time — DESAT must. T2 is designed for slower sustained OC (rise time ≫ 1 μs), which is exactly the correct division of labour: DESAT for SC, comparator OCP for sustained OC.