Sensors in automotive designs are used in a wide range of applications from measuring the pressure of gas tank vapor and exhaust to tracking magnetics for gear tooth and valve position. Regardless of their application, however, most automotive sensor modules share a common high level architecture and must meet a stringent set of requirements.

Many of these sensors use a bridge arrangement and produce a differential signal with small amplitude. These bridges exhibit random part-to-part variations, offsets and non-linearities. Therefore, they often require signal conditioning to amplify and compensate for these variations and produce the linear accurate signal the system requires. Usually these sensor modules connect to the system via a traditional 3-wire connection which provides power and ground to the module.

The module typically returns an analog radiometric representation of the measurement. The conditioned signal from the sensor module is then received by the system microcontroller via a single channel of a multiplexed A-D converter. Figure 1 shows a typical automotive sensor module for a Manifold Absolute Pressure (MAP) application.

(Click to enlarge image)
Figure 1: In a typical automotive sensor application for Manifold Absolute Pressure (MAP), a piezo-electric pressure sensor and signal conditioning IC link to the ECU via a 3-wire interconnect.

The automotive domain presents a much more severe environment for electronics design than one normally expects. Many OEMs in this market specify operational temperature ranges from -50° C to +150° C. In addition, sensor modules integrated into an automobile must tolerate large power supply disturbances and electrostatic discharge (ESD) strikes in excess of 8 kV.

This article discusses the unusual set of challenges engineers at ZMD America encountered while designing the ZMD31015 RBic_dlite, a sensor signal conditioning chip that provides amplification and correction of bridge sensor signals. In particular, it describes the techniques ZMD engineers used to ensure the IC would reliably operate in the harsh automotive environment and how the use of full-chip mixed-signal simulation helped the team identify and resolve unforeseen design issues prior to manufacturing.

Temperature, power challenges
The ZMD31015 RBic_dlite IC, Figure 2, performs digital compensation of sensor offset, sensitivity, temperature drift and non-linearity using an internal digital signal processor (DSP) running a correction algorithm with calibration coefficients stored in EEPROM.

(Click to enlarge image)
Figure 2: Block diagram of the ZMD31015 RBic_dlite IC.

The CMOS chip includes a high-precision bandgap reference with proportional-to-absolute-temperature (PTAT) output, a low-power 14-bit analog-to-digital converter (ADC), and a DSP core with EEPROM to precisely calibrate the bridge output signal. Three selectable outputs allow the chip to be used in a wide variety of applications. Designers added a single-wire digital interface to connect to system microcontrollers.

Given the automotive environment's wide operating temperature range and wide V_DD range (2.7 V to 5.5 V), the ZMD design team realized they needed an extremely robust design and verification process. In the analog pre-amplification path the designers needed to ensure op amp stability, open loop gains, and temperature matching of resistors which set the amplifier gain. Temperature and power supply extremes presented additional challenges in the chip's ADC. Cold temperatures and low VDD levels impede charge transfer across pass gate switches due to elevated V_Ts at -50° C coupled with low overhead gate drive at V_DD = 2.7 V.

On the other hand, high temperatures cause exponentially increasing junction leakages which manifest as a charge load off the switch capacitor nodes. Balancing switch size, capacitor size and operating frequency to satisfy all these extremes would clearly require exhaustive parametric simulation and analysis across temperature, VDD and process extremes.

High temperatures also posed a problem for EEPROM retention. The DSP in the ZMD31015 core uses coefficients stored in EEPROM to correct for offset, span, temperature and nonlinearity. These mission-critical parameters are written/set during sensor-module calibration. Any loss or corruption of data during that operation could undermine sensor calibration and produce an in-range signal that the system could mistakenly interpret as correct.

This result, particularly in steering or braking systems, could lead to catastrophic results. Inaccurate data in the EEPROM could also be caused by false programming generated by a power glitch that puts the control logic of the conditioner in an invalid state and turns on the chip Vpp charge pump.

ZMD engineers already had an EEPROM process and cell design that was proven reliable at high temperature. To further ensure EEPROM integrity, they employed a linear feedback shift register (LFSR) to perform error checking. To address the false write problem caused by a power glitch, designers added a charge-pump interlock mechanism that is code and temporal based and requires a sequence of codes to occur in a prescribed order before an EEPROM can write.

As final insurance the ZMD design team implemented an EEPROM file that once programmed, permanently disables all subsequent EEPROM writes.

Need for diagnostics
Automotive sensors are often used in mission-critical applications like steering and braking where a failure can have severe consequences. Therefore any signal conditioner targeted for the automotive market must include a complete set of diagnostic capabilities to enable detection of potential faults.

One common category of failure modes is sensor connection. Figure 3 shows four possible fail points of a sensor bridge connected to a signal conditioner.

(Click to enlarge image)
Figure 3: Possible fail points of a sensor bridge connected to a signal conditioner.

If a failure occurs at point 1, both BP and BN are pulled low by the bridge. In the event of a failure at point 2 or 3, BP/BN inputs to the signal conditioner would be floating and indeterminate. A failure in point 4 would pull BP and BN high. Therefore, failures at points 2 and 3 are more difficult to detect. If the signal conditioner were to switch a small leakage path to ground on BP and BN, failures in points 2 or 3 would pull the corresponding input low.

To detect all four potential failures, ZMD designers implemented a method where a small current source to ground was switched to each input when an ADC conversion was not occurring or the BP/BN inputs were not being sampled. After a short interval (approximately 50 μs) the system compared the voltage level of BP and BN to a window between 15 and 85 percent of V_DD. If both BP and BN fell within the window, all sensor connections were intact. Any failure to fall within the window would indicate a diagnostic state.

Pin-to-pin shorts presented an additional hazard. Careful selection of pin placement can often eliminate this issue or make it much easier to detect. Some cases, particularly shorts in BP/BN, are exceptions. BP/BN pins or PCB traces are typically located adjacent to each other. If BP or BN short they will still produce a signal with valid levels that will not be caught by any of the sensor connection check diagnostic techniques previously described.

ZMD engineers addressed this issue by developing a technique in which BP was pulled down when an ADC conversion was not occurring or the BP/BN inputs were not being sampled. If a short existed between BP and BN, then BN would follow BP down. The system then compared BN to a value of 15 percent of VDD. If BN fell below that value, a diagnostic state was indicated.

Finally, the ZMD design team had to address any potential short/open in the signal line of the wiring harness to either the power supply or ground wire. Clearly a short to either power or ground would fall outside the 5% to 95% V_DD criteria for a valid signal. But if the signal conditioner attempted to drive a different value, a contention could exist. Designers feared that even after a failure was cleared, damage could occur to the sensor and the system could fail.

While contention would normally not damage the IC output buffer at normal operating temperatures, at 150° C electromigration of the metal connectors inside the IC is considerable. ZMD designers solved this potential problem by using an optional current limiting circuit on the output buffer.

Optimizing the design flow
Traditionally engineers building ICs like the ZMD31015 engineers have largely relied on a fragmented and bottom-up-based approach to analog and mixed-signal design because it provides a proven, reliable result. In recent years, however, many designers have become aware of the advantages of combining a top-down methodology and making use of full system modeling to identify potential problems early in the design cycle that arise from the interplay of analog and digital circuits.

The engineers at ZMD America are no exception. Over the last few years they have made extensive use of full-chip mixed-signal simulation tools, in particular the Cadence AMS design environment (www.cadence.com), to identify and track down unexpected problems that occur during the interplay between function blocks. The impact on chip development time has been dramatic. While earlier product designs typically took multiple spins to eliminate bugs, today ZMD commonly uses first pass silicon as samples to customers.

The ZMD31015 development team began by designing the analog and digital sections of the IC simultaneously (Figure 4).

(Click to enlarge image)
Figure 4: Design flow for the ZMD31015 sensor signal conditioning chip.

On the analog side, designers used Cadence Composer for schematic capture. Analog simulations were run using Cadence's Virtuoso Spectre Circuit Simulator, a high performance SPICE simulator, and the Virtuoso Analog Design Environment, as well as a parametric analysis tool and a corner-case simulation tool. Given the extreme environmental conditions the device had to meet, designers ran an exhaustive battery of analog regression tests and corner-case simulations.

Run in an automated fashion, these scripted tests covered an extremely wide range of environmental conditions. This process included corners simulations across temperature extremes between -50° C and +150° C, V_DD extremes ranging from 2.65 V to 5.5 V and a wide variety of process tests such as fast NMOS and PMOS devices, nominal NMOS and PMOS devices, and slow NMOS and PMOS devices.

The tests also covered minimum and maximum resistance and capacitance of resistors and capacitors, and minimum and maximum performing BJTs. Overall, the team ran more than 50 corner-case simulations. Once testing was complete, ZMD designers used the Cadence Virtuoso layout environment to layout the analog blocks.

For the digital sections of the chip design, ZMD engineers used Verilog modeling and ran initial simulations using Cadence's NC-Sim mixed-language simulator. Once the digital core met performance requirements, the digital block was sent through a comprehensive regression environment that ran self-checking tests on NC-Sim. The designers used synthesis tools within the Cadence Encounter RTL-to-GDSII design environment to synthesize the Verilog blocks to a gate-level netlist and performed place-and-route using synthesis and physical implementation from the Cadence Encounter digital IC design platform.

Mixed-signal simulation is critical
The advantage of full chip, mixed-signal simulation came to light when the team discovered a previously undetected bug in the pre-amp design. In the initial design the team used small 100 nA current sinks on the BP/BN inputs. The designers believed that this would allow the sensor connection check comparators to detect an open bridge connection because the BP/BN pin would fall below 15% of V_DD. In Cadence's Virtuoso Spectre Circuit Simulator, simulations of the analog section of the design showed the 100 nA current sink was adequate for that task.

The design also uses a chopper-stabilization technique to switch the bridge inputs with a clock to average out the natural effects that occur in any op amp. Unfortunately, that technique also generates a charge injection back onto the inputs. For various reasons, ZMD designers chose to not run mixed-signal simulations in the early stages and therefore those early simulations of the analog blocks did not factor in the choppering on the pre-amp, because the chopper clock is located in the digital core.

One of the primary advantages of running a full chip mixed-signal simulation using an environment like Cadence's Virtuoso AMS Designer is that it allows the designers to explore potential problems that arise from the interaction between the analog and digital domain. Another important advantage it offers is the ability to run segments of the design at different levels of abstraction. This allows designers to accelerate their simulation runs by using higher levels of abstraction for the segments of the design they consider proven.

In this case, the design team had validated both the individual analog and digital blocks in the design but neither process took into consideration the effects from the chopper clock and the switching of the current sinks happening in the digital core. When the design team ran a full chip mixed-signal simulation with the chopper block driven by the clock in the digital core, they discovered it created enough charge injection feedback to sustain BP/BN inputs at a voltage higher than the diagnostic checking level. The designers needed a mixed-signal simulation with an extracted view of the pre-amp to identify the bug.

Eventually, the problem was solved by replacing the 100 nA current sinks with larger 1 μA sinks. Without this final round of mixed-signal simulations, the problem would not have been discovered until after test-chip manufacturing. The value of full chip mixed-signal simulation in minimizing silicon respins was thus made clear.

Conclusion
Failure is not an option in automotive sensor design. Many of these devices operate in mission-critical applications where a faulty reading can lead to a disastrous event. Accordingly, diagnostic detection plays a crucial role in sensor design.

The development of the ZMD31015 illustrates how difficult it is to build in these comprehensive diagnostic capabilities and meet the automotive environment's severe environmental constraints. By taking full advantage of full chip modeling and mixed-signal simulation provided by Cadence technologies, the ZMD design team was able to meet its goals and develop a high performance, high reliability product.

About the author
Eric Hoffman is ASSP (Application Specific Standard Product) Principal Engineer at ZMD America (www.zmda.com)which he joined in May of 2001 as a Senior IC Design Engineer doing ASIC's and ASSP's for sensor signal conditioning. Prior to that, Eric worked at Intel Corporation for 10 years, primarily doing memory and high-speed data-path design. Eric earned his M.S. in Electrical Engineering from the University of Minnesota.