MOSFET Redundancy/Fail-Safe in Automotive System

[MR.AWESOME]

Yohoho. I've got an N-MOSFET driving some relays that control the 'Run' circuit in a vehicle. If a FET fails, these relays must not cut off power while the car is running. The FET's I'm using are ON Semi's NCV8402. They are pretty heavy duty as it is, but I want to implement some sort of redundant or fail-safe system to make sure.

I have an MCU with CMOS output of 3.3V driving the gate. There is a series resistor on the gate as well as a pull-down resistor. I will probably include a diode to block any voltage to the MCU that may arise out of a Drain-Gate short failure. How does that sound to you guys? Did I miss anything so far?

I was thinking of using a logic gate to compare the state of the MCU's output pin with the state of the FET to determine if a fault occurred. I would put a voltage divider from the drain-side of the FET to one of the inputs of the logic gate and the other side of the logic gate to the gate-side of the FET. Doing this would require me to clamp the voltage down to a lower level than what is provided by the MOSFET, so I would add an external TVS from Drain to Source as well. How does that sound?

Now the real trouble I'm having is deciding on whether to just wire up two FETs in parallel and monitor if one of them goes bad to alert the operator, or if I need a completely separate backup system that is unused in normal operation, but would kick in in case of the primary MOSFET failing. I feel like if there was some event large enough to take out one of the FETs, if they were in parallel, the event would take them both out. So I would need a separate system. Lemme know what you guyses think.

Thanks

 

[OLIVE2222]

Hi MR.AWESOME,

About the redundancy it will not suffice to parallel a circuit that can't be interrupted.
You have described exhaustive s way to monitor and protect you Fet's but you still rely on the same µC to both drive it and ensure is protection. If you have a µC failure (hardware or firmware) you are in trouble. So maybe better to leave the monitoring to a fully external circuit (can be µC less) and to implement reciprocal watch dog between them to ensure that's both are working. Sure you must still use bullet proof and oversized componant (also have a look on smart fet's).
By the way the normal fail safe-mode for cars (and trains) is to stop them. Don't stop them as you want is the normal fail-safe mode for aircraft's (and flying saucers)

Olivier