EV DC/DC Converter Functional Safety: What OEM Buyers Should Request

OEM buyers should request more than an ASIL label: they need a traceable safety case covering the converter’s safety goals, isolation barriers, diagnostics, fault reactions, interfaces and validation evidence. The supplier must show how the DC/DC converter supports the vehicle-level safety concept and where system integration remains the OEM’s responsibility.

What safety responsibility does the DC/DC converter actually have?

The first request should be a clear item definition. It should identify the high-voltage input, low-voltage output, control interfaces, operating modes, external protections and the vehicle functions that depend on the converter. A DC/DC converter may supply a 12 V or 24 V network, support steering or braking-related electronics, maintain a control battery, or provide power during high-voltage system transitions. Each use changes the hazards and required fault response.

Ask the supplier to state whether the converter is developed as a safety-related item, a safety element out of context, or a non-safety component used within an OEM safety architecture. The requested integrity level must come from the vehicle hazard analysis and risk assessment, not from a generic product claim. ISO 26262 provides the automotive functional-safety framework, including management, concept, system, hardware, software and supporting-process activities.[1][2]

The evidence should distinguish supplier responsibilities from integration assumptions. For example, the converter may detect an internal overvoltage, while the vehicle controller decides whether to open contactors or enter a reduced-power mode. That boundary must be documented in the technical safety concept and interface specification.

What documents should be included in the supplier safety package?

Request a structured safety package at quotation and update it through design reviews. The core documents normally include the item definition, safety plan, hazard-related assumptions, technical safety requirements, hardware and software safety analyses, interface control document, diagnostic description, safety manual and verification plan.

A safety manual should explain how the converter is intended to be integrated, what external measures are mandatory, which inputs and outputs are safety-relevant, and what operating conditions invalidate the analysis. It should also describe diagnostic reaction times, reset conditions, fault-signalling behaviour, prohibited configurations and requirements for wiring, grounding, cooling and communication.

Ask for requirements traceability from safety goals to technical requirements, design elements, tests and results. A supplier declaration or assessment report can be useful, but it does not replace the underlying work products. Review whether the evidence covers the delivered hardware and software revision, production controls, change management and field-update policy.

How should the high-voltage isolation architecture be reviewed?

Isolation is both an electrical-safety issue and a functional-safety concern. Request the isolation concept for the transformer, power switches, sensing circuits, communication interfaces, auxiliary supplies and enclosure. The supplier should identify every barrier between the high-voltage domain, low-voltage output, chassis and external control circuits.

Review insulation coordination, creepage and clearance, dielectric withstand, insulation resistance, contamination assumptions, materials, potting or encapsulation strategy and ageing considerations. Do not accept a single headline isolation value without the test method, duration, environment, production-screening method and applicable operating limits. The actual requirements depend on the vehicle voltage, working voltage, pollution conditions, packaging and regional regulations.

The converter should also define its behaviour after an isolation fault. Relevant questions include whether it detects abnormal isolation directly, whether it relies on a vehicle insulation-monitoring device, how quickly it reports a fault, and whether output shutdown or contactor opening is required. Confirm how isolation monitoring interacts with capacitors, filters, pre-charge circuits and multiple high-voltage loads.

Which diagnostics should the buyer require?

Request a diagnostic matrix rather than a general statement that the product has protection functions. The matrix should identify each monitored failure, detection mechanism, diagnostic interval, fault threshold, fault reaction, signal path, residual risk and verification method.

Typical subjects include input overvoltage and undervoltage, output overvoltage and undervoltage, overcurrent, short circuit, power-stage failure, gate-drive faults, thermal overload, sensor plausibility, fan or pump interface faults where applicable, communication timeout, corrupted commands, memory errors and loss of regulation. The supplier should explain how latent faults are detected during start-up, operation and shutdown.

Diagnostics must be assessed under realistic conditions. A converter that detects an output overvoltage may still expose the vehicle network to a transient before shutdown. Ask for timing budgets, waveform evidence and load conditions. Also review whether independent monitoring is needed for a hazardous failure, such as a second voltage-monitoring path or an external supervisory controller.

What safe state and fault reaction should be specified?

“Shutdown on fault” is not a sufficient requirement. Depending on the vehicle function, the safe reaction may be controlled output reduction, immediate disable, isolation from the low-voltage bus, a latched fault, or continued operation in a degraded mode. The correct choice depends on whether loss of converter output creates a greater hazard than continued operation.

Define the safe-state transition, maximum reaction time, energy remaining in output capacitors, restart conditions and driver or fleet-service notification. Specify whether the converter must reject an enable command after a critical fault, whether a power cycle is required, and which faults may be cleared by the vehicle controller.

Include communication details: fault-code format, signal polarity, timeout limits, bus-off behaviour, message authentication requirements where applicable, and the response to contradictory commands. ISO/SAE 21434 addresses cybersecurity risk management across the vehicle E/E lifecycle and complements, rather than replaces, functional-safety work.[10]

How should hardware and software evidence be evaluated?

For hardware, request the safety analysis method, failure-rate assumptions, single-point and residual-fault results, latent-fault treatment, diagnostic coverage rationale and environmental derating assumptions. Review whether the analysis includes power semiconductors, magnetic components, current and voltage sensors, isolation components, processors, memories, watchdogs, communication transceivers and connector faults.

For software, request the software safety plan, architecture, low-level safety mechanisms, watchdog strategy, startup checks, memory protection, calibration controls and verification summary. Confirm how boot software and application software are separated, how invalid calibration data is handled, and how updates are controlled. Software evidence should match the shipped version and configuration.

Ask for fault-injection results, boundary-condition tests, electromagnetic-compatibility interaction tests and thermal derating evidence. If an independent assessor or certification body is involved, identify the assessment scope and open findings. A certificate or assessment statement should be treated as supporting evidence, not as proof that every vehicle integration assumption has been satisfied.

Which supplier evidence should be a release gate?

Make evidence deliverables contractual and tie them to programme milestones. Before design freeze, require the safety concept, assumptions of use, interface requirements and preliminary analyses. Before validation approval, require completed verification, fault-injection results, production test coverage, change-control commitments and an updated safety manual.

The supplier should provide a clear list of open deviations, known limitations, diagnostic blind spots and conditions requiring external hardware. Request sample production-end-of-line tests for isolation, sensor plausibility, communication and protective shutdown. Confirm how traceability is maintained from component changes to safety impact analysis.

For platform products, ask which evidence is generic and which is configuration-specific. A change in output voltage range, firmware calibration, cooling arrangement, connector pinout or communication protocol can alter the safety argument. The OEM should receive a configuration-specific compliance matrix and a defined notification process for component obsolescence, firmware changes and manufacturing-site changes.

Before nomination, hold a joint safety review with the converter supplier, vehicle controls team, battery-management team and functional-safety manager. Walk through credible single faults from the high-voltage terminals to the low-voltage loads, including wiring faults and unavailable communication. The review should end with named owners, measurable acceptance criteria and a list of evidence required for vehicle validation.