Motor Drive Stage — Topology, Braking, Soft-Start, Noise, Thermal

A. PMDC vs BLDC (board-level abstraction only)

• PMDC (most common): H-bridge + current sense. The control loop can be expressed as “PWM duty → current/torque evidence → speed/position evidence → motion state”.
• BLDC (variant): 3-phase bridge. Algorithm depth (six-step vs FOC) stays out of scope; the board must still expose the same safety hooks: phase/bus current evidence, bus voltage evidence, and driver fault signals.
• Common requirement: A defined stop/brake policy and a defined fault policy matter more than the control method.

B. Motion chain (the five segments that must be engineered)

• Soft-start: PWM ramps up under current limiting to avoid high inrush torque, gear shock, and false obstacle flags during the first tens of milliseconds.
• Ramp: Acceleration is bounded; the current waveform should transition from a short peak to a repeatable steady envelope.
• Cruise: A stable window where current and pulse rate are “clean”; this is where position integrity checks are most reliable.
• Decel: Reduce kinetic energy before end-stop; this lowers impact, reduces backfeed spikes, and improves end-stop vs stall discrimination.
• Stop/Brake/Hold: Choose between coasting, short-brake, or hold torque. Each choice must consider door rollback risk and backfeed handling.

C. Braking & backfeed (avoid the “rail upset” failure)

• Short-brake: Can stop quickly but can inject energy into the electrical domain; verify the motor bus rise and ensure logic rails remain stable.
• Controlled decel: Often reduces the worst spikes; verify that decel time does not violate safety expectations.
• Rollback scenario: If the door tends to pull the motor (gravity/spring imbalance), enforce a hold strategy or mechanical assist; avoid “half-alive logic” during bus disturbances.

D. Noise vs efficiency (PWM frequency selection)

• Audible noise: PWM in or near the audible band can excite mechanical resonance. Moving frequency upward helps but increases switching loss and EMI pressure.
• Current sampling timing: Sample current in the stable portion of PWM; avoid switch edge artifacts that inflate torque estimates and trigger false protection.
• EMI containment: Keep the high di/dt loop compact; the radio island must not share noisy return paths from the bridge.

E. Protection policy (threshold + time window + action)

• Short-circuit / fast OCP: Hardware-level trip (driver fault) within microseconds to protect silicon; action = immediate gate disable + fault latch.
• Stall / jam: Evidence-based detection = high current + near-zero pulse rate + duration window. Action = stop/brake + optional reverse + fault latch.
• Overtemperature: Use board thermal evidence (FET/driver temperature). Action = derate speed/force or inhibit motion until recovery threshold is met.
• Recovery rules: Define “manual clear” vs “auto retry” and tie this to interlock states; avoid repeated start attempts under jam conditions.

Position Sensing — Hall, Optical Encoder, Limit, Travel Learn

A. Sensor set (use complementarity, not redundancy theater)

• Hall pulses: strong for speed and relative travel; vulnerable to mechanical gap variation and noise injection on long runs.
• Optical encoder pulses: strong for higher resolution travel; vulnerable to dust/aging/partial occlusion causing missing edges.
• Limit switch: a hard boundary and a safety reference; must include debounce and “contact health” diagnostics to avoid false end-stop.

B. Conditioning & diagnostics (where “random stops” are born)

• Input protection: long wires behave like antennas. Clamp and filter before logic thresholds; avoid sharing noisy ground returns with motor loops.
• Debounce as a policy: debounce is not just filtering; it defines how the system distinguishes a real limit from a bounce burst.
• Pulse counters: maintain pulse count, pulse rate, and a pulse-loss counter. Pulse-loss must be visible in logs.
• Cross-check rules: limit switch activation must be consistent with pulse-based travel estimation; contradictions are diagnostics, not “rare events”.

C. Travel learn (state evidence, not app workflow)

• Trigger conditions: first install, post-maintenance, or after detected pulse integrity failures (rising pulse-loss rate).
• What to record: total pulses over full travel, pulses at each end-stop, and snapshots of current + pulse rate at end-stop entry.
• Success criteria: repeatability within a defined tolerance across two runs; otherwise enter a safe degraded mode rather than “accept bad learn”.

D. Evidence: PWM correlation + pulse integrity

• Correlation check: if pulse loss occurs in sync with PWM duty transitions, suspect electrical coupling/threshold issues before suspecting mechanics.
• Discriminator: pulse loss without PWM correlation points more toward sensor contamination/aging or mechanical alignment issues.
• Required counters: pulse-loss count, limit-switch bounce count, and “expected speed vs measured speed” mismatch count.

Force/Torque & Obstacle Detection — Evidence, Discriminators, Windows

A. Torque evidence (current → torque estimate) with required compensation

• Mapping: treat motor current as a torque proxy only after defining a baseline envelope vs motion state (start/ramp/cruise/decel).
• Voltage sensitivity: bus voltage changes modify current dynamics; evidence must be interpreted with UVLO/bus state awareness.
• Temperature sensitivity: coil resistance and MOSFET Rds(on) drift change the same “torque proxy” value; apply derating or adaptive baseline within strict bounds.
• Calibration: establish a “normal travel envelope” from healthy runs; use it as a reference for discriminators, not as a fixed constant.

B. Core discriminators (end-stop vs obstacle vs stall)

• End-stop (normal): current rises as speed/pulse rate drops inside an end-stop position window; duration is short and repeatable.
• Obstacle/entrapment: current slope (di/dt) rises quickly while pulse rate collapses outside the end-stop window; action must be immediate and logged.
• Stall/jam: high current + near-zero pulses for longer than a stall window; optional reverse attempt can be used as secondary evidence, but safety must not depend on retries.

C. Windows & filters (the primary lever against nuisance trips)

• Blanking window: suppress obstacle logic during the first start segment; allow only fast hard protection (short-circuit OCP) during this time.
• Evidence window: compute current features using a short window (mean/peak/slope) that rejects PWM edge artifacts.
• Decision window: require evidence persistence for a minimum time to prevent single-sample triggers; tune separately for obstacle vs stall.
• Recovery window: after an event, enforce a stable period before allowing re-enable; avoid “oscillation” between start and trip.

D. Mechanical safety inputs (edge sensor + E-stop) with diagnostics

• Edge sensor: treat as an independent safety channel; implement basic integrity checks (stuck-high/low, toggling noise count) and log every trigger.
• E-stop: highest priority; bypass soft logic and assert a deterministic stop path. Record the input state and the drive state at the same timestamp.
• Long-wire reality: both inputs are vulnerable to ESD/EFT injection; use input conditioning and store “bounce/noise counters” as evidence.

Safety Interlocks — Photo-eye, Cover Interlock, Forced Shutoff & Recovery

A. Photo-eye input (failure modes that must be diagnosable)

• Alignment loss: stable blocked/unblocked states over long durations; report as a persistent fault rather than “random stop”.
• Sunlight/optical interference: rapid toggling or bursts; count toggles and classify as “noise” vs “real beam break”.
• ESD/EFT on cable: short spikes; conditioning must reject single-sample flips and log spike-like anomalies when they coincide with resets.

B. Cover/service interlock (turn into a safe mode, not only a ban)

• Service mode: opening the cover inhibits motion and marks logs accordingly; avoids unintended starts during maintenance.
• Bounce/health counters: track bounce counts for the cover switch; repeated bounce indicates contact wear or wiring issues.

C. Forced shutoff chain (soft policy + hard disable)

• Soft policy: controlled decel/stop/reverse as appropriate; improves mechanical stress and user experience.
• Hard disable: gate driver EN/FAULT path disables switching deterministically; required when safety evidence demands immediate removal of drive energy.
• Priority rule: E-stop and certain interlock faults must assert hard disable regardless of motion state.

D. Latch and recovery conditions (must be explicit and logged)

• Latch class: define which faults require manual clear vs auto-clear after a stable window.
• Stable window: require an unbroken “OK” duration before re-enable; prevents oscillation between trip and restart.
• Snapshot: store interlock source + timestamp + current/speed snapshot + drive state; enables “why it stopped” without guesswork.

RF Remote + Connectivity — Sub-GHz Reliability Under Wi-Fi/BLE Coexistence

A. Sub-GHz remote receive chain (board-level essentials)

• Front-end blocks: antenna → matching → ESD clamp → RF receiver input (optional selectivity parts are implementation-dependent).
• Hardware evidence hooks: RSSI/AGC indication (or equivalent), IRQ/wake pin, decode status flags/counters.
• Antenna placement: keep the antenna zone clear of high-di/dt loops; treat it as a dedicated “RF island”.

B. Coexistence: two failure mechanisms that look similar but fix differently

• RF sensitivity loss: switching noise and ground return coupling raise the receiver noise floor; RSSI distribution shifts and PER rises during motor PWM.
• Real-time loss: Wi-Fi/BLE activity increases ISR latency or blocks decode windows; decode-fail and retry counters rise even when RSSI remains stable.

C. Key engineering levers (RF island vs power island)

• Ground return control: avoid sharing high-current return with RF receiver reference; enforce a single controlled return bridge between islands.
• Supply cleanliness: isolate the RF/MCU rail from motor/power switching ripple; verify with rail ripple snapshots during PWM edges.
• Timing discipline: protect the decode window from long critical sections; log ISR-latency outliers as a “real-time evidence” counter.

D. Mandatory evidence & A/B test recipe

• Metrics: RSSI histogram (or min/avg), PER / success rate, retry counter, decode-fail counter.
• A/B conditions: (1) motor PWM OFF vs ON, (2) 2.4 GHz TX burst OFF vs ON, same distance/button press count.
• Interpretation: if PER rises while RSSI stays similar, suspect real-time/latency; if RSSI shifts and PER rises together, suspect noise-floor coupling.

Device-Level Security — Pairing Window, Key Storage, Anti-Replay Evidence

A. Pair / learn button as a controlled security window

• Windowed accept: accept learn/pair events only inside a timed window; reject all out-of-window requests with a reason code.
• State evidence: store window state (open/closed), timeout count, and pairing-fail reasons as counters.
• Physical reality: button bounce and ESD must not create unintended windows; track bounce/noise counts.

B. Key storage boundary (secure element as a “trust box”)

• Key store: keep anti-replay and rolling-code secrets behind a restricted access boundary (secure element / TPM / HSM conceptually).
• Access discipline: treat the MCU↔secure-element link as a trust boundary; failures must have explicit reason codes.
• Lifecycle evidence: count and log key events (create/update/erase/fail) to avoid silent degradation.

C. Anti-replay and counter resynchronization evidence

• Counter window: accept rolling-code values within an allowed forward window; reject out-of-window values deterministically.
• Rollback detection: detect and log counter rollback or non-monotonic sequences; treat as a security event, not a “random failure”.
• Resync evidence: resync is allowed only under controlled conditions (window open + valid sequence); record the resync reason.

D. Reset/brownout consistency (concept-level fault injection resistance)

• Atomic state: counter and key state must not become half-updated across reset/brownout; prefer monotonic or atomic update strategies.
• Reset evidence: log reset reason with a counter snapshot to prove whether failures correlate with power integrity events.

EMC/ESD/EFT/Surge Coexistence — Disturbance → Symptom → Evidence → Isolation

A. Attack surfaces (where the energy enters)

• Long wires: photo-eye / wall control / safety edge / cover switches → common-mode injection and false triggers.
• Motor cable: high di/dt loops and PWM edges → ground bounce, pulse-loss, RF dropouts, occasional resets.
• AC / adapter input: surge / EFT bursts → UVLO/BOR events, cold-start failures, relay chatter.
• Antenna area: ESD and return-path contamination → sensitivity loss and decode failures.

B. Countermeasures must match paths (not just “add parts”)

• Clamp at the entry: TVS selection must consider energy rating, leakage, and capacitance; placement must minimize clamp loop area.
• Shape the edge: RC + series resistance + debounce windows reduce long-wire false triggers more reliably than oversized clamps.
• Control return paths: partition RF/logic/power islands and force a single controlled return bridge; keep clamp current out of RF reference.
• Common-mode control: CM chokes/ferrites only work when placed at the correct boundary with a defined current return.
• Board-level isolation: treat creepage/clearance and isolation boundaries as layout rules; avoid routing sensitive references across the boundary.

C. Anti-example: “TVS added, but false trips and comms got worse”

• Suspect capacitance first: extra input capacitance slows edges or shifts thresholds, increasing false triggers and decode failures.
• Suspect loop & placement: a distant TVS creates a large clamp loop; the clamp current becomes a new noise source.
• Suspect shared return: clamp currents returning through RF/logic reference create sensitivity loss and state-machine corruption.
• Prove with evidence: compare rail droop, reset reasons, and event counters before/after placement changes.

D. Mandatory evidence set (minimum to debug field failures)

• Reset source statistics: BOR vs WDT vs external RST (plus optional lockup/assert categories if available).
• Rail droop snapshot: min-hold or event capture for 3V3 (and other critical rails) during disturbance windows.
• Correlators: PWM state, RF activity state, and key interlock input state at trigger time.
• Counters: interlock glitch count, pulse-loss count, RF retry/decode-fail count.

Thermal, Mechanics & Reliability — Heat → Lifetime → Noise → Maintenance Evidence

A. Hot-zone map (components that dominate lifetime)

• MOSFETs + driver: conduction + switching loss drive junction temperature cycling and long-term drift.
• Power conversion parts: elevated temperature increases ripple and can degrade RF/sensing coexistence margins.
• Protection/clamp parts: repeated stress events can create localized heating and leakage drift.

B. Thermal path design (turn hotspots into spread-out heat)

• Copper spreading: use wide copper planes and continuous heat paths; avoid thermal bottlenecks that trap heat.
• Vias & sinks: via arrays create vertical heat escape; heatsink interfaces must sit on the true hot zone, not a nearby cool pad.
• Temperature sensing: place NTC near representative hot zones; control logic must reflect actual junction trends, not ambient.

C. Derating policy (measurable thresholds and recovery windows)

• Thermal thresholds: define staged actions (limit speed/torque → pause → lockout) and include recovery hysteresis windows.
• Noise impact: thermal stress often correlates with comms/sensing instability; track thermal events with RF and sensor counters.

D. Low-temperature start & backup capability (evidence-driven)

• Cold start failures: higher friction and lower battery capability increase rail droop and BOR rate.
• Strategy: staged startup and enable sequencing; prove with rail min-hold and start-failure reason codes.

E. Mechanical/environment reliability: wear, vibration, condensation

• Connectors/relays: contact wear raises resistance and heat; intermittent contact shows up as pulse-loss, interlock glitches, or resets.
• Vibration: loosening drives intermittent faults; capture with glitch counters and correlating timestamps.
• Condensation: moisture can shift thresholds and contaminate optical paths; treat as a diagnosable drift source.

Symptom → Evidence → Isolate → First Fix (with MPN Examples)

Minimum evidence record (store as counters + snapshots)

• Reset reasons: BOR vs WDT vs external RST (and optional lockup/assert buckets).
• Rail min-hold: 3V3 min value + droop duration during the event window.
• Motion evidence: motor current peak/plateau + Hall/encoder pulse-loss counter.
• Safety evidence: photo-eye/interlock debounced state + glitch counter.
• RF evidence: RSSI trend + PER/success rate + retry + decode-fail counters.

High-frequency field symptoms (8–10) — each with MPN examples