H2-1. Mission & Boundary: What “Power & Backup” Owns in Security Systems

This page owns the engineering decisions that keep security endpoints powered through disturbances (blink, brownout, load spikes) and leaves a provable trail (health metrics + event logs) when anything goes wrong.

• Continuous power: AC-DC / DC-DC rails, sequencing, and transient behavior under real security loads (IR, heaters, small motors, edge compute).
• Backup continuity: two clear goals—hold-up (tens of ms to seconds) and battery/supercap backup (minutes to hours) with controllable shutdown policies.
• Power-path control: eFuse / hot-swap / ideal-diode ORing, inrush limiting, reverse-blocking, source switchover behavior.
• Provable operations: health metrics (brownout counters, thermal events, backup SoC/SoH) and event logs (reset reason, Vmin, duration, timestamps, monotonic counters).

• PoE switching / negotiation (PSE, power allocation, IEEE 802.3 behaviors) — only referenced as “external DC input” or “post-PD rail”.
• Outdoor surge/ESD/lightning protection (TVS/GDT, bonding, SPD) — dedicated “Surge/ESD Protection (Outdoor)” page.
• Timing networks (PTP/1588 distribution) — dedicated “Timing & Sync for CCTV” page.
• NVR/VMS platform ingest/codec/storage/compliance — dedicated recorder/integrity pages.

• Inputs: AC adapter or DC feed; optional “post-PD DC rail” as a generic input (no PoE deep dive).
• Loads: steady rails (SoC/MCU) + pulse rails (IR/heater/motor) + always-on domain (RTC/log/tamper).
• Signals: PG/RESET, fault IRQ, and a minimal telemetry/log interface (I²C/SPI/UART—named only, not protocol deep dive).

• Hold-up (ms–s): survive brief outages and source switching. Failure mode is usually a voltage-window problem (Vout dips below UVLO/PG) rather than average power.
• Battery / supercap backup (min–hours): maintain operation or perform controlled degradation (e.g., disable IR heater first, keep logs/RTC alive, then graceful shutdown). Failure mode is often SoC/ESR/temperature mismatch.

• Minimum measurable evidence: Vmin on main rail + duration below threshold; backup current snapshot; device temperature at event.
• Minimum log fields: reset reason (brownout/UVLO/OCP/OTP/watchdog), timestamp (RTC) + monotonic counter, Vmin, duration, SoC, temperature, and protection trip counters.
• Acceptance criterion: no reset under defined disturbances; if a reset happens, the system must output a complete log entry that points to a root-cause class.

H2-2. Topologies & When to Use: Flyback vs LLC in Security Power

Choose topology by power range, noise constraints, standby efficiency, and disturbance behavior—especially pulse loads (IR/heater/motor) and light-load burst conditions that can trigger resets.

• Best fit: low–mid power endpoints, cost-sensitive designs, flexible outputs.
• Primary risks: peak currents and magnetics/thermal limits reduce transient margin; clamp strategy impacts stress and noise.
• Security-specific trap: pulse rails (IR/heater/motor) create fast load steps—design must prioritize output sag and recovery time, not only efficiency.

• Best fit: mid–high power, efficiency/thermal/noise priority, higher continuous loads.
• Primary risks: light-load burst/skip behavior can introduce low-frequency ripple “packets” that couple into sensitive domains; regulation may degrade during input sag/hold-up window.
• Security-specific trap: night-time low load (idle camera) + periodic spikes (IR on) can repeatedly cross mode thresholds—this is where “random resets” often hide.

• Pulse load step (IR/heater/motor): measure Vout droop, recovery time, and PG/RESET threshold crossing. If Vout droops before PG/RESET, the root cause class is power transient margin. First fix: increase effective output energy (cap/loop), tune response, and review power-path switching window.
• Light-load burst noise: measure burst period and ripple envelope, and correlate it with fault counters/reset reasons. If faults align with burst packets, the root cause class is light-load mode behavior. First fix: adjust mode thresholds, add controlled preload, or improve filtering on sensitive domains (keep changes within this page’s scope).
• Hold-up during input sag: measure time-to-UVLO and the rail voltage window during sag. If hold-up meets calculation but fails system-level, the culprit is usually downstream UVLO/PG or path switchover timing rather than capacitor value alone.

H2-3. Power Tree Architecture: Rails, Sequencing, and “Keep-Alive” Domains

A security endpoint power tree must separate “evidence survival” (always-on) from “service rails” (main) and “stress rails” (pulse loads). The objective is not only avoiding resets, but also ensuring every reset has a provable cause record.

• AON / Keep-Alive: RTC, event log buffer, tamper counters, minimal supervisor. Must survive brief outages long enough to finalize evidence.
• Main: MCU/SoC + networking/control rails. Must be stable under normal operation; can enter controlled degradation on brownout.
• Pulse-load: IR illuminator, heater, small motor/solenoid rails. High di/dt and high peak current; should be isolated and the first to shed.

• Power-up order: AON stable → Main rails stable → enable pulse-load rail(s). This prevents heavy loads from disturbing boot.
• PG chain: PG must represent the main rail window (not just “rail exists”). Use supervisors so reset release follows an explicit threshold + delay.
• Reset sources: treat reset as an input to the evidence system—every reset must map to a reason (brownout/UVLO/thermal/watchdog).

• Controlled degradation (preferred): on input sag or main-rail droop, disable pulse-load first (IR/heater/motor), keep AON alive, and give Main a short window to write a complete event record.
• Hard reset (only when necessary): if rails cross below a non-operational threshold, reset immediately—but the AON domain must still capture reset reason + Vmin + duration.

• First 2 measurements: Main rail Vmin & time-below-threshold + PG/RESET waveform on the same time axis.
• Prove causality: if Vmain droops before PG deasserts, the cause class is transient margin / domain isolation. If PG stays valid but resets occur, inspect reset counters (watchdog/thermal).
• Reset statistics: maintain counters for watchdog / brownout / UVLO / thermal events; trend frequency to identify the dominant failure mode.

H2-4. Protection & Power Path Control: eFuse, Hot-Swap, Ideal Diode ORing

“Protection” here means protecting the power path and backup switchover: prevent destructive faults, avoid false trips during legitimate inrush, and switch sources without corrupting rails or evidence.

• Limit current (ILIM): caps short/overload energy and protects upstream supply; must still allow legitimate pulse loads via time-window control.
• Blanking window (tBlank): prevents nuisance trips for allowed surges (IR turn-on, motor start, bulk cap charging).
• Safe operating area (SOA): defines how long the device can survive “half-fault” conditions without overheating.
• Ramp control (dV/dt): controls inrush and upstream droop by shaping the output rise and limiting charging current into bulk capacitance.

• Reverse blocking: prevents battery/supercap from back-feeding the adapter rail (heat, instability, and unexplained brownouts).
• Dual-source priority: adapter-first, backup-first, or “highest wins” policies—choose based on required continuity and evidence retention.
• Switchover window: allow either seamless switching or an acceptable micro-sag; use hold-up capacitor to bridge the crossing window.

• Inrush validation: measure input current waveform + input droop + eFuse fault flag/log. If input droops before the trip, the system is being collapsed by inrush, not a true short. First fix: tune dV/dt, adjust tBlank, or reduce bulk charging peak.
• ORing switchover: measure reverse current during voltage crossing + output sag relative to UVLO/PG thresholds. If reverse current appears, reverse-blocking is insufficient; if output sag crosses UVLO, bridge energy or switch speed is insufficient. First fix: adjust priority thresholds, improve ORing control, and add hold-up bridging.

H2-5. Backup Energy Design: Hold-up Capacitor vs Supercap vs Battery

Backup energy must be engineered as a closed loop: define the target hold-up time, define the allowed voltage window, budget the effective load power after brownout policy, then validate by waveform and reset-cause evidence.

• Vhi / Vlo must be defined by real rail thresholds (PG/UVLO/reset) and the minimum voltage needed to finish evidence tasks (log finalize + counter update).
• P_load is the post-policy power: shed pulse loads first (IR/heater/motor), then keep AON alive, then keep Main only as needed for controlled shutdown.
• Low-voltage behavior matters: DC/DC efficiency and current limit near Vlo can shorten real hold-up time versus the ideal energy equation.

• Hold-up waveform: capture Vout during input loss, annotate Vhi/Vlo, and mark the exact time PG/RESET changes state.
• Timestamp & reset point: confirm the event record is finalized before Vout crosses the evidence boundary (AON must survive long enough).
• Low temp / aging: repeat at cold and at aged ESR/leakage conditions; many “calculated OK” designs fail due to ESR-driven droop, not missing nominal capacity.

H2-6. Charging & Discharging Control: Charger, Fuel Gauge, and Safe Cutoff

Charging and discharging must be treated as a system policy: power-path continuity, safe temperature windows, accurate state-of-charge decisions, and cutoffs that preserve the always-on evidence domain during brownout and cold start.

• Linear vs switching charger: choose by efficiency and thermal headroom; keep the interface as “state + limits”, not as a chip tutorial.
• Power-path preference: prioritize powering the system rail while charging storage, so switchover and load steps do not corrupt evidence rails.
• Temperature window: NTC gates charging enable, current level, and fault transitions; every violation must be logged.

• Discharge limiting: prevents the storage rail from collapsing when the main domain wakes or when pulse loads would otherwise step current.
• UV cutoff policy: choose a cutoff that protects the pack while still guaranteeing AON evidence completion (log finalize + counters).
• Cold start: at low temperature or low SoC, bring up AON first, then decide whether Main can start; record failures with timestamps.

• Coulomb count + OCV calibration: SoC is not “always correct”; define when SoC is trusted (rest windows, temperature range).
• SoH trend: runtime policy must consider aging; a pack can show high SoC but fail under load due to increased internal resistance.
• Decision logging: record SoC/SoH/temperature and the policy decision (keep recording, save logs, safe shutdown) for traceability.

• Charge curve: I/V/T versus time + state transitions (Precharge→CC→CV→Terminate) with reason codes.
• SoC drift & calibration points: log when OCV calibration occurs and how SoC changes; investigate large corrections.
• Cold-start proof: verify AON can rise at worst-case temperature/SoC; then verify Main start does not cause UVLO resets.

H2-7. Health Metrics: What to Measure, How to Trend, When to Alert

Health metrics are only useful if they are observable, trended, and explainable. Each alert should bind to two evidence snapshots (forensics-friendly) without relying on cloud dashboards.

• Short-term buffer: seconds–minutes around events (pre/post window) to support field forensics.
• Long-term roll-up: hourly/daily min/max/p95/count for weeks of retention with low storage cost.
• Trend rules: rising brownout frequency, downward Vin_min slope, rising ESR proxy, or baseline thermal shift under similar load.

Use a minimal severity model (OK/Warn/Fail or 0–100). Every non-OK alert should append two waveform equivalents:

• Vmin + duration: the minimum voltage and how long the rail stayed below a policy boundary.
• Power snapshots: P_before / P_after (or Iin/Iout snapshot) to distinguish input weakness from load escalation.

H2-8. Event Logs & Non-Repudiation (Local): What to Record for Forensics

This chapter stays strict: only power-domain event logs and the smallest practical integrity layer inside the device. The goal is reconstructable forensics without platform-level compliance scope.

• CRC detects random corruption and partial writes.
• Hash chaining (prev_hash → this_hash) makes deletion/insertion detectable.
• Signature (optional): sign the chain head or key records with a secure element for device-origin proof.

• Two-phase record: write a pre-record on threshold crossing, then finalize with the last evidence values if AON power remains.
• Atomic validity flag: a record is either valid or marked partial; never treat partial as a clean event.
• Ring buffer with pointers: use stable pointers and monotonic record ids to survive power loss.

H2-9. Validation Plan: Bring-Up, Power Cycling, Brownout, and Backup Runtime Tests

Validation should be executed as a repeatable SOP: goal, tools, steps, and pass/fail. The focus here is three failure drivers: power interruptions, path switching, and pulse loads.

• Step 0 — Instrumentation: confirm rail naming, measurement points, PG/RESET chain, and log extraction path.
• Step 1 — Baseline steady-state: verify nominal rails, ripple proxies, thermal rise, and idle power.
• Step 2 — Controlled power cycling: repeated cold/warm cycles; confirm boot reason codes are consistent and monotonic counters increment correctly.
• Step 3 — Brownout/flicker: scripted dips and short interruptions; verify hold-up and graceful behavior.
• Step 4 — Pulse loads: inject IR/heater/motor-equivalent load steps; verify transient recovery without false trips.
• Step 5 — Backup runtime: run-down from full to cutoff; verify runtime, cutoff policy, and log completeness.
• Step 6 — Protection behavior: OCP/short/OTP and recovery mode (latch vs hiccup) under controlled conditions.

• No unexplained reset: each reset must map to a clear reason code and evidence snapshot.
• Hold-up meets spec: t_hold ≥ target under defined Vwindow (use PG/UVLO boundary as Vlo).
• Log completeness: every tested event yields a record with time + ordering + evidence + integrity fields.

H2-10. Field Debug Playbook: Symptom → Evidence → Isolate → Fix

Field debug should minimize instruments and maximize evidence. Each symptom starts with two measurements and ends with a smallest viable fix (parameter / layout / policy).

H2-11. IC/BOM Pointers (Examples): What Parts Typically Appear Here

This chapter provides part categories + common example MPNs for security power and backup designs, without turning it into a shopping list. Each category includes why it is used, what parameters matter, and a replacement window to keep designs robust across supply changes.