1) Protection Domains (what must be protected)

• Input domain (AC/DC/PoE feed): highest energy exposure; dominated by surge/lightning coupling and line disturbances.
• Bus domain (DC link & distribution): vulnerable to UVLO/brownout and repetitive burst disturbances; often where resets begin.
• Load domain (LED strings / wiring): open/short events, hot-plug transients, and reverse energy injection from long cable runs.
• Logic & I/O domain (MCU, aux rails, PHY-side rails): low-energy but fragile; ESD/EFT can create silent leakage or repeated resets.

Domain separation exists to decide where energy is allowed to go and which parts may sacrificially fail (clamps) versus which parts must survive (switching silicon, metering core, and control rails).

2) Evidence Chain (what must be proven)

• Event: surge / ESD / EFT (burst) / lightning-like common-mode coupling.
• Action: clamp, current-limit, disconnect, auto-retry, latch-off (and any thermal foldback behavior).
• Outcome: brownout/reset, hard failure, degraded brightness, abnormal heating, communication errors, parameter drift.

A useful system makes the action observable and the outcome attributable. That requires both a fast protection path (trip) and a persistent proof path (counters + logs + timestamps).

1) Symptom groups (start from what is observable)

• Reset / reboot: repeated restarts, flickering on/off, intermittent recovery after power cycle.
• Hard fail: no light output, no response, or protective shutdown that never recovers.
• Degrade: still turns on, but runs hotter, dimmer, or derates earlier than before.
• Comms errors: sporadic CRC/errors, missing acknowledgements, unstable auxiliary interfaces.
• Drift: thresholds shift, current accuracy changes, nuisance trips increase over time.

“Degrade” and “drift” are the costly failures: the product appears functional but silently loses margin. Without metering + event logs, these cases are easily misattributed to general design quality rather than transient exposure.

2) Threat classes (translate into damage mechanism + signature)

• Surge: high-energy line transient → clamp stress, silicon overstress, latch-up, and parameter shift.
  Typical signature: clamp activation + bus voltage dip + current-limit/disconnect event.
• ESD: localized discharge at I/O/connector → latent leakage or intermittent interface weakness.
  Typical signature: I/O fault flags + rising comms error count + unexplained standby current.
• EFT/Burst: repetitive fast transients → repeated UVLO/brownout, reset storms, nuisance trips.
  Typical signature: reset_reason + brownout counter + short-duration undervoltage events.
• Lightning-like common-mode coupling: large CM energy → ground reference shift and multi-rail anomalies.
  Typical signature: simultaneous anomalies across domains + elevated event density around the incident time window.

1) The 4 stages and what they guarantee

• Clamp (TVS/MOV/GDT): reduces voltage spikes to a defined ceiling; may be sacrificial under extreme energy.
• Limit (eFuse/HSS): enforces a programmable current/energy envelope; prevents “long-duration stress.”
• Disconnect (latch-off / ORing / reverse block): isolates the downstream rail when the envelope is exceeded.
• Recover (auto-retry vs latched + service): defines whether the product self-heals or requires intervention.

Practical rule: Clamp decides peak, Limit decides energy, Disconnect decides survival, and Recover decides user experience. If any stage is missing, the “weakest stage” becomes unpredictable silicon damage.

2) Sacrificial vs recoverable: when each is required

• Sacrificial-first (clamps accept damage): when external energy is unbounded or line coupling is harsh (outdoor, long cable runs).
• Recoverable-first (eFuse/HSS self-manages): when downtime/false trips are costly (commercial, networked nodes, frequent switching).
• Hybrid is common: clamp absorbs peak; eFuse limits energy and sets the action policy.

The design objective is not “never fail.” It is controlled failure or controlled recovery, with evidence to prove which occurred.

1) Capabilities that matter in luminaires

• Inrush shaping: soft-start, dv/dt control, hot-plug handling to avoid nuisance trips.
• Fault handling: programmable current limit, short-circuit response, thermal protection, OV/UV gating.
• Energy direction: reverse current block / ideal-diode ORing behavior to prevent back-feed damage.
• Observability: fault pins + telemetry registers (reason, peak, counters) to build an evidence trail.

2) SOA + repetition: why “survived once” can still fail later

• Peak vs energy: a clamp handles peak; the eFuse limits time-integrated stress on the pass FET.
• Thermal accumulation: dense auto-retry cycles can create heat oscillation (cool → retry → re-trip).
• Field diagnosis requirement: log retry_count_window, duration, and temp_bin to correlate failures with event density and recovery time.

Mechanism-first takeaway: repeated disturbances turn into failure when the protection policy allows too much “on-time under stress” before a full disconnect, or retries are too aggressive for the thermal time constant.

1) Current sensing: shunt vs Hall (what changes the evidence quality)

• Shunt (resistor + amplifier): high bandwidth and linearity, ideal for capturing short over-current peaks. Key trade-offs are loss/heat and common-mode robustness during surges.
• Hall (magnetic sensing): galvanic isolation and low insertion loss, useful when the measurement domain must be isolated. Trade-offs include offset/temperature drift and limited peak fidelity for very fast events.
• Evidence-first selection: protection evidence prioritizes no-saturation peak capture; metering evidence prioritizes stable, calibratable drift behavior.

If the sensor saturates during the disturbance, peak is understated and root-cause becomes guesswork. Sensor robustness during common-mode excursions is therefore part of the protection chain, not an afterthought.

2) Voltage sensing: divider vs isolated sampling (avoid injecting the transient)

• Divider sampling: simplest and fast, but must be protected so surge energy is not injected into the logic domain.
• Isolated sampling: separates hazardous domain from measurement domain; often safer for evidence retention but may trade bandwidth and cost.
• Common-mode reality: surge/lightning-like events can shift reference potentials; the measurement chain must remain functional to preserve bus_min, V_valley, and event timing.

Metering is only valuable if it survives the incident. Measurement-domain protection is a prerequisite for a credible evidence chain.

1) Core accounts (the minimum set worth keeping)

• Instant/average: V/I/P (instant + average) for trend baselining and anomaly detection.
• Energy: Wh (and optionally Ah) to quantify usage and support lifecycle accounting.
• Runtime: runtime_h, switch_count as exposure proxies for stress and service cycles.
• Temperature linkage: temp_bins for lifetime inference and for explaining derating/degradation.

2) Health indicators (turn incidents into diagnosable signals)

• Protection density: protect_trip_count_window, event_density.
• Power integrity: brownout_count, bus_min_hist (valley distribution, not only min).
• Performance drift: P_avg_drift / I_error_trend to detect aging, contamination, or thermal path degradation.
• Policy quality: retry_count_window, latch_count to expose nuisance trips vs true hazards.

These indicators answer three field questions with evidence: “How often?”, “How severe?”, and “Is it getting worse?”

2) NVM choice: match the medium to the write pattern

• FRAM: best for frequent small writes (counters, compact event records), strong power-loss tolerance.
• EEPROM: suitable for moderate logging rates; control update frequency to avoid hot-spot wear.
• Flash: large capacity but erase/write granularity demands append-only design and careful recovery rules.

Reliability comes from the log structure first; the storage medium determines endurance and recovery margins.

3) Crash-safe write rule: payload first, commit last

• Stage A (payload): write the full record body and CRC, but do not “publish” it yet.
• Stage B (commit): write a small commit marker that turns the record valid.
• On reboot: scan backward for the last valid commit marker to rebuild head/tail.

Avoid “index-first” updates. If power fails mid-write, the commit marker cleanly separates valid vs incomplete records.

1) Probe points that answer “what happened” vs “what reacted”

• Input & clamp: before/after clamp to quantify residual stress (supports peak_v evidence).
• eFuse/HSS VIN/VOUT: confirm limit/disconnect behavior (supports trip_action).
• Current sense / IMON: observe current limiting dynamics and event duration (supports peak_i, duration).
• MCU rail / reset: attribute resets to power integrity vs unrelated logic (supports brownout_count correlation).

2) Two-waveform triage (default SOP)

• Waveform #1: V_in and/or V_after_clamp (residual voltage and valleys).
• Waveform #2: I_limit or IMON at the protection stage (action timing and severity).
• Optional #3: MCU_VDD or RESET (prove reboot causality).

The goal is not to “measure everything” but to prove the sequence: disturbance → protection action → system consequence.

1) Coordination objectives (what “good” looks like)

• Route energy correctly: large transient energy is handled by the clamp path, not by metering/MCU rails.
• Protect expensive silicon: the most fragile domains (metering SoC, ADC front-end, MCU) must see reduced residual stress.
• Maintain system continuity: short disturbances should not become repeated resets or “false faults.”

2) Common failure patterns (why “more parts” can die faster)

• TVS placed too late: the transient hits switches or metering ICs first; the clamp acts after damage occurs.
• eFuse limiting too slow: MOV absorbs repeated energy, overheats, and drifts or fails after multiple events.
• Thresholds too tight: EFT-like bursts trigger nuisance trips, creating repeated retry/reset storms.

When coordination fails, the log typically shows either “no action during high peak” or “too many actions during low severity.”

1) Device-side telemetry outputs (what to export)

• Periodic snapshot: Wh, runtime_h, temp bins, drift summaries, valley histogram summaries.
• Event report: event_type, peak, duration, trip_action, rail_id, time_base, window counters.
• Rate control: during event storms, report counts/summary first and limit detailed records to the latest N.

2) Local maintenance workflow (field-ready sequence)

• Read dashboard first: energy/runtime, trip density, brownout exposure, drift indicators.
• Read latest N events: confirm type/severity/action and timeline ordering.
• Capture 2-wave evidence: V_in (or V_after_clamp) + I_limit, aligned to the trip edge.

The fastest root-cause path is: dashboard anomaly → event pattern → two waveforms to prove sequence.