H2-1. Use cases and decision entry for high-bay / industrial drivers

What this chapter must accomplish: Provide a fast, testable boundary for “industrial/high-bay,” then turn project inputs into an architecture decision (PFC + isolated CC + surge/EMI + thermal derating + telemetry). No topology lessons, no protocol stacks.

1) Boundary: the 4 things that make this “industrial”

• Grid class: wide-range 90–305Vac or industrial mains (277Vac / 347Vac / 480Vac). The input class defines device stress, UV thresholds, and bus headroom.
• Disturbances: brownout/line dips, short interruptions, generator/line variation. The decision point is whether “no visible dropout” is required or “safe restart” is acceptable.
• Surge / lightning exposure: repeated IEC 61000-4-5 events and long wiring that couples common-mode energy into the driver enclosure.
• Maintenance model: “install and forget” vs serviceable. Telemetry is not a nice-to-have when failures are expensive to diagnose (high ceiling, industrial site).

2) Decision inputs (treat as a project intake form)

This is the minimum evidence set to avoid guessing. Each item maps directly to later chapters (surge, inrush, thermal, validation, field debug).

• VAC range: min / nominal / max (e.g., 90–305Vac; or 480Vac system). Include frequency if variable.
• Line dip profile: dip depth (Vac), duration (ms), and repetition (rare vs frequent). Example: “drops to 160Vac for 80ms.”
• Power level: rated W and operating duty (continuous vs intermittent). Impacts capacitor stress and thermal headroom.
• Thermal envelope: ambient range + fixture cavity temperature expectation. Include airflow uncertainty (“sealed housing”).
• Surge target: kV and source impedance (Ohms) for the environment, plus whether long cable runs are present.
• Reliability goal: lifetime hours target (drives electrolytic stress strategy and derating policy).
• Telemetry needs: required fields (runtime hours, temp max, surge counter, brownout count, fault history, basic energy/Wh).

3) The decision logic (how to choose architecture blocks)

1. Start with the grid class: industrial mains (277/347/480) pushes higher bus stress and stricter creepage/clearance thinking; wide-range (90–305) pushes robust UV hysteresis and dip handling.
2. Lock the surge posture: if repeated surges are expected, assume coordinated SPD layers (energy absorption + clamping + controlled return paths). “One MOV” is not a strategy.
3. Define the interruption behavior: choose between (a) ride-through target (no visible dropout), or (b) controlled shutdown + clean restart. This drives bus energy requirements and UV timing.
4. Commit to thermal derating as a feature: industrial drivers must include a measurable derating curve tied to a trustworthy temperature point (NTC placement).
5. Decide maintainability: if repair is costly, log the events that explain failures (surge counts, brownout counts, thermal peaks, last fault codes).

4) Output of this chapter (what the reader should conclude)

• If the project is 277/347/480 + high surge + maintenance required → baseline architecture is Front-end SPD/EMI + PFC/DC bus + isolated constant-current stage + thermal derating + telemetry/event logs.
• If the project is 90–305 + frequent brownout/dips + “no visible flicker” → emphasize UV hysteresis policy, restart behavior, and evidence-based validation of bus sag vs ILED droop.

H2-2. System architecture: power path + protection + telemetry partition

What this chapter must accomplish: Show the full system partition so later sections can reference measurable nodes. The key is separating energy flow from information flow, and designing telemetry to survive surges without increasing EMI.

1) The 5-segment power path (energy flow)

• AC input interface: where inrush and breaker trips originate (evidence: Iin peak at TP-AC).
• SPD + EMI region: energy absorption/clamping and noise control (evidence: surge event counters; post-event leakage checks).
• Rectifier + DC bus: the system’s “truth node” for brownout and ride-through (evidence: VBUS sag vs time at TP-BUS).
• PFC front-end: defines bus regulation under line variation (evidence: bus ripple and UV thresholds).
• Isolated constant-current stage: controls ILED and enforces output protections (evidence: ILED ripple and fault state).

2) The 2 side paths (information flow)

• Sensing path: NTC + hotspot temperature proxy, DC bus voltage, LED current sense. These are the inputs that drive derating and fault decisions.
• Telemetry path: event log + counters + fault history + basic energy/runtime. The interface must be designed to survive common-mode stress and not inject switching noise.

3) “Measure points” mapping (why each TP exists)

• TP-AC (VAC/Iin): explains breaker trips, inrush, and hot restart failures.
• TP-BUS (VBUS): explains brownout flicker, ride-through, and restart behavior.
• TP-ILED (current ripple): explains visible instability, loop stress, and output behavior under dips.
• TP-NTC (temperature): explains derating correctness and lifetime stress management.
• TP-LOG (event/counters): explains “what happened” after storms or repeated dips when no damage is visible.

4) Telemetry insertion rules (hardware survival, not protocol detail)

• Hard boundary at the isolation barrier: telemetry should not rely on fragile ground references across surge events.
• Surge-first thinking: the weakest interface dies first unless protected; treat it as a “front-line” circuit with its own protection and return path discipline.
• EMI hygiene: sampling bandwidth, filtering, and routing should avoid turning telemetry into an antenna or a conducted-emissions injector.

References (placeholder)

Add vendor datasheets, IEC 61000-4-5 surge test plan references, and internal validation notes here when publishing the full page.

H2-3. High-voltage input realities: brownout, line variation, ride-through targets

Goal: Prevent visible instability and false protection triggers under industrial mains. This chapter turns field input disturbances into measurable thresholds and time-domain evidence: line dip waveform → VBUS sag → ILED droop.

1) Classify the disturbance first (dip vs variation vs interruption)

• Brownout / line dip: VAC drops below normal but does not fully disappear. The main risk is repeated threshold crossing that causes flicker or restart oscillation.
• Line variation / generator input: VAC drifts for seconds to minutes. The risk is running near margins (bus headroom, thermal stress) and triggering protections that were tuned for “clean mains.”
• Short interruption: VAC disappears briefly (ms–hundreds of ms). The design choice is either ride-through or controlled shutdown + clean restart.

2) UVP policy that avoids “threshold chatter”

UVP should be treated as a policy, not a single number. A stable design uses a four-part rule set:

• Trip threshold: where VBUS is declared unsafe for regulation.
• Recovery threshold (hysteresis): must be meaningfully higher than the trip point to avoid re-triggering during sag recovery.
• Debounce time: prevents short glitches from causing a full shutdown.
• Restart behavior: defines how the driver re-enters regulation (e.g., soft-start, limited current ramp, and a minimum “stable-bus” window).

The evidence for UVP correctness is time-aligned behavior: VBUS should cross thresholds cleanly (no repeated toggling), and ILED should not show periodic droop/recovery under a realistic dip profile.

3) Ride-through: translate “no visible dropout” into measurable acceptance

Ride-through is not a slogan. Define it using two measurable outputs and one internal node:

• ILED droop limit: how far output current is allowed to drop (as a percentage) during the interruption.
• Droop duration: how long ILED may stay below its nominal level.
• VBUS minimum: the lowest bus voltage observed during the event (the “truth node” that predicts whether regulation can be maintained).

From these, choose one system-level strategy (without topology theory):

• Energy-first: more bus hold-up so ILED stays near nominal.
• Graceful derating: controlled dim-down during dip, then smooth recovery (prefer “no flicker” over “perfect brightness”).
• Clean shutdown: if ride-through is not required, shut down once, log the event, and restart deterministically (avoid repeated chatter).

4) 480Vac (and other high-line classes): margin thinking at system level

• Headroom under worst-case: margin must consider high-line + transient + surge interaction (VBUS peak matters, not only steady-state).
• Protection interaction: at high line, devices that “look fine” at 277Vac can enter different failure modes (e.g., higher stress at the rectifier/bus node, protection components heating faster, and tighter spacing sensitivity).
• Acceptance must include drift: record VBUS peak and post-event leakage drift (a pass/fail at one time point is not enough for industrial exposure).

5) Evidence fields (loggable and testable)

H2-4. Surge/lightning protection strategy (IEC 61000-4-5) and SPD coordination

Goal: Design for repeated surge exposure with measurable acceptance. This chapter focuses on layered SPD coordination, common-mode vs differential-mode current paths, and post-surge operability (no resets, no dead service port, no hidden leakage drift).

1) Start from a surge target that can be tested

• Specify level: surge kV + source impedance (Ohms), and whether tests include both common-mode and differential-mode injection.
• Define repetitions: repeated events matter because MOVs age; pass/fail must include drift checks (leakage and heating trend).
• Define “still works”: after surge, the driver must regulate, restart deterministically, and keep telemetry/interface functional.

2) Three-layer SPD coordination (division of labor)

• Layer A — energy handling (front): absorbs/handles large energy so downstream blocks do not see destructive stress (often MOV/GDT roles).
• Layer B — fast clamping (near sensitive nodes): clamps residual overshoot to protect control/telemetry/isolation devices (TVS role).
• Layer C — current-loop control (layout): minimizes loop area and parasitic inductance so clamping works as intended; otherwise “good parts” fail in bad loops.

3) Common-mode vs differential-mode: identify the current return path

Protection succeeds or fails based on where surge current returns. Treat this as a path-mapping task:

• Differential-mode: injected between line and neutral; return path stays within the input pair. Focus on DM filtering and clamp coordination at the input.
• Common-mode: injected line/neutral to protective earth or chassis; return path may try to flow through parasitics into logic/telemetry ground unless explicitly controlled.

4) Component roles and failure modes (design constraints)

• MOV: energy absorption and repeated surge endurance. Watch temperature rise and leakage drift as aging indicators.
• GDT: high-energy handling but can introduce follow current risk; coordination must ensure it does not keep conducting in high-line scenarios.
• TVS: fast clamp for sensitive nodes but limited energy; common failure is short-circuit → must coordinate with fuse/thermal fuse actions.
• Fuse / thermal fuse: last-resort containment. A coordinated design ensures safe isolation under MOV thermal runaway or TVS short.

5) Post-surge operability: “it passed, but it resets / the service port died”

• Symptom: light still turns on, but MCU resets, logs are lost, or telemetry port fails.
• Root cause pattern: common-mode surge lifts local ground references; interface protection is treated as ESD-only; return path crosses sensitive areas.
• Hardware-level fixes: harden the service interface as a front-line circuit (own protection + controlled return), keep surge current loops out of logic ground, and log the event (surge counter + last reset reason).

6) Evidence fields (surge acceptance checklist)

References (placeholder)

Add surge test plan references (IEC 61000-4-5), vendor protection device datasheets, and your internal validation notes when publishing the full page.

H2-5. Inrush control: NTC sizing, relay bypass, and cold/hot restart behavior

Goal: Prevent nuisance breaker trips, relay contact damage, and NTC cracking under real industrial usage (multi-lamp simultaneous energization and short power interruptions).

1) Treat inrush as a timeline problem (not a single peak number)

• Phase A — AC applied → rectified bus starts charging: the highest Iin peak typically occurs here.
• Phase B — controlled precharge / soft-start: aim for a predictable VBUS rise without repeated restarts.
• Phase C — normal run with bypass: NTC should stop dissipating significant power, and the relay should stay stable (no chatter).

Industrial “trip reports” are often caused by many luminaires hitting Phase A at the same instant. Design acceptance should include repeated starts and grouped starts.

2) NTC sizing: four constraints that must be satisfied together

• Cold resistance (R25): limits the first-cycle peak current. Too high can make bus charge slow or unstable during marginal mains.
• Single-start energy capability: must cover the bus precharge energy without cracking or drifting.
• Thermal saturation risk: once hot, the NTC resistance collapses; it becomes a weak limiter for the next start.
• Hot restart interval (short off-time): the highest-risk case—NTC is still hot, yet the bus is discharged enough to demand a large charge current.

Define a hot restart window (power-off to power-on interval) and validate inrush behavior inside that window, not only at cold start.

3) Relay bypass: timing + contact stress + fail-safe behavior

• When to close: close after VBUS reaches a stable region and Iin has already fallen below a safe threshold (avoid closing into high di/dt).
• How to avoid arcing: minimize voltage/current discontinuity at the moment of closure (stable bus, no chatter, one-way transition).
• Fail-safe: if relay fails open, the system should avoid NTC overheating (derate or limit retries). If relay sticks closed, the upstream protection chain must contain faults.

4) Bus charging strategy (system-level)

Use an explicit bus charge target so that tests are reproducible:

• VBUS charge time: controlled ramp to reduce Iin peak and reduce stress on input components.
• Retry policy: avoid repeated “charge attempts” that heat NTC and amplify relay wear.
• Group-start readiness: verify behavior when multiple drivers start together (aggregate inrush is the breaker killer).

5) Interaction with SPD / MOV: worst-case combined stress

In industrial sites, a start event may overlap with a mains disturbance. Worst-case risk rises when:

• High-line or noisy mains causes a brief overvoltage at the input, pushing the MOV into conduction.
• NTC is already hot (low resistance), so inrush is less limited.
• MOV and NTC simultaneously dissipate energy, increasing temperature rise and aging rate.

Acceptance should include post-event drift checks (MOV leakage drift and NTC thermal behavior), not only “it started once.”

6) Evidence fields (what to record and why)

H2-6. Thermal design & lifetime: NTC placement, derating curves, electrolytic stress

Goal: Extend field lifetime by controlling the true stress drivers: hotspot temperature, electrolytic capacitor heating, and stable derating behavior that does not “breathe” around thresholds.

1) Temperature sensing is only useful if the sensor represents the limiting stress

Thermal decisions should be tied to the weakest lifetime link. In high-bay/industrial drivers, the limiting link is often:

• Driver hotspot (power stage/rectifier region)
• Electrolytic capacitor stress (ripple current → self-heating)
• LED/fixture thermal path (system-level, not internal LED physics)

2) NTC placement: “hotspot” vs “ambient” and common failure patterns

• NTC too “ambient”: reads low while internal hotspot rises → insufficient derating → accelerated aging and sudden early failures.
• NTC on the wrong local hotspot: reads high or noisy → unnecessary derating and visible brightness instability.
• Best practice (engineering level): place NTC where it correlates to the lifetime limiter and is thermally coupled with low variance across builds.

A robust design validates the bias between NTC reading and a true hotspot probe point, then uses that bias in acceptance.

3) Derating curves: choose the weakest link, then enforce stability (hysteresis + slew)

Thermal derating should be a mapping (temperature → target ILED) plus a policy that prevents oscillation:

• Start-derating point: where lifetime stress becomes unacceptable.
• Foldback region: ILED reduced gradually to maintain operation without overheating.
• Hysteresis: recover threshold must be lower than trip to prevent “breathing.”
• Slew/ramp limit: brightness changes should be bounded to avoid visible steps and loop instability.

4) Electrolytic capacitor stress (engineering level)

• Ripple current: increases internal heating and accelerates aging.
• Temperature rise: is the lifetime multiplier in the field (trend matters).
• Actionable acceptance: record a ripple proxy / measurement point and a cap temperature proxy, then validate that derating reduces stress in the highest ambient scenarios.

5) OTP vs thermal foldback: shutdown vs derate

• OTP (hard shutdown): maximum protection, but may cause blackouts and repeated restarts if thresholds are noisy or hysteresis is weak.
• Thermal foldback: better availability, but requires stable mapping (hysteresis + slew limiting) and deterministic recovery conditions.
• Fail-safe rule: if sensing is suspect or temperature rises abnormally fast, prioritize containment (shutdown and log).

6) Evidence fields (thermal and lifetime)

References (placeholder)

Add inrush measurement notes, relay/NTC component datasheets, and internal thermal validation logs when publishing the full page.

H2-7. LED current quality: ripple, flicker risk, and deep-dim stability (industrial constraints)

Goal: Deliver an industrial “minimum correct” current quality: controlled ripple, low flicker risk, and stable operation across temperature, aging drift, and high-line power conditions—without turning this page into a dedicated flicker standard guide.

1) Define what “good enough” means for industrial luminaires

• Ripple is bounded: quantify ILED ripple % and ensure it stays within the product’s acceptance window.
• Low-frequency content is controlled: the visible-risk region is usually driven by low-frequency components (IEEE 1789 can be referenced as a pointer, not the core of this page).
• No breathing / hunting: deep dim (if used) prioritizes stability and repeatability over extreme dim ratios.
• Stable across conditions: verify behavior vs ambient temperature, warm-up, and aging drift.

2) Source separation: find where ripple originates before “fixing” it

Industrial debugging is fastest when ripple is separated into three buckets using time-aligned evidence:

• VBUS-driven ripple: bus ripple or low-frequency energy variation leaks into ILED.
• Loop-driven breathing: COMP/FB shows low-frequency motion even when VBUS is relatively clean.
• Output coupling / filtering: VBUS and COMP look stable, but ILED still carries ripple or spikes (layout coupling or output filtering weakness).

This page stays at the “measure-and-separate” level. Detailed mitigation methods belong to the dedicated Flicker Mitigation page.

3) Deep-dim stability (if present): industrial priority order

• Priority #1: no periodic pulsing, no sudden step changes, no restart loops at low current.
• Priority #2: predictable recovery when temperature or line conditions change.
• Priority #3: dim ratio—only after stability is proven.

4) Evidence fields (what to capture)

H2-8. Protection set: OVP/UVP, open/short LED, brownout hysteresis, safe recovery

Goal: Avoid the most hated field behavior: intermittent faults that cause repeated flashing or repeated restarts. This chapter is written as threshold + debounce + action + recover (with logging).

1) Use one protection language for all faults

• Detect: threshold + sampling window + debounce (avoid false triggers during cold start and transients)
• Action: derate / hiccup / latch / retry (choose by safety and stress)
• Recover: recover threshold + stable window + max retry / cooldown
• Log: fault code + counter + last reason + recovery time

2) Open-string / short-string / output OVP: prevent mis-detection

• Cold-start guard: allow a startup window where Vout/ILED is building and transient open-string conditions are not treated as permanent faults.
• Priority and timing: open-string often coexists with Vout rise; define which detector dominates and how long it must persist.
• Connector bounce reality: add debounce and bounded retry. Unbounded retries become visible flashing and repeated stress.

3) Brownout: hysteresis + stable recovery (no breathing)

• Trip threshold and recover threshold must be separated (hysteresis) to avoid oscillation near the edge.
• Stable window: require VBUS to remain above recovery threshold for a minimum time before re-enabling full current.
• Recovery style: prefer soft recovery (controlled ramp) rather than hard off/on toggling when visibility matters.

4) Hiccup vs latch vs retry: choose by safety and field experience

• Hiccup: good for transient faults but must include cooldown and frequency limits (otherwise it becomes a flashing generator).
• Latch: best for persistent or severe faults; prevents repeated stress on power components and wiring.
• Retry: useful for intermittent faults (e.g., contact issues), but always bounded by max retries and a minimum cool-down.

5) Event logging fields for maintenance

Industrial drivers earn trust when the fault is explainable in the field. Log fields should be actionable:

• fault_code, fault_counter
• recovery_time, last_reset_reason
• brownout_counter (and any relevant input event counters)
• snapshot: Vout and ILED state when the fault was declared (at least a scalar capture if full waveforms are not stored)

6) Evidence fields (protection acceptance)

References (placeholder)

Add product acceptance limits for ripple, internal stability test logs, and any standard pointers (e.g., IEEE 1789) when publishing the full page.

H2-9. Telemetry & maintenance: what to measure, how to log, how to survive surges

Goal: Make the driver maintainable. Telemetry is treated as a data model plus interface survivability—without diving into DALI/DMX/wireless protocol stacks.

1) Minimum telemetry field set (industrial “must-have”)

The field set below is intentionally small: it enables trend analysis and root-cause hints without turning the node into a complex monitoring system.

• runtime_hours: supports lifetime and maintenance scheduling decisions.
• energy_Wh: provides a coarse load profile; anomalies can indicate persistent derating or abnormal duty cycles.
• temp_max: peak temperature is often more actionable than instantaneous temperature for reliability correlation.
• surge_event_counter: helps correlate degradation with surge exposure over time.
• brownout_count: characterizes line quality and repeated line-dip stress.
• fault_history (last N): stores the latest events with code + timestamp/uptime + snapshot.

2) Sensor point selection (measure for explainability)

• NTC(s): choose placement based on explainable derating and lifetime stress (hotspot vs ambient). A “temp_max” metric is only meaningful if the sensor represents the intended stress point.
• VBUS: links brownout behavior to bus sag and restart events; closes the loop with line-dip evidence.
• ILED: ties brightness anomalies and protection events to current reality; enables meaningful fault snapshots.
• Estimated stress (optional): infer key component stress trends from hotspot temperature and operating conditions (trend alarms, not precision thermal modeling).

3) Interface survivability (after surges, telemetry must still work)

Industrial maintainability fails if the interface dies or misbehaves after a surge event. Survivability is treated as layered strategy:

• Physical survival: limit energy at the connector, provide controlled return paths, and avoid injecting surge energy into logic ground that causes MCU resets.
• Common-mode immunity: keep the telemetry link readable under high common-mode disturbances (ground reference strategy, isolation, filtering at the boundary).
• Fail-safe behavior: a damaged or shorted telemetry port must not disturb the power regulation path. The power chain remains stable even if the telemetry layer is degraded.

4) Log schema (names, units, rates, triggers, retention)

Telemetry becomes useful only when the schema is explicit and exportable.

5) Explainable faults (field code → evidence points)

Fault records should immediately indicate which evidence point to inspect first.

• BROWNOUT: check VBUS minimum after dip, recover stable window, and brownout counter trend.
• OTP / FOLDBACK: check temp_max and hotspot sensor credibility (placement vs actual heat source).
• OPEN / SHORT: check ILED and Vout snapshots around startup and during connector disturbances.
• POST-SURGE anomalies: verify telemetry link health, counter increments, and absence of corrupted history entries.

H2-10. Validation plan: bring-up, surge, thermal, and long-run reliability screens

Goal: Turn validation into a workflow with gates: survive first, then robustness, then lifetime screens, then symptom-based pre-check—without reproducing full standards.

1) Bring-up (survive first)

• Current-limited power-up: prevent catastrophic first-power failures while confirming the bus charge behavior.
• Bus charge verification: capture VBUS ramp and settle; confirm no abnormal overshoot or repeated restarts.
• Constant-current establishment: confirm ILED ramp, absence of false open/OVP detection during startup guard.
• Baseline logging: confirm runtime and counters start clean, and temp reporting behaves as expected.

2) Surge validation (step levels + post-surge self-test)

• Step levels: run surge tests progressively (lower to higher), verifying behavior after each step.
• Post-surge self-test (must-have): after each step, confirm (a) normal output regulation, (b) protection actions still correct, (c) telemetry interface readout is still functional and counters increment rationally.
• Degradation checks: look for interface read errors, corrupted history entries, abnormal leakage trends, or altered recovery timing.

3) Thermal validation (derating curve credibility)

• Thermal sweep: verify ILED vs temperature derating curve under controlled ambient changes.
• Airflow sensitivity: repeat key points with airflow variation (duct/fan changes) to confirm stable behavior.
• Recovery quality: confirm recovery does not create visible flashing (stable window + soft ramp policy).
• Telemetry correlation: confirm temp_max captures meaningful peaks tied to derating and stress.

4) Long-run screens (lifetime stress patterns)

• High-temp powered run: monitor temp_max, fault history, and any drift in behavior over time.
• On/off cycling: watch inrush-related stress signatures and restart stability across repeated cycles.
• Brownout cycling: confirm no breathing near thresholds and recovery remains deterministic (no repeated restart loops).
• Log export: ensure logs remain readable and consistent after extended operation.

5) Symptom-based pre-check (EMI/harmonics without clause deep dive)

Only capture observable symptoms and the evidence required to diagnose functional impact:

• Symptoms: unexpected protection triggers, telemetry misreads, unstable brightness, abnormal restart cadence.
• Evidence: VBUS / ILED / COMP captures plus log counters and fault history around the event.
• Gate: no functional failures; logs remain coherent and explainable.

6) Evidence package (what to keep)

References (placeholder)

Add internal validation reports, acceptance criteria, and any standard pointers used for surge screening and symptom-based pre-check when publishing the full page.