What must be distinguishable (event semantics)

• Normal: measurement stays in the expected window with margin.
• OpenFault: loop breaks → sensed V/I moves toward “open” bin and remains there.
• ShortFault: hard short → sensed V/I collapses into “short” bin with high confidence.
• Tamper: loop is bypassed or manipulated → DEOL relationship breaks or falls into a “bypass” region.
• SupervisionFail: ADC saturates, reference drifts, or leakage shifts bins so boundaries are ambiguous.

Single EOL vs DEOL (what more bins buy)

• Single EOL: typically supports robust separation of Normal / Open / Short with guard bands, but has limited leverage to prove bypass/tamper beyond coarse inconsistencies.
• DEOL: expands the “valid states” into multiple resistance combinations, making Tamper detection more reliable by enforcing relationship checks (not just a single threshold).

Hard problems in the field (where false states come from)

• Cable resistance: long runs shift the “Normal” center and reduce margin; guard bands must account for worst-case length.
• Leakage & moisture: humidity and contamination create slow drift toward “short-like” bins (partial short).
• Protection leakage: TVS/ESD parts add bias/leakage that can compress bin spacing, especially at high temperature.

How to set thresholds without becoming a formulas class

• Bins + guard bands: each state has a center region plus a buffer zone to prevent boundary chatter.
• Baseline calibration: record an installation baseline (with checks to avoid “learning” a tampered condition).
• Temperature handling: use segmented thresholds or small temperature-aware offsets to keep bins separated across drift.
• Fail-safe: if separation collapses (ADC near rail / reference unstable), emit SupervisionFail instead of guessing.

Why false alarms happen (three root classes)

• Fast transients: spikes push a sample across a bin boundary for <1–2 samples.
• Contact bounce / chatter: mechanical jitter creates rapid toggles that mimic open/short edges.
• Protection side effects: TVS/ESD leakage and capacitance add a bias path that shifts bins (temperature-dependent).

Three-layer defense (what each layer is for)

• RC filtering: suppress fast spikes; tradeoff is slower edge response (must not hide real open/short).
• Digital debounce: reject short toggles; expressed as a time window or a required count of consistent samples.
• Periodic confirmation: require N consistent samples before latching a fault; use separate clear logic to avoid oscillation.

Latch / clear policy (stability under boundary chatter)

• Fault latch: enter Open/Short/Tamper only after N consecutive in-bin samples.
• Fault clear: exit only after M consecutive normal samples (often M ≠ N to prevent ping-pong).
• Evidence-first: record the first threshold crossing and the final latch time to separate spikes from persistent faults.

How to verify the tuning (evidence metrics)

• fault count: how often a fault is entered.
• time-in-fault: total duration of the fault state.
• bin transition rate: how often samples hop between bins (spike signature).

Output types (why protection and proof differ)

• Relay output: coil inrush + flyback control; contact risk includes stick/weld and bounce.
• Low-side MOSFET: simple switching; short-circuit and ground-bounce dominate stress paths.
• High-side MOSFET: “power-to-load” behavior; inrush, SOA, and reverse/inductive energy handling are critical.

Relay drive (the “mechanical” failure modes still need evidence)

• Coil energize: the first milliseconds set peak current and heat; size the driver for inrush.
• Flyback/clamp: choose a clamp that protects silicon without making release too slow.
• Contact anomalies: welded/stuck contacts can make “OFF” commands ineffective—proof must catch this.

MOSFET drive (shorts and heat are the true design center)

• Short-circuit limiting: fast current limiting or foldback prevents destructive SOA events.
• Thermal protection: OTP triggers should be counted and reported; repeated OTP indicates undersized margins.
• Inductive loads: define the freewheel/clamp path so energy returns safely without corrupting sensing.

Proof (observability) — three evidence levels

• Voltage readback: confirms the output node moved; fast and cheap but not a full “load proof”.
• Current readback: proves the load actually drew current; detects missing load/open circuit.
• Contact/loop proof: verifies relay state or load presence; catches welded contacts and bypass wiring.

Isolation partition (what lives on each side)

• Field side: terminals, protection, DI/DO AFE, sense references, field ground.
• Logic side: MCU, bus interface, configuration, event logs.
• Across barrier: digital signals (isolator/transceiver) and isolated power.

Digital isolators / isolated transceivers (selection focus)

• CMTI behavior: prevents dv/dt-induced bit flips that look like random events.
• ESD robustness: reduce susceptibility to port strikes that couple into logic I/O.
• Failure bias: prefer predictable fail-safe behavior that does not turn outputs on unexpectedly.

Isolated power (noise becomes “decision drift”)

• Isolated DC/DC: provides the barrier supply but introduces ripple and switching noise.
• Post regulation: LDO/filters create a quiet rail for AFE/ADC references and reduce bin jitter.
• Evidence linkage: ripple spikes correlate with increased bin transition rate and false supervision events.

Ground-fault & leakage paths (what defeats “perfect isolation”)

• Cable moisture leakage: slow bias shift compresses DI bins toward short-like regions.
• Shield bonding: shield-to-ground choices create return paths that vary by installation.
• Protection leakage: TVS/ESD leakage increases with temperature and can couple across domains.
• Parasitic capacitance: isolation components have capacitive coupling that carries common-mode noise.

24V front-end (the “dirty edge” that defines reliability)

• Reverse polarity: block reverse current without creating a large dropout that triggers early UVLO.
• Surge absorption: clamp fast spikes so downstream eFuse and DC/DC stay within safe operating windows.
• Input current limiting: control hot-plug inrush into bulk capacitance and downstream converters.

eFuse / hot-swap (turn catastrophic faults into bounded events)

• Soft-start: defines inrush profile, prevents input collapse, and avoids unintended brownout resets.
• OCP / short response: fast limit + controlled retry policy prevents thermal runaway and repeated chatter.
• Recovery strategy: distinguish “persistent short” vs “transient overload” using fault timers and counters.

OVP / UVLO / brownout behavior (make resets explainable)

• UVLO: ensures rails fall in a predictable order; prevents partial operation that corrupts supervision bins.
• OVP: clamps or disconnects before converters saturate and inject noise into sensing references.
• Reset accounting: brownout count and last_reset_reason provide a forensic anchor for field debugging.

Hold-up (event persistence under real outages)

• Goal: guarantee a minimum “write-complete window” for event codes, timestamps, and last-good states.
• Trigger: detect input collapse early (pre-UVLO) and switch to a safe write-and-freeze sequence.
• Completion flag: store a “write_done” marker so the next boot can report whether the last event was finalized.

Buzzer drive & power budget (always-on patterns must be engineered)

• Duty-cycled patterns: reduce average power while preserving urgency; avoid continuous drain during long faults.
• Night/quiet modes: use “silence” that affects buzzer only, while LEDs remain truthful and persistent.
• Driver robustness: protect the buzzer path so a shorted transducer does not collapse logic rails or mask faults.

LED encoding strategy (few channels, high information)

• Core set: Power / Alarm / Fault / Comm / Zone (or channel group) is usually sufficient for field triage.
• Pattern priority: Fault overrides Alarm only when it invalidates alarm meaning (e.g., sensing lost).
• Consistency rule: the same event code always yields the same LED/buzzer code; no hidden “context modes”.

Silence & reset (module-level only)

• Silence: acknowledges audible alert while preserving visible truth; never clears the underlying fault.
• Reset: re-initializes the annunciation state machine and rechecks evidence inputs (DI bins / DO proof / power).
• Auditability: log both actions as events (silence_request, reset_request) with timestamps.

Evidence mapping (make field behavior explainable)

• One-to-one map: each state and sub-state maps to a single event code family.
• No “mystery blinking”: a short lookup table should decode the pattern without manuals full of exceptions.
• Proof-first behavior: if proof contradicts command, show “Fault/Trouble” rather than “Alarm”.

DI self-test (supervision is verified, not assumed)

• Weak stimulus checks: periodically apply a controlled, low-impact test stimulus and verify the sensed response stays within expected windows.
• Window health: track “margin to threshold” so the module can detect supervision chains that are drifting toward false alarms.
• Distinguish failure modes: separate true open/short from supervision degradation (moisture leakage, protection capacitance, cable aging).

DO diagnostics (prove the output actually happened)

• Proof paths: use current/voltage feedback or contact readback to confirm physical actuation.
• Mismatches are first-class events: if commanded and observed disagree, log a proof mismatch rather than silently retrying.
• Bounded fault behavior: overcurrent/thermal trips are counted and time-stamped so recurring overloads are detectable.

Event logging (ring buffer + power-loss safety)

• Ring buffer: keep the last N events with monotonic IDs so ordering remains reliable even if absolute time drifts.
• Commit marker: write event record first, then a commit flag; on next boot, report incomplete commits as forensic clues.
• Brownout marker: record input collapse and reset reasons to separate “electrical environment” from “logic defects”.

What to store (minimum viable forensic fields)

These fields enable fast triage: whether the system is power-limited, supervision-limited, or output-proof-limited.

Port protection (layered roles, not a random parts list)

• TVS: clamps fast edges; may add capacitance/leakage that shifts DI sense windows.
• GDT: handles high energy; requires deliberate return routing so discharge does not cross sensitive references.
• RC: shapes bandwidth and impulse response; changes time constants that interact with debounce and fault confirmation.
• CMC: reduces common-mode injection; effectiveness depends heavily on placement and return path integrity.

Return path (where surge current flows decides whether the module stays truthful)

• Goal: keep surge current on a short, high-energy loop that returns to the correct ground reference.
• Avoid: letting surge return cross the DI sense resistor/reference node, which re-biases the measurement during the event.
• Isolation upsets: common-mode injection can trigger isolation-side resets or lockups; record these as event evidence.

Protection side-effects (leakage/capacitance → threshold drift → false alarms)

• Leakage: tiny currents can matter because supervised DI is often high-impedance; bins lose separation and margins shrink.
• Capacitance: edges look like state transitions; without coordinated sampling windows, transient spikes become faults.
• Post-stress drift: after EFT/surge, track DI window margins and false alarm rate to detect “soft damage”.

Layout rules (keep high-energy paths away from sensitive measurement)

• Shortest clamp loop: place clamp elements close to the connector and route the discharge path with minimal loop area.
• Sensitive keepout: keep DI sense resistor and reference routing away from surge return traces and shield drains.
• Controlled coupling: separate noisy discharge nodes from ADC/reference nodes; avoid running them in parallel.

Test boundary (module-level, reproducible)

• Validate DI supervision, DO drive + proof, protected power behavior, and logging integrity.
• Use controlled injection and fixed measurement points (TP1/TP2/TP3) to keep results comparable across builds.
• Do not convert this into a certification walkthrough; treat stress tests as engineering evidence for design closure.

What must be captured (minimum forensic set)

A test passes only when the observed electrical behavior matches the expected code path, and the log commits survive worst-case interruption.

MPN examples (components commonly used to implement/validate this plan)

These are example parts (drop-in alternatives exist). They help define realistic test expectations and proof paths.

• Digital isolators (logic isolation): ADI ADuM1401 / ADuM1250; TI ISO7741; Silicon Labs Si8641.
• Isolated RS-485 (host/bus): ADI ADM2587E (iso + DC/DC class); TI ISO1410 (isolated transceiver family).
• Isolated DC/DC (barrier power): Murata NXE1/NME series; RECOM RxxPxx family (typical isolated converters).
• Hot-swap / eFuse (24V front-end protection): TI TPS2660; ST STEF01; ADI/LTC LTC4368 (surge stopper class).
• High-side / low-side switches (DO transistor outputs): Infineon PROFET family BTSxxx; TI TPS1Hxxx high-side switch families; low-side drivers such as TI TPIC6B595 (power shift register class).
• Relay drivers: TI DRV110 (solenoid/coil driver class); ULN darlington arrays ULN2803A (basic coil drive), with proper flyback strategy.
• Current sense (proof path): TI INA180/INA181; ADI AD8418; shunt + ADC method.
• TVS (line protection examples): SMBJ class SMBJ33A / SMBJ24A (select per rail); low-cap TVS families for fast lines when needed.
• RTC / time base (for logs): Maxim/ADI DS3231 (high-stability RTC class) when local timestamping is required.
• Non-volatile log storage: FRAM class MB85RC256V (Fujitsu/Cypress class); SPI NOR flash class W25Q64.