System Interlocks: PG/FAULT→EN/ILIM, Hold-Up Tactics

Q: How do I size a hold-up capacitor or supercap for logging and safe shutdown?

Use C ≥ (I_load/η)·t_hold / (ΔV_allow − I_load·ESR). Include temperature and aging margin. Confirm that t_boot + t_mount + t_sign + t_flush ≤ t_hold. If not, enter “limit-maintain” mode: reduce load via ILIM and commit only the minimal, verifiable log set.

Q: Can bypass be used for field maintenance without risking reverse current or overheating?

Bypass is time-boxed and current-limited. Specify I_bypass and T_window in BOM, monitor temperature rise, and ensure reverse-current blocking. Maintain PG/FAULT visibility even in bypass and auto-exit when limits are reached. Never use bypass to mask unstable upstream rails.

Q: What’s the simplest interlock that still handles contact-resistance degradation gracefully?

Measure ΔV/I to estimate R_contact and watch its trend. On threshold crossing, step ILIM down and flag maintenance; deny only if temperature or I_rev exceeds limits. This avoids nuisance trips while preventing hot-spot escalation and connector damage.

Q: How do I unify PG/FAULT polarity differences across brands with open-drain wiring?

Force open-drain for all status pins; normalize polarity with inverters or firmware. Use a single pull-up rail and a shared debounce window. Document polarity, pull-up value (e.g., 10 kΩ), and tPG-valid in the Cloud Mapper so cross-brand swaps don’t break logic.

Q: Should EN be gated by PG only, or also by ILIM/thermal status?

Gate EN with PG_voted and supervisory status: ILIM state, thermal threshold, and retry timers. Priority: allow → limit → deny. EN should not assert when ILIM is already degraded or thermal is latched. This prevents re-enabling into unsafe load conditions.

Why system-level interlocks matter

Device-level protection is insufficient against sequence hazards and cross-rail interactions. A robust power path requires PG→EN/ILIM interlocks plus a three-state strategy: Allow → Limit → Deny. In this philosophy, PG is a voting input (admission conditions), EN is the gatekeeper, and ILIM is the degradation valve.

Risk chain to stop (real archetypes)

Upstream not settled: AC-DC startup ripple and PFC hunting; Hot-Swap closes early → inrush spike + SOA violation.
Dual-source ping-pong: A/B rails within tens of mV → Ideal-Diode flip-flop → elevated I_rev heating, brownouts.
Contact degradation: R_contact creeps up → local hot spots → false PG and intermittent resets under load step.

Interlock philosophy

PG ≠ regulated DC; it is a voted admission signal. Combine multiple PG sources via open-drain AND with debounce (t_PG-valid) and timing guard (t_EN-guard) before enabling downstream converters.

Three-state strategy

Allow when PG-voted true and thermal/ΔV/I_rev are healthy. Limit first on faults (ILIM down-shift, soft-start re-pull) to keep logging & graceful actions. Deny only after exceeded limits or exhausted retries (latch or timed recovery).

Event lifecycle

Admission → Degrade → Deny → Recover, bound to PG/FAULT/thermal/ΔV and timers; every transition creates an auditable log.

Recommended parameter bands

Debounce tPG-valid: 1–5 ms (noisy backplanes use upper range).
Enable guard tEN-guard: 2–10 ms (cover upstream settling & sampling windows).
Limit ladder: 1–2 steps before deny (e.g., 100%→70%→deny).
Thermal handoff: 85–100 °C triggers deny or longer cool-off.
Retry budget: 2–3 attempts with exponential backoff (e.g., 20/80/200 ms).

Minimal log dataset

Timestamp, monotonic counter, supply domain ID.
Trigger source: PG/FAULT/THERM/ΔV/I_rev.
Decision: Allow/Limit/Deny; retry index; timers used.
Measured snapshot: V, I, T, ΔV, I_rev, ILIM step.

Figure S1 — System interlocks: PG voting drives EN/ILIM into Allow/Limit/Deny.

One-sentence principle: PG is a voting gate; EN/ILIM execute policy. Incident mapping: (1) upstream unsettled → increase t_PG-valid, enforce t_EN-guard, prefer Limit before Deny; (2) ΔV ping-pong → add ΔV_hys and t_min-reselect; (3) contact rise → thermal-linked Limit→Deny with log & lockout.

BOM & migration reminders

Three-state policy must be configurable and bound to PG/FAULT; never hard-wire PG to EN.
Record tPG-valid, tEN-guard, ILIM ladder, retry budget, and cooldown policy in BOM notes.
When migrating, re-tune ΔV/thermal limits and re-run admission/deny tests before approving cross-brand parts.

Single / Dual source & cascades

Three architectures dominate: single-source cascades, dual-source OR-ing, and backplane-card. Interlocks define admission, degradation, and safe fallback across transient and fault conditions.

Figure S2 — Common interlock topologies: cascade, dual-source OR-ing, and backplane-card.

Power-up sequences

Single-source: AC-DC PG↑ → Hot-Swap PG↑ → DC-DC EN↑ (each step gated by t_PG-valid and t_EN-guard).
Dual-source: Preferred source satisfies ΔV_trip & PG↑ → EN↑ (other source held by OR-ing controller).
Backplane-card: PG_bus↑ (debounced) ∧ Card PG↑ → Card EN↑ (local guard).

Fault fallback (graceful first)

PG↓ or surge detected → Limit (ILIM step-down, re-pull soft-start) + log.
Repeated trips or thermal threshold → Deny with latch or timed recovery.
Dual-source: if active source fails and ΔV allows, switch to standby (respect t_min-reselect & ΔV_hys).

Tuning ranges (defaults to refine per design)

ΔV_trip (priority): 10–40 mV; ΔV_hys ≥ 2× ripple p-p.
t_min-reselect: 50–200 ms to suppress ping-pong.
I_rev(max): per connector/plane; verify P ≈ I_rev × V_drop vs. thermal budget.
PG_bus pull-up: 4.7–22 kΩ per bus C and length.

Acceptance & tests — Single/Dual: verify power-up ordering; inject ±ΔV steps to keep switchovers <0.2 Hz and dwell ≥5×t_min-reselect; backplane: PG_bus jitter ≤ t_PG-valid/2 must not raise EN. Log each transition with source & policy.

BOM & migration reminders (topologies)

Dual-source: record ΔV_trip=__ mV, ΔV_hys=__ mV, t_min-reselect=__ ms, I_rev(max)=__ A.
Backplane: PG_bus=open-drain AND; pull-up __ kΩ; local debounce t_PG-valid=__ ms; EN guard t_EN-guard=__ ms.
Re-validate after any cross-brand swap; update logs/telemetry schema for policy mapping.

PG / FAULT / EN / ILIM / TMR model

PG (Power Good)

Default as open-drain, often active-high after pull-up. Treat PG as a voting input. Add debounce tPG-valid=1–5 ms and RC/DF filter. Choose pull-up 4.7–22 kΩ per bus C & length.

FAULT

Open-drain, usually active-low. Clear behavior varies: auto, command, or power-down. Record latched vs momentary sources (OC/OT/UV/OV/I_rev).

EN (Enable)

Gatekeeper with threshold & hysteresis: V_EN(th), V_EN(hys). Add an external guard delay tEN-guard=2–10 ms. Never hard-wire PG to EN directly.

ILIM (Current limit)

DAC / resistor / register controlled. Modes: constant-current or foldback. Use a downgrade ladder (e.g., 100%→70%→50%) and a recover threshold (≤0.7× trip or ΔT ≥ 10–15 °C).

Timers: TMR / RETRY

Debounce & guards (T_PG_valid, T_EN_guard), retry windows (e.g., 20/80/200 ms), latch cooldown, and T_min-reselect for dual-source anti-ping-pong.

PMBus / I²C field mapping (unified keys)

Normalize brand-specific registers into these keys for cross-brand policy reuse: PG_STAT, FAULT_LOG, ILIM_CFG, RETRY_CFG, THERM_STAT, ΔV_STAT.

Example — TI: STATUS_WORD/STATUS_IOUT/ON_OFF_CONFIG → FAULT_LOG/PG_STAT/EN-policy; IOUT_OC_FAULT_LIMIT → ILIM_CFG.
ST, NXP, Renesas, onsemi, Microchip, Melexis: map their STATUS_*/CONFIG_*/PROT_* to the unified keys above. Keep the IC registers intact; do semantic mapping in MCU/cloud.

Figure S3 — Unified signal timing: PG debounce, EN guard, ILIM steps, FAULT and retry timers.

Minimal interlock wiring & registers

Wiring: PG lines → open-drain AND → local RC → MCU/logic → EN; FAULT → MCU/logic → (EN↓ or ILIM↓).
Regs (starting): ILIM_CFG.step=[100,70]; RETRY=[20,80,200]ms; T_PG_valid=3ms; T_EN_guard=5ms; FAULT_LOG depth ≥ 8.

Acceptance & tests

Inject PG chatter (< T_PG_valid) ⇒ EN must not rise.
Apply short surge ⇒ first trip enters Limit (ILIM↓); repeat + high temp ⇒ Deny.
Clear FAULT per policy; verify retry and cooldown behavior and complete logs.

BOM & migration reminders

Unify open-drain polarity for PG/FAULT and document pull-ups.
Insert tEN-guard before EN; ban PG→EN hard-wire.
Start ILIM more conservative than legacy; relax after thermal/surge regression passes.

Allow / Limit / Deny policy library

Power-up

Trigger: PG_VOTED=1 & T_PG_valid met.
Action: EN↑, soft-start, SOA coordination.
Exit: SS done or FAULT ⇒ Limit path.

Short / Surge

Trigger: OC/surge or FAULT.oc=1.
Action: Limit-first (ILIM↓ + soft re-pull), log & count.
Exit: Repeat within N or high temp ⇒ Deny (EN↓, latch/cool).

Dual-source switch

Trigger: ΔV_trip, PG_A/B change.
Action: Enforce T_min-reselect & ΔV_hys, cap I_rev; optionally Limit before switch.
Exit: Active source stable & PG_VOTED=1, log event.

Maintenance (Bypass/Maintain)

Trigger: Maintenance command or critical-rail keep-alive.
Action: Bypass (time-limited/audited) or Maintain (keep key rails + ILIM + thermal guard).
Exit: Time elapsed or risk ↑ ⇒ resume policy or Deny.

Cold-start

Trigger: Main source UV, need auth/log.
Action: Use hold-up (cap/supercap) to power MCU; PG delay window for signing/logging.
Exit: Main recovers → standard power-up; else limited retries → Deny.

Figure S4 — Interlock policy state machine linking PG/FAULT to Allow, Limit, or Deny with timers.

Executable test skeleton

Power-up: inject PG pulses shorter than T_PG_valid ⇒ EN remains low.
OC/Surge: first event ⇒ Limit (ILIM↓); second + hot ⇒ Deny (latch/cool).
Dual-source: ±ΔV staircases ⇒ switch rate < 0.2 Hz; dwell ≥ 5×T_min-reselect; I_rev within budget.
Maintenance: in Bypass, overheat or reverse-current ⇒ immediate exit to policy or Deny.
Cold-start: hold-up powers MCU for sign/log within PG delay window; on failure limit retries then Deny.

BOM & migration reminders

Declare Limit-first priority & thermal constraints; document ILIM.step[], RETRY_CFG, T_min-reselect, ΔV_trip/hys, T_cooldown, THERM thresholds.
Before cross-brand swap, update field mapping (Chapter #signals) and re-run the five policy use cases.

Sizing & supercap tactics

Ideal capacity

Use a first-order estimate: C ≥ I_load × t_hold / ΔV_allow. Reserve margin for temperature and aging (≥15%).

With ESR & efficiency

Practical sizing: C ≥ (I_load/η) × t_hold / (ΔV_allow − I_load × ESR). Evaluate at worst-case combo (low temp + aged ESR).

Logging window

Ensure t_boot + t_mount + t_sign + t_flush ≤ t_hold. If exceeded, degrade to limited-current + minimal log.

Supercap tactics (parallel / series / revive)

Parallel: C adds; ESR lowers. Check loop inductance to limit peak inrush.
Series: double voltage, half capacity (per string), ESR adds. Must balance (passive 100–470 kΩ/cell or active).
Revive: after storage, pre-charge each cell to a safe threshold (e.g., ~2.2 V) with controlled current.
I_recharge limit: set by rail headroom / thermal / connector rating; implement via series R or CC source (USB-C revive supported).

Worked example

Target: I_load=0.8 A, t_hold=120 ms, ΔV_allow=1.2 V, η=0.9, ESR=40 mΩ → C≈91 mF; with 1.25× margin choose ≈120 mF. Record in BOM: C_hold-up≈120 mF; ESR_total≤40 mΩ; t_hold≥120 ms.

Acceptance & bench correlation

Spice step-load + power-loss events; measured ΔV and duration within <10% of formula.
Repeat at −20 °C & aged ESR; re-allocate ΔV_allow/ESR budget if out of spec.

Figure S5 — Hold-up capacitor sizing with ESR/efficiency corrections and minimum logging time.

BOM & migration reminders

C_hold-up = ___ mF; ESR_total ≤ ___ mΩ; t_hold ≥ ___ ms to complete logs & orderly shutdown.
I_recharge_limit = ___ A (series R or CC module PN); balance method: passive ___ kΩ/cell or active balancer PN.
Document storage/temperature profile with a revive sequence and regression checkpoints.

Wiring patterns & priorities

Open-drain PG/FAULT voting

Multi-PG → open-drain AND → single pull-up (4.7–22 kΩ) → local debounce (1–5 ms) → MCU/logic. Segment pull-ups on backplane to reduce bus C.

EN guard & active inhibit

Add tEN-guard (2–10 ms) before EN; give FAULT/THERM the right to force EN low. Add series R + clamp on gate path to avoid back-drive.

ΔV_trip & priority

Diff-amp + comparator with hysteresis: set ΔV_hys ≥ 2× ripple p-p; priority window 10–40 mV; T_min-reselect=50–200 ms.

Isolation & level compatibility

PG/FAULT polarity must match across domains via digital isolators; normalize to 3.3 V open-drain at MCU side when mixing 3.3/5/12 V rails.

Layout/DRC checklist

Unified open-drain polarity; single-point pull-up traceable.
EN guarded; active-inhibit (FAULT/THERM→EN↓) verified.
ΔV_trip sampling symmetry; resistor tolerance/tempco checked.
Isolation creepage/clearance per voltage domain.
Hot-swap gate/sensing loops shortest; decoupling near pins.
Hold-up/supercap return path inductance minimized.

Host register set (mapping to #signals)

ILIM_CFG (mode/level/steps/recover)
RETRY_CFG (sequence & count)
PG_STAT (per-source & voted)
FAULT_LOG (time, temp, ΔV, I_rev, policy)
THERM_STAT, ΔV_STAT, MAINT_MODE

Figure S6 — Practical wiring of PG voting, EN gating, ILIM steps, and ΔV_trip priority with isolation.

BOM & migration reminders

PG/FAULT open-drain unified; pull-up = __ kΩ; local debounce = __ ms.
EN guard before enable (tEN-guard=__ ms); active inhibit chain (FAULT/THERM→EN↓) verified.
ΔV_trip=__ mV; ΔV_hys=__ mV; T_min-reselect=__ ms; I_rev(max)=__ A (thermal checked).

Test matrix & failure injection

Define a repeatable, quantitative validation program for system interlocks. Cover debounce robustness, dual-source anti-flapping, contact degradation, capacitive load steps, outage logging, and maintenance bypass windows. Results must be machine-verifiable with a minimal log set ({event_id, ts, cause, policy, temp, dv, i_rev, crc}).

Scenarios (≥12)

PG debounce tolerance (1–5 ms jitter)
Dual-source ΔV flapping (sweep ΔV_trip/ΔV_hys/T_min-reselect)
Contact degradation (step R_contact, record ΔT & actions)
Capacitive load steps (1×/2×/3×; dv/dt & SOA guard)
Surge/short: Limit-first → Deny escalation
I_rev control during OR-ing priority changes
Power-loss logging (minimal set in N ms)
Maintenance bypass window (time limit, ΔT, backfeed)
Cold-start + hold-up window (t_boot+mount+sign+flush ≤ t_hold)
Temperature extremes (−20 °C / +85 °C)
USB-C revive path (CC-limited recharge; no rail collapse)
Recovery & latch clear (Retry schedule / cool-down)

Metrics (per scenario)

Switching frequency f_sw & minimum dwell t_dwell
EN false-on / false-off counts
ILIM step trajectory (% and repetitions)
I_rev peak and ΔT on hot spots
Log coverage: ID/time/cause/policy present
Pass/Fail with FAULT_LOG evidence

Fault injection (repeatable)

PG jitter via programmable open-drain pulse (0.2–5 ms)
ΔV steps ±(5–60 mV), step 5 mV, dwell 50–500 ms
Programmable series R (0–200 mΩ) for R_contact
Switched C_load matrix (incl. ESL/ESR models)
Pulsed load for surge/short with thermal ramp
Timed power-loss with “countdown” trigger to logger
Bypass/Maintain timers with ΔT & backfeed monitors
USB-C revive CC-limited pre-charge to safe threshold

Quantitative thresholds

Anti-flap: f_sw < 0.2 Hz; t_dwell ≥ 5×T_min-reselect
Debounce: PG jitter ≤ T_PG_valid/2 must not cause EN↑
Logging: 100% of scenarios write minimal set & verify
I_rev: ≤ I_rev(max) with ΔT inside policy limits
Limit-first: first event → ILIM; repeat/over-temp → Deny

Data & evidence

Capture PG[i], PG_voted, EN, ILIM%, FAULT, THERM, ΔV, I_rev, ts, policy_state, and attach oscilloscope/thermal plots per scenario. Sign each log with CRC/crypto for auditability.

Figure V1 — Validation matrix with pass/fail thresholds and injection flow.

BOM & migration reminder

Only after all 12 scenarios pass regression may cross-brand parts be released for production.

Seven-brand mapping (field semantics)

Card-style semantics to align PG/FAULT/EN/ILIM/I²C/PMBus behaviors across seven brands. Use these as semantic anchors for migration; final release still requires Chapter #validation regression. Scope: internal substitutions within TI / ST / NXP / Renesas / onsemi / Microchip / Melexis.

TI

PN: LM5069 (Hot-Swap), TPS25982 (eFuse), LM74700-Q1 (Ideal Diode), TPS2121 (Dual-source)
PG/FAULT: open-drain, active-low; pull-up 4.7–22 kΩ
EN_th/HYS: clean thresholds; add external tEN-guard 2–10 ms
ILIM_mode: const / foldback / fine steps (policy-friendly)
RETRY/FAULT: programmable; supports Limit-first → Deny
Regs map: PG_STAT, FAULT_LOG, ILIM_CFG, RETRY_CFG, THERM_STAT
Red-flags: none typical; confirm SOA for large C_load
Compensation: verify ΔV_hys & Tmin for TPS2121 anti-flap

ST

PN: STEF01/12 (eFuse), STPMIC1 (PMIC)
PG/FAULT: open-drain; polarity consistent with TI
EN_th/HYS: check temp drift; add tEN-guard
ILIM_mode: const with fast-trip; foldback depends on PN
RETRY/FAULT: mode varies (auto/latched)
Regs map: PG_STAT/FAULT_LOG via PMIC status
Red-flags: fewer native ideal-diode/mux options
Compensation: system ΔV_trip + ΔV_hys + I_rev controller

NXP

PN: NX5P3290 (CL load switch), PF1550 (PMIC family)
PG/FAULT: open-drain; low-voltage rails friendly
EN_th/HYS: ensure guard against line noise
ILIM_mode: current-limited switch (steps depend on PN)
RETRY/FAULT: basic auto/command clear
Regs map: PMIC status → unified keys
Red-flags: dual-source often system-level only
Compensation: implement ΔV_hys & Tmin in logic

Renesas

PN: ISL6146/6145A (Hot-Swap), RAA489xxx (path/mux)
PG/FAULT: open-drain; retry/latched configurable
EN_th/HYS: stable; verify thresholds at extremes
ILIM_mode: const/foldback selectable
RETRY/FAULT: granular timers; good for policy mapping
Regs map: rich control/status for PMBus/I²C
Red-flags: variant-specific defaults differ
Compensation: audit defaults; align with Limit-first

onsemi

PN: NIS5021/5020 (eFuse), ideal-diode via FET+ctrl
PG/FAULT: open-drain; clear semantics
EN_th/HYS: confirm startup sequence
ILIM_mode: constant limit with fast trip
RETRY/FAULT: latch/auto variants
Regs map: discrete; map via host controller
Red-flags: mux control typically discrete
Compensation: ΔV_trip + I_rev controller + timers

Microchip

PN: MIC2005/2009 (CL switch), MIC2545A (PDS)
PG/FAULT: open-drain; USB/low-V ecosystems
EN_th/HYS: add guard; noise-tolerant layouts
ILIM_mode: const limit; foldback by family
RETRY/FAULT: predictable; host-driven clear
Regs map: via host I²C (no native PMBus on switches)
Red-flags: coarse ILIM steps on some PNs
Compensation: finer steps in host policy

Melexis

PN: MLX91220 (current sensing), MLX90614 (temp)
Role: telemetry augmentation for THERM_STAT & I telemetry
PG/FAULT: from host mapping
EN_th/HYS: n/a (sensing functions)
ILIM_mode: n/a; use with eFuse/diode controllers
Regs map: expose to host: THERM_STAT/ΔV_STAT
Red-flags: not native eFuse/hot-swap
Compensation: ensure sampling sync & calibration

Migration guidance

Prioritize semantic alignment over package: PG/FAULT polarity & open-drain, EN threshold + tEN-guard, ILIM mode/steps, RETRY/LOCK behavior.
For dual-source designs without native mux ICs, implement ΔV_trip + ΔV_hys + T_min-reselect + I_rev control per policy state machine.
Any substitution must pass Chapter #validation’s 12-scenario regression before release.

BOM & release rule

Internal alternatives are limited to TI / ST / NXP / Renesas / onsemi / Microchip / Melexis. Anything beyond this scope requires design review and full regression.

Cross-brand migration

Make incompatibilities explicit and give a stepwise migration lane for PG → EN → ILIM → FAULT → Timers. Bind release gates to the 12-scenario regression in #validation.

Risk map (semantic differences)

PG: polarity (active-low/high), open-drain vs push-pull, pull-up range, tPG-valid spec.
EN: V_EN(th), hysteresis, temp drift; need external tEN-guard.
ILIM: resistor/DAC/register; constant vs foldback vs stepped; recovery threshold.
FAULT: polarity/open-drain; clear = auto / command / power-cycle; latch vs retry.
Timers: retry/cooldown/T_min-reselect clock bases differ → absolute error.

Migration lanes (compensations)

PG unify: force open-drain + same polarity; add inverter/firmware flip if needed; pull-up ≈ 10 kΩ; align tPG-valid.
EN guard: add tEN-guard 2–10 ms (digital first); verify V_EN(th)/HYS worst case.
ILIM conservative: start 20–30% below nominal (e.g., 3.0 A → 2.2 A); confirm Limit-first.
FAULT clear: MCU-command only; no immediate auto-retry; cool-down then retry; log before retry.
Timers align: longer windows for ΔV_hys / T_min-reselect / Retry; tighten after bench data.

Figure A1 — Swimlane of cross-brand migration with risks and compensations.

Case A — Hot-Swap controller

From → To: <BrandA><PN_A> → <BrandB><PN_B>
PG: polarity=low/OD; PU=10 kΩ; tPG-valid=3 ms
EN: add tEN-guard=5 ms; +0.2 V margin
ILIM: 3.0 A → 2.2 A steps; recovery 0.8×
FAULT: command-clear; cooldown=200 ms
Timers: ΔV_hys=25 mV; T_min-reselect=80 ms
Gate: pass 12 scenarios; I_rev ≤ target; 100% logs

Case B — Dual-source MUX/Ideal-Diode

From → To: <BrandA><PN_A> (native mux) → <BrandB><PN_B> (comp+FET)
PG: OD unify; PU=8.2 kΩ (backplane)
EN: tEN-guard=8 ms; startup noise test
ILIM: foldback → const 1.8 A
FAULT: latched→cmd-clear; add THERM to log
Timers: ΔV_trip=30 mV; ΔV_hys=20 mV; Tmin=120 ms
Gate: f_sw<0.2 Hz; t_dwell≥5×Tmin; ΔT within policy

BOM & migration reminder

Before migration, update the Cloud Telemetry Mapper (PG/FAULT/ILIM field semantics & event schema) and then run the #validation 12-scenario regression.

Procurement notes (small-batch)

Copy these cards directly into your BOM remarks. Fill placeholders and keep the semantic constraints intact to avoid rework during validation.

Figure B1 — BOM remark cards for interlocks: mandatory clauses, optional items, and quality & traceability.

Mandatory (paste into BOM)

PG voting is open-drain; any unmet PG → EN=Low. EN guard tEN-guard=<__ms>; ΔV_trip=<__mV>; T_min-reselect=<__ms>. Hold-up C=<__µF>; t_hold≥<__ms>. Bypass only within maintenance window (I=<__A>, T=<__s>). Cross-brand requires PG/FAULT/ILIM mapping + 12-scenario pass. FAULT cleared by MCU command; no instant auto-retry.

Optional

AEC-Q100 / wide temp; package/finish; thermal probes + ΔT; small-batch supply (cut-tape/partial reel); second-source readiness; USB-C revive with current limit.

Quality & Traceability

Lot ID / supplier code / COA; config version & policy hash; minimal log CRC; incoming QA sampling (ΔV flap / PG debounce / power-loss log); hotspot check on OR-ing; fail policy: Limit-first → Deny with evidence.

Frequently Asked Questions

Answers are scoped to system-level interlocks (PG/EN/ILIM/FAULT/Timers/Hold-up/Bypass). Visible text is identical to the JSON-LD below for SEO integrity.

Why do I need a PG voting chain instead of wiring each PG directly to EN?

A single PG rarely proves a stable rail. Vote multiple PGs with open-drain AND, add a common pull-up, and enforce a debounce window (e.g., 2–5 ms). Only when PG_voted is true should EN be released. This prevents early enables during upstream settling and avoids cascading inrush or SOA overruns.

How much debounce should I add so that brief PG chatter won’t falsely enable rails?

Size debounce so brief chatter never asserts EN: start at 2–5 ms digital filtering or RC equivalent, then confirm with worst-case startup noise and long harness tests. Rule of thumb: debounce ≥ 2× longest observed PG jitter, yet short enough not to delay soft-start coordination.

What’s a safe way to wire FAULT so it reliably disables upstream stages?

Expose FAULT as open-drain, active-low, fan-in to the same voting bus or to a dedicated “deny” gate. Latch in firmware, log cause, and command-clear only after a cool-down timer. Avoid tying FAULT directly to EN without logging; require evidence before re-enable.

How do I bind “limit-current” instead of “deny-power” when a non-critical stage misbehaves?

Map first FAULTs to ILIM steps (e.g., −30% then −50%) and keep EN asserted while temperature and I_rev remain inside limits. Escalate to deny only if repeated trips or thermal threshold is exceeded. This preserves service continuity and protects logging and orderly shutdown.

How wide should the ΔV_trip window be to avoid A/B source ping-pong?

Pick ΔV_trip to enforce priority plus ΔV_hys to avoid flapping. Typical start: ΔV_trip ≈ 20–30 mV with ΔV_hys ≈ 20 mV and T_min-reselect 80–120 ms. Validate by sweeping source delta and verifying switching frequency < 0.2 Hz and minimum dwell ≥ 5×T_min-reselect.

How do I size a hold-up capacitor or supercap for logging and safe shutdown?

Use C ≥ (I_load/η)·t_hold / (ΔV_allow − I_load·ESR). Include temperature and aging margin. Confirm that t_boot + t_mount + t_sign + t_flush ≤ t_hold. If not, enter “limit-maintain” mode: reduce load via ILIM and commit only the minimal, verifiable log set.

Can bypass be used for field maintenance without risking reverse current or overheating?

Bypass is time-boxed and current-limited. Specify I_bypass and T_window in BOM, monitor temperature rise, and ensure reverse-current blocking. Maintain PG/FAULT visibility even in bypass and auto-exit when limits are reached. Never use bypass to mask unstable upstream rails.

What’s the simplest interlock that still handles contact-resistance degradation gracefully?

Measure ΔV/I to estimate R_contact and watch its trend. On threshold crossing, step ILIM down and flag maintenance; deny only if temperature or I_rev exceeds limits. This avoids nuisance trips while preventing hot-spot escalation and connector damage.

How do I unify PG/FAULT polarity differences across brands with open-drain wiring?

Force open-drain for all status pins; normalize polarity with inverters or firmware. Use a single pull-up rail and a shared debounce window. Document polarity, pull-up value (e.g., 10 kΩ), and tPG-valid in the Cloud Mapper so cross-brand swaps don’t break logic.

Should EN be gated by PG only, or also by ILIM/thermal status?

Gate EN with PG_voted and supervisory status: ILIM state, thermal threshold, and retry timers. Priority: allow → limit → deny. EN should not assert when ILIM is already degraded or thermal is latched. This prevents re-enabling into unsafe load conditions.

How do I test interlocks for fast capacitive loads and still respect SOA?

Step C_load in controlled increments and monitor dv/dt, inrush, and MOSFET SOA. Use ILIM trajectory plus soft-start to shape current. Pass if dv/dt and junction-temp remain within limits and no FAULT flapping occurs. Record waveforms and correlate with FAULT_LOG.

Which events must be logged before re-enable is allowed after a FAULT?

Log minimally: event_id, timestamp, root cause (PG/ΔV/THERM/short), policy action (allow/limit/deny), ILIM level, I_rev peak, and CRC. Require a cool-down and a successful health check before clearing latch and re-enabling. No evidence, no re-enable.

System Interlocks for eFuse/Hot-Swap/OR-ing

Why system-level interlocks matter

Risk chain to stop (real archetypes)

Interlock philosophy

Three-state strategy

Event lifecycle

Recommended parameter bands

Minimal log dataset

BOM & migration reminders

Single / Dual source & cascades

Power-up sequences

Fault fallback (graceful first)

Tuning ranges (defaults to refine per design)

BOM & migration reminders (topologies)

PG / FAULT / EN / ILIM / TMR model

PG (Power Good)

FAULT

EN (Enable)

ILIM (Current limit)

Timers: TMR / RETRY

PMBus / I²C field mapping (unified keys)

Minimal interlock wiring & registers

Acceptance & tests

BOM & migration reminders

Allow / Limit / Deny policy library

Power-up

Short / Surge

Dual-source switch

Maintenance (Bypass/Maintain)

Cold-start

Executable test skeleton

BOM & migration reminders

Sizing & supercap tactics

Ideal capacity

With ESR & efficiency

Logging window

Supercap tactics (parallel / series / revive)

Worked example

Acceptance & bench correlation

BOM & migration reminders

Wiring patterns & priorities

Open-drain PG/FAULT voting

EN guard & active inhibit

ΔV_trip & priority

Isolation & level compatibility

Layout/DRC checklist

Host register set (mapping to #signals)

BOM & migration reminders

Test matrix & failure injection

Scenarios (≥12)

Metrics (per scenario)

Fault injection (repeatable)

Quantitative thresholds

Data & evidence

BOM & migration reminder

Seven-brand mapping (field semantics)

TI

ST

NXP

Renesas

onsemi

Microchip

Melexis

Migration guidance

BOM & release rule

Request a Quote

Accepted Formats

Attachment

Cross-brand migration

Risk map (semantic differences)

Migration lanes (compensations)

Case A — Hot-Swap controller

Case B — Dual-source MUX/Ideal-Diode

BOM & migration reminder

Procurement notes (small-batch)

Mandatory

Optional

Quality & Traceability

Mandatory (paste into BOM)

Optional