ESD, Surge & EMC Design for Digital Isolation Systems
← Back to: Digital Isolators & Isolated Power
H2-1. Scope & System Immunity Goal
Define system immunity as an engineering acceptance target: under specified ESD/EFT/Surge/EMI stresses and a defined test setup, isolated ports must avoid unsafe behavior, uncontrolled resets, silent data corruption, and non-recoverable faults. This page coordinates device ratings with port layout, protection stacks, return-path closure, and measurable pass criteria—not product promotion and not protocol-stack details.
- Transient retries/retransmissions within X events over Y minutes.
- Automatic link re-acquisition within N ms without manual intervention.
- Temporary performance degradation that returns to baseline within N seconds and is diagnosable by logs/counters.
- Unsafe actuator behavior, uncontrolled gate-drive state, or loss of fail-safe defaults.
- Uncommanded reset/latch-up, permanent damage, or undiagnosable silent data corruption.
- Recovery that requires power-cycling, firmware reflashing, or physical reconnection.
Each archetype is defined by cable exposure, chassis/PE availability, allowable leakage, switching dv/dt proximity, and whether the failure mode is safety-critical or data-integrity-critical.
| Port archetype | Exposure / reference | Threat focus | Functional pass definition | Priority |
|---|---|---|---|---|
| Isolated USB service port | User-touch, cable hot-plug, chassis optional | ESD + EMI-R | No reset; enumeration stable; auto-recover < N ms; error bursts ≤ X/hour | P0 |
| Isolated RS-485 / CAN | Long harness, noisy cabinet, chassis may be weak | EFT + Surge + EMI-C | No bus-off storm; fail-safe receiver stable; recover < N s; CRC tail ≤ X over Y min | P0 |
| Isolated Ethernet port | Shielded/unshielded variants, common-mode sensitivity | EMI (C/R) + ESD | Link stable; no retrain loops; packet loss ≤ X over Y min; logs identify events | P1 |
| Isolated SPI/I²C/UART to AFE | Internal cable/board, high-speed edges, sensitive thresholds | EFT-like CM injection + EMI | No silent data corruption; checksum/CRC detects all faults; error rate ≤ X/10⁶ transfers | P1 |
| Gate-driver control & sensing | High dv/dt, high di/dt, safety-critical default states | EMI-R + CM dv/dt injection | No unsafe gate state; UVLO/fail-safe deterministic; recovery policy bounded < N ms | P0 |
The matrix is used as the single source of truth for test planning, layout reviews, and field-issue triage. Any “datasheet rating” claim must be translated into the above acceptance targets plus explicit layout/protection prerequisites.
H2-2. Threat Model: ESD / EFT / Surge / EMI (Conducted & Radiated)
Use one consistent language across ESD, EFT, Surge, and EMI: each threat is defined by waveform/energy, injection method, dominant coupling path, victim nodes, observable signatures, and the fastest confirmation check. This enables repeatable design reviews and fast field triage.
- Dominant path: fast current seeks the shortest return; poor clamp placement or long return injects common-mode noise.
- Typical signature: reset, temporary lock-up, link flap, or latent margin loss after repeated hits.
- First check: clamp-to-reference return path length and whether discharge current closes on chassis/PE or through the barrier.
- Primary knobs: TVS location, return closure, controlled loop area, barrier C and shield bonding strategy.
- Dominant path: burst coupling drives supply/reference bounce and threshold crossings more often than permanent damage.
- Typical signature: state-machine glitches, brownout-like behavior, false wake, sporadic CRC bursts.
- First check: PDN droop and reference stability at the receiver/isolator VDD pins during bursts.
- Primary knobs: decoupling placement, return-path discipline, CMC/RC shaping, deterministic UVLO and fail-safe defaults.
- Dominant path: energy and source impedance determine residual voltage and heating; single-component “high rating” is not enough.
- Typical signature: immediate damage, parametric drift, or failures that appear after repetition/thermal stress.
- First check: protection stack energy sharing and whether heat/repetition pushes clamps into a non-linear region.
- Primary knobs: staged protection, thermal headroom, cable/chassis return, and clear separation of surge current loops.
- Dominant path: dv/dt creates common-mode current through barrier capacitance and Y-cap/shield returns.
- Typical signature: compliance failure, link jitter sensitivity, intermittent errors correlated with switching edges.
- First check: identify the CM loop closure point and measure which edge transitions correlate with failures.
- Primary knobs: edge-rate shaping, loop-area minimization, CMC placement, barrier C selection, and controlled chassis bonding.
| Threat | Injection / trigger | Dominant path | Victim nodes | Common signatures | Fast check |
|---|---|---|---|---|---|
| ESD | Touch point at connector/shell; discharge to chassis or floating reference | Clamp return length; unintended closure through barrier C/shield loop | I/O thresholds, reset pin, isolator VDD, clock reference | Reset, lock-up, link flap; latent margin loss after many hits | Verify clamp placement + return closure; correlate signatures with hit location |
| EFT | Burst coupling on cable or power; fast repetition stresses PDN | Reference bounce; supply droop; threshold crossings and state-machine glitches | Receivers, isolator supply, digital filters, UVLO comparators | CRC bursts, false wake, intermittent misreads, “brownout-like” behavior | Measure VDD at victim pins during burst; check decoupling/return routing |
| Surge | Energy injection through cable/power; source impedance matters | Protection energy sharing; residual voltage; thermal/repetition accumulation | Primary clamps, secondary clamps, isolated power front-end, barrier stress points | Immediate failure; drift; repetition-only failures; heating and leakage rise | Check residual voltage at the protected node + clamp temperature rise |
| EMI (C/R) | Switching edges; cable as antenna; conducted CM noise | dv/dt → Icm through barrier C/Y-cap/shield loop; loop-area radiation | Clock/PLL, high-speed interfaces, ADC front-end references | Compliance fail; link sensitivity; jitter-related retrains; intermittent errors | Identify CM loop closure and correlate failures with specific edge transitions |
- ESD immunity is not guaranteed by isolation: discharge current can still close through barrier capacitance or shield/chassis loops.
- EFT is not “minor ESD”: it often manifests as PDN and reference instability rather than component destruction.
- Surge rating is not a single number: energy sharing and repetition/thermal headroom decide survival and drift.
- EMI is a loop problem: dv/dt is converted into CM current; the loop closure point determines emissions and susceptibility.
H2-3. Failure Signatures & What They Usually Mean
Build a practical index from observable symptoms to dominant coupling paths. Each downstream section removes one or more dominant paths by tightening the return closure, improving clamp effectiveness, shaping edges, stabilizing references, and making failures diagnosable.
- CM-INJ: common-mode current injection via barrier capacitance, Y-cap, shield, or chassis loops.
- RTN-OPEN: return path not closed (long/indirect return) causing ground bounce and reference instability.
- CROSS-GAP: unintended coupling/return crossing the isolation split (copper, stitching, parasitic bridges).
- CLAMP-SLOW: clamp path is too long/slow; residual voltage reaches victim pins.
- PDN-DROP: supply droop or UVLO chatter at isolator/receiver pins during stress.
- REF-BOUNCE: reference threshold crosses due to local ground movement and edge sensitivity.
- EDGE-FAST: edge-rate too fast; amplifies emissions and susceptibility through dv/dt conversion.
- THERM-DRIFT: repetition/thermal accumulation causes protection drift or latent damage.
Likely cause: isolator/receiver VDD droop, UVLO chatter, long clamp return injecting into logic reference, or discharge current closing through sensitive ground.
Fast check: measure VDD at victim pins during stress; verify clamp-to-reference path length and the actual closure point (chassis/PE vs logic ground).
Primary knobs: move/shorten clamp return, tighten local decoupling at isolator/VDD pins, enforce deterministic UVLO/fail-safe defaults.
Escalation: if VDD remains stable but reset persists, search for REF-BOUNCE at reset/threshold nodes and CROSS-GAP coupling across the split.
Likely cause: dv/dt-to-Icm conversion through barrier capacitance injects common-mode noise; thresholds shift; the channel becomes timing/noise limited.
Fast check: correlate error counters to switching edges and stress location; measure common-mode current on the cable/shield and compare against error bursts.
Primary knobs: edge-rate shaping, reduce CM loop area, add/optimize CMC placement, select lower barrier capacitance where compatible.
Escalation: if CRC occurs only during high load, check PDN-DROP and UVLO chatter as a secondary amplifier.
Likely cause: receiver reference instability or supply perturbation triggers false state transitions; common-mode injection disturbs clock recovery/timing margins.
Fast check: instrument link state transitions and correlate with stress timing; probe VDD and reference at the PHY/isolator pins (not only at regulators).
Primary knobs: local decoupling and return closure at the PHY/isolator, robust fail-safe receiver biasing, controlled chassis bonding for shield returns.
Escalation: if only one stress position triggers flaps, locate the unintended loop closure point and CROSS-GAP coupling.
Likely cause: common-mode injection modulates clock reference or couples into sensitive analog clock circuits; reference bounce increases effective jitter and wander.
Fast check: compare behavior across different chassis bonding and shield termination options; correlate unlock events to edge transitions and CM current.
Primary knobs: reduce CM loop area, isolate clock reference grounding, edge shaping at aggressor nodes, and apply low-jitter isolation where needed.
Escalation: if unlock persists even with stable reference, check for CLAMP-SLOW residuals reaching clock pins during ESD events.
Likely cause: injected common-mode current or reference bounce changes effective input/reference; isolated power noise couples into measurement reference.
Fast check: compare drift with and without high dv/dt activity; probe reference and isolated supply ripple at the ADC/modulator and its receiver pins.
Primary knobs: tighten reference grounding, reduce barrier-induced CM injection, improve isolated power filtering/placement, and enforce partition rules.
Escalation: if only specific harness configurations trigger drift, treat it as a chassis/shield return closure problem (CM loop).
Likely cause: staged protection not sharing energy; residual voltage reaches the secondary through parasitics or power pathways; repetition heating shifts clamp behavior.
Fast check: measure residual at the protected node and compare across repetition; observe clamp temperature and post-test leakage drift.
Primary knobs: add staged protection, shorten high-energy loop paths, increase thermal headroom, and separate surge current loops from sensitive grounds.
Escalation: if stress appears only with specific chassis connections, verify return closure and shield bonding strategy.
| Signature | Path tags | Fast check | Primary knobs | Go to |
|---|---|---|---|---|
| Reset / brownout | PDN-DROP, RTN-OPEN, CLAMP-SLOW | VDD at victim pins; clamp return closure | Decoupling, return paths, clamp placement | H2-4, H2-6, H2-7, H2-10 |
| CRC bursts / BER tail | CM-INJ, EDGE-FAST, REF-BOUNCE | Correlate with dv/dt and CM current | Edge shaping, CM loop control, CMC | H2-4, H2-8, H2-10 |
| Link flap / retrain | CM-INJ, PDN-DROP, RTN-OPEN | State logs + pin-level VDD/reference | PDN hardening, chassis bonding, partition | H2-4, H2-6, H2-9, H2-10 |
| PLL unlock / jitter sensitivity | CM-INJ, REF-BOUNCE, EDGE-FAST | Correlate unlock with CM loop closure | Reference isolation, edge shaping, loop reduction | H2-4, H2-8, H2-10 |
| ADC drift / code jumps | REF-BOUNCE, CM-INJ, PDN-DROP | Probe reference + isolated supply ripple | Reference grounding, filtering, CM control | H2-4, H2-6, H2-9, H2-10 |
H2-4. Coupling Paths Across the Isolation Barrier
Isolation breaks DC conduction, but it does not eliminate displacement current or common-mode loops. Barrier capacitance, package/PCB parasitics, and chassis/PE/shield return choices determine where injected current closes—and therefore which nodes fail.
Fast dv/dt converts into common-mode current through Cbar. Even with “strong isolation ratings”, injected current can disturb thresholds, clocks, and references unless the loop closure is controlled.
Injected current always closes a loop. The closure point can be beneficial (short, well-defined path to chassis) or destructive (through sensitive grounds, across splits, or via long cable return paths).
When the local reference shifts, receivers interpret it as a signal change. This manifests as CRC bursts, link flaps, UVLO chatter, clock sensitivity, and sampling drift—even without visible “damage”.
| Path | Increases it | Reduces it | Common breakage | Measure / observe |
|---|---|---|---|---|
| CM-INJ | High dv/dt, high Cbar, large CM loop area | Edge shaping, lower Cbar, controlled chassis/shield closure | EMI fail, CRC bursts, jitter sensitivity | CM current on cable/shield; correlation with error bursts |
| RTN-OPEN | Broken/long return, split planes with unintended bridges | Short return paths, strict partition, no-cross-gap routing | Resets, link flaps, threshold misreads | Reference bounce at victim pins; return-path inspection |
| CLAMP-SLOW | TVS far from entry, long via/loop to reference | Move clamp to entry; minimize clamp loop area | Iso-side stress, latent drift, sudden failures | Residual voltage at protected node; clamp temperature |
| PDN-DROP | Weak local decoupling; shared return with surge currents | Pin-level decoupling; separate current loops; robust UVLO | Reset, UVLO chatter, false wake | VDD/UVLO at device pins during stress |
H2-5. Rating Coordination: Device vs System (Don’t Over-trust Datasheet)
Translate component ratings into system-achievable immunity. A datasheet claim becomes valid only when test definition, injection point, return reference, layout discipline, protection loops, and pass criteria match the system context.
- Waveform / standard: IEC vs HBM/CDM; surge 1.2/50 vs 10/700 vs 10/1000; EFT bursts.
- Injection point: contact/air discharge, cable/port entry, power input, chassis, or shield.
- Return reference: where the current closes (chassis/PE, primary GND, secondary GND, floating).
- Pass criteria: allowed errors, allowed resets, recovery time, and what counts as “functional pass”.
System gating conditions: short clamp loop at port entry, defined chassis/PE closure, no-cross-gap return, stable VDD/UVLO behavior.
Dominant paths: CLAMP-SLOW, RTN-OPEN, CM-INJ, PDN-DROP.
System gating conditions: staged protection, minimized high-energy loops, thermal headroom for repetition, defined measurement node for residuals.
Dominant paths: CLAMP-SLOW, THERM-DRIFT, CM-INJ.
System gating conditions: pin-level decoupling, deterministic UVLO/fail-safe states, partition discipline, logging for triage and recovery policy.
Dominant paths: PDN-DROP, REF-BOUNCE, RTN-OPEN.
| Datasheet claim | Test definition | System target | Dominant paths | Gating conditions | Evidence to show |
|---|---|---|---|---|---|
| IEC ESD ±X kV | Waveform + gun method + discharge point + return reference | No reset; bounded errors; recover < N ms | CLAMP-SLOW, RTN-OPEN, CM-INJ, PDN-DROP | Clamp at entry; defined chassis closure; no-cross-gap routing; stable UVLO/fail-safe | Residual at node; VDD at pins; CM current; state logs |
| Surge rating (10/1000 or 1.2/50) | Waveform + source impedance + repetition + coupling mode | No damage; no parameter drift; functional pass | CLAMP-SLOW, THERM-DRIFT, CM-INJ | Staged protection; short high-energy loops; thermal headroom; defined measurement node | Clamp temperature; leakage drift; residual waveform; post-test checks |
| EFT immunity level | Burst definition + coupling clamp placement + reference | No latch-up; no uncontrolled states; recover < N ms | PDN-DROP, REF-BOUNCE, RTN-OPEN | Pin-level decoupling; deterministic defaults; partition discipline; logging | VDD at pins; UVLO state; error counters; recovery logs |
H2-6. Port Layout Rules: Partition, Return Path, and “No-Cross-Gap” Discipline
Provide the most failure-prone port rules as reviewable and testable constraints: partition is strict, return closure is deliberate, and no current is allowed to “find its own way” across the isolation split.
Treat Connector, Protection stack, and Isolator as a constrained triangle. The triangle must keep (1) the high-energy clamp loop short, (2) the signal return closed without crossing the split, and (3) the common-mode loop closure controlled.
- Clamp at the entry with the smallest possible loop to the intended reference (typically chassis/PE for port events).
- Keep the split clean: place a visible keep-out zone around the isolation gap; route no return-carrying conductors across it.
- Close returns locally: provide a short, deliberate return path for each high-frequency current loop; avoid “return hunting”.
- Separate aggressors: keep high dv/dt nodes away from isolator channels and sensitive references (clock/ADC/UVLO nodes).
- Stage protection when needed: entry stage for energy, secondary stage near the victim for residual control (prevents CLAMP-SLOW failures).
- No-cross-gap: do not bridge the split with copper pours, guard traces that create return shortcuts, or unintended capacitive plates.
- No long clamp returns: do not send ESD/surge current through logic grounds before reaching the closure reference.
- No shared loops: do not share surge/ESD current loops with sensitive references, oscillators, ADC references, or reset nets.
- No “shield ambiguity”: do not leave shield/drain closure undefined; define the closure point and verify it in test setups.
- No hidden coupling near the gap: avoid long parallel runs across the split that form large parasitic capacitance.
| Choice | Best for | Risk if misused | Dominant paths |
|---|---|---|---|
| Protection near entry | Dumping energy early; minimizing high-energy loop area | Residual travels on traces into sensitive domains if there is no second stage | CLAMP-SLOW, CM-INJ |
| Protection near victim | Controlling residual at sensitive pins; preventing trace-as-antenna effects | Energy still propagates into the board; clamp return may pollute logic ground | RTN-OPEN, PDN-DROP |
| Staged protection | Entry stage for energy + near-victim stage for residual control | Requires disciplined partition and well-defined closure references | CLAMP-SLOW, RTN-OPEN, CM-INJ |
H2-7. Protection Stack: TVS / RC / CMC / GDT / Ferrites (When & Why)
Focus on stack logic inside isolated systems. Each element must have a defined job: which threat it targets (ESD/EFT/Surge), which current loop it closes, and which dominant path it suppresses (CM-INJ, CLAMP-SLOW, RTN-OPEN, PDN-DROP, THERM-DRIFT).
Primary failure modes: CLAMP-SLOW, RTN-OPEN, CROSS-GAP return shortcuts.
Typical stack blocks: entry TVS (or 2-stage clamp) + optional light edge damping (series R/RC) when bandwidth allows.
Primary failure modes: CM-INJ, PDN-DROP, REF-BOUNCE causing functional upsets (resets, CRC bursts, link flaps).
Typical stack blocks: CMC near connector + PDN filtering/decoupling near victim + controlled return closure.
Primary failure modes: THERM-DRIFT (heating & aging), CLAMP-SLOW residuals reaching sensitive pins, uncontrolled closure paths.
Typical stack blocks: GDT (or high-energy stage) at entry + secondary clamp near victim + layout loops designed for energy sharing.
| Element | Best for | Placement intent | Side effects to manage | Dominant paths |
|---|---|---|---|---|
| TVS clamp | ESD residual control, secondary surge clamping | Near entry for energy; near victim for residual (prefer staged) | Capacitance & dynamic resistance affect signal & edge rate | CLAMP-SLOW, CM-INJ |
| Series R / RC | Edge damping, ringing control, dv/dt reduction | Close to driver/victim to shape edges and reduce injection | Adds delay / slows edges; must fit timing budget | EDGE-FAST, CM-INJ |
| CMC | EFT/EMI common-mode suppression on cables | Near connector; keep return closure controlled | May interact with cable; avoid creating new CM loops | CM-INJ |
| Ferrite bead | HF isolation for PDN branches and sensitive rails | In series with targeted rails, with local decoupling | Can form resonances; placement matters more than “ohms” | PDN-DROP, REF-BOUNCE |
| GDT | High-energy surge diversion (coarse stage) | Entry stage, with a defined high-current path to chassis | Trigger behavior & follow current; requires staged coordination | THERM-DRIFT, CLAMP-SLOW |
| Port type | Threat priority | Stack ladder (entry→inner) | Placement rules | Pitfalls | Evidence |
|---|---|---|---|---|---|
| Data-only | ESD + EFT | CMC → TVS (low-C) → optional series R/RC → Isolator | CMC at connector; TVS return loop minimal; no-cross-gap | TVS too far; clamp return through logic ground | Residual waveform + CM current + error counters |
| Data + Power | Surge + EFT | GDT/entry stage → TVS/secondary → PDN bead+local decoupling → Isolator | High-current path to chassis; pin-level decoupling near victim | Energy routed across ground planes; PDN droop resets | VDD at pins + UVLO logs + temperature drift |
| Shielded cable | EMI + ESD | Shield closure → CMC → TVS → Isolator | Define closure point; avoid ambiguous shield returns | Shield becomes unintended CM loop; cross-gap coupling | Radiated scan + CM current + A/B closure tests |
| Unshielded cable | EFT + radiated EMI | CMC → edge shaping (R/RC) → TVS → Isolator | Minimize loop areas; keep aggressors away; control edge rate | Fast edges drive CM emission; long loops act as antennas | Near-field scan + burst correlation with errors |
H2-8. Barrier Capacitance, CM Emission, and Edge-Rate Shaping
Explain why isolation can make EMI worse: barrier capacitance converts fast dv/dt into common-mode current. The fix is edge-rate control, loop geometry control, and controlled CM loop closure.
- Fast edges create dv/dt at drivers and switching nodes.
- Barrier capacitance couples dv/dt across the isolation split and produces common-mode current.
- Common-mode current excites cable/chassis loops, increasing radiated emission and injecting noise back into sensitive references.
- Slew-rate or drive-strength settings when available.
- Series R / RC shaping near drivers or near victims (reduce EDGE-FAST injection).
- Clamp and filter placement that avoids creating new fast return spikes.
- Prefer lower Cbarrier when emissions are CM-limited.
- Keep isolation split clean: avoid copper “plates” that form unintended capacitive bridges.
- Maintain a clear keep-out zone around the gap (supports no-cross-gap discipline).
- CMC placement near connector to reduce CM propagation on cables.
- Define shield/drain closure points; avoid ambiguous closure that makes loops unpredictable.
- Use Y-cap only with a controlled closure reference and verified system constraints.
- Minimize loop areas for clamp returns and high-frequency currents.
- Keep high dv/dt aggressors away from the isolator channels and sensitive references.
- Maintain continuous reference planes where returns must be stable; avoid forced detours.
H2-9. Y-Cap, Shield Bonding, and Leakage Constraints (Medical/Portable)
Treat Y-caps and shield bonding as a controlled common-mode (CM) return strategy that can improve EMC, while simultaneously increasing leakage / touch current. The correct choice is therefore gated by product scenario (medical/portable/industrial), grounding model, and leakage constraints.
- Y-cap / shield bonding provides a stronger CM loop closure → often reduces CM-INJ symptoms and radiated emission.
- The same closure creates a leakage path (frequency-dependent) → touch/leakage current increases.
- Medical/portable scenarios frequently prioritize leakage limits over “best EMC closure”.
- Scenario: medical, portable (battery/floating), or fixed industrial?
- Grounding model: reliable chassis/PE reference, or floating/uncertain closure?
- Leakage constraint: touch/leakage current limit per applicable standard (treat as a hard gate).
- EMC pain point: radiated fail, EFT-induced upsets, ESD resets, or cable CM current?
| Option | CM closure behavior | Typical EMC effect | Leakage / touch current risk | Best-fit scenarios | Dominant paths |
|---|---|---|---|---|---|
| No Y | CM loop closure weak / less defined | May worsen radiated EMI if dv/dt is high; relies on CMC/edge shaping/geometry | Lowest leakage | Portable, floating, strict leakage gate | CM-INJ, RTN-OPEN |
| Single Y | One controlled closure point (if reference is defined) | Often reduces CM emission and EFT/ESD functional upsets | Moderate; must pass leakage gate | Systems with defined chassis/PE and limited leakage budget | CM-INJ |
| Dual Y | More symmetric closure; CM loop often “stiffer” | Best chance to reduce CM emission when dv/dt is high | Highest; frequently blocked by medical/portable constraints | Fixed industrial, reliable PE, leakage budget available | CM-INJ, EDGE-FAST |
- Start: identify scenario: Medical / Portable / Fixed industrial.
- Grounding: confirm if chassis/PE is a reliable reference (Yes/No).
- Leakage gate: if leakage/touch current limit is strict → prefer No Y or controlled Single Y only if verified.
- EMC objective: if CM emission dominates and leakage budget allows → consider Single Y first, then Dual Y if needed.
- Shield bonding: choose single-point for controlled closure; multi-point only with stable chassis reference and verified loops.
- Verify: run leakage/touch current test + EMI + immunity using the H2-10 test template and record evidence.
H2-10. Test Plan & Pass/Fail Criteria (ESD/EFT/Surge/EMI)
Convert design guidance into reviewable and repeatable acceptance. Provide a test skeleton that fixes setup variables (return strap, reference plane, injection point, harness placement), specifies what to log, and defines pass/fail criteria using X/Y/N placeholders.
- Injection point: port pin, shield, chassis point, cable segment, or power entry (must be recorded).
- Return closure: return strap path to ground plane / chassis; keep length and routing fixed.
- Reference planes: ground plane and coupling plane geometry and distances.
- Harness placement: length, height above plane, bundling, shield termination mode.
- Operating state: traffic pattern, load, power mode, clock state, and logging window.
- Functional: reset count, CRC/error count, link flap count, downtime (ms), clock unlock + relock time, ADC code jumps/drift.
- PDN evidence: VDD minimum at victim pins, UVLO events, brownout logs.
- Protection evidence: residual at protected node (peak), clamp temperature trend (if surge repetition).
- CM evidence: cable/shield CM current snapshot (peak/trend) and near-field hotspots (if available).
| Field | Example value | Why it matters | Related paths |
|---|---|---|---|
| Setup ID / photo | Case-ESD-01 / photo link | Ensures reproducibility across labs | RTN-OPEN |
| Injection point | Port pin / shield / chassis | Determines the dominant coupling path | CM-INJ |
| Return strap | Length + routing note | Controls loop area and closure | RTN-OPEN |
| Reset / CRC / flap | X/Y/N placeholders | Primary functional acceptance metrics | PDN-DROP, CM-INJ |
| VDD@pins min | ≥ X V | Explains brownout-driven upsets | PDN-DROP |
| Residual node peak | ≤ X V | Validates clamp loop effectiveness | CLAMP-SLOW |
- Freeze setup variables: plane distances, harness placement, return strap routing.
- Enable logging: counters window definition, timestamps, state snapshots.
- Baseline run: confirm stable metrics without injection.
- Record each injection: point, level, count, interval, polarity.
- Capture evidence: residual node, VDD@pins min, CM current snapshot when possible.
- On anomaly: save state snapshot immediately (logs/registers/clock state).
- Repeat baseline checks: no parameter drift, stable leakage/touch current behavior.
- Verify recovery policy: auto recovery time and manual intervention requirements.
- Archive report: template-complete, with setup ID and photos.
- Reset count ≤ X within Y injections; recovery ≤ N ms.
- CRC/error bursts ≤ X per Y minutes under defined traffic load.
- Link flap count ≤ X, cumulative downtime ≤ Y ms, max single event ≤ N ms.
- Clock unlock count ≤ X; relock time ≤ Y ms; no persistent unlock.
- ADC code jump/drift ≤ X (unit per system definition) over Y minutes.
H2-11. Production & Documentation: Hi-pot/PD, Certificates, Black-Box Logs
Turn “lab pass” into production-repeatable and field-traceable. Define a parallel window for Hi-pot / partial discharge (PD) and ESD/EFT/Surge/EMC, build an audit-ready evidence pack (certificates + material/layout proof), and standardize black-box logs for root-cause attribution.
- Hi-pot/PD stress screens insulation defects (contamination, voids, geometry margin).
- EMC/ESD/EFT/Surge stress exposes coupling paths and return-closure mistakes (CM-INJ / RTN-OPEN).
- Process controls must not break immunity: coating/slots/clearance changes can shift return paths and CM loops.
- Define an internal window: allowed variations for cleaning, coating, slotting, spacing, and assembly gaps—then verify both PD and immunity.
| Evidence tier | Contents | Naming/trace fields | Why it exists |
|---|---|---|---|
| Design proof | Partition screenshots, creepage/clearance marks, “no-cross-gap” notes, return-closure points, Y-cap/shield mode | PCB Rev / BOM Rev / Stackup Rev / Drawing Rev | Prevents “undefined closure” debates |
| Test proof | H2-10 Setup ID, photos, raw logs (reset/CRC/flap/unlock), residual/VDD evidence, anomalies snapshots | Setup ID / Case ID / Date / Operator / Firmware tag | Makes results comparable across labs |
| Certification proof | Certificates/CB reports index, material evidence (CTI/material grade), scope & applicability notes | Report ID / Edition / Applicable PCB+BOM Rev | Audit-ready evidence chain |
| Production proof | Sampling records (X pcs/lot), Hi-pot/PD results, quick immunity sanity, failed-unit archive policy | Lot ID / Sample ID / Fixture ID / Result hash | Turns pass into repeatability |
- Sampling rate: Hi-pot/PD = X pcs/lot; quick immunity sanity = Y pcs/lot.
- Stop rule: if fails > N in a lot → isolate lot; run root-cause; verify corrective action with re-sampling.
- Golden fixture: fixture ID must be logged; replace/repair triggers a new fixture qualification case.
- Change control: any PCB/BOM/process rev change triggers at least X validation runs using the H2-10 template.
| Category | Minimal fields to log | Retention (placeholder) | Storage reference BOM (examples) | Usage notes |
|---|---|---|---|---|
| Power | UVLO count, min VDD@pins, brownout timestamp | Keep last N events |
SPI NOR: Winbond W25Q64JVSSIQ I²C EEPROM: Microchip 24LC256-I/SN |
Correlates resets with PDN drops |
| Thermal | OT count, max temp bucket, cooldown time | Keep X days |
Temp sensor (I²C): TI TMP117AIDRVR RTC (timestamp): Analog Devices DS3231MZ+ |
Explains heat-triggered immunity regressions |
| Link / Data | CRC bursts, link flap count, retrain count, downtime | Keep last Y sessions | microSD (if used): Amphenol 101-00660-68 (socket) | Maps to symptom dictionary (H2-3) |
| Clock | unlock count, relock time, persistent unlock flag | Keep last N unlocks | Supervisor/reset: TI TPS3890DL50 (example) | Distinguishes timing failure vs data corruption |
H2-12. Applications & Quick Pairings (System Patterns Only)
Provide an immunity pattern library for isolated systems. Each pattern is constrained to Threat → Key knobs → Common pitfalls → Minimal pass configuration, and includes example BOM part numbers for fast prototyping (final selection must match target levels).
- CMTI margin and controlled return closure (avoid RTN-OPEN).
- Edge-rate shaping + CM loop minimization (dv/dt → Icm → emission chain).
- Gate-loop compactness, Miller clamp strategy, and local decoupling.
- Y-cap/shield mode only if leakage gate allows; otherwise use CMC/edge/geometry.
- Fast edges + high barrier capacitance produce unexpected CM emission.
- Protection return routed through sensitive ground before reaching chassis.
- Gate-driver bias loop too large; dv/dt injects into logic side via parasitics.
| Function | Example part number | Role in immunity | Notes |
|---|---|---|---|
| Isolated gate driver | TI UCC21750 | High dv/dt channel robustness; reduces CM upset sensitivity | Verify CMTI, UVLO, fault behavior vs target |
| Isolated bias module | Murata MGJ2D051505SC | Stable isolated supply; reduces PDN-DROP and noise coupling | Check creepage/clearance and power headroom |
| Isolated ΔΣ modulator (current/voltage) | TI AMC1311 / ADI AD7401A | Immune sensing path with strong CM robustness | Match filter + sampling strategy to noise goals |
| ESD clamp (signal) | Nexperia PESD5V0S1UL | Fast clamp at port; protects logic pins from ESD spikes | Place at entry; shortest return to reference |
| Ferrite bead (local damping) | Murata BLM21PG600SN1D | Reduces HF noise injection into sensitive rails | Validate DC drop and thermal rise |
| Safety Y-cap (optional gate) | Murata DE2E3KY222MA3BM | Controlled CM return closure for EMI (if leakage budget allows) | Use only after leakage/touch-current verification |
- Protection stack: staged energy absorption (front coarse, back fine).
- Fail-safe receiver states + diagnosable default behavior.
- Shortest return for TVS clamps; consistent harness placement in tests.
| Function | Example part number | Role in immunity | Notes |
|---|---|---|---|
| Isolated CAN transceiver | TI ISO1042 | Isolation + bus robustness; reduces CM upset propagation | Verify bus fault behavior + EMC performance |
| isoSPI transceiver | Analog Devices LTC6820 | Robust isolated comm over transformer; good for HV daisy chains | Transformer/layout dominate robustness |
| RS-485/ CAN TVS | Littelfuse SM712 | Fast clamp for bus line ESD/EFT transients | Return routing defines effectiveness |
| GDT (surge staging) | Bourns 2038-09-SM-RPLF | Front-end energy handling for higher surge scenarios | Coordinate with TVS to avoid overstress |
| Power-line TVS (example) | Littelfuse SMBJ58A | Clamps supply surge entering the node | Select voltage/energy vs actual surge profile |
- Edge-rate control (series R / drive strength) before adding heavy filters.
- Minimize loop area and barrier-coupling impact (Cbarrier-driven CM current).
- Separate “EMI fix” changes from “timing fix” changes using structured logging.
| Function | Example part number | Role in immunity | Notes |
|---|---|---|---|
| Digital isolator (data lanes) | TI ISO7741 / ADI ADuM141E | Breaks ground path; reduces ESD/EFT propagation | Verify propagation/skew vs timing budget |
| Edge shaping (series R) | Yageo RC0603FR-0722RL (22Ω) | Reduces dv/dt to lower CM emission | Tune per eye/jitter constraints |
| ESD clamp (signal) | Nexperia PESD5V0S1UL | Protects interface pins against contact/air discharge | Return path defines clamp quality |
| Ferrite bead (rail HF isolation) | Murata BLM18AG601SN1D | Prevents burst noise from collapsing local rails | Confirm DC current and impedance target band |
- Prefer No Y or tightly controlled Single Y only after leakage verification.
- Use CMC/edge shaping/geometry to reduce CM emission without creating a leakage path.
- Record both EMC and leakage evidence under the same Setup ID.
| Function | Example part number | Role in immunity | Notes |
|---|---|---|---|
| Isolated USB (Full-Speed) | Analog Devices ADuM4160 | Breaks ground path; isolates service/HMI port | Verify data rate and system power topology |
| Isolated DC-DC (example) | RECOM R05P05S | Provides isolated power for the port domain | Verify leakage, EMC, creepage/clearance constraints |
| USB ESD array | Littelfuse SP0503BAHT | Fast clamp at connector; reduces resets and latch-up risk | Route to reference with minimum loop |
| Ferrite bead (VBUS filtering) | Murata BLM21PG600SN1D | Suppresses burst noise on power rail into the port | Confirm current rating; avoid excessive DC drop |
| Safety Y-cap (usually gated) | Murata DE2E3KY222MA3BM | Optional controlled closure if leakage budget allows | Default strategy: No Y → CMC/edge/geometry first |
| Scenario | Primary threat | First knobs |
|---|---|---|
| Motor/Inverter | High dv/dt CM-INJ + radiated EMI | Edge shaping → return closure → gate-loop compactness |
| BMS/HV | Harness surge/EFT + service ESD | Protection staging → shortest clamp return → fail-safe states |
| Precision sampling | Edge-driven emission + timing-sensitive upsets | Edge shaping → barrier coupling control → structured logging |
| Medical HMI | EMC vs leakage gate conflict | No Y first → CMC/edge/geometry → leakage-verified closure |