Medical HMI Isolation: Isolated USB + IEC 60601-1 Power
← Back to: Digital Isolators & Isolated Power
Scope & Decision Tree (Medical HMI Isolation)
This chapter locks the page boundary and turns medical isolation requirements into a 3-minute decision flow: Data-only vs Data+VBUS vs System PSU segmentation.
What this page is / isn’t
- It is: a system-level guide for Isolated USB (FS/HS) in medical HMI, with IEC 60601-1 constraints translated into engineering actions: zoning, leakage budget, EMC/ESD return paths, and verifiable pass criteria.
- It is: a practical method to choose where the barrier goes and how the isolated power is routed, without violating leakage-current limits.
- It is not: USB protocol/driver material (enumeration, descriptors, class stacks). Those belong to a dedicated USB protocol page.
- It is not: a full power-topology design tutorial (magnetics, compensation, transformer design). Only the medical-compliant isolation constraints are covered here.
Boundary rule: every statement in this page must remain inside:
Isolated USB + 60601-1 isolation & leakage + EMC/ESD return-path + testability.
Decision tree (3–5 questions that set the architecture)
- Q1 — Access model: Is the USB port used during normal operation, or service-only (maintenance/firmware/diagnostics)?
- Q2 — Patient contact path: Does the system have any patient-contact or patient-vicinity coupling path that makes leakage current the primary hard constraint?
- Q3 — Grounding model: Is Protective Earth (PE) present and stable, or is the enclosure intended to be floating/portable?
- Q4 — Isolation scope: Must VBUS be electrically separated, or is data-only isolation sufficient with local power sourcing?
- Q5 — Trade-off priority: When EMC and leakage conflict, is the project allowed to spend BOM/space on source/path control before considering any capacitive bridging?
Output of the tree: one of three topologies (A/B/C) with a matching leakage budget and validation plan.
Non-negotiable: any topology that relies on “undefined ground return” is rejected by design.
Output deliverables (what the reader will leave with)
- Topology decision: a concrete isolation placement (A/B/C) that can be reviewed and audited.
- Leakage budget structure: a worksheet with explicit contributors: Y-cap, Barrier capacitance, Shield-to-chassis coupling, EMI filter paths.
- Validation checklist: a minimal closed-loop plan covering leakage measurement, insulation withstand (hi-pot), and EMC/ESD robustness with defined pass criteria placeholders (X/Y/N).
Implementation note: the decision tree intentionally avoids USB protocol details and power-topology design details. Only isolation placement, leakage control, return paths, and testability are decided here.
System Zones: Patient / Operator / Earth Boundaries
This chapter draws hard electrical boundaries for medical HMI: Primary, Secondary, PE/Chassis, and Patient vicinity. The goal is to prevent any hidden return path from crossing the isolation barrier.
Zone definitions (designable, reviewable, testable)
- Primary (mains / high-energy domain): noisy energy source zone. Current loops must close locally. No signal return is allowed to “borrow” this domain.
- Secondary (SELV logic domain): MCU, display, touch, local rails. All signal return currents must remain inside this domain.
- PE/Chassis domain: a controlled sink for shield and ESD/EMI energy. It is not a general-purpose signal return.
- Patient vicinity domain: a constraint boundary: any capacitive or conductive coupling into this domain is counted in the leakage budget and must be measurable.
Core rule: the isolation barrier separates return-current ownership. Any “mystery return path” is treated as a design defect.
Typical signal / power / shield paths (minimum set)
- Data path: USB D+/D− → isolation barrier → MCU (secondary). Data isolation does not imply VBUS isolation.
- Power path: AC-DC/charger → (medical-compliant) rails → VBUS control/switch → USB port, with a defined default state on faults.
- Shield & EMC path: USB shield → single controlled bond → chassis/PE, so ESD energy is steered away from the logic return.
Common mistakes (root causes of leakage/EMC failures)
- Using USB shield as a signal return: creates uncontrolled common-mode current loops and defeats isolation zoning.
- ESD return crossing the isolation gap: TVS placement or stitching that forces ESD current to traverse the barrier causes resets and test instability.
- Multiple secondary-to-chassis bonds: turns the chassis into a distributed return path; leakage becomes location-dependent and lab-to-lab inconsistent.
- “EMC first” Y-cap habit: adding capacitive bridging without a leakage budget breaks medical limits even if emissions improve.
- Mechanical proximity violations near the barrier: screws, copper pours, or shield tabs near creepage/clearance keepouts can fail audits despite nominal PCB spacing.
Quick check (field-ready): if a symptom changes when the shield bond point changes, the design is dominated by an uncontrolled return path.
Pass criteria placeholder: no return current crosses the barrier in normal operation; leakage stays within X under defined conditions Y.
Review posture: zoning must be consistent across schematic, PCB, and validation wiring. If two drawings imply different return paths, the design is treated as not yet defined.
60601-1 Safety Targets You Must Translate into Design Numbers
This chapter converts compliance language into engineering knobs that can be reviewed and tested: MOPP/MOOP, Working Voltage, Creepage/Clearance, Hi-pot Path, CTI / Pollution / Altitude.
Key fields that must appear in specs and evidence packages
Device / Module
Insulation class (Basic/Reinforced, MOOP/MOPP target: X) · Working voltage / lifetime model (VIORM/VIOTM: X) · Surge/impulse class: X · Barrier capacitance: X pF · CMTI/dv/dt: X kV/µs · Safety approvals / report IDs: X
Insulation class (Basic/Reinforced, MOOP/MOPP target: X) · Working voltage / lifetime model (VIORM/VIOTM: X) · Surge/impulse class: X · Barrier capacitance: X pF · CMTI/dv/dt: X kV/µs · Safety approvals / report IDs: X
PCB Geometry
Minimum creepage: X mm · Minimum clearance: Y mm · Keepout/slot usage: Y/N · Coating coverage: Y/N · Material CTI class: X · Pollution degree: X · Altitude limit: X m
Minimum creepage: X mm · Minimum clearance: Y mm · Keepout/slot usage: Y/N · Coating coverage: Y/N · Material CTI class: X · Pollution degree: X · Altitude limit: X m
Test Evidence
Hi-pot test nodes + return path: Primary↔Secondary / Shield↔Secondary (select) · Leakage measurement setup: X · Sample size / traceability: X · Certificates (PSU, isolator, module): X · Drawings: PCB + mechanical + harness
Hi-pot test nodes + return path: Primary↔Secondary / Shield↔Secondary (select) · Leakage measurement setup: X · Sample size / traceability: X · Certificates (PSU, isolator, module): X · Drawings: PCB + mechanical + harness
Documentation rule: every compliance “term” must map to a number and a design artifact (PCB drawing / PSU certificate / test report).
Five questions reviewers ask (acceptance posture)
-
Where is the isolation boundary?
Evidence: a single block diagram that matches schematic and PCB zoning; isolation scope is explicitly labeled (Data-only, Data+VBUS, or segmented service domain). -
How is working voltage defined across lifetime?
Evidence: stated operating voltages and expected stress model (RMS/peak) with the chosen insulation class (placeholders: X, Y, Z years). -
How are creepage and clearance proven on the final assembly?
Evidence: the shortest measured path is identified (including slots/coating/keepouts), and mechanical features near the barrier are accounted for. -
What is the hi-pot withstand path and wiring?
Evidence: explicit test nodes and return path; “test points” match production test fixtures and lab type tests (placeholders: X kV, Y s). -
Where does leakage current flow, and how is it bounded?
Evidence: leakage contributors are enumerated and measured under a defined setup (PE present/absent, cable/external device states).
Common failure mode: a spec contains terms but no numbers, or numbers exist but no artifact proves them.
Pass criteria placeholder: the compliance package remains consistent across diagram, PCB drawing, and test records (no contradictory return paths).
Leakage Current Budget & Y-Cap Strategy (The Non-Negotiable Chapter)
Medical HMI success depends on a controlled leakage-current budget. The chapter explains how to bound leakage contributors and how to avoid “EMC fixes” that violate leakage limits.
Leakage budget worksheet (structure that stays mobile-friendly)
Contributor 1 — Y-cap(s)
Path: Primary noise → Y-cap → PE/Chassis → return coupling
Knob: capacitance value / placement / single vs symmetric
Measurement hook: leakage under defined setup (PE present: Y/N) · Result: X
Path: Primary noise → Y-cap → PE/Chassis → return coupling
Knob: capacitance value / placement / single vs symmetric
Measurement hook: leakage under defined setup (PE present: Y/N) · Result: X
Contributor 2 — Barrier capacitance (intrinsic)
Path: Primary ↔ barrier C ↔ Secondary (common-mode coupling)
Knob: device choice (lower barrier C) / edge-rate control / routing symmetry
Measurement hook: compare leakage and emissions before/after isolator swap · Result: X
Path: Primary ↔ barrier C ↔ Secondary (common-mode coupling)
Knob: device choice (lower barrier C) / edge-rate control / routing symmetry
Measurement hook: compare leakage and emissions before/after isolator swap · Result: X
Contributor 3 — Shield-to-PE/Chassis coupling
Path: USB shield → bond point → PE/Chassis (ESD sink path)
Knob: bond topology (single point), location, mechanical contact quality
Measurement hook: leakage repeatability vs bond location · Result: X
Path: USB shield → bond point → PE/Chassis (ESD sink path)
Knob: bond topology (single point), location, mechanical contact quality
Measurement hook: leakage repeatability vs bond location · Result: X
Contributor 4 — EMI filter paths (parasitics)
Path: filter components + parasitics create unintended capacitive bridges
Knob: filter placement / return path / choke choice / keepout near barrier
Measurement hook: emissions vs leakage delta when filter changes · Result: X
Path: filter components + parasitics create unintended capacitive bridges
Knob: filter placement / return path / choke choice / keepout near barrier
Measurement hook: emissions vs leakage delta when filter changes · Result: X
Budget rule: leakage is only meaningful when the setup is defined (cable/external device state, PE present/absent, service port enabled/disabled).
Y-cap placement options (choose by budget, not habit)
Option A — No Y-cap
Use when: leakage limit is extremely tight or patient coupling dominates.
Benefit: lowest leakage by design.
Risk: emissions margin must come from source/path control.
Guardrails: strict zoning + controlled shield/ESD return + edge-rate control.
Pass criteria: emissions pass without adding cross-barrier capacitance (X).
Use when: leakage limit is extremely tight or patient coupling dominates.
Benefit: lowest leakage by design.
Risk: emissions margin must come from source/path control.
Guardrails: strict zoning + controlled shield/ESD return + edge-rate control.
Pass criteria: emissions pass without adding cross-barrier capacitance (X).
Option B — Single-point Y-cap to chassis/PE
Use when: a controlled CM return is needed without symmetric coupling.
Benefit: targeted EMI improvement with a defined return point.
Risk: leakage becomes sensitive to PE presence and measurement setup.
Guardrails: define the single bond + validate repeatability across labs.
Pass criteria: leakage ≤ X under setup Y; repeatability within N%.
Use when: a controlled CM return is needed without symmetric coupling.
Benefit: targeted EMI improvement with a defined return point.
Risk: leakage becomes sensitive to PE presence and measurement setup.
Guardrails: define the single bond + validate repeatability across labs.
Pass criteria: leakage ≤ X under setup Y; repeatability within N%.
Option C — Symmetric Y-caps (balanced)
Use when: CM emissions demand balance and return path is well defined.
Benefit: better symmetry can reduce radiated EMI in some layouts.
Risk: total leakage increases and can be harder to justify medically.
Guardrails: pair with verified PE/chassis strategy; prevent multi-point bonds.
Pass criteria: EMI improvement is measurable while leakage stays ≤ X.
Use when: CM emissions demand balance and return path is well defined.
Benefit: better symmetry can reduce radiated EMI in some layouts.
Risk: total leakage increases and can be harder to justify medically.
Guardrails: pair with verified PE/chassis strategy; prevent multi-point bonds.
Pass criteria: EMI improvement is measurable while leakage stays ≤ X.
Non-negotiable principle: if a Y-cap is used, it must be part of an explicit leakage budget and validated wiring setup.
Pass criteria (placeholders for review and test plans)
Leakage limit: total leakage ≤ X µA (or Y mA) under setup S (PE: Y/N, cable: X, external device: Y/N).
Repeatability: results vary by ≤ N% across cable swaps and lab setups when the defined wiring is followed.
No side effects: EMC improvements do not introduce USB resets, touch drift, or unexplained re-enumeration under ESD stress (events ≤ X in Y trials).
Design posture: leakage control is treated as a system KPI. EMC actions are accepted only if leakage remains bounded under a defined setup and stays repeatable.
Isolated USB Architecture Options (FS/HS) for Medical HMI
This chapter covers isolation-relevant physical architecture only (no USB protocol stack). The focus is on barrier placement, VBUS ownership, shield/ESD return control, and leakage-safe behavior.
Topology A/B/C (3-line decision blocks)
Topology A — Isolated data + local VBUS supply
When to use: service-only or tightly controlled accessory power; lowest-leakage posture with local VBUS sourcing.
Primary risk: uncontrolled return via shield or external device reference bypasses the intended zoning.
Required pairings: VBUS switch with default-off + controlled enable; single-point shield bond to chassis/PE; ESD return must not cross the barrier.
When to use: service-only or tightly controlled accessory power; lowest-leakage posture with local VBUS sourcing.
Primary risk: uncontrolled return via shield or external device reference bypasses the intended zoning.
Required pairings: VBUS switch with default-off + controlled enable; single-point shield bond to chassis/PE; ESD return must not cross the barrier.
Topology B — Isolated data + isolated VBUS power
When to use: external accessories require electrically separated VBUS; isolated service domain must supply and control VBUS.
Primary risk: leakage budget pressure from isolated power + parasitics; lab-to-lab variability without a defined setup.
Required pairings: certified isolated power chain; no-load loss control; VBUS OC/SC/UVLO protections; explicit leakage budget and repeatability checks.
When to use: external accessories require electrically separated VBUS; isolated service domain must supply and control VBUS.
Primary risk: leakage budget pressure from isolated power + parasitics; lab-to-lab variability without a defined setup.
Required pairings: certified isolated power chain; no-load loss control; VBUS OC/SC/UVLO protections; explicit leakage budget and repeatability checks.
Topology C — Isolated hub / service port segmentation
When to use: multi-port HMIs or systems requiring a gated service domain (user port vs service port separation).
Primary risk: multi-point bonds and hidden CM return paths during hub/port changes; ESD energy spreads into logic domain.
Required pairings: hardware gate (service disabled by default); consistent zoning across diagram/schematic/PCB; event logging for port power and resets.
When to use: multi-port HMIs or systems requiring a gated service domain (user port vs service port separation).
Primary risk: multi-point bonds and hidden CM return paths during hub/port changes; ESD energy spreads into logic domain.
Required pairings: hardware gate (service disabled by default); consistent zoning across diagram/schematic/PCB; event logging for port power and resets.
Isolation rule: “Data isolation” is not a complete solution unless VBUS behavior and shield/ESD return ownership are explicitly defined.
Key specs that decide medical robustness (not delay/skew)
- ESD robustness (system-level): port ESD must not trigger uncontrolled resets or repeated re-connect events (acceptance placeholders: X events in Y trials).
- Common-mode emission behavior: barrier capacitance, shield bond topology, and return paths dominate radiated/ conducted EMI in practice.
- Barrier capacitance: lower coupling reduces leakage and CM injection; treat it as a first-class selection knob (X pF placeholder).
- VBUS switch behavior: default state, soft-start, OC/SC protection, UVLO, and fault latching determine safe outcomes during hot-plug and faults.
- Fail-safe states: defined outputs during power-down and fault states (data pins, VBUS, and control lines) improve audit posture and field diagnostics.
- Package / geometry feasibility: creepage/clearance and keepouts must be compatible with the chosen placement and enclosure constraints.
Quick check posture: if behavior changes when the shield bond location changes, return-path ownership is not yet controlled.
Pass criteria placeholder: topology remains stable across cable swaps and external device changes under defined setup S.
Acceptance posture: a USB isolation topology is considered complete only when default VBUS behavior, shield bond, and leakage setup are explicitly defined.
60601-1 Compliant Power for HMI (Low-Leakage First)
This chapter focuses on medical-constrained power architecture: certification evidence, low-leakage strategy, and secondary DC-DC behavior (no-load loss, noise, and stability under real HMI usage).
Power tree options (2–3 structures, no magnetics design)
Option 1 — Medical AC-DC → Isolated rail → Point-of-load DC rails
Use when: mains-powered HMI with stable PE model and strong audit posture.
Strength: clear evidence chain; stable leakage control with defined EMI strategy.
Risk: secondary rail noise can couple into touch/USB if return paths are not controlled.
Required measurements: leakage, ripple (rails), thermal rise, hi-pot wiring consistency.
Use when: mains-powered HMI with stable PE model and strong audit posture.
Strength: clear evidence chain; stable leakage control with defined EMI strategy.
Risk: secondary rail noise can couple into touch/USB if return paths are not controlled.
Required measurements: leakage, ripple (rails), thermal rise, hi-pot wiring consistency.
Option 2 — AC-DC (primary domain) → Isolation stage (module) → Secondary rails
Use when: isolation boundary must be explicit and modular for review/production.
Strength: isolation is a distinct artifact; easier traceability across revisions.
Risk: no-load loss and parasitic coupling dominate leakage/EMI at light loads.
Required measurements: no-load loss, leakage budget contributors, repeatability across setups.
Use when: isolation boundary must be explicit and modular for review/production.
Strength: isolation is a distinct artifact; easier traceability across revisions.
Risk: no-load loss and parasitic coupling dominate leakage/EMI at light loads.
Required measurements: no-load loss, leakage budget contributors, repeatability across setups.
Option 3 — Main HMI supply + Gated isolated service-domain supply
Use when: service port must be present but disabled by default (segmented service domain).
Strength: service leakage and noise are bounded and can be independently validated.
Risk: gating mistakes cause “hidden always-on” paths; certification evidence becomes inconsistent.
Required measurements: service domain off-state leakage, VBUS default behavior, event logging.
Use when: service port must be present but disabled by default (segmented service domain).
Strength: service leakage and noise are bounded and can be independently validated.
Risk: gating mistakes cause “hidden always-on” paths; certification evidence becomes inconsistent.
Required measurements: service domain off-state leakage, VBUS default behavior, event logging.
Power posture: low-leakage strategy is prioritized. EMC actions must remain inside the leakage budget defined earlier.
Regulate→Isolate vs Isolate→Regulate (HMI trade-offs)
- Regulate→Isolate: stable pre-regulation can reduce stress variation into the isolation stage; verify no-load loss and CM coupling of the isolated stage.
- Isolate→Regulate: isolates earlier and can contain noise domains; verify secondary ripple and touch/USB sensitivity under real load transients.
- Selection rule: choose the direction that keeps leakage predictable and makes measurement hooks unambiguous (leakage, ripple, PE bond).
Pass criteria (placeholders for reviews and validation)
Leakage: total leakage ≤ X under setup S (PE: Y/N, cable state, service-domain gating state).
Ripple/Noise: key rails ripple ≤ X under load profile Y (measurement bandwidth/probe method documented).
Thermal: temperature rise ≤ X °C at ambient Y, including no-load and typical HMI duty cycles.
Hi-pot: withstand test passes at X kV for Y s with documented nodes and return paths consistent with drawings.
Acceptance posture: power architecture is considered compliant only when leakage remains bounded under a defined setup and measurement points are documented.
EMC/ESD Strategy Without Breaking Leakage Limits
Medical HMI is defined by a hard conflict: EMC fixes often add cross-domain coupling, while leakage limits forbid it. The strategy here is return-path ownership first, then path control, and only then budgeted capacitive bridging.
Three iron rules for ESD return (non-negotiable)
Rule 1 — ESD energy must return to chassis/PE without crossing the isolation gap.
Why it matters: crossing the barrier injects impulse into the secondary domain and triggers USB resets, touch drift, or MCU brownouts.
Quick check: if ESD causes re-enumeration or spontaneous resets, verify whether the return path is using secondary ground as a bridge.
Why it matters: crossing the barrier injects impulse into the secondary domain and triggers USB resets, touch drift, or MCU brownouts.
Quick check: if ESD causes re-enumeration or spontaneous resets, verify whether the return path is using secondary ground as a bridge.
Rule 2 — TVS must dump into a short, wide chassis path, not into logic ground.
Why it matters: a “correct TVS part” is ineffective if its current loop is long or forced through sensitive ground regions.
Quick check: compare physical distance and copper width from TVS to chassis bond vs TVS to logic ground; the chassis path must be shorter.
Why it matters: a “correct TVS part” is ineffective if its current loop is long or forced through sensitive ground regions.
Quick check: compare physical distance and copper width from TVS to chassis bond vs TVS to logic ground; the chassis path must be shorter.
Rule 3 — Shield must have a defined role and bond strategy (single-point unless proven otherwise).
Why it matters: multi-point bonds create uncontrolled loops that change with cables and external devices, making leakage and EMI irreproducible.
Quick check: large pass/fail differences across cable swaps and external device changes indicate hidden loop formation.
Why it matters: multi-point bonds create uncontrolled loops that change with cables and external devices, making leakage and EMI irreproducible.
Quick check: large pass/fail differences across cable swaps and external device changes indicate hidden loop formation.
Acceptance posture: ESD protection is judged by system behavior and return-path closure, not by component presence alone.
EMI remediation order (do not start with Y-cap)
- Step 0 — Freeze the setup: define PE present/absent, cable state, external device state, and service-port gating state (setup S).
- Step 1 — Control the source: reduce dv/dt and CM excitation at switching/noisy nodes (edge-rate and loop-area knobs).
- Step 2 — Control the path: enforce single-point shield bond, shortest TVS→chassis loop, correct CMC placement, and strict partitioning.
- Step 3 — Reduce coupling: minimize barrier capacitance and cross-gap parasitics (keepouts, slots, controlled copper near the barrier).
- Step 4 — Budgeted Y-cap (last): only when leakage budget remains within limits and results stay repeatable under setup S.
Pass criteria placeholder: EMI improves while leakage remains ≤ X under setup S, and results vary ≤ N% across cable swaps.
Field stability placeholder: ESD events do not produce USB reconnect storms or touch instability beyond X events in Y trials.
Result: EMC improvements become repeatable and auditable while leakage remains bounded under a defined measurement setup.
Layout & Mechanical Guardrails (Partition, Slots, Shield Bond)
This chapter locks in timeless implementation rules: strict partitioning, slot/keepout usage, connector-zone return control, and mechanical restrictions near the isolation band.
Layout checklist (hard rules)
- Hard partition: Primary/Secondary must be physically separated; no copper, vias, or return currents may cross the isolation gap.
- Isolation band keepout: enforce keepout for copper and components near the barrier; prevent parasitic bridging.
- Slots must cut the shortest path: slot placement must increase creepage where the shortest path actually exists (not decorative).
- Guard ring is domain-local: guard features must remain within the same domain and must not form cross-gap capacitive bridges.
- Connector zone rule: TVS→chassis bond loop must be shortest and widest; ESD return must stay out of logic ground regions.
- Shield bond is explicit: single-point bond unless a verified multi-point strategy exists; hidden contacts count as extra bonds.
- Mechanical no-go: screw posts, metal frames, and copper pours must not encroach on isolation keepouts or shorten creepage.
- Stitching discipline: stitching vias belong within a domain (chassis domain or logic domain) and must not stitch across the barrier.
- Evidence consistency: partition boundaries must match block diagram, schematic labels, and PCB documentation.
Quick review posture: any “unexpected conductive contact” (spring fingers, screws, frames) must be treated as a bond candidate and validated.
Typical violations (text-only examples)
Violation — Cross-gap stitching via
What happened: vias or copper features bridge the gap area.
Why it fails: creates an unintended return/coupling path that breaks leakage and EMI repeatability.
Fix: remove stitching across the band; keep stitching inside a single domain only.
What happened: vias or copper features bridge the gap area.
Why it fails: creates an unintended return/coupling path that breaks leakage and EMI repeatability.
Fix: remove stitching across the band; keep stitching inside a single domain only.
Violation — TVS dumped to logic ground
What happened: TVS current returns through secondary ground before reaching chassis/PE.
Why it fails: ESD energy is injected into the HMI domain; resets and touch drift follow.
Fix: move TVS reference to chassis bond; shorten and widen the dump path.
What happened: TVS current returns through secondary ground before reaching chassis/PE.
Why it fails: ESD energy is injected into the HMI domain; resets and touch drift follow.
Fix: move TVS reference to chassis bond; shorten and widen the dump path.
Violation — Hidden multi-point shield bonds
What happened: shield touches chassis/metal frame at multiple points unintentionally.
Why it fails: creates loops that vary with assembly and cables; leakage becomes unpredictable.
Fix: enforce a single defined bond; isolate other contacts mechanically.
What happened: shield touches chassis/metal frame at multiple points unintentionally.
Why it fails: creates loops that vary with assembly and cables; leakage becomes unpredictable.
Fix: enforce a single defined bond; isolate other contacts mechanically.
Violation — Slot does not cut the true shortest path
What happened: a slot is present but not aligned to the creepage-limiting geometry.
Why it fails: creepage is not improved where it matters; review still fails.
Fix: reposition slot based on the actual shortest creepage route.
What happened: a slot is present but not aligned to the creepage-limiting geometry.
Why it fails: creepage is not improved where it matters; review still fails.
Fix: reposition slot based on the actual shortest creepage route.
Outcome: layout and mechanical constraints become reviewable, repeatable, and compatible with leakage-safe EMC strategy.
Fail-Safe States & Serviceability (What Happens on Power Loss)
Medical HMI reviews emphasize predictable safe defaults and diagnosability. The scope here is isolation-related behavior only: isolated power and isolated signals during power loss and fault conditions.
Fail-safe state list (card-format, audit-friendly)
USB D+/D- (isolated data path)
Default on power loss: Hi-Z / disconnected state within X ms.
Reason: prevents false attach, phantom enumeration, and uncontrolled retries when rails collapse.
Pass criteria: no repeated re-enumeration beyond N events under setup S.
Default on power loss: Hi-Z / disconnected state within X ms.
Reason: prevents false attach, phantom enumeration, and uncontrolled retries when rails collapse.
Pass criteria: no repeated re-enumeration beyond N events under setup S.
USB VBUS (service power)
Default on power loss: VBUS switch OFF; fault-dependent latch behavior per policy (OC/SC/UVLO).
Reason: avoids powering external devices through uncontrolled states and reduces leakage exposure during faults.
Pass criteria: VBUS OFF within X ms; no unintended back-power paths under setup S.
Default on power loss: VBUS switch OFF; fault-dependent latch behavior per policy (OC/SC/UVLO).
Reason: avoids powering external devices through uncontrolled states and reduces leakage exposure during faults.
Pass criteria: VBUS OFF within X ms; no unintended back-power paths under setup S.
Service enable GPIO / control lines
Default on power loss: service disabled (safe state) with defined pull direction.
Reason: ensures service port is not exposed by default; prevents accidental enable on brownout.
Pass criteria: service remains disabled across Y brownout cycles; enable requires explicit auth OK.
Default on power loss: service disabled (safe state) with defined pull direction.
Reason: ensures service port is not exposed by default; prevents accidental enable on brownout.
Pass criteria: service remains disabled across Y brownout cycles; enable requires explicit auth OK.
Isolated rail (iso DC-DC / iso bias)
Default on UVLO/OT: rail shutdown and optionally fault-latched OFF (policy defined).
Reason: prevents unstable oscillation and repeated fault cycling that produces EMI and unpredictable states.
Pass criteria: no restart storms; recovery follows defined sequence within X s.
Default on UVLO/OT: rail shutdown and optionally fault-latched OFF (policy defined).
Reason: prevents unstable oscillation and repeated fault cycling that produces EMI and unpredictable states.
Pass criteria: no restart storms; recovery follows defined sequence within X s.
Isolation barrier outputs (fault pins / interrupts)
Default on fault: diagnosable flag asserted (latched or level) to support root-cause logging.
Reason: enables field troubleshooting without probing across isolation zones.
Pass criteria: fault cause retrievable within X s after event; matches observed behavior.
Default on fault: diagnosable flag asserted (latched or level) to support root-cause logging.
Reason: enables field troubleshooting without probing across isolation zones.
Pass criteria: fault cause retrievable within X s after event; matches observed behavior.
Shield bond / chassis reference
Default posture: single defined bond point (no unintended secondary bonds).
Reason: prevents hidden return paths that alter leakage and ESD behavior during fault and recovery.
Pass criteria: behavior repeatable across assembly variance within N% under setup S.
Default posture: single defined bond point (no unintended secondary bonds).
Reason: prevents hidden return paths that alter leakage and ESD behavior during fault and recovery.
Pass criteria: behavior repeatable across assembly variance within N% under setup S.
Audit note: each default must be explicitly stated in schematic/requirements and verifiable by a defined setup and timing window.
Black-box logging (minimum set for field diagnosis)
Power integrity: UVLO count, minimum rail value (placeholder), total UVLO duration, recovery count.
Protection events: OT trips, VBUS OC/SC events, latch status, clear actions, ESD-related reset counter (if available).
Serviceability: service enable/disable timestamps, auth result code, failed-auth reason code, session duration.
Pass criteria placeholder: logs readable within X s after event; records remain consistent across power cycles.
Acceptance posture: service access is gated by default; fault behavior is auditable via explicit defaults and event records.
Timing/Noise Co-Design (Touch/Display/Audio vs Isolation)
Medical HMI noise symptoms (touch jitter, display artifacts, audio hum) often trace back to isolated power ripple, barrier capacitance, and uncontrolled common-mode return paths.
Symptom → suspect path (repeatable troubleshooting map)
Symptom: Touch jitter appears only when an external USB device is attached.
Suspect path: CM current via barrier capacitance + shield loop changes the touch reference.
Quick check: compare behavior with service domain disabled and with shield bond moved to the defined point.
Fix knob: return-path control → coupling reduction → filtering → (last) budgeted Y-cap.
Suspect path: CM current via barrier capacitance + shield loop changes the touch reference.
Quick check: compare behavior with service domain disabled and with shield bond moved to the defined point.
Fix knob: return-path control → coupling reduction → filtering → (last) budgeted Y-cap.
Symptom: Display “snow” or flicker increases on AC mains compared to battery/isolated source.
Suspect path: isolated DC-DC ripple + CM injection couples into display rails/reference.
Quick check: measure ripple at TP-Ripple and correlate artifacts with load steps (brightness changes).
Fix knob: source control (dv/dt/loop) → return-path control → rail filtering.
Suspect path: isolated DC-DC ripple + CM injection couples into display rails/reference.
Quick check: measure ripple at TP-Ripple and correlate artifacts with load steps (brightness changes).
Fix knob: source control (dv/dt/loop) → return-path control → rail filtering.
Symptom: Audio hum changes with cable movement or enclosure contact.
Suspect path: shield bond ambiguity creates variable CM loops; audio reference follows CM current.
Quick check: enforce single bond strategy and verify repeatability across cable swaps under setup S.
Fix knob: bonding strategy → coupling reduction → filtering.
Suspect path: shield bond ambiguity creates variable CM loops; audio reference follows CM current.
Quick check: enforce single bond strategy and verify repeatability across cable swaps under setup S.
Fix knob: bonding strategy → coupling reduction → filtering.
Symptom: Touch drift increases after ESD events, then slowly recovers.
Suspect path: ESD return crosses sensitive ground regions; recovery resets reference baselines and injects CM energy.
Quick check: verify TVS dump path to chassis is shortest; ensure D+/D- goes Hi-Z and service is disabled in fault state.
Fix knob: return-path closure → fail-safe defaults → coupling reduction.
Suspect path: ESD return crosses sensitive ground regions; recovery resets reference baselines and injects CM energy.
Quick check: verify TVS dump path to chassis is shortest; ensure D+/D- goes Hi-Z and service is disabled in fault state.
Fix knob: return-path closure → fail-safe defaults → coupling reduction.
Symptom: Noise spikes occur during service port enable/disable transitions.
Suspect path: VBUS switch behavior and inrush transients couple through barrier/return paths.
Quick check: scope VBUS inrush profile; compare with service gated OFF posture.
Fix knob: VBUS switch policy → source control → filtering.
Suspect path: VBUS switch behavior and inrush transients couple through barrier/return paths.
Quick check: scope VBUS inrush profile; compare with service gated OFF posture.
Fix knob: VBUS switch policy → source control → filtering.
Symptom: Touch errors correlate with isolated rail no-load/light-load operation.
Suspect path: burst/skip-mode ripple and CM current dominate at light load.
Quick check: compare ripple spectrum at light load vs typical load; verify behavior under setup S.
Fix knob: no-load loss/operating mode selection → return-path control → filtering.
Suspect path: burst/skip-mode ripple and CM current dominate at light load.
Quick check: compare ripple spectrum at light load vs typical load; verify behavior under setup S.
Fix knob: no-load loss/operating mode selection → return-path control → filtering.
Priority rule: source → return path → filtering → (last) budgeted Y-cap.
Quick fixes (isolation-relevant only)
- Freeze the bond strategy: enforce a single shield bond point and remove hidden mechanical contacts; verify repeatability across cables.
- Gate service domain by default: service OFF posture first; enable only after auth and log all transitions.
- Shorten ESD dump loops: TVS must dump into chassis with a short, wide loop; keep ESD current out of logic ground.
- Reduce cross-gap parasitics: enlarge keepout near barrier, avoid copper/via proximity, and use slots where geometry limits creepage.
- Control switching excitation: minimize loop area and edge-rate where feasible; validate noise change at TP-Ripple.
- Filtering as a controlled step: apply rail filtering after return-path ownership is correct; validate against leakage budget.
Pass criteria placeholder: symptom probability ≤ N% under setup S across Y device/cable permutations.
Noise placeholder: ripple/CM indicators reduced to ≤ X under defined bandwidth and probe method.
Acceptance posture: noise issues are resolved by controlling injection and return paths first; capacitive bridging is only used within a defined leakage budget.
H2-11 · Validation Plan (Type Test + Factory Test) for Medical HMI Isolation
A compliance-ready validation plan turns leakage, dielectric strength, and USB immunity into repeatable wiring, operating states, and pass/fail numbers (X/Y/N placeholders).
PlanType Test vs Factory Test (same metrics, different rigor)
The same electrical-safety metrics must exist in both phases, but with different coverage, sampling, and documentation depth.
Type Test (Certification / Design verification): worst-case operating states + full enclosure configuration + defined measurement method + archived reports/certificates.
Factory Test (Production): fast screening on critical paths + controlled fixtures + sampling plan + traceability to product revision (HW/FW/BOM).
LeakageLeakage Current Test Worksheet (structure, not a wide table)
Define leakage by state × supply mode × switch positions × measurement points. Record results with unambiguous denominators.
- Operating states: Normal / Standby / Service port enabled / Charger connected (if any) / Display max brightness / Touch active / Audio active (as applicable).
- Supply modes: AC mains / external DC adapter / internal battery (if applicable).
- Switch positions: USB cable connected vs disconnected; shield bonded vs floating option; any PE bond option (single-point only).
- Measurement points: PE, accessible metal, USB shield, patient boundary reference (as defined in system zones).
- Pass criteria (placeholders): leakage ≤ X µA in state A; ≤ Y µA in state B; no state exceeds N events over T minutes.
Output requirement: every leakage number must be tied to a named state and a named measurement point.
DielectricHi-pot / Insulation Resistance / (if needed) Partial Discharge
Certification review typically fails on unclear test paths. Make the wiring path and referenced barrier explicit.
- Hi-pot path: apply stress across the intended isolation barrier (Primary ↔ Secondary, and/or Secondary ↔ PE), not “some convenient node”.
- IR path: measure insulation resistance on the same boundary used for hi-pot; record humidity/temperature if required.
- PD (optional): only when required by the selected insulation system and working-voltage/lifetime model.
- Pass criteria (placeholders): withstand ≥ X Vrms for Y s; IR ≥ N MΩ; PD ≤ P pC at V.
USBUSB Physical + EMC/ESD Validation Order
Validate in an order that avoids false conclusions (functional failures disguised as EMC issues).
- Step 1: USB link integrity (enumeration + sustained transfer + reconnect/suspend/resume as used in service workflows).
- Step 2: ESD to connector shell/shield and enclosure; verify fail-safe behavior and recovery policy.
- Step 3: EMI emissions/immunity; verify that fixes do not break leakage limits.
- Step 4: Regression: repeat leakage + functional USB after every EMI/ESD fix (Y-cap changes are last resort).
DocsArtifacts & Traceability Pack (what must be archived)
- Hardware: PCB revision, creepage/clearance drawing, partition screenshots, isolation BOM snapshot.
- Power: PSU module certificates/reports, leakage test record, PE bond definition.
- USB: topology diagram, ESD/EMC countermeasures list, service policy (default off / authenticated enable).
- Manufacturing: factory test procedure, fixture photo, calibration record, sampling rule.
ExamplesTest Equipment (example part numbers/models; equivalents acceptable)
Electrical Safety / Leakage Analyzer: Fluke Biomedical ESA615 (for IEC 60601-1 style leakage workflows).
Hipot + Leakage (production-friendly): Chroma 19032 / 19032-P electrical safety analyzer family.
ESD Simulator: Ametek-CTS / Teseq NSG 438 / NSG 438A (IEC 61000-4-2 class devices).
Use a single naming convention for all recorded tests: State-ID / Point-ID / Cable-ID / Fixture-ID / Revision-ID.
DiagramTest Path Map: Hipot + Leakage + ESD (wiring-level)
A review-friendly wiring map that shows boundaries, stress path, and measurement points without schematic detail.
Diagram intent: show “what connects to what” for audit questions, not circuit detail.
H2-12 · Selection Logic & Quick Pairings (with reference part numbers)
Selection is knob-driven: start from leakage & insulation targets, then EMC/ESD, and only then optimize cost/size/supply. Reference part numbers below are “known-good starting points”.
KnobsSelection knobs (ranked, do not reorder)
Top (non-negotiable): leakage budget, insulation class (MOOP/MOPP), certified barrier ratings, working voltage lifetime model.
Middle: EMC/ESD robustness (connector ESD, CM emission, shield/PE strategy) without violating leakage.
Bottom: cost, footprint, procurement risk (second source, package, lead time).
USBIsolated USB architecture picks (reference IC part numbers)
HS/FS/LS isolated repeater (USB 2.0 up to 480 Mbps): TI ISOUSB211 (reinforced isolation class devices).
HS-capable USB isolator family (retimed, clocked): Analog Devices ADuM4165 / ADuM4166 (480 Mbps-class; external clock/crystal requirement depends on variant).
FS/LS isolator (service ports that do not need HS): Analog Devices ADuM4160 (1.5/12 Mbps).
Reference “connector survival” parts (ESD + CMC)
- ESD protection (USB data lines): TI TPD4E05U06; Nexperia PESD5V0S1UL.
- USB common-mode choke (noise control before Y-cap): TDK ACM2012 series; Murata DLW21 series.
- Rule: ESD/CMC choices must be re-verified for leakage impact through shield/PE strategy (do not assume “drop-in”).
Power60601-1 compliant power (reference module part numbers)
Medical power selection is certificate-driven first, then leakage/no-load loss, then ripple/thermal.
Medical AC-DC (example families): Mean Well MPM-65-5 / MPM-65-12; Mean Well RPS-75-5; RECOM RACM100-12S / RACM100-24S.
Medical DC-DC (example families): Mean Well MDS06F-12 / MDS03F-05; CUI PTP20-24-S5 / PTP20-24-S12 (2xMOPP-class series).
Pass criteria placeholders: leakage ≤ X µA, ripple ≤ Y mVpp (bandwidth defined), module temperature rise ≤ N °C at worst-case ambient.
PairingsQuick Pairings (fixed 4-line format)
Use case: Patient-adjacent HMI with a service USB port (HS required).
Why: HS isolation + controlled CM emission + reinforced barrier strategy.
Watch-outs: shield-to-PE bonding must match leakage budget; avoid “Y-cap first”.
Pass criteria: leakage ≤ X µA; ESD recovery ≤ Y s; no unintended service enable events > N/day.
Why: HS isolation + controlled CM emission + reinforced barrier strategy.
Watch-outs: shield-to-PE bonding must match leakage budget; avoid “Y-cap first”.
Pass criteria: leakage ≤ X µA; ESD recovery ≤ Y s; no unintended service enable events > N/day.
Use case: Operator-only HMI where service USB is limited to FS/LS.
Why: simpler isolation + lower integration risk; easier functional regression.
Watch-outs: ensure enumerations and suspend/resume behavior matches field workflows.
Pass criteria: stable enumeration across Y cable swaps; leakage ≤ X µA in all defined states.
Why: simpler isolation + lower integration risk; easier functional regression.
Watch-outs: ensure enumerations and suspend/resume behavior matches field workflows.
Pass criteria: stable enumeration across Y cable swaps; leakage ≤ X µA in all defined states.
Use case: Low-leakage power-first architecture (noise-sensitive touch/display).
Why: certified AC-DC + medical DC-DC with controlled no-load loss reduces ripple-driven UI artifacts.
Watch-outs: ripple measurement bandwidth and probe method must be standardized (avoid “scope myths”).
Pass criteria: ripple ≤ Y mVpp; touch jitter ≤ N; leakage unchanged after EMC fixes.
Why: certified AC-DC + medical DC-DC with controlled no-load loss reduces ripple-driven UI artifacts.
Watch-outs: ripple measurement bandwidth and probe method must be standardized (avoid “scope myths”).
Pass criteria: ripple ≤ Y mVpp; touch jitter ≤ N; leakage unchanged after EMC fixes.
SupplyProcurement & change-control guardrails
- Lock the certificate set: power modules and isolators must retain the same safety approvals across revisions.
- Second-source rule: qualify at least one alternate for ESD/CMC parts; verify leakage does not drift.
- Change triggers: any shield bond change, Y-cap change, or module change forces leakage re-test + USB regression.
- Factory fixtures: fixture ID is part of the test record; uncontrolled fixtures invalidate trending.
DiagramKnob Priority Pyramid (Leakage/Safety always on top)
A selection diagram that prevents “EMC fixes” from silently breaking leakage compliance.
Diagram intent: enforce the correct decision order across design, review, and factory change-control.
Request a Quote
H2-13 · FAQs (Field Troubleshooting + Acceptance Disputes)
Scope: isolated USB + medical power + leakage/EMC/grounding/test definitions only. Each answer is fixed to 4 lines with measurable placeholders (X/Y/N).
Data placeholders (use the same definitions across lab, type test, and factory test)
- Setup S#: defined wiring + operating state ID (e.g., Service OFF/ON, USB attached, max brightness).
- TP-Leakage-#: named leakage measurement point; TP-Ripple: named ripple/CM check point.
- X µA: leakage limit placeholder; N dB: EMC margin placeholder; Y: duration/cycles placeholder; N: event count placeholder.
Rule: do not change Y-caps first; control source/return path before capacitive bridging.
EMC passes but leakage fails — change Y-cap first or fix return path/shield first?
Likely cause: CM current is forced through a leakage-sensitive path due to return-path/shield ownership; Y-cap value/placement is not budgeted.
Quick check: enforce the defined single-point shield bond and re-measure TP-Leakage-1 under Setup S1; compare delta before touching Y-caps.
Fix: control return path/shield first → add/optimize CMC and edge control → adjust Y-cap only within the leakage budget.
Pass criteria: leakage ≤ X µA @ S1 for Y minutes; EMC margin ≥ N dB with the same configuration.
Radiated EMI fails unless a Y-cap is added — which common-mode path is most likely first?
Likely cause: dominant CM current flows on the USB cable/shield due to barrier capacitance and an uncontrolled chassis bond reference.
Quick check: measure CM current on the USB cable (or compare emissions) with shield bond moved to the defined point; verify TP-Ripple does not spike under S2.
Fix: reduce excitation (dv/dt/edge) + enforce shield-to-chassis ownership + CMC first; add minimal symmetric Y-cap only if leakage budget allows.
Pass criteria: radiated meets limit with margin ≥ N dB at S2; if Y-cap used, C ≤ X nF and leakage ≤ Y µA.
Touch drifts only when an external USB device is attached — suspect shield bond or isolated power ripple first?
Likely cause: external device changes CM reference; ambiguous shield bonding plus barrier CM injection shifts the touch reference, amplified by isolated rail ripple.
Quick check: A/B test (shield floating vs single-point bond) and log touch stability while measuring TP-Ripple under S3.
Fix: lock shield bond policy + reduce isolated ripple/noise mode + add CM choke/return-path control before any Y-cap adjustment.
Pass criteria: touch noise index ≤ X and drift ≤ Y under S3; no more than N drift events per Y minutes.
ESD to the USB port causes reboot — check TVS return path first or isolated-side rail droop first?
Likely cause: ESD current returns through logic ground instead of chassis, or VBUS/isolated rail droops and triggers UVLO/reset.
Quick check: during ESD shots, capture VBUS and isolated rail minimum; confirm TVS has a short chassis dump loop and the shield bond is at the defined point.
Fix: shorten TVS-to-chassis return + add local energy storage on the sensitive rail + tighten fail-safe defaults (VBUS OFF, D+/D- Hi-Z) during fault.
Pass criteria: ≤ N reboots in Y shots @ IEC level; functional recovery ≤ X seconds; logs capture fault cause within X seconds.
HS intermittently downshifts to FS — suspect CM emission first or VBUS dip/UVLO first?
Likely cause: transient VBUS dips/UVLO events destabilize the isolated USB path, or CM noise degrades signal integrity enough to force fallback.
Quick check: log min VBUS and UVLO flags during downshift; correlate with emissions/CM current changes under S4.
Fix: stabilize VBUS timing (switch + bulk + inrush policy) + reduce CM injection (bond/CMC/edge control) before protocol-level assumptions.
Pass criteria: HS maintained for ≥ Y minutes @ S4; downshift events ≤ N per hour; VBUS min ≥ X V (placeholder).
Same device, different labs report different leakage — which 3 test definitions must be normalized first?
Likely cause: mismatch in operating state, wiring reference (PE/chassis/shield), or measurement method (instrument mode/bandwidth/polarity).
Quick check: run both labs using the same Setup S# checklist + same TP names; record mains condition and switch positions identically.
Fix: publish a single-page test method: state IDs, wiring diagram, TP list, instrument settings; require sign-off before comparing results.
Pass criteria: inter-lab delta ≤ X µA or ≤ Y% for all defined states; no state exceeds limit by more than N µA.
Hi-pot passes but users report “tingling” — which leakage paths are most often overlooked?
Likely cause: overlooked paths via shield-to-chassis contact, EMI filter parasitics, unintended mechanical bonds (screws/standoffs), or wet/contaminated surfaces.
Quick check: measure leakage from accessible metal and USB shield to PE under the worst-case state S5; inspect for unintended secondary bonds.
Fix: remove unintended bonds + enforce single-point shield bond + re-validate leakage budget after any filter/bond change.
Pass criteria: accessible leakage ≤ X µA @ S5; complaint reproduction count ≤ N across Y trials (placeholder).
After isolating the service port, EMI gets worse — is it shield discontinuity or CM current rerouting?
Likely cause: shield reference is broken or moved, causing CM current to reroute onto the cable; barrier capacitance now drives a more efficient radiator.
Quick check: compare CM current on the service cable before/after isolation change; verify the shield bond point matches the zone plan.
Fix: restore a controlled shield termination to chassis at a single point + add/optimize CMC + reduce edge excitation where possible.
Pass criteria: emissions margin ≥ N dB @ S6; leakage remains ≤ X µA with the same bond configuration.
Isolated supply no-load loss exceeds target and causes temperature rise — change topology first or enable strategy first?
Likely cause: burst/skip mode or bias overhead dominates at light load; always-on rails keep the converter in an inefficient operating region.
Quick check: measure input power at no-load and standby state S7; check whether rails can be gated by service policy without breaking defaults.
Fix: implement enable/gating policy first (service OFF by default) + validate recovery sequencing; change topology/module only if gating cannot meet targets.
Pass criteria: no-load power ≤ X mW @ S7; temperature rise ≤ Y °C; wake/recovery success ≥ 1−N%.
After power recovery, USB does not enumerate (electrical/power side only) — check VBUS timing or default states first?
Likely cause: VBUS ramp/hold violates the isolator/hub expectations, or D+/D- are not in the defined Hi-Z/default state during brownout recovery.
Quick check: scope VBUS rise/fall and confirm D+/D- default (Hi-Z) under S8; verify service stays disabled until rails are stable.
Fix: enforce VBUS switch sequencing + lock fail-safe defaults + prevent restart storms (UVLO latch policy as defined).
Pass criteria: enumeration success ≥ 1−N% across Y power cycles; attach-to-ready time ≤ X seconds.
Chassis grounding reduces noise but leakage increases — which “single-point connection” should be moved first?
Likely cause: a new bond created a direct leakage path; the connection moved CM current into a leakage-measured boundary.
Quick check: move only the shield/PE bond location (one change at a time) and re-measure TP-Leakage-1 vs the noise index under S9.
Fix: keep exactly one defined bond point near the connector/chassis reference; remove any secondary unintended contacts; re-check EMC without adding Y-caps first.
Pass criteria: noise index ≤ X while leakage ≤ Y µA @ S9; configuration repeatable across N assemblies.
Type tests pass but production failures appear sporadically — which two diagnostic log points come first?
Likely cause: intermittent rail minima/UVLO events or uncontrolled service transitions are not visible; failures are “unclassifiable” without black-box evidence.
Quick check: add and read back logs after a failure: (1) min VBUS & min isolated rail, (2) latched fault reason (UVLO/OT/OC/ESD-reset).
Fix: implement latched fault cause + rail-min capture with timestamps; keep service default OFF and log every enable/disable transition.
Pass criteria: ≥ (1−N%) of field failures classified automatically; time-to-root-cause ≤ X minutes; no restart storms beyond Y retries.
