Hot-Plug / Brown-Out: Inrush, TVS, Sequencing & Ghost-Power Control
← Back to: I²C / SPI / UART — Serial Peripheral Buses
This page turns hot-plug and brown-out failures into a measurable playbook: control inrush and clamp energy, prevent ghost-power back-feed, and enforce a clean UVLO/reset authority so systems recover every time. Follow the trigger → waveform → log → pass-criteria flow to stop reboots, stuck buses, and data corruption across repeated plug cycles.
H2-1. Definition & Scope Guard (Hot-Plug / Brown-Out)
This page is an engineering playbook for hot-plug transients, brown-out behavior, and ghost-powering that can destabilize I²C/SPI/UART systems. It focuses on measurable boundaries (energy, thresholds, timing) and repeatable verification.
In scope
- Connector bounce & re-contact sequences
- Inrush limiting (Ipeak / di/dt / dV/dt)
- Clamp/TVS conduction and energy accounting
- Rail droop, UVLO/BOR thresholds, reset timing
- Ghost-powering (back-feed through I/O/ESD paths)
Out of scope (link-only)
- Full IEC ESD/surge standards and broad protection catalogs
- General isolation architecture beyond hot-plug timing context
- Generic level-translation theory unrelated to power transients
- Complete power-supply design textbooks (loop stability, magnetics)
Hot-plug event
A connection/disconnection transient that stresses power + I/O at the same time.
- Includes: connector bounce, inrush charging, clamp conduction, sequencing mismatch.
- Engineering checks: Ipeak/di-dt, Vport clamp (Vclamp), rail droop vs threshold, reset/glitch triggers.
- Common trap: “Voltage looks fine” while energy, return path, or bounce repetition still causes soft failures.
Brown-out
Rail droop crossing reliability boundaries (UVLO/BOR), causing undefined or sticky states.
- Not just “low voltage”: threshold crossing + dwell time + reset/PG timing.
- Engineering checks: Vrail vs UVLO/BOR, hysteresis behavior, reset assert/release alignment, write-protect effectiveness.
- Common trap: “No reboot” does not imply safety; partial/rail-specific brown-outs can break interfaces quietly.
Ghost-powering
Back-feed into an “off” rail through I/O or protection structures (half-powered hazard).
- Typical path: external signal → ESD diode → VDD rail → partial logic alive.
- Engineering checks: Vrail when “off”, abnormal line bias, latch-up/stuck bus, unexpected temperature rise.
- Common trap: treating it as leakage; ghost-power often supplies enough current to lock state machines.
Quick fit check (this page applies if any is true)
- Plug/unplug causes reset, link drop, or intermittent interface errors after reconnection.
- “Off” devices still show activity (LED on, bus lines held, or rails not fully at 0 V).
- Repeated hot-plug makes the port progressively less stable (soft degradation).
H2-2. Failure Signatures (Symptom → First Check Map)
Use this section as a routing table: pick a symptom, perform the three first checks, then follow the most likely cause bucket (inrush, bounce, clamp energy, back-feed, UVLO/reset timing). The goal is to prevent unfocused “try everything” debugging.
How to use this map
- Pick the symptom card that best matches the field behavior.
- Do the three “first checks” (fast, measurable, and high-signal).
- Route into the likely bucket (then design/verify with thresholds).
Symptom
Instant reboot / link drop at plug-in
Three first checks
- Reset truth: confirm RESET assertion (pin/log) vs software crash.
- Threshold crossing: measure Vrail droop vs UVLO/BOR (and hysteresis).
- Inrush stress: measure Ipeak/di-dt and check if protection is “hiccuping”.
Likely buckets:
Inrush
UVLO/Reset
Bounce
Symptom
Intermittent I²C NAK / SPI CRC / UART framing after hot-plug
Three first checks
- Time-correlation: error counters vs time since plug-in (burst window behavior).
- Partial brown-out: check peripheral rails/PG/reset alignment (not only the main rail).
- Ghost-power flag: verify “off” rails are truly 0 V; isolate suspected I/O back-feed.
Likely buckets:
UVLO/Reset
Back-feed
Bounce
Symptom
Port becomes “more fragile” after repeated hot-plug
Three first checks
- Clamp health: check TVS leakage/temperature vs baseline (soft degradation).
- Waveform drift: compare Vclamp/overshoot before vs after cycling (same setup).
- Statistics: failure rate vs cycle count (a monotonic trend is a strong hint).
Likely buckets:
Clamp energy
Return path
Symptom
Device is “off” but still alive (ghost power)
Three first checks
- Off-rail voltage: measure “off” rails for residual voltage (mV→V range).
- Disconnect isolation: remove one signal group (I/O) and see if residual voltage collapses.
- Line bias: check stuck-low/stuck-high behavior on bus lines after power-off.
Likely buckets:
Back-feed
Sequencing
H2-3. Root Cause Physics (Connector Bounce, Inrush, Clamp, Back-Feed)
Hot-plug failures are energy-path problems. The sections below keep only the physics that directly changes design choices and verification metrics: bounce, inrush, clamp energy, and back-feed.
Bounce = repeated events
Inrush = Cload charge
Clamp = energy + return path
Back-feed = half-powered rail
Physics
Connector bounce
- Model: the contact closes/opens multiple times, creating a short burst of repeated hot-plug events.
- Breaks: repeated inrush + repeated clamp conduction → higher accumulated stress and intermittent “works-then-drops”.
- Measure: count re-contact spikes within the first milliseconds (voltage or current shows multiple peaks).
- Control: soften each event (pre-charge/soft-start) and reduce burst sensitivity (debounce + power-good gating).
- Trap: passing a single plug cycle is not evidence; bounce is statistical and must be evaluated over cycles.
Physics
Inrush (Cload charging)
- Model: Vin charges Cload through a finite path impedance; ESR and line inductance shape I(t) and ringing.
- Breaks: source droop triggers UVLO/BOR or protection hiccup; ground/return noise can corrupt I²C/SPI/UART timing.
- Measure: Ipeak/di-dt (current probe or shunt) + Vin/Vrail droop against thresholds.
- Control: limit Ipeak, or di/dt, or dV/dt depending on what causes failure.
- Trap: watching only Ipeak while ignoring Vin droop; resets typically follow threshold crossing, not “big current”.
Physics
Clamp energy (TVS / clamps)
- Model: clamps conduct once Vport crosses a knee; energy is redirected through a return loop, not “disappearing”.
- Breaks: even if peak voltage is acceptable, clamp current and loop inductance can inject ground bounce and reset glitches.
- Measure: Vclamp waveform + event repetition + clamp health (leakage/temperature drift) over cycles.
- Control: select for dynamic behavior and keep the clamp return loop short; treat “layout + return” as part of the clamp.
- Trap: picking a bigger TVS while leaving a long return path; protection can make system noise worse.
Physics
Back-feed (ghost-power path)
- Model: an external I/O signal forward-biases protection structures into an “off” VDD rail (half-powered state).
- Breaks: sticky state machines, stuck-low bus lines, intermittent NAK/CRC/framing, and unsafe writes during power loss.
- Measure: VDD(off) residual voltage + “disconnect test” (remove a signal group and observe collapse).
- Control: cut the path (OE→Hi-Z, bus switch/isolator, series-R limiting, reverse blocking, sequencing).
- Trap: calling it leakage; back-feed can supply enough current to lock a device without full power-up.
H2-4. Inrush Control Architecture (eFuse / Load Switch / Soft-Start)
Inrush control is a knob selection problem: limiting peak current, limiting di/dt, or limiting dV/dt. The correct choice depends on load type (pure capacitance vs a DC/DC behind the switch) and whether hard cut-off and fault reporting are required.
Control knobs and what they protect
- Limit Ipeak: protects source and switch SOA; may increase ramp time.
- Limit di/dt: reduces inductive spikes/EMI; may slow response to step loads.
- Limit dV/dt: controls rail ramp and cross-rail disturbance; may violate power-up timing windows if too slow.
Load type changes stability risk
- Pure capacitive load: typically compatible with controlled ramps (soft-start/load switch).
- DC/DC behind the switch: can “fight” current limits and create hiccup loops (UVLO → restart → limit → UVLO).
- Rule: if Vin droop crosses UVLO/BOR or resets downstream logic, treat droop as the first pass/fail metric.
Common solution buckets (with typical fit)
Load switch
controlled ramp (dV/dt)
- Best for large Cload with acceptable ramp time.
- Watch: ramp too slow can misalign reset/PG windows.
eFuse
limit + protect + disconnect
- Best when hard cut-off, fault reporting, and short-circuit behavior are required.
- Watch: retry policy can create repeated hiccup if the load is a DC/DC startup.
Pre-charge
NTC / resistor path
- Best for simple, low-cost setups where insertion frequency and thermal drift are controlled.
- Watch: behavior changes hot vs cold; consistency across production can be weak.
Pass criteria (placeholders)
- Droop: Vin droop < X% with dwell < Y µs (no UVLO/BOR crossing).
- Current: Iin peak < X A and no repeated hiccup within Z plug cycles.
- Interface: no NAK/CRC/framing burst within the first T s after plug-in.
H2-5. Brown-Out Engineering (UVLO, Reset Tree, Hold-Up, Sequencing)
Brown-out robustness is proven by verifiable clauses: no reset chatter, no sticky “half-alive” states, no unsafe writes, and deterministic recovery after droop events.
No reset chatter
No sticky states
No unsafe writes
Deterministic recovery
Clause
UVLO threshold + hysteresis
- Goal: avoid threshold “ping-pong” during droop and ripple.
- Design knobs: adequate hysteresis, clean threshold crossing, and reset release gated by stable power-good.
- Measure: count threshold crossings per event; track reset transitions (assert/release) for chatter.
- Pass criteria (placeholder): ≤ 1 crossing per event; reset pulse ≥ X ms; release only after PG stable ≥ Y ms.
Clause
Reset authority + reset tree
- Goal: one reset “authority” defines system behavior (supervisor or MCU BOR, not both competing).
- Design knobs: reset gating with PG inputs; distribute reset to MCU, key peripherals, and I/O enable pins.
- Measure: timing alignment of rail PG vs reset; confirm no bus error bursts after release.
- Pass criteria (placeholder): reset release occurs after all required PG signals are valid; recovery has no NAK/CRC/framing burst in T s.
Clause
Hold-up window
- Goal: preserve critical rails long enough to assert safe states (write-protect, OE→Hi-Z, reset assert).
- Design knobs: targeted hold-up (only critical rails), controlled discharge, and prioritized “safe action” ordering.
- Measure: droop-to-safe-action timing; rail stays above Vsafe until actions complete.
- Pass criteria (placeholder): critical rail ≥ Vsafe for ≥ X ms; safe actions complete before rail < Vsafe.
Clause
Sequencing (power + reset + enable)
- Goal: prevent “half-on” states by ordering core/IO/analog/PHY and aligning reset/enable.
- Design knobs: power-good dependencies; reset release order; explicit OE gating for bus switches/level shifters.
- Measure: PG sequence timing; verify no stuck-low buses and no false-ready indication after recovery.
- Pass criteria (placeholder): sequence meets dependency arrows; recovery is deterministic across N cycles.
H2-6. Ghost-Powering Prevention (I/O Clamp Paths & Safe Power-Off)
Ghost-powering happens when external signals feed an “off” rail through clamp paths. Prevention requires cut points (limit, isolate, or block) plus power-off sequencing that forces safe states before rails enter undefined regions.
Minimal path model
- Path: External signal → clamp/ESD structure → VDD(off) rail → partial logic half-powered.
- Typical outcomes: sticky states, bus hang (stuck-low), false responses, unsafe writes during power loss.
Observable symptoms (serial bus view)
- I²C: SDA/SCL stuck-low, repeated NAK bursts, bus-clear required after power cycle.
- SPI: MISO drives when it should be Hi-Z, CRC errors after hot-plug or brown-out edges.
- UART: framing/parity spikes, garbage bytes during rail collapse or recovery.
- Non-volatile: EEPROM/flash corruption if write windows overlap droop.
Engineering cut points (choose at least one by dominance)
Series-R
limit back-feed current
- Reduces injected current into VDD(off).
- Trade: slower edges; verify timing margins where needed.
OE → Hi-Z
isolate I/O
- Use bus switch/isolator/level shifter with OE to force high impedance during off/brown-out windows.
- Bind OE to reset/PG gating to make behavior deterministic.
Ideal diode
block reverse feed
- Prevents rail lift and reverse feed into upstream domains.
- Place at power-domain boundary (where “off” must remain off).
Verification clauses (placeholders)
- Power-off injection: with main power OFF, apply worst-case external I/O states; confirm VDD(off) stays below X V.
- Back-feed limit: injected current into off-domain stays below X mA (worst-case pin mix).
- Recovery: after power cycle, buses recover within T s and do not remain stuck-low.
- Write safety: write-protect asserted before rails enter undefined region; no corruption across N cycles.
H2-7. Port Protection in Hot-Plug Context (TVS, Clamp, Inrush + Layout)
Scope Guard
Only hot-plug–relevant TVS/clamp/layout rules; does not replace the dedicated Port Protection subpage.
- Allowed: repeat surge energy, clamp Rdyn impact, return-loop layout, series R/RC effects in hot-plug windows.
- Not covered: full ESD/surge standards catalog, broad TVS families, generic port-protection encyclopedia.
In hot-plug events, protection success is defined by system behavior: clamp action must not inject destructive return currents that create ground bounce, rail droop, or error bursts. Selection and layout must therefore be evaluated as a loop, not as isolated parts.
Repeat surge energy
Clamp Rdyn
Return loop
Series R / RC
Clause
TVS/clamp parameters that matter in hot-plug
- Dynamic resistance (Rdyn): determines how clamp voltage rises with event current, shaping injection into the return network.
- Clamp voltage is not a constant: interpret Vc together with the event-current definition and measurement bandwidth.
- Energy + repetition: many hot-plug failures come from repeated smaller events (connector bounce), not a single extreme pulse.
- Degradation indicators: leakage drift, hot spots, and effective capacitance/threshold shifts that correlate with “port becomes fragile”.
Verification clauses (placeholders)
- Vport clamp < X V under the defined hot-plug current profile and probe bandwidth.
- After N plug cycles, TVS leakage increase < X (same temperature conditions).
- Error burst (NAK/CRC/framing) within first T seconds stays below X per window.
Clause
Layout: clamp current return loop is the real design object
- Shortest loop: place TVS to reference ground so the clamp path is physically short and has minimal loop area.
- Ground bounce control: avoid routing clamp current through sensitive digital ground returns that set logic thresholds.
- Split grounds: if chassis/shield and digital ground exist, connect intentionally so clamp currents do not “bridge” across narrow paths.
What to measure (fastest)
- Vport (near connector), local GND bounce (near IC), and key rail droop (near supervisor/BOR input).
- Compare loop variants (TVS reference point + routing) against the same hot-plug stimulus.
Clause
Series R / RC effects during hot-plug
- Limit injection: reduces peak current into clamp structures and reduces back-feed risk.
- Damp ringing: mitigates connector-bounce–excited ringing with line inductance.
- Edge control trade: slower rise/fall must still meet bus timing margins (tR/tF, sampling window).
Pass criteria (placeholders)
- Hot-plug window error burst decreases without violating rise/fall timing constraints.
- Ground bounce and rail droop remain within the brown-out prevention limits defined earlier.
H2-8. System & Firmware Robustness (State Machine, Timeouts, Write-Protection)
Hot-plug and brown-out resilience requires software clauses that make recovery deterministic: explicit state transitions, bounded timeouts, controlled retries, and write-safety rules tied to power-good health.
Clause
Recovery state machine (re-entrant)
- Flow: Detect → Debounce → Power-good → Init → Bring-up → Health monitor.
- Rule: every failure path returns to a defined safe state; no state may be “sticky”.
- Observable: log state transitions, recovery time, and success rate across repeated events.
- Pass criteria (placeholder): recovery success ≥ X% over N cycles; no permanent hang.
Clause
Bounded timeouts + controlled retries
- I²C: clock-stretching timeout + bus-clear policy (bounded retries with backoff).
- SPI: CRC retry budget + fallback to fault isolation when bursts persist.
- UART: framing/parity retry policy + resync/flush on repeated errors.
- Pass criteria (placeholder): no stuck-low longer than Z ms; recover within Y retries.
Clause
Write-safety tied to power health
- Rule: EEPROM/page write and flash/program are allowed only when PG is valid and rails are above Vsafe.
- Hook: assert write-protect and stop transactions before rails enter undefined regions.
- Consistency: register shadows and NVM updates must be commit-checked (version/CRC markers).
- Pass criteria (placeholder): no corruption across N power cycles under worst-case hot-plug stress.
Clause
Watchdog + safe-state recovery
- Safe state: disable risky outputs, force Hi-Z where applicable, stop writes, and wait for stable PG.
- Rule: watchdog is a last resort; recovery must converge, not oscillate (no reboot storms).
- Pass criteria (placeholder): after watchdog, reach health monitor within T seconds.
H2-9. Measurement & Validation (What to Probe, How to Trigger, What to Log)
Scope Guard
Defines a reproducible measurement workflow and unified metrics; does not re-teach protection or firmware design.
- Allowed: triggers, probe points, capture windows, error counters, and production-ready pass gates.
- Not covered: deep TVS/layout theory, full state-machine implementation details, or instrument purchasing advice.
A hot-plug or brown-out issue is an event sequence + statistics problem. A single screenshot rarely proves robustness; repeatable triggers, fixed probe definitions, and consistent denominators turn “occasional” failures into measurable engineering variables.
Trigger chain
Probe map
Correlation
Logging
Production gate
Step 1
Trigger chain (capture the same event every time)
- Primary triggers: Vin droop or reset assert (stable, system-relevant).
- Secondary markers: plug edge or port-voltage threshold crossing (event label).
- Deglitch: power-good and reset edges must use a consistent deglitch rule.
- Window: capture includes pre-event + post-event time (placeholders: X / Y).
Minimal trigger set (recommended)
- Trigger A: Vin droop below threshold → capture full window.
- Trigger B: reset assert edge → correlate with droop and error bursts.
Step 2
Probe map (each waveform answers one question)
- Energy / rails: Vin, key rails (near BOR/supervisor), inrush current (clamp probe or shunt).
- Protection behavior: Vtvs/port voltage, local GND bounce (near IC reference).
- I/O behavior: SDA/SCL, SCLK/MISO, UART RX/TX for stuck-low, bit errors, and ghost-power signatures.
- Location rule: classify probe points as source / port / IC / return (same net, different answers).
Step 3
Correlate errors to power events (reduce the suspect set)
- Align the timeline: droop, PG, reset, and I/O error burst must share the same time axis.
- Event ID: each plug cycle produces a unique identifier (even simple counters work).
- Fast causal split: errors before droop point to bounce/ESD/SI; errors after droop/reset point to brown-out/reset-tree.
- Ghost-power clue: power-off rail lift + continued I/O drive indicates back-feed paths.
Step 4
What to log (metrics must have denominators)
- Failure rate: define per plug cycle / per minute / per 1k transactions (never omit the denominator).
- Retries: timeout counts + retry counts + backoff counts (bounded).
- Error counters: NAK / CRC / framing/parity counted per fixed time window.
- Recovery time: from reset assert (or droop) to health-monitor entry.
Minimum event record (recommended)
- Timestamp + event type (plug / droop / reset), plus PG state.
- Rail min/max + droop dwell time (placeholders).
- Bus state (timeout, stuck-low, retries) and write-protect state.
Step 5
Production validation (pass gates + repeatability)
- BIST / loopback: quick health of I/O + bus stack before and after cycling.
- Plug cycles: controlled repetition count (N) under fixed harness and supply impedance.
- Threshold gate: pass/fail defined by error burst, recovery time, and rail droop limits.
Pass criteria template (placeholders)
- Vin droop < X% with dwell < Y.
- After N cycles, failure rate < X% and burst errors < X/window.
- Recovery reaches health monitor within T seconds; no permanent hang.
H2-10. Engineering Checklist (Design → Bring-up → Production)
This checklist condenses the entire hot-plug and brown-out playbook into auditable items. Each line defines what must exist, what evidence to review, and what passes (placeholders).
Design
Architecture, knobs, and cut points
Inrush knob chosen
Evidence: Ipeak/di/dt/dVdt target defined · Pass: < X (placeholder)
Reset authority defined
Evidence: supervisor/BOR + gating diagram · Pass: no reset chatter (placeholder)
Ghost-power cut point exists
Evidence: Series-R / OE-HiZ / reverse-block · Pass: VDD(off) < X (placeholder)
TVS return loop reviewed
Evidence: loop path + reference ground · Pass: bounce < X (placeholder)
Sequencing + release rules
Evidence: rail order + reset release order · Pass: no “half-on” states (placeholder)
Bring-up
Probe, trigger, reproduce, and log
Trigger chain unified
Evidence: droop/PG/reset triggers documented · Pass: capture repeatable (placeholder)
Probe locations fixed
Evidence: source/port/IC/return points defined · Pass: comparable results (placeholder)
Repro script exists
Evidence: fixed harness + fixed supply impedance · Pass: reproducible failures (placeholder)
Denominators defined
Evidence: per-cycle / per-window counters · Pass: burst ≤ X (placeholder)
Recovery converges
Evidence: bounded retries + safe-state · Pass: reach Health in T (placeholder)
Production
Fixture, thresholds, sampling, and cycle life
BIST / loopback gate
Evidence: pre/post cycle health check · Pass: all channels OK (placeholder)
Plug-cycle sampling
Evidence: fixed harness + fixed action · Pass: failure rate < X% (placeholder)
Threshold pass gate
Evidence: burst errors + recovery time · Pass: ≤ X per window (placeholder)
Degradation check
Evidence: post-cycle leakage/behavior · Pass: drift < X (placeholder)
H2-11. Applications (Where Hot-Plug/Brown-Out Actually Breaks Systems)
Scope Guard
Only hot-plug and brown-out failure chains in real systems; no protocol deep-dive or generic EMC textbook.
- Use it like a map: pick the closest bucket → match failure keywords → run the “first checks” → apply the relevant knobs (inrush / reset tree / cut points / logging).
- Keep it bounded: each bucket lists the shortest checks and the few knobs that move pass/fail.
Bucket A
Field-pluggable modules (sensor head / expansion board / cabling)
Typical triggers
Connector bounce (multi-hit) · Unknown Cload · DC/DC hiccup under ramp · Clamp injection to reference ground
First checks (shortest path)
- Correlate Vin droop and reset assert in the same time window.
- Capture Iin peak and look for repeated inrush pulses (bounce).
- Check error bursts per fixed window (not “random” errors).
reboot
enumeration fail
brown-out
fragile-after-plug
Bucket B
Industrial long-cable links (RS-485 / long UART)
Typical triggers
Ground potential differences · Common-mode step at plug · Shield/chassis contact order · Return-path discontinuity
First checks (shortest path)
- Measure local GND bounce near MCU/PHY and align with framing bursts.
- Verify TVS return loop does not inject into sensitive ground reference.
- Check reset tree chatter around thresholds/hysteresis.
framing
parity
false reset
link drop
Bucket C
I²C/SPI expansions with peripheral power (ghost-power prone)
Typical triggers
Signal contacts before power · One side powered while the other is off · ESD diode back-feed into VDD
First checks (shortest path)
- Measure VDD(off) lift during “power-off” (direct ghost-power evidence).
- Detect stuck-low (SDA/SCL) or abnormal drive (SPI MISO).
- Confirm recovery without full power-cycle (avoid “only reboot fixes it”).
NAK
stuck SDA
phantom power
hung bus
Bucket D
Automotive/robotics power events (brown-out, cold start, battery dip)
Typical triggers
Battery dip · Harness impedance · Multi-rail sequencing under cold start · Repeated micro brown-outs
First checks (shortest path)
- Verify UVLO threshold + hysteresis prevents reset oscillation.
- Confirm hold-up covers “write-disable window” (no corruption).
- Track recovery time and failure rate with fixed denominators (cycle-based gates).
boot loop
data corruption
false lock
sporadic resets
H2-12. IC Selection Notes (Load Switch / eFuse / Ideal Diode / Supervisor / TVS)
Rule
Select by goal → knobs → hidden traps → validation gates. Example MPNs are reference points; verify package/suffix, ratings, and availability.
- Avoid brand piles: a few representative MPNs per category, tied to the knobs that affect pass/fail.
- Always close the loop: measure droop, Iin profile, reset behavior, and burst errors using fixed denominators.
Goal
Limit inrush / shape ramp / protect against faults
Key knobs (what actually matters)
- Ilim profile: peak-limit vs constant-current vs foldback; match to bounce repetition.
- dV/dt (soft-start): controlled ramp reduces bounce re-hit energy and droop coupling.
- Fault response: latch-off vs hiccup vs auto-retry (must align with recovery policy).
- Reverse blocking: prevents back-feed through the power path during off/partial power.
- SOA / repetitive stress: hot-plug is often repeated stress, not one-time surge.
Validation gates (tie to measurements)
- Plug event: Iin peak < X and no multi-hit “hiccup train”.
- System: Vin/rail droop < X% with dwell < Y.
- After N cycles: burst errors and recovery time meet thresholds.
Example MPNs (Load switch / eFuse / hot-swap controller)
- Load switch (soft-start family example):
TPS22965,TPS22918(verify current rating / slew options / package). - eFuse example (Ilim + fault response):
TPS25940,TPS25947(verify reverse blocking behavior and fault mode pins). - Hot-swap controller example (external FET):
LTC4211,LM5069(verify Vin range, sense method, SOA support).
Tip: prefer parts with explicit reverse current specs when ghost-power risk exists.
Goal
Block back-feed / manage source switching
Key knobs
- Reverse current blocking: stop “off rail lift” and phantom power paths.
- Switchover transient: prevent rail glitch that triggers BOR/reset.
- Rds(on)/drop: droop budget impact under load step.
- Priority policy: avoid oscillation between sources during dips.
Example MPNs (Ideal diode / power mux)
- Ideal diode controller (external MOSFET):
LTC4412,LTC4416(verify reverse blocking and control method). - Power mux (priority + seamless switch):
TPS2121,TPS2113A(verify switch transient and current limit behavior).
Gate check: during “source swap”, log rail min and confirm no reset chatter.
Goal
Reset authority (UVLO/BOR behavior that does not chatter)
Key knobs
- Threshold accuracy: avoid “almost reset” zones across temperature/lot.
- Hysteresis: prevents reset oscillation around a drooping rail.
- Delay: align reset release to rail settling and sequencing order.
- Manual reset / watchdog: create recoverable states when firmware stalls.
Example MPNs (Supervisors / reset monitors)
- Supervisor with adjustable features example:
TPS3808(verify threshold options, delay, manual reset pin). - Common reset monitor family example:
TPS3823,TPS3839(verify threshold variant suffix). - Classic reset supervisor example:
MAX809,MAX810(verify voltage option and package). - Microcontroller supervisor example:
MCP1316(verify threshold option and reset type).
Gate check: under repeated droops, reset must assert cleanly and release once (no chatter).
Goal
Clamp energy at the port (hot-plug context only)
Key knobs (hot-plug relevant)
- Dynamic clamp: clamp is current-dependent; “peak V” alone is not sufficient.
- Rdyn: sets how much injection occurs at high surge current.
- Energy / repetition: repeated plug events can degrade devices.
- Capacitance: can worsen edge/timing on sensitive nets; validate with bursts and thresholds.
Example MPNs (TVS / ESD protection parts)
- Low-cap ESD array (signal lines) examples:
RClamp0502B,RClamp0524P(verify channel count/capacitance). - General-purpose TVS diode (power/port) examples:
SMBJ5.0A,SMBJ12A(verify voltage class and surge rating). - Automotive-grade ESD protector example family:
PESD1CANseries (verify AEC-Q101 option and capacitance).
Gate check: after N plug cycles, confirm no new leakage/fragility and burst errors remain within thresholds.
Cross-category pass gates (placeholders)
- Plug event: Iin peak < X A, no repeated hiccup pulses.
- Power integrity: rail droop < X% with dwell < Y.
- System behavior: reset asserts cleanly and releases once; recovery time < T.
- Link health: burst errors < X/window after N cycles; no stuck-low or phantom power.
Recommended topics you might also need
Request a Quote
H2-13. FAQs (Hot-Plug / Brown-Out)
Intent
Close long-tail troubleshooting without expanding scope. Each answer is a 4-line, measurable SOP.
- Data structure: each item includes data tags (category / observable / instrument / denominator) as
data-*attributes. - Pass criteria: uses placeholders X/Y/T/N with units and denominators (per plug cycle / per 1k transactions / per window).
Hot-plug reboots instantly — calculate inrush first or check PG/reset triggers first?
Likely cause: rail droop or PG/reset deglitch window causes a reset (inrush often *drives* the droop).
Quick check: trigger on plug edge and overlay Iin, Vin/rail min, and reset/PG within the same time window.
Fix: add controlled ramp (soft-start) or current limiting; add PG deglitch / reset gating matched to rail settling.
Pass criteria: rail droop < X% for < Y µs, and reset asserts ≤ 1 pulse per plug cycle.
TVS is “strong” but the link still drops — wrong clamp energy assumption or return path too long?
Likely cause: high loop inductance and Rdyn cause ground bounce/overshoot even with a high-power TVS; “peak V” alone misses repeated-energy stress.
Quick check: probe TVS node-to-local ground and compare to pin-level; look for overshoot aligned with error bursts.
Fix: shorten TVS return loop (closest reference), reduce inductance, add series-R/RC where allowed; choose TVS by Rdyn/energy in the hot-plug profile.
Pass criteria: pin voltage max < X V during plug, and link errors < X/1k frames over Y plug cycles.
After hot-plug, I²C becomes “occasional NAK” — ghost-power or brown-out sticky state?
Likely cause: peripheral is partially powered via I/O clamp path, or enters an undefined state during a droop and fails to re-init cleanly.
Quick check: measure VDD(off) during “off” and detect stuck-low (SDA/SCL); correlate NAK bursts with plug timing.
Fix: enforce Hi-Z on off-side (bus switch/isolator with OE), add series-R current limiting, and guarantee a clean reset/POR for peripherals after droops.
Pass criteria: VDD(off) < X V under external signaling, and NAK rate < X/1k transactions over Y plug cycles.
Power dips don’t reboot, but data corrupts — missing write-protect or dirty reset timing?
Likely cause: non-volatile write continues during undervoltage (or reset releases too early), causing partial writes or inconsistent metadata.
Quick check: log write-in-progress vs rail droop/reset timestamps; verify corruption aligns with dips.
Fix: add brown-out write inhibit, supervisor-gated reset, and hold-up for “write-disable window”; use journal/CRC for atomicity.
Pass criteria: 0 checksum/journal failures over N induced dips, and write-disable asserted within T µs after rail < X V.
Only long cables / field setups reproduce it — common-mode step from ground potential or worse connector bounce?
Likely cause: common-mode surge and return-path discontinuity shift the receiver reference; bounce adds repeated hits that amplify the stress.
Quick check: capture common-mode step and local ground bounce at the receiver during plug; align with burst error timing.
Fix: control chassis/return path, add CMC or isolation/differential interface where needed, and debounce hot-plug detection to avoid multi-hit initialization.
Pass criteria: common-mode at receiver < X V, and burst errors < X per Y ms window over N cycles.
eFuse keeps hiccuping — current limit too low or soft-start interacting with a DC/DC loop?
Likely cause: startup demand exceeds Ilim (or triggers UV), causing repeated fault cycles; DC/DC may “hunt” against the ramp.
Quick check: record Iin profile, rail ramp, and fault indicator; identify a repeating period (“hiccup train”).
Fix: raise Ilim or extend ramp, add pre-charge, or change fault mode (latch-off + bounded retry) to match the system recovery plan.
Pass criteria: ≤ 1 fault cycle per plug, no hiccup train within Y ms, rail reaches regulation within T ms.
Peripheral stays lit after “power-off” — fastest way to locate the ghost-power path?
Likely cause: I/O back-feeds through internal clamp structures into VDD, partially powering logic and pulling buses into invalid states.
Quick check: measure VDD(off) and port current; compare voltage drop across series-R (if present) to identify the feeding line.
Fix: enforce Hi-Z on signals when either side is off (bus switch/isolator with OE), add series-R current limiting, and add reverse blocking on the power path if required.
Pass criteria: VDD(off) < X V and port current < X mA with external lines active in the off state.
Reset looks fine but UART framing spikes — rail droop impacting clock or RX level not meeting VIH?
Likely cause: undervoltage shifts oscillator/PLL timing or violates RX threshold margins during a droop, creating burst framing errors without a full reset.
Quick check: correlate framing bursts to Vio min and clock stability; probe RX level to confirm VIH/VIL margins during the plug window.
Fix: increase Vio hold-up or rail stiffness, add level shifting with defined OE, reduce baud during hot-plug window, and deglitch/timeout the receiver state machine.
Pass criteria: framing errors < X/1e6 bytes over Y events, and RX VIH margin ≥ X mV at Vio(min).
Plug event doesn’t fail immediately but becomes “fragile” — how to validate TVS aging / pad stress?
Likely cause: repetitive stress increases leakage or effective Rdyn, or mechanical/pad damage increases loop impedance and noise injection.
Quick check: compare clamp waveform and leakage (I–V) before/after N cycles; track error-rate drift under identical triggers.
Fix: derate (higher energy/automotive grade), improve footprint and return path, add strain relief, and validate solder/pad integrity under insertion stress.
Pass criteria: leakage < X µA at V, clamp shift < X%, and error rate drift < X per 1k after N cycles.
Failure rate increases with plug count — which statistic is the most sensitive early indicator?
Likely cause: marginal energy/return-path design drifts into failure as stress accumulates; early symptoms appear as longer recovery and higher retry bursts before hard fails.
Quick check: log P95 recovery time, retries per 1k transactions, reset pulses per plug, and VDD(off) lift across identical plug cycles.
Fix: set fixed denominators and gates, then tighten the controlling knob (ramp/Ilim/return loop/cut points) that correlates most strongly with drift.
Pass criteria: p_fail < X ppm over N cycles, retries < X/1k, and P95 recovery < T ms.
Device occasionally locks up and only power removal recovers it — brown-out sticky state?
Likely cause: partial-power conditions leave internal logic latched while I/O remains active, preventing clean re-init and requiring a full reset/power-cycle.
Quick check: detect stuck-low lines and confirm BOR/supervisor thresholds during droops; verify reset does not chatter and truly re-arms the peripheral.
Fix: enforce a single reset authority (supervisor gating), add cut points (load switch/eFuse) for bounded power-cycle recovery, and implement a safe-state retry policy.
Pass criteria: recovery without manual power pull in < T ms, and 0 stuck-line events across N induced brown-outs.
Same design, different lots behave differently — Cload/ESR spread or thresholds/hysteresis too tight?
Likely cause: margins are insufficient against component spread (Cload/ESR) or rail threshold/hysteresis spread, moving the system onto a reset/undefined boundary.
Quick check: measure worst-case Cload/ESR and actual UVLO/BOR threshold+hysteresis; compare against observed droop minima in plug events.
Fix: widen margins (more hysteresis, slower ramp, larger hold-up, stronger rail path) so the worst corner stays away from the boundary.
Pass criteria: zero failures across corner matrix (Cload=Xmax, ESR=Xmin, Vth=±X%) for N cycles per corner.
