Hypothesis

Damage to Q1/Q2 + R21/R45 occurs at load turn-off, not during the sink phase. The "FET fails first, shunt vaporises secondarily" pattern observed on S/N A002854 (E-004) and the 19 V × 1 A failure threshold (E-002) are consistent with a brief V_DS × I_D excursion into the linear-mode SOA's secondary-breakdown corner during the transition from "sinking" to "off", rather than during steady-state operation.

Mechanism chain (proposed):

1. Firmware writes ISET = 0 (intentional turn-off, or EMAX trip forces it).
2. OPA2192 V+ collapses → loop demands V_gate ↓ → FET enters turn-off transition.
3. Simultaneously, two transient sources push the operating point destructively:
   • PSU overshoot: E36231A regulates into a sinking load. When load suddenly drops, output voltage briefly overshoots above setpoint while its control loop re-acquires (5–10 % for ~ms is typical for bench supplies). At 16 V setpoint × 10 % overshoot = 17.6 V drain spike, very close to the empirical 19 V failure threshold from E-002.
   • OPA2192 loop ringing: the V+ step from "sinking" to 0 is unfiltered (single I²C write to AD5593R). Loop response can briefly undershoot V_gate (= more conduction) before settling. Combined with V_DS still high → instantaneous power well above steady-state.
4. FET briefly enters secondary breakdown → develops a hot spot → cumulative micro-damage that surfaces as broken IMEAS/VMEAS/VREM after enough turn-off cycles.
5. Eventually FET shorts D-S → PSU current flows uncontrolled through R45 (1206 / 250 mW per E-001 §8 errata) → R45 vaporises within ms.

Why turn-off, not sink phase: during steady-state sink, the control loop is settled and dissipation is bounded by I_LOAD × V_DS at the commanded operating point. Steady-state dissipation at 8 V × 2 A = 16 W (within bottom-side-HS thermal envelope per E-001 §4). Turn-off introduces a transient where V_DS and I_D briefly de-correlate — exactly the failure mode trench FETs are worst at.

Empirical confirmation #1 (2026-06-09 AM, engineer 99 % confident)

Engineer reports: damage reliably occurs on the 20 V / 1 A → 20 V / 0 A transition. Sequence is "step ISET 1 A → 0, next run something is broken." Cable length to the load is ~1 m (= ~1 µH loop inductance, consistent with the analysis above).

This empirical pattern confirms the mechanism class (turn-off transient is destructive) and narrows the failure to the turn-off event specifically, not the sink phase or the turn-on phase. The remaining unknown is which sub-mechanism within the turn-off dominates:

• (a) PSU overshoot during the FET turn-off
• (b) Secondary breakdown during the 100–500 ns V_DS×I_D crossover as the channel pinches off
• (c) OPA2192 control-loop ringing causing a brief V_gate undershoot

All three share the same mitigation set (soft turn-off, snubber, TVS clamp), so the engineering response can proceed without further sub-mechanism characterisation. Scope captures during the planned bench diagnostic would still resolve which dominates, but are no longer blocking the fix.

Cumulative-damage signature: "next run something is broken" rather than "this run something broke" indicates a cumulative-degradation pattern (each turn-off chips at the device until it fails) rather than a single catastrophic event. This is the classic linear-mode trench-FET hot-spot pattern: each turn-off transient nucleates micro-damage at the same hot spot until enough silicon is compromised that the device fails at a normally-safe operating point.

Empirical confirmation #2 (2026-06-09 PM, SMCJ24A retrofit cascade)

Engineer patched a SMCJ24A (1500 W bidirectional TVS, V_BR ≈ 27–30 V, V_C_max ≈ 38.9 V) across Q1 D-S on S/N A002854 CH0 as the E-006 retrofit experiment. Initial behaviour "seemed to work better" — turn-off pulses survived for some number of cycles longer than the unprotected case.

Then the cascade played out exactly as the mechanism chain predicts:

1. After some runs: symptom changed to "constant 100 mA at 20 V independent of ISET." Diagnosed (after the fact) as TVS pulse-degraded into low-V breakdown — repeated avalanche events dropped V_BR below the 20 V working voltage, so the TVS conducted continuously at V_LOAD and bypassed the FET entirely as a current path.
2. Engineer lifted the SMCJ24A.
3. Found R21 (CH0 sense, 0.1 Ω / 250 mW) had vaporised (open).
4. Replaced R21 with a fresh part.
5. Powered on at 20 V → current immediately went to PSU compliance limit → Q1 (CH0 FET) confirmed shorted D-S (multimeter continuity test pending but symptom-diagnostic).

Order-of-events reconstruction (chronological):

• TVS absorbed the turn-off pulses doing its protective job → V_BR degraded gradually
• Eventually a turn-off pulse exceeded what the degraded TVS could clamp → Q1 saw destructive V_DS×I_D corner → Q1 hot-spot failure → shorted D-S
• With Q1 shorted, the next PSU enable event drove the full PSU current through the only remaining series resistance (R21) → R21 vaporised in ms
• R21 open → no current path → board went to "broken but safe" state (the symptom engineer observed after removing the TVS)
• Replacing R21 → re-completed the path through the shorted Q1 → max current on power-on

Confirms steps 4–5 of the mechanism chain end-to-end with hard empirical data. The "FET fails first, shunt vaporises secondarily" prediction is now confirmed twice: once on Q2/R45 (CH1, original E-004 damage), now on Q1/R21 (CH0).

Key implication: TVS protection is NECESSARY BUT INSUFFICIENT. The SMCJ24A worked as designed (clamped the transients, protected the FET temporarily) but absorbed the same energy that was killing the FET — and degraded under that absorption. Hardware-only protection without addressing the per-pulse energy at source just changes which part fails first. Firmware soft turn-off is now the load-bearing fix, not "the biggest lever among several." See E-006 for the parallel hardware-protection update.

A002854 is now fully retired — both Q1+R21 (CH0) and Q2+R45 (CH1) broken. Need a fresh DUT to continue bench work. See E-004 update.

Implication for AL.05 (Maestro v1.0.264)

AL.05 EMAX still runs at 16 V × 1 A → 0 on every test execution — the same turn-off pattern that's been damaging A002854. Each AL.05 run nucleates further damage on whatever DUT is in the rig. Expect another DUT to fail after enough EMAX runs.

Proposed alternative AL.05 operating point: 8 V × 2 A → 0.

Lower V_DS during the turn-off crossover keeps the device further from secondary breakdown without changing the EMAX functional coverage. AL.04 already operates at 8 V × 2 A safely (per v1.0.264 docstring); AL.05 inherits the same operating point with a longer hold.

Production-test abuse tolerance — separate concern, see E-006

End-user (production-test operator) abuse scenarios — relay-open mid-current, Phoenix wire cut, cable yank during operation — produce the same V_DS-spike + V_DS×I_D-crossover damage as firmware turn-off, but at faster rates (arc-driven di/dt) and without firmware control. Mitigation is hardware (TVS D-S clamp, possibly upgraded drain caps), not firmware — fundamentally a different design lever than the soft-turn-off discussion above.

Filed separately as E-006 to keep the design-spec dimension (TVS sizing, V_LOAD ceiling decision, R3 layout impact) from blurring with the firmware-fix dimension tracked here in E-005. As of 2026-06-09 PM (this entry's Empirical confirmation #2 above): the retrofit experiment proved TVS-alone is insufficient — see E-006 for the updated conclusion.

Alternatives considered

• Steady-state thermal failure during sink — empirically excluded by the user's observation that damage correlates with the turn-off step, not with the sink duration.
• Inductive kickback alone — would damage C16/C21 (50 V caps) first, not the FET. Observed failures don't show cap damage.
• Manufacturing defect — possible for a single board, but the lab observation of a consistent 19 V × 1 A failure threshold across multiple test events points to a systematic stress mechanism, not random infant mortality. Empirical confirmation #2 (cascade pattern matching the prediction) now rules this out.
• OPA2192 supply rail glitching during load step (ISO5V or 5V via R65–R69 bypass per E-003 dropping under transient ground-return current) — could de-stabilise the loop but only secondary to (3) above.
• Body-diode reverse-recovery damage at turn-ON — separate interpretation (drain dips briefly below source during fast turn-on, body diode forward-conducts, reverse recovery on the way back damages the junction). Less likely to be primary since the user's empirical evidence points squarely at the turn-off event; would explain residual damage at turn-on if scope captures show drain dipping below 0 V. Diagnostic for this is "scope V_DS at turn-on, look for negative excursion."

Open questions

• Which sub-mechanism (PSU overshoot / SOA crossover / OPA ringing) dominates the turn-off damage? Not blocking the fix but useful for R3 design (different mitigations weight differently).
• PSU overshoot magnitude on E36231A at a 1 A → 0 A step at V_LOAD = 20 V — datasheet typical vs measured. Scope capture would settle (a) vs (b)+(c).
• OPA2192 closed-loop step response for an ISET=2A → 0 step — does V_gate ring, overshoot, double-pulse?
• Compensation pole — what sets the dominant pole on the OPA2192 loop? If it's just C14 = 100 pF, the loop is wide-bandwidth and prone to ringing on a step.
• Is the I²C write to AD5593R ISET = 0 truly single-frame? Confirm the firmware doesn't do anything weird (e.g. write maximum value first then 0).
• Does EMAX trip behaviour differ from a normal firmware-commanded turn-off? If EMAX trips with interrupt-driven cut-off, the transient is harsher.
• How many turn-off cycles does it take to pulse-degrade a SMCJ24A enough to make V_BR drop into the 20 V working range? From the retrofit-experiment data, somewhere between a few and a few-dozen runs at 20 V × 1 A → 0. Quantifying this would help R3 spec the TVS choice and the "soft turn-off vs hardware clamp" priority split.

Next step

Updated priority order after empirical confirmation #2:

1. 🔴 FIRMWARE SOFT TURN-OFF — load-bearing fix. Empirical confirmation #2 proves hardware-only protection (even 1500 W SMCJ24A) degrades under the abuse it's protecting against. Without per-pulse energy reduction at source, every subsequent mitigation eventually fails. Ramp ISET → 0 over ~100 ms instead of step write. Decision deferred to firmware team (engineer to discuss; can the AD5593R DAC do its own ramp, or does the host need to write intermediate ISET values?). [Bumped from #2 in prior revision.]
2. Drop AL.05 to 8 V × 2 A in the Maestro YAML. Reduces per-pulse energy at the bench-test level immediately. See "Implication for AL.05" above. Maestro action item.
3. Allocate a fresh AL DUT. A002854 is fully retired — both Q1+R21 (CH0) and Q2+R45 (CH1) broken. Update fe_J8_active_load.py docstring S/N when the new board lands. (See E-004.)
4. Bench scope capture on the new DUT (≤ 30 min, V_LOAD = 8 V, ISET 1 A → 0) — settles which sub-mechanism dominates and gives quantitative data driving the R3 snubber / TVS sizing. Do this BEFORE running any more high-energy turn-off cycles on the fresh DUT.

Mitigations to evaluate if soft turn-off isn't sufficient or isn't possible in firmware:

• RC snubber across FET D-S: 10 Ω + 100 nF / 50 V. Absorbs inductive kick + soaks PSU overshoot energy. Quick to retrofit on R2 boards.
• TVS diode D-S: see E-006 for sizing analysis. Sized for steady-state V_LOAD AND clamp-under-V_C of C16/C21's 50 V rating. However: empirically demonstrated to degrade under repeated abuse → only useful as tertiary protection after firmware soft turn-off is in place.
• Compensation cap increase: raise the OPA2192 loop's dominant pole cap (slow the loop). Trade-off: slower step response on the ISET-up transition too.
• R21/R45 upgrade from 250 mW → 1 W (matches schematic intent per E-001 §8 errata): delays the cascade-secondary R-vaporisation enough that a fuse could clear first, or at minimum gives more diagnostic time after a FET-short before the board is destroyed. Cheap BOM swap. See E-006 for R3 spec recommendation.

Cross-references

• E-001 (this project) — power budget; §2 sets V_DS ≤ 50 V (cap binding) and current limits; §8 errata explains the R21/R45 1 W intent vs 250 mW BOM mismatch that's biting hard.
• E-002 (this project) — lab observation of 19 V × 1 A failure threshold; this concept proposes the mechanism behind that observation.
• E-004 (this project) — broken CH1 on S/N A002854 (Q2/R45) — now joined by CH0 (Q1/R21) per Empirical confirmation #2.
• E-006 (this project) — production-test abuse-tolerance + TVS clamp sizing + R3 V_LOAD-ceiling decision. Updated 2026-06-09 PM with the retrofit experiment result.
• projectId 1 / E-026 — operating-points decision for Maestro tests; AL.05 at 16 V × 1 A = 16 W still carries the turn-off risk pattern — recommend update to 8 V × 2 A.
• Maestro package v1.0.264 fe_J8_active_load.py emax_shutoff_test() — currently does step turn-off (ISET → 0 immediately after the trip wait). A "soft turn-off" experiment would be easy to add as an optional parameter — and now empirically the highest-priority engineering action.

Hypothesis

The AL board needs a hardware clamp on the FET drain to survive end-user / production-test abuse scenarios that interrupt load current with cable inductance present. Without a clamp, any disconnect event during sink — relay-open mid-current, Phoenix wire cut, operator yanking the cable — produces inductive-kickback + arc transients on the drain node that exceed the FET's safe operating envelope. The existing C16/C21 (10 nF / 50 V) caps provide partial clamping but at the limit of their rating and provide no current path for the energy dump.

Scope distinction vs. E-005: E-005 is about firmware-controlled turn-off transients (where soft turn-off in firmware is the natural fix). This entry (E-006) is about uncontrolled external disconnects (where firmware can't help — must be hardware). Both share the same destructive mechanism (V_DS spike + V_DS×I_D crossover) but different design levers.

Retrofit experiment result (2026-06-09 PM) — TVS-alone is INSUFFICIENT

This entry's Next Step #3 (R2 retrofit experiment) was executed today. Result: failed.

Engineer patched a SMCJ24A (1500 W bidirectional, V_BR ≈ 27–30 V) across Q1 D-S on the rig DUT (S/N A002854 CH0). Sequence:

1. SMCJ24A installed. Initial test runs "seemed to work better" — turn-off pulses survived for some additional cycles compared to the unprotected case.
2. After some number of runs at 20 V × 1 A → 0: symptom changed to "constant 100 mA at 20 V independent of ISET".
3. Diagnosis (after the fact): SMCJ24A pulse-degraded into low-V breakdown. Each turn-off transient absorbed by the TVS caused micro-degradation of the avalanche silicon, dropping V_BR over time. Once V_BR fell below 20 V working voltage, the TVS conducted continuously at V_LOAD and acted as a ~20 V zener, bypassing the FET as the dominant load path.
4. Engineer lifted the SMCJ24A. Found R21 (CH0 sense) had vaporised (open).
5. R21 replaced. Power-on at 20 V → current immediately went to PSU compliance limit → Q1 confirmed shorted D-S (symptom-diagnostic; multimeter continuity verification pending but consistent with the cascade pattern).

Order-of-events reconstruction:

• TVS absorbed turn-off pulses doing its job → V_BR degraded gradually
• Eventually a pulse exceeded what the degraded TVS could clamp → Q1 hit destructive V_DS×I_D corner → Q1 shorted D-S
• With Q1 shorted, full PSU current flowed through the only remaining resistance (R21) → R21 vaporised
• R21 open → no current path → board went to "broken but safe" state
• Replacing R21 → re-completed the conductive path through the shorted Q1 → max current

Critical empirical conclusion:

A 1500 W SMCJ24A protected the FET for some additional cycles, then degraded faster than it took the FET to fail. The TVS is necessary but NOT sufficient. Hardware-only protection without per-pulse energy reduction at source just shifts which part fails first.

The hierarchy of protection has changed:

Updated TVS strategy

TVS is still recommended for R3 abuse-tolerance, but with a corrected role:

• TVS fires only when soft turn-off (firmware) fails AND when end-user abuse occurs (wire cut, relay-fail, cable yank)
• Expected lifetime of the TVS = (number of soft-turn-off failures) + (number of end-user abuse events) — should be tens-to-hundreds over product lifetime, not thousands
• At that pulse count, even SMAJ24CA (400 W) would survive — SMCJ24A (1500 W) is overkill if soft turn-off is in place
• Default recommendation back to SMAJ24CA: 4× lower pulse capacity than SMCJ24A but bidirectional + smaller package. Adequate as a tertiary protection layer.

Threat model — what can the operator / end-user do?

The "no firmware mitigation" entries are the gap E-006 has to fill with hardware protection. As of 2026-06-09 PM that protection is understood to be a layered defence (TVS + caps + 1 W shunt) rather than TVS-alone.

TVS clamp sizing — depends on the R3 V_LOAD spec

Constraint: TVS V_C_max must be ≤ C16/C21 rating (50 V on R2; could be raised on R3) to ensure caps don't fail before the TVS clamps.

TVS option comparison (all rated for 24 V working, varying package + power + polarity):

This is fundamentally a V_LOAD-ceiling design decision:

• If R3 V_LOAD ≤ 24 V (covers 24 V PoE-style rails comfortably): SMAJ24CA. Clean choice, room for cap rating headroom, room for V_BR tolerance band. Bidirectional safer than SMCJ24A for assembly + reverse-polarity protection.
• If R3 V_LOAD ≤ 30 V: SMAJ30CA with V_C_max barely under cap rating. Risky.
• If R3 V_LOAD > 30 V: TVS alone insufficient; must upgrade C16/C21 to 100 V rating.

Recommended R3 specification:

• V_LOAD ≤ 24 V (matches Sparrow's PoE / M.2 rail envelope) + SMAJ24CA as tertiary clamp, OR
• V_LOAD ≤ 50 V (matches R2 design intent) + upgrade C16/C21 to 100 V + SMAJ30CA.

Other layered defenses — UPDATED with R21/R45 upgrade recommendation

• R21/R45 upgrade from 250 mW → 1 W (HIGH PRIORITY) — matches schematic intent per E-001 §8 errata. Today's empirical cascade proves the 250 mW part vaporises in ms after FET-short, leaving no diagnostic time and no opportunity for upstream fuses to clear. A 1 W part would survive the secondary-failure transient long enough to (a) act as a thermal fuse only after sustained fault, (b) give diagnostic visibility of "FET shorted but board still partially intact," (c) potentially allow a downstream fuse to clear first. Same 0.1 Ω value; just spec a higher-power-rated 1206. ~€0.05 BOM impact per channel. No layout change needed.
• Larger drain capacitance (e.g. 100 nF / 100 V instead of 10 nF / 50 V) — raises both the cap rating headroom AND extends the LC time constant of the post-disconnect ringing. Recommended alongside TVS, not instead of.
• Series fast-blow fuse on the Phoenix path — ~2 A fast-blow absorbs FET-D-S-short scenarios so R21/R45 doesn't have to. Trade-off: needs replacement after every fault; adds inline resistance affecting accuracy.
• Kelvin sense on Phoenix — separates load current path from sense path. Less benefit for protection; more benefit for accuracy under varying cable IR drop. Out of scope for E-006.
• TVS at the PSU side of the cable too — clamps PSU output overshoot before it reaches the AL board. Doubles BOM but minimal cost; also helps protect the TVS-on-AL-board from absorbing all the energy alone.

Alternatives considered

• Bigger caps alone (no TVS) — caps clamp at their failure rating, not their working rating; clamp behaviour is essentially "fail open at V_max". Not a designed clamp; a one-shot fuse. Rejected as primary protection.
• Firmware-only protection — covered by E-005 for controlled turn-off. Cannot defend against uncontrolled disconnects, so insufficient for abuse tolerance. But empirically the most important protection — see "Critical empirical conclusion" above.
• TVS-only protection — empirically tested 2026-06-09 PM and failed. TVS degrades under the abuse it's protecting against if every test cycle includes a destructive turn-off. Needs to be paired with energy-reduction-at-source (firmware soft turn-off) to stay functional over product lifetime.
• Series resistor in load path — 1 Ω absorbs the inductive kickback into thermal dissipation. Trade-off: 1 W at 1 A, adds to measurement IR drop, adds noise. Rejected for accuracy reasons.
• Faster turn-off detection in firmware — monitor IMEAS rate-of-change; if drop is too fast, do something. Adds complexity, can't actually prevent damage (event has already happened by the time firmware sees it).

Open questions

• R3 V_LOAD spec ceiling — needed before TVS sizing can be finalised. This is the load-bearing design decision; everything else flows from it.
• Does the AL board's BOM allow a TVS retrofit on R2 boards? A no-load footprint for D-S TVS could be added during R2.x revision if it doesn't exist; or we land it as a manual retrofit on the current rig-DUT boards.
• C16/C21 footprint — current 0603 part. Upgrading to 100 V at same capacitance may need 0805 or 1206 — does the layout allow?
• Energy capacity check for the chosen TVS — at 1 µH × 1 A² × 0.5 = 0.5 µJ, every SMAJ part is overkill on inductive energy. But empirical retrofit-experiment data shows the actual per-pulse energy reaching the TVS is much higher (PSU overshoot dump is the dominant term, estimated 2–10 mJ per pulse). Even SMCJ24A at 1500 W rating degrades after some-tens-to-hundreds of pulses at this level. R3 spec needs to size for expected pulse count over product lifetime AND assume firmware soft turn-off is in place to keep pulse rate low.
• R21/R45 1 W BOM substitute — what's the equivalent at 1 W in 1206? (e.g. Stackpole CSR1206-FT-R10, or similar.) Confirm availability + price + footprint compatibility.

Next step

Updated priority order after retrofit experiment failure 2026-06-09 PM:

1. 🔴 Firmware soft turn-off (E-005 Next Step #1) is the prerequisite for any hardware protection strategy to work long-term. Until soft turn-off is implemented, every TVS will degrade and every R21/R45 upgrade will eventually fail under repeated abuse. E-006 is no longer independently actionable — it depends on E-005's firmware fix as the foundation.
2. R21/R45 upgrade to 1 W — uncontroversial BOM change, no layout impact, ~€0.05 cost. Can be done independently of any other decision. Reduces severity of FET-short cascades. R3 spec item; consider as a R2.x ECN if there's stock to swap.
3. Pin the R3 V_LOAD spec ceiling (engineering decision — bench-test data + Sparrow deployment envelope). Once pinned: TVS choice + cap-rating decision flow automatically.
4. Choose TVS part based on (3). If V_LOAD ≤ 24 V → SMAJ24CA is the leading candidate (revised down from SMCJ24A on the basis that abuse rate should be low post-soft-turn-off, so the extra pulse capacity is no longer needed).
5. R3 schematic + layout updates: add TVS footprint (close to FET drain pad, minimal trace inductance), upgrade C16/C21 if V_LOAD > 24 V chosen.
6. Cross-link to a new R3 requirement (please_requirement_create on this project) once R3 spec phase formalises — "Survive load disconnect at I_LOAD,max without device damage" with TVS sizing as the implementation. The requirement needs to specify expected lifetime (e.g. "≥ 1000 abuse-disconnect events without degradation") to drive TVS sizing properly.
7. R2 retrofit experiment — completed 2026-06-09 PM, result captured above. Not a useful next step to retry.

Cross-references

• E-001 (this project) — power budget; §2 explains why C16/C21 50 V binds the design today; §8 errata explains the R21/R45 mismatch that just bit hard.
• E-002 (this project) — R3 thermal coupling investigation (related but distinct R3 spec input).
• E-004 (this project) — broken DUT S/N A002854; now broken on BOTH channels after the retrofit experiment.
• E-005 (this project) — turn-off mechanism + firmware soft-turn-off. Empirical confirmation #2 of E-005 IS this entry's retrofit experiment result.
• projectId 1 / E-027 — IDC J8 over-drive retrospective; the connector-rating thinking that surfaced this whole class of "the protection isn't there" concerns.

Candidate ICs to replace the failing discrete bidirectional-SDA bridge around U5 (ISOW7741). Root cause is captured in the E-003 root-cause comment: bidirectional I2C through a unidirectional isolator + single-sided Q4 discrimination latches the bus; aggravated by a 3.3V host / 5V iso rail mismatch.

Hypothesis

A purpose-built galvanically-isolated I2C device removes the latch failure mode entirely (loop-breaking handled internally and symmetrically). Because U5 also supplied isolated power (ISO5V via integrated DC-DC), the best fit is a part that carries BOTH isolated I2C and isolated power, so the whole U5 + Q4/diode network collapses to one component.

Alternatives considered

Tier 1 - isolated I2C + integrated isolated DC-DC (closest drop-in for the whole U5 + bridge)

• TI ISOW1412 - purpose-built isolated I2C/SMBus WITH integrated DC-DC. Lead candidate: replaces isolator + discrete bridge + iso-supply in one part. Verify the DC-DC current budget covers the load-side draw (AD5593R + REF3425 + TMP116 + pull-ups - light).
• ADI ADM3260 - isolated I2C + dual isolated DC-DC. Mature; check output power vs load-side need.

Tier 2 - isolated I2C only (keep a separate iso rail, or keep ISOW7741 just for power)

• ADI ADuM1250 / ADuM1251 - hot-swappable bidirectional I2C isolators; separate VCC1/VCC2 handles the 3.3V/5V split natively. ADuM1251 = SDA bidir + SCL unidir (fits single-master/no-stretch).
• TI ISO1640 / ISO1641 / ISO1644 - modern bidirectional I2C isolators; ISO1644 adds 2 unidirectional GPIO channels (could carry RESET, freeing a channel).
• TI ISO1540 / ISO1541 - older proven bidirectional I2C parts (ISO1541 = unidir SCL, lowest power).
• Silicon Labs Si8600/Si8605 - equivalent second source.

Tier 3 - keep the discrete approach but make it correct

• Keep ISOW7741 for power; carry buffered UNIDIRECTIONAL I2C across it using NXP P82B96 on each side. The P82B96 implements the proper Tx/Rx offset discrimination on BOTH sides - the symmetric, designed-for-it version of the single-Q4 kludge. More parts, but validates the original intent.

Cross-cutting (any option)

Match the two I2C rail voltages, or pick a part with independent VCC1/VCC2 level support - the 3.3V host vs 5V iso mismatch was half the problem.

Open questions

• Required isolated-power budget on the load side (mA @ ISO5V) - drives Tier 1 feasibility.
• Reinforced vs basic isolation rating needed for this application.
• Is the spare RESET isolation channel worth preserving (favours ISO1644)?

Next step

Shortlist for serious review: ISOW1412, ADM3260, ADuM1251. Ingest their datasheets into Probe for a cited comparison (pin behaviour, iso-power budget vs load-side current, rail/level fit) before committing the next-revision change.

RIGOR NOTE: this shortlist is from general device knowledge, NOT yet Probe-ingested/datasheet-verified. Pinouts, power budgets and speed grades to be confirmed on ingest.

(Reposted 2026-06-18 after the Trace rollback wiped the original E-010.)

Finding

AL board S/N A002878, when installed on the Sparrow test rig and run through fe_J8_active_load AL.07 (auto-calibrate CH0), produces the same MOSFET-shorted hardware-fault signature as the earlier A002854 finding (see E-004 on this project).

From a v1.0.283-era run on 2026-06-17 (Maestro report DB later wiped; data captured in chat):

auto_calibrate ch0 mode=auto: ...
truth PSU=12.00 V × ISET=1.0 mA: psu_truth_v=2.5683 V, psu_truth_i=0.5025 A
sweep PSU=5.00 V × ISET=0.300 A:  psu_truth_v=2.6528 V, psu_truth_i=0.8010 A
sweep PSU=10.00 V × ISET=0.500 A: psu_truth_v=2.7033 V, psu_truth_i=1.0016 A
sweep PSU=12.00 V × ISET=0.700 A: psu_truth_v=2.7497 V, psu_truth_i=1.2008 A
observed deviations: ISET=167.006% IMEAS=3.586% VMEAS=2.119% VREM=0.928%

╔═══════════════════════════════════════════════════════════╗
║ CH0: HARDWARE FAULT DETECTED: MOSFET_SHORTED              ║
╚═══════════════════════════════════════════════════════════╝
PSU truth current 0.801 A AND AL IMEAS 0.772 A both high at
ISET=0.300 A (PSU is current-limiting at ~0.80 A) — MOSFET is
SHORTED. ACTION: Replace the channel's MOSFET.

The v1.0.283 cross-check (PSU truth vs AL IMEAS — both reading the same ~0.8 A regardless of the ISET command from the AL DAC) caught it the moment AL.07's cal sweep ran. PSU was current-limiting at ~0.80 A regardless of what ISET was commanded.

CH1 on the same board (A002878) cal'd cleanly the same run: ISET dev 0.368 %, IMEAS dev 0.502 %, all within ≤1 % tolerance — no fault.

Diagnosis

Same as projectId 4 / E-004 on A002854: the channel's pass-MOSFET is shorted (drain↔source through the silicon), so the channel sinks unbounded current regardless of what the AL DAC's ISET register commands. PSU current limit becomes the limit, not the MOSFET.

Action

• Replace CH0 MOSFET on A002878 (same procedure as A002854 rework).
• Once replaced, re-run AL.07 to validate cal — should see clean deviations < 1 %.
• Add A002878 to the "boards with broken channels — set write_back=\"false\" until reworked" list referenced in fe_J8_active_load.py docstring (currently lists A002854 / A002872 / A002874 / A002877 — add A002878).

Related

• projectId 4 / E-004 (id 25 originally) — first instance, on A002854.
• projectId 1 / E-027 — RETRO: AL.05 over-drove IDC J8 at 2 A on the same v1.0.247–v1.0.262 cabling. Inspect whether A002878 was ever on the over-driven harness (could be a cascading cause).
• projectId 1 / E-024 — original AL routing bug; not causally related to this MOSFET failure but provides the full AL cal flow context.

Reproducibility

Reproduced first on 2026-06-17 v1.0.283-era runs; signature is deterministic — every AL.07 attempt on this board produces the same hardware-fault banner. Maestro DB no longer holds the run records, but the cross-check evidence is captured here and the engineer's local saved tool results may still have it.

Symptom

Maestro run ec14209d-808a-42cb-be8a-e1a594667e90 (2026-06-18 17:05 UTC, v1.0.319 Sparrow Unit Test on AL S/N A002870) — J8 — AL.02 — CH1 measure at 400 mA / 16 V failed; J8 — AL.01 — CH0 measure at 400 mA / 16 V passed at the SAME commanded operating point with essentially the same values.

Comparison (commanded: ISET = 400 mA, VLOAD ≈ 16 V):

So the AL CH1 ISET → actual-current path is ~2.5 % low at 400 mA after the just-run auto-cal pass. CH0 lands on target.

Pre-test calibration was already run

In the SAME test execution, AL.07 (Auto-calibrate CH0) and AL.07b (Auto-calibrate CH1) both ran and PASSED before AL.01 / AL.02 measured. So the residual on CH1 is what the auto-cal converged to, not stale cal drift.

Other CH1 behaviour from the same run

• AL.04b — Phoenix CH1 sink 1 A / 15 V / 2 s hold (soft on/off) — PASS. So CH1's MOSFET / shunt / power-handling path is healthy at the 1 A operating point.
• AL.06 / AL.06b — pre/post-Phoenix cool-down — PASS on both channels.

So CH1 is functional and the slope is correct enough at the Phoenix operating point — the marginal miss is specific to the 400 mA / 16 V (AL.02) gate. Likely the per-channel cal is well-converged for one operating point and slightly off for another (cal fit is per-channel linear; if the slope's anchor points were chosen at a different current range, the 400 mA point sits on a residual bias).

Hypotheses (rank-ordered)

1. Auto-cal fit anchors don't include 400 mA; CH1 sees larger residual than CH0 simply because CH1's hardware has a slightly different ISET-vs-actual-current slope and the fit doesn't cover this point as accurately. Reproducible across runs if true. → bench-investigate the auto-cal sweep points and consider adding the 400 mA point to the cal fit anchors.
2. AL shunt or feedback-loop component on CH1 is just inside spec but worse than CH0 (resistor tolerance, op-amp offset). The auto-cal compensates as best it can but residual is irreducible. → measure the shunt resistance + feedback-amp offset on both channels and compare.
3. PSU current readback is noisy at this operating point and the 10 mA delta is measurement uncertainty rather than a real per-channel difference. → re-run AL.02 alone 5× and look at the PSU_I_TRUTH spread.

Reproducibility

• Run: ec14209d-808a-42cb-be8a-e1a594667e90 2026-06-18 17:05 UTC
• Package: v1.0.319 (post cal-writeback + post all-tests-enabled)
• AL S/N: A002870
• Other AL board on file with a CH-specific issue: A002878 CH0 MOSFET shorted (E-011) — different board, different channel, different mode. This A002870 CH1 marginal is a separate finding.

Severity / scope

Warning + action. AL.02 is a parametric measurement gate; missing by 10 mA at 400 mA target is a 2.5 % miss — outside spec but functional. Doesn't block the rest of the test. Operator-visible failure.

Analytical estimate of the maximum power that VLOAD1_OUT / VLOAD2_OUT can sink per channel. Two independent ceilings — the binding one depends on AD5593R DAC mode and cooling stack. Derived from schematic + DON70N06 datasheet; not a customer requirement.

1. Loop-gain ceiling (electrical, hard cap)

OPA2192 (U2) closes a current-control loop:

• V(+) input = SET_LOAD × R17/(R17+R20) = SET_LOAD / 10 (18k:2k divider)
• V(−) input = V_ILOAD = I × R_sense × G_INA = I × 0.1 Ω × 20 = I × 2.0 V/A
• ⇒ I_LOAD = SET_LOAD / 20 (A per V)

AD5593R Vref = 2.5 V (REF3425), VDD = ISO5V:

Which mode the firmware uses is unknown — needs confirmation.

2. Voltage ceiling at VLOAD*_OUT

3. Electrical P_max per channel (V × I)

P_FET ≈ V_LOAD × I_LOAD (R_sense drop ≤ 12.5 mV, negligible):

4. Thermal budget (with fan + heatsink + gap filler)

DON70N06 thermal-pad on bottom (drain). Two cooling stacks:

A) Bottom-side heatsink (pad → gap filler → HS → fan) — preferred:

• R_θJC = 1.44 °C/W (datasheet)
• Gap pad: 0.5–1 mm × 3–6 W/m·K × ~30 mm² → ~5 ± 3 °C/W
• Small M.2 HS + 5 V fan via J5 + MAX6650 → ~5 ± 2 °C/W
• Total R_θJA ≈ 11 (7–14) °C/W

B) Top-side heatsink (mold compound → gap filler → HS → fan):

• ψ_JT estimated ~10 ± 5 °C/W (Doingter datasheet does NOT publish ψ_JT)
• Same gap + HS layers → R_θJA ≈ 20 (12–28) °C/W

P_max = (T_J − 25 °C) / R_θJA:

5. What's binding?

Cross-referencing the loop-gain ceiling (§3) against the thermal budget (§4) at T_J = 125 °C derate:

6. Caveats

1. ψ_JT (top-side junction-to-package-top) is estimated — not published in the Doingter datasheet.
2. Two channels share heatsink → total board heat doubles; HS-to-ambient resistance worsens if HS undersized for 2× load.
3. Fan part number unknown — 5 °C/W for HS-to-air assumes a typical 25–40 mm 5 V fan @ 5–15 CFM. MAX6650 supports this range.
4. SOA (Fig. 11): at V_DS=50 V the DC SOA is ~1 A → silicon is not the limit, the thermal envelope is.
5. Pulsed operation: SOA permits ~10× the DC number for ms-scale bursts.
6. Caps C16/C21 set the 50 V external-voltage ceiling, not the FET's 60 V V_DS rating.

7. Source refs

• Schematic: 03_Implementation/DesignFiles/m2top_2xload_R2.pdf (sheet 3, "Load 1&2")
• BOM: 03_Implementation/DesignFiles/m2top_2xload_R2_BOM.csv
• Datasheet: Doingter DON70N06 (now attached to EGP10001550 in component library id=1545)

8. Errata

2026-06-09 — R21/R45 sense-resistor rating corrected (§2)

Original §2 quoted "(0.1 Ω 1206, 1 W) — I²·R = 1 W → 3.16 A", based on the "1W" annotation on schematic sheet 3. Engineer's BOM review (2026-06-09) noted the actual part listed in the BOM uses footprint rc1206_100m (EGP10001617) — a standard 1206 thick-film at 250 mW, not 1 W. §2 now reflects the as-built 250 mW rating, with continuous-current limit revised from 3.16 A to 1.58 A. The 1 W annotation on the schematic is a spec-vs-BOM mismatch — design intent appears to have been a high-power 1206, but the procured part is a standard 1206. Worth flagging for R3.

This correction tightens the safety margin at 1 A operation from 10× to 2.5×, but does not change the §3/§5 conclusions (loop-gain still caps at 250 mA, electrical P/channel still binds before R_sense). It does increase the likelihood that R_sense fails first during a fault transient (e.g. FET-shorts-out scenario), as the 250 mW part vaporises faster than the 1 W part would have under the same fault.

For the next revision (R3): look at improving the thermal path between Q1/Q2 (DON70N06 DFN5×6) and the system heatsink. R2 lab data (2026-06-09) shows linear-mode failures around 19 V × 1 A — well below the FET's published 60 V / 87 W envelope. Root cause is likely trench-FET secondary breakdown, but the steady-state thermal envelope is also tight on R2 (~9 W/ch with moderate bottom-side heatsink, see E-001 §4).

Ideas worth evaluating for R3

• Bottom-side coupling via thermal vias: ensure Q1/Q2 thermal pads connect to a large bottom-side copper area with a dense via array (typ. 9–16 vias of 0.3 mm under the pad). Current R2 layout has not been audited — confirm via count + bottom-side copper coverage.
• Bottom-side heatsink mount: M.2 cards can carry a heatsink on the back face. Direct pad → gap pad → HS gives the lowest R_θJA (≈ 11 °C/W in E-001 §4-A vs ≈ 20 °C/W for top-side). Mounting hardware footprint is the main constraint.
• Gap-filler material upgrade: 6 W/m·K vs 3 W/m·K halves the gap-pad resistance. Trade-off is cost + compressibility.
• FET change: a linear-rated FET (IXYS IXTP08N50L, Infineon IPB-series, OnSemi NTHLxxx) likely has more impact than thermal improvements alone — but improved cooling is complementary, not redundant.
• Larger or split FET package: TO-220 or DPAK with explicit tab cooling gives 10× lower R_θJC than DFN5×6, at the cost of M.2 height/footprint.

Linked

• E-001 (this project) — VLOAD power analysis with the R2 thermal numbers.
• Lab observations 2026-06-09: failure threshold ~18–19 V × 1 A, both FET and shunt fail (shunt fails secondarily when FET shorts).

Action for R3 spec phase

Add a thermal-envelope requirement (target P/channel + V × I corner) before the next layout iteration, so the FET choice + heatsink coupling decisions are driven by a number instead of by datasheet-vs-empirical surprises.

The galvanic isolation block around U5 (ISOW7741F — 4-channel digital isolator with integrated DC-DC) does not work as designed on R2.

Workaround in use on every R2 board (confirmed 2026-06-09)

Unmounted (vs schematic-default mounted):

Mounted (vs schematic-default NM — the "Optional isolation bypass" block on sheet 1):

Net effect: the isolator is bypassed and the AD5593R / INA2181 / REF3425 run directly from host 5 V / 3 V3 with shared ground. Functionally fine on the Sparrow test rig (AL + host share chassis ground anyway), but loses the design intent of breaking ground loops between AL load currents and host I2C reference.

What "does not work" actually means (to be investigated)

User reports U5 doesn't work — exact failure mode is not yet captured. Investigation for R3 needs to nail down which of these is happening:

• Isolated-side power rail (ISO5V) not coming up / drooping / noisy?
• I2C signals not crossing in one or both directions?
• RESET line stuck?
• Device sometimes works, sometimes doesn't (marginal supply / EMI)?
• Pin / footprint error on R2 layout?
• BC846B level-translator circuit interferes with the ISOW7741 input stage?
• Pullup R2/R3 to ISO5V vs other pullups creating contention?
• ISOW7741 minimum decoupling not met (datasheet wants specific bulk + HF caps close to VDD / VISO)?

Action for R3 spec phase

1. Reproduce the failure on a single R2 board with U5 (and R2/R3/Q4) mounted and R65–R69 unmounted — capture exact symptom (scope traces of ISO5V rail, I2C bus, RESETn; supply currents on both sides).
2. Decide whether R3 keeps the isolator or removes it. The current as-built (R65–R69 jumpered, no isolation) works — so the answer is partly "do we actually need isolation?" Consider where AL load currents return relative to the host I2C reference.
3. If isolator is kept for R3: fix the root cause, drop the BC846B SDA translator (the ISOW7741 already provides bidirectional I2C isolation when wired correctly), re-evaluate pullup placement, and revisit decoupling layout.
4. If isolator is dropped for R3: remove the "Optional isolation bypass" jumper block entirely (no point in a non-isolated design having a bypass block), route signals directly, and document why isolation was deemed unnecessary.

Cross-link

This is independent of the linear-mode FET / shunt failures (E-001, E-002) — different subsystem, separate fix.

Observed 2026-06-09 on the bench: Active Load DUT S/N A002854 has a broken measurement on CH1 (AL board Phoenix terminal J4). CH0 (J3) is unaffected as of this filing.

Context — same board as the test-rig reference unit: A002854 is the AL board cited in the fe_J8_active_load.py docstring (Pilot screenshot 2026-06-04). It's been the active DUT through all the v1.0.247–v1.0.264 bench iterations, including:

• The IDC J8 over-drive sessions documented in projectId 1 / E-027 (2 A through a 0.4 A-cont / 1 A-peak connector, multiple runs of AL.05 EMAX).
• Today's lab characterisation that surfaced the linear-mode FET failures at ~19 V × 1 A captured in this project's E-002.

Possible failure modes (not yet diagnosed):

1. Q2 (CH1 trench FET) damaged — if a recent step pushed the FET into its secondary-breakdown corner, the channel could be shorted, open, or running with a parameter shift that breaks IMEAS/VMEAS/VREM.
2. R45 (CH1 sense resistor) damaged — 1206 / 250 mW per BOM (per E-001 §8 errata); under a FET-short transient, the sense resistor fails secondarily and can open / change value. This breaks IMEAS path.
3. Trace / connector wear at J4 — accumulated from rig handling; less likely than (1)/(2) given today's lab data.

What "broken" means here is not yet captured — to be filled in when the failure mode is diagnosed. Engineer to specify which measurement(s) are wrong (IMEAS / VMEAS / VREM / power / temp / all), what value(s) are observed, and under what stimulus.

Action:

• Quarantine A002854 for CH1 testing until the failure is characterised. CH0 still usable.
• Do not run further high-current Phoenix or IDC tests on CH1 of this DUT — risk of additional damage and risk of obscuring the failure root cause.
• Diagnose: scope IMEAS (ESH10000536.IMEAS2), VMEAS, VREM with PSU sourcing a small current (≤ 0.1 A) on the Phoenix path with the relay routing forced to CH1 (host RELAY1 + RELAY2). Compare against CH0 readings on the same DUT.
• Decide: repair (Q2 + R45 replacement?) vs retire to debug-only status. If retired, allocate a fresh AL board as the new rig reference; update the docstring S/N in fe_J8_active_load.py.

Cross-references:

• E-001 (this project) — power budget + R21/R45 sense-resistor rating errata.
• E-002 (this project) — linear-mode FET failure observations at 19 V × 1 A.
• projectId 1 / E-027 — IDC J8 over-drive retrospective; CH1's IDC J8 connector pins also saw the over-current runs.
• Maestro package ESH10000633_SparrowUnitTest_v01 — v1.0.264 AL.04b step targets CH1 specifically; will hit this DUT's broken side if installed and run without quarantine.

Two additional DUTs need rework (in addition to S/N A002854 already documented in E-004):

Rework procedure

For each board, per affected channel:

1. Diagnose before rework: multimeter Ω across Q1 D-S (and Q2 D-S). < 1 Ω → FET shorted; replace. Verify R21 (R45) is open or off-value → replace.
2. Replace MOSFET — Doingter DON70N06 (DFN5×6). Original BOM part; same footprint.
3. Replace shunt resistor — 0.1 Ω, currently spec'd 1206 / 250 mW per BOM (EGP10001617, footprint rc1206_100m). STRONGLY CONSIDER upgrading to 1 W during this rework (matches schematic intent per E-001 §8 errata, and matches E-006's HIGH-PRIORITY recommendation). Same 0.1 Ω value, same 1206 footprint — drop-in substitution, ~€0.05 cost. Reduces severity of any future FET-short cascade.
4. Visually inspect surrounding parts — C16/C21 drain caps, INA2181 sense amp, OPA2192 control opamp. If any cap shows discolouration / cracking, or any IC has visible damage, flag for further investigation before re-power.

Why this is happening to multiple DUTs

This is the third (and fourth) confirmed instance of the turn-off-transient cascade documented in E-005:

• A002854 CH1 (Q2/R45) — original failure (E-004)
• A002854 CH0 (Q1/R21) — failed during the SMCJ24A retrofit experiment (E-005 Empirical confirmation #2)
• A002872 — this entry
• A002877 — this entry

This is not bad luck — it's a systemic issue. The R2 board is failing reliably under the bench-test workload that the rig has been running (AL.05 EMAX at 16 V × 1 A → 0, plus earlier 4 A and 2 A variants). Every DUT that's been used long enough on this rig sees the same cascade.

Mitigation strategy (full plan in E-005 + E-006):

1. Don't put reworked DUTs back on the rig until firmware soft turn-off is in place (E-005 Next Step #1). Otherwise these boards will fail again on the same cascade.
2. Do install the R21/R45 1 W upgrade during this rework if 1 W parts are available — reduces future-failure severity even if a turn-off cascade does re-occur.
3. Test the firmware soft-turn-off fix on these reworked boards once it's available — they become the validation platform for the fix.

Suggested allocation post-rework

• One reworked board → fresh rig DUT (replacing A002854 per E-005 Next Step #3). Update fe_J8_active_load.py docstring S/N reference when the new board lands.
• Other reworked board → spare / firmware-soft-turn-off validation platform.

Cross-references

• E-001 §8 errata — explains the R21/R45 250 mW vs 1 W mismatch; rework is the natural moment to fix this.
• E-004 — broken CH1 (and now CH0) on S/N A002854; same failure mode as these two DUTs.
• E-005 — root-cause mechanism (turn-off transient → FET secondary breakdown → cascade) + firmware-soft-turn-off as primary mitigation. Read before reworking — sets the boundary conditions for what to do with reworked boards.
• E-006 — R21/R45 1 W upgrade is the HIGH-PRIORITY layered-defense recommendation. Rework is the right moment to implement.

DUT S/N A002874 — CH0 (J4) is broken. Rework: replace Q1 (CH0 MOSFET) + R21 (CH0 shunt resistor).

This is the same failure mode and rework pattern as the boards in E-007 (A002872, A002877) and E-004 (A002854). Channel-and-connector explicit here ("CH0 J4" — relay-board J4 routes to AL CH0 per the v1.0.261+ Phoenix relay topology in fe_J8_active_load.py).

Rework

1. Diagnose: multimeter Ω across Q1 D-S. < 1 Ω → confirmed shorted; replace. Verify R21 is open / off-value → confirmed; replace.
2. Replace Q1 — Doingter DON70N06 (DFN5×6).
3. Replace R21 — 0.1 Ω 1206. Use 1 W part if available (per E-001 §8 errata + E-006 HIGH-PRIORITY recommendation). Drop-in for the 250 mW BOM part.
4. Inspect CH1 while at it — CH1 may have accumulated micro-damage from the same workload even if not yet manifesting. Multimeter check of Q2 D-S + R45 continuity. If concerns, flag for separate rework.

Channel count so far

Failed channels attributed to the same turn-off-transient cascade (E-005):

That's at least 5 confirmed-failed channels across 4 DUTs from the same root cause. Strengthens the "systemic issue, not bad luck" framing in E-005 / E-006 / E-007 — every reworked DUT must wait for the firmware soft turn-off fix before going back on the rig, or it will fail again the same way.

Cross-references

• E-001 §8 — R21 250 mW vs 1 W rating mismatch.
• E-004 — A002854 first-failure record.
• E-005 — root-cause turn-off mechanism + firmware soft-turn-off as primary mitigation.
• E-006 — R21/R45 1 W upgrade is HIGH PRIORITY.
• E-007 — companion rework note for A002872 + A002877.

Root-cause analysis of "I2C doesn't work through U5 (ISOW7741)" [E-003].

TOPOLOGY (read from schematic sheet 1): bidirectional SDA is passed through the UNIDIRECTIONAL ISOW7741 by splitting it into a forward + reverse channel, with BAT54J diodes turning the isolator's push-pull outputs into pull-low-only (open-drain) bus drivers.

• Forward (host->slave): SDA -> Q4(BC846B: E=SDA,B=_SDA_BIAS,C=_SDA_IN) -> _SDA_IN [R4 3k3 to 5V] -> U5.4 INC --iso--> U5.17 OUTC=_SDA1_OC -> D7 -> SDA1.
• Reverse (slave->host): SDA1 -> U5.16 IND --iso--> U5.5 OUTD=_SDA_OC -> D6 -> _SDA_OC_RES [R60 82] -> SDA.
• Pull-ups: host SDA/SCL via R61/R62 1k to VID=3.3V; iso SDA1/SCL1 via R2/R3 1k to ISO5V=5V. SCL & RESET are forward-only (OK: host is sole master, no clock stretching). The D6/D7 open-drain conversion is correct.

FAILURE MECHANISM: a unidirectional isolator pair carrying bidirectional I2C forms a positive-feedback loop. Host pulls SDA low -> forward path pulls SDA1 low -> SDA1 low is read by reverse input IND -> reverse path pulls host SDA low. Both sides now hold each other low; when the host releases SDA, the reverse path keeps it low => BUS LATCHES LOW (I2C dead).

The only loop-breaker is Q4's direction discrimination: a reverse-driven "low" arrives offset ~one BAT54J drop above GND (~0.3-0.5V via D6), and Q4 must treat that as not-a-real-low and stay OFF; a true host low (~0V) must turn Q4 ON. That requires _SDA_BIAS (set by R5 2k7 / R50 680 / D1 off 5V) to sit in a ~0.6-1.0V window.

WHY IT'S FRAGILE / FAILS:

1. The discrimination window is razor-thin; resistor tolerance + BAT54J Vf drift over temp + Q4 beta spread erode the margin. If _SDA_BIAS lands slightly high, Q4 stays ON at the 0.4V received-low -> never unlatches -> stuck bus.
2. Rail asymmetry: host bus = 3.3V (VID) but the iso bus AND the discrimination bias network = 5V. The threshold/offset scheme is effectively dimensioned for 5V; the 3.3V host side doesn't line up.
3. Asymmetric design: discrimination exists on the HOST side only (Q4). SDA1 feeds IND directly with no equivalent, so the reverse channel re-triggers on EVERY forward-driven low — the entire anti-latch burden is on one marginal transistor. A proper bidirectional buffer puts the offset on BOTH sides.

BENCH CONFIRMATION: scope SDA(host) + SDA1(iso) during one transaction. Latch signature = after the first low (often first ACK) both stick low and never release. Measure _SDA_BIAS DC (expect 0.6-1.0V; >1V is the smoking gun) and the received-low level on SDA (~0.3-0.5V). Often passes at 100kHz, fails faster.

RIGOR NOTE: BC846B & BAT54J datasheets are not yet ingested, so the bias-window numbers are first-order estimates from topology; the mechanism is solid, the exact thresholds want bench confirmation.

FIX DIRECTION: the R65-R69 workaround deletes isolation. To keep isolation, replace the discrete Q4/diode bridge with a purpose-built galvanically-isolated I2C device (see the next-revision options concept entry), and match the two I2C rail voltages.

(Analysis by Probe review on board 20 / ESH10000536 R2. Reposted 2026-06-18 after the Trace rollback wiped the original.)

Subject: E-003

— odb board 20 (comment)