Power Health Loggers and Black-Box Recorders

Turn OV/UV/OC/OT anomalies into trustworthy evidence: timestamped events with pre/post windows, durable NVM commits, and paged read-only export. Power Health Loggers capture start/peak/end, survive brownouts with journal + tail mark, and provide a clean chain-of-custody for post-mortem analysis and production quality loops.

Quick Browse

Browse sections

1 Answer Box 2 What is it 3 Working Principle 4 Technical Breakdown 5 Key Metrics 6 Design Guidelines 7 Troubleshooting Matrix 8 Applications & Schematics 9 Data Model & NVM Commit 10 Validation & Evidence Chain 11 FAQ 12 Reference & CTA

Answer Box (Conclusion & Buying Decisions)

A power health logger converts OV/UV/OC/OT rail faults into structured, time-stamped evidence with pre/post windows, and safely commits records to NVM during brownouts. Logs are exported in read-only mode to preserve the chain of custody—enabling trustworthy post-mortem analysis, faster FA/QA loops, and parameter convergence across builds.

Event set coverage Timestamp resolution Pre/Post depth NVM commit strategy RO export & integrity

✅ Suitable

Needs post-loss evidence
Fast “fault → proof” loop

⛔ Not a replacement for

Power Monitor / ADC
Sequencer (power timing)
PG Aggregator (voting)

One-click evaluation checklist

Rails & events TS target Power-down slope Retention window Export limits

One-screen takeaway for power health loggers: events → timestamp → pre/post → NVM commit → export — 3:2 infographic • Answer Box

What is it (Definition & Boundaries)

A power health logger is a focused module that detects rail exceptions, time-stamps them, preserves pre/post context, and commits records to non-volatile memory during brownouts. Data exports in read-only mode to maintain evidentiary integrity. Its scope excludes power sequencing, continuous power monitoring, and PG aggregation.

Out of scope

No power sequencing logic

Out of scope

No continuous ADC metering

Out of scope

No PG voting/aggregation

NVM choice

EEPROM vs FRAM—trade endurance, commit energy, and latency.

Timebase

Local ticks with a health flag and a recent calibration offset.

Event inputs

Threshold/window comparators with minimum-pulse glitch rejection.

Data model

Fixed header (Type/TS/Flags/CRC) + TLV extensions for peaks/duration/tags.

Boundary map showing logger focus vs excluded siblings — 3:2 diagram • Logger scope & boundaries

Working Principle (Architecture & Data Path)

The logger converts rail exceptions into a durable, replayable narrative: event sensing → gating/windowing → timestamping (timebase) → pre/post ring buffer → brownout-aware commit → resilient NVM (journal/dual-write/CRC) → paged, read-only export. Every block is scoped to logging only, preserving chain-of-custody.

Rail Event Inputs → Gate & Window Checks → Timestamp (timebase) → Ring Buffer (pre/post) → Commit Controller (brownout-aware) → NVM (journal/dual-write/CRC) → Export (paged, read-only)

Event Detection

Programmable thresholds, hysteresis, minimum-pulse reject; tri-phase tags (Start / Peak / End) for causal replay.

Tip: reject narrow EMI glitches; keep thresholds outside ripple envelopes.

Timebase

Local RC or crystal; record Timebase-Health and Last-Calibration-Offset for drift transparency.

Resolution matches fault physics: 1–10 µs (fast) or 0.1–1 ms (slow).

Pre/Post Ring Buffer

Circular snapshots preserve prelude before faults and recovery/secondary behavior after.

Keep narrative context with fixed-budget sampling; compress repetitive OK states.

Commit Controller

Brownout early-warning, smallest write unit, priority commit; CRC + Entry-ID + Config-Version with commit ticket.

Write what matters first; prove it with a ticket; rollback on partial tails.

NVM Strategy

Journal pages or dual-write; monotonic Entry-ID; rollback if tail mark is broken.

Never trust half-written data; validate with CRC/Fletcher.

Export Path

Paging, rate-limiting, read-only export; compliant clear/erase policy with audited admin events.

Get logs out fast without breaking chain-of-custody.

Block diagram of logger data path from events to NVM/export — 3:2 diagram • Events → Timestamp → Pre/Post → Commit → NVM → Export

Technical Breakdown (Mechanisms & Field Definitions)

The following mechanisms define how evidence is generated, made consistent, and exported without overstepping into sequencing or continuous power monitoring. Each block lists key Fields, Acceptance criteria, and typical Pitfalls.

4.1 Event Models

Crossing, Duration (≥X), Peak, Rate-of-Change (dv/dt).

Fields: Type, Threshold-ID, Min-Pulse, Start/Peak/End TS, PeakValue, Duration
Acceptance: Precedence reconstructable in post-mortem
Pitfalls: Treating ripple as faults; missing dv/dt spikes

4.2 Debounce & Time Gating

Minimum pulse, pulse count, jitter window; EMI false-positive control.

Fields: MinPulse, DebounceMode, Accepted/Rejected counters
Acceptance: Rejected-glitch rate matches scope validation
Pitfalls: MinPulse too long → real UV lost

4.3 Timestamp System

Choose 1–10 µs for fast faults, 0.1–1 ms for slow; record timebase health & last calibration offset.

Fields: TSResolution, TimebaseHealth, CalOffset, SyncMarker
Acceptance: Drift within budget; analyzer can correct
Pitfalls: Unstated resolution/offset breaks comparability

4.4 Pre/Post Window Design

Depth from T_pre / Δt and T_post / Δt; compress repeated OK states.

Fields: PreDepth, PostDepth, SamplePeriod (Δt), OKCompression
Acceptance: Prelude + recovery captured without buffer exhaustion
Pitfalls: Sampling too slow; prelude missing

4.5 Commit & Consistency

Journal/dual-write/CRC; monotonic Entry-ID; Commit-Ticket; rollback on broken tail mark.

Fields: EntryID, CRC, CommitTicket, PageTailMark
Acceptance: No “ghost entries” after abrupt loss
Pitfalls: Large write unit; commit energy underestimated

4.6 Clear / Eraser Policy

Two-step + time window; log the admin clear event; allow partial-range erasure.

Fields: ClearArmed, ClearWindowTS, AdminEvent
Acceptance: Evidence chain preserved; intended ranges only
Pitfalls: Auto-purge on boot

4.7 Multi-Rail Correlation (No Sequencer)

Shared timebase + ChannelID; offline alignment only; no sequencing actions implied.

Fields: ChannelID, per-channel delay constants (doc), SyncMarker
Acceptance: Analyzer infers precedence across rails
Pitfalls: Hidden comparator skew; missing IDs

Timeline showing pre/post windows, event start/peak/end, and timestamp ticks — 3:2 timeline • Pre / Event (Start–Peak–End) / Post • Δt • Min pulse • TS resolution

Key Metrics (What to measure & how to size)

A logger’s value is set by detectability (events, thresholds, min-pulse), temporal fidelity (TS resolution, pre/post depth), and durability/integrity (commit latency, NVM endurance, CRC/dual/journal), within the bounds of export bandwidth and power budget.

Metrics table

Event Types	Threshold Step	Min-Pulse	TS Resolution	Pre Depth	Post Depth	Commit Latency	NVM Endurance	Data Integrity (CRC/dual/journal)	Export Bandwidth	Supply & Iq	Op-Temp
OV/UV/OC/OT (+dv/dt)	2–20 mV / 0.5–2%	100 ns – 1 ms	1–10 µs / 0.1–1 ms	8–128 samp	8–256 samp	≤ 1–10 ms	EEPROM 1e5–1e6 / FRAM 1e10+	CRC + journal/dual	10–500 kB/s	Active 2–8 mA; Standby < 0.5 mA	–40…85/105/125 °C
OV/UV/OC/OT	5–10 mV / 1%	200 ns – 500 µs	2–5 µs / 0.2–0.5 ms	16–64 samp	16–128 samp	≤ 5 ms	EEPROM 1e6 / FRAM 1e12	CRC + dual	50–200 kB/s	Active 3–6 mA; Standby < 0.3 mA	–40…105 °C
OV/UV/OC/OT (+peak)	≤ 5 mV / 0.5%	≥ 100 ns	≤ 2 µs / ≤ 0.2 ms	≥ 64 samp	≥ 128 samp	≤ 2 ms	FRAM 1e12+	CRC + journal + tail mark	≥ 200 kB/s	Active 2–4 mA; Standby < 0.2 mA	–40…125 °C

Sizing formulas

Pre depth: Pre ≥ ceil(T_pre / Tsample)
Post depth: Post ≥ ceil(T_post / Tsample)
Commit energy: E_commit ≥ N_pages × E_write_per_page
Export time: T_export ≈ Size / Throughput

Acceptance

TS_res ≤ (shortest real event)/10
Min-Pulse ≤ (shortest fault)/2
Commit latency < brownout margin; E_commit within headroom
NVM endurance ≥ lifetime writes × safety factor
Export completes within service window

Red lines

No CRC, no ship
Never erase without audit
Journal or dual-write only
Timebase health flag required
Clear = two-step + timed window

Cheat-sheet of key metrics and quick formulas (3:2). — 3:2 cheat-sheet • Metrics table + formulas + red-lines

Design Guidelines (10 field-proven rules)

Practical guardrails to hit first-time success and maintain an auditable evidence trail—without stepping into sequencing or continuous power monitoring.

Match resolution to fault time scale

Avoid aliasing; size TS in µs or ms by physics.

Test: scope vs log timestamps agree.

Place thresholds outside ripple envelope

Add hysteresis; avoid chatter near steady ripple.

Test: 0 false trips in ripple scan.

Filter EMI without losing true UV

Set Min-Pulse from scope stats; validate rejection rate.

Test: rejects ≥95% injected glitches.

Size pre/post for recovery narratives

Capture prelude + secondary effects; compress OK states.

Test: full recovery captured.

Brownout headroom before write starts

Early-warn + smallest write unit; bound commit latency.

Test: survives injected cut at −Z ms.

Enforce CRC + Entry-ID + version

Prevent ghost entries; enable fleet comparability.

Test: corrupt tail → clean rollback.

Prefer journal pages over full sectors

Short atomic commits; robust rollback on tail break.

Test: no half-writes after power loss.

Export is paged, throttled, read-only

Preserve chain-of-custody; avoid starving rails.

Test: 1 kB page < X ms at Y kbps.

Calibrate timebase and log its offset

Drift is documented, not hidden; add health flag.

Test: analyzer corrects to spec.

Erase with two-step timed window

Admin event is logged; limit scope/duration.

Test: audit log shows clear intent.

Ten design commandments cards for power health loggers — 3:2 card grid • Ten rules, one-liners, acceptance micro-tests

Troubleshooting Matrix (Diagnose → Observe → Fix)

Use this matrix to move from symptom to trigger condition to the smallest set of observable fields that prove the likely cause, then apply a single remedy you can test within a day. Reuse your own table form—this page defines which fields to capture and how to fill them consistently.

Columns (fixed order)

Symptom
Trigger Condition
Observable Fields (Type, TS, Duration, Peak, Config-Ver, CRC, Commit-Ticket)
Likely Cause
Remedy

Field notes

Type: OV/UV/OC/OT/(dv/dt) — keep taxonomy consistent.
TS: order & spacing first; check Timebase-Health bit.
Duration: separates chatter vs sustained faults.
Peak: compare to threshold & ripple envelope.
Config-Ver: bind behavior to configuration.
CRC: trust only verified entries.
Commit-Ticket: proves atomic write.

Starter rows (examples)

Symptom	Trigger Condition	Observable Fields	Likely Cause	Remedy
False UV	Load ripple near threshold	Type, TS, Duration	Threshold inside ripple or Min-pulse too short	Raise threshold, add hysteresis, lengthen Min-pulse
No log after power loss	Abrupt outage	Commit-Ticket, CRC	Insufficient commit energy or wrong priority	Add headroom, shrink page, prioritize primary event
Event misordering	Reset / drift window	TS, Timebase-Health	Timebase drift or reset gaps	Increase calibration cadence; validate health bit
Export congestion	Heavy readout during load	TS, Entry-ID	Paging / rate-limit disabled	Enable paging + throughput cap; export in idle windows

Evidence map (check in this order)

TS + Commit-Ticket (ordering & durability)
Peak vs Threshold (binning sanity)
Duration vs Min-pulse (chatter vs real)
Config-Ver (stale configs?)
CRC (trust boundary)

Decision flow for diagnosing logging issues (3:2). — Decision flow — Symptom → Observable fields → Likely cause → Remedy

Applications & Schematics (Topologies & Export)

Three canonical use cases show only the logger-relevant wiring—event inputs, timebase, NVM, and export. Sizing remains strictly within logging scope (no sequencer or continuous ADC functions).

Server / Storage mainboard

Log: multi-rail UV/OV/OT; confirm “UV then OC”.
Wire: PoL comparators → logger channels; local timebase + calibration offset; close NVM; service-header export.
Size: TS 1–10 µs; Pre/Post for VRM recovery; journal unit ≤ brownout headroom.
Evidence: monotonic Entry-ID + Commit-Ticket; paged export.

Motor drive domain

Log: startup inrush UV and thermal OT interactions.
Wire: shunt/voltage comparators → logger; brownout early-warn; FRAM for endurance.
Size: Min-pulse rejects PWM spikes; deep Post for thermal settle.
Evidence: Peak corroborates UV depth; Timebase-Health under EMI.

SoC / FPGA load transients

Log: droop events under burst loads (no DVFS policy here).
Wire: window comparators → logger; local XO with periodic offset log; export in maintenance slot.
Size: low-µs TS; Pre captures prelude; short dense Post; journal writes.
Evidence: Pre/Post frames reconstruct burst envelope; CRC + tail mark intact.

Connection checklist

Event inputs: comparator/window outputs; digital alerts.
Timebase: local RC/XO + Last-Calibration-Offset field.
NVM: on-die or near-die to reduce commit energy.
Export: paged API with throughput cap; read-only mode; export in low-load windows.

Export tool skeleton

API: LIST(page, cursor) | READ(page_id) | STATUS() | LOCK_RO(enable)
Cursor: opaque cursor; payload carries monotonic EntryID
Integrity: per-page CRC; optional tail mark
Formats: CSV & JSON → {EntryID, Type, TS, Duration, Peak, ConfigVer, CRC, CommitTicket}
Safety: LOCK_RO(true) before export; clear via two-step timed window (admin logged)

Topologies for server, motor drive, and SoC board using logger — Three-panel topology sketches — server / motor drive / SoC (logger-only connections)

Data Model & NVM Commit

Define a compact binary record that is self-validating and consistent across fleets, then use a journal-first commit with tail mark and rollback so logs survive brownouts without ghost entries. Export is paged and read-only with cursoring.

Fixed header (16B, little-endian, packed)

`u16 EntryID`	Monotonically increasing (wrap-aware)
`u32 Timestamp`	Tick unit + epoch/offset policy
`u8 Type`	Enum: OV/UV/OC/OT/dvdt…
`u8 Flags`	Phase(Start/Peak/End), Timebase-Health, Brownout-Commit…
`u8 ChannelID`	Rail/zone code
`u8 CfgVer`	Config/firmware version ID
`u16 CRC16`	Header CRC (CRC-16/CCITT-False recommended)

TLV extension (variable)

0x01 PeakValue (u16/u32)
0x02 Duration (u16 in µs/ms)
0x03 TempZone (i16, 0.1°C)
0x04 BoardRev (u8)
0x05 HashRef (16B digest → immutable config blob)
0x06 Notes (ASCII/UTF-8 ≤ 32B)

Format: [u8 Type][u8 Len][Len bytes Value]… until page end or TLV_END=0x00.

Journal commit (brownout-aware)

Append record (header with CRC + TLVs)
Update EntryCount (write-through)
Write TailMark{MAGIC,PageCRC}
Flip Page Directory to PAGE_VALID
Increment Commit-Ticket (dual-copy)

Boot scan & rollback

Invalid MAGIC/CRC → discard last page; adjust ticket delta
Valid page → continue append or open new page

Clear & admin events

Range or session clear → RO lock → two-step arm → timed window → erase → write Admin Event (Type=ADMIN_CLEAR, operator ID).

Export (paged, RO)

READ_PAGE(idx, window) → {records[], next_offset}
STATUS() → {LastEntryID, CommitTicket, RO_Lock}
LOCK_RO(enable) → one-way during export session
CSV/JSON fields: {EntryID, TS, Type, Flags, ChannelID, CfgVer, CRC, TLVs…}

Acceptance

EntryID monotonic (wrap-aware)
Power cut at −Z ms → valid page + ticket advanced
Zero ghost entries; CRCs pass
Every record maps to HashRef of config

Binary layout of event record with fixed header and TLV extension — Binary layout + journal page & directory — fixed header (16B) with TLV chain

Validation & Evidence Chain

Prove detectability, ordering, durability, and integrity under controlled faults. Each test yields objective metrics and an audit trail, culminating in a defensible chain-of-custody from event to export.

Lab script (ordered)

Configure thresholds & TS resolution → record HashRef + CfgVer
Inject UV glitch < Min-pulse → no entry; reject counter ↑
Inject UV > Min-pulse → Start/Peak/End; PeakValue & Duration TLVs
Brownout test (−Z ms pre-cut) → page valid; Commit-Ticket advanced
Paged export with throughput cap → monotonic EntryID; page CRCs
Timebase drift & calibration → Health bit; offset logged

Metrics & targets

FPR ≤ 5% (glitch rejections)
FNR = 0% at spec amplitudes
Commit success ≥ 99.9% at profile
Export throughput ≥ target with RO lock
Evidence reliability 100% CRC; scope timing within TS resolution

Compliance & chain-of-custody

Export is read-only (LOCK_RO(true))
Admin ops (clear/unlock) produce Admin Events
All logs map to immutable HashRef of config
Reports bundle CSV/JSON + scope screenshots + tool versions

Lab validation plan for logger integrity and commit success — Swimlane plan — Setup → Inject → Observe → Verify → Export → Calibrate (with outcomes)

FAQ

Answers stay within 40–70 words and reference logger fields only (Type, TS, Duration, Peak, CfgVer, CRC, Commit-Ticket).

How is commit guaranteed after power loss?

Use a journal-first flow with a small atomic write unit, TailMark {MAGIC, PageCRC}, and a dual-copy Page Directory. Raise a separate Commit-Ticket after the tail lands. On boot, accept pages with valid TailMark and CRC; otherwise roll back the last page. Brownout early-warn provides headroom to finish the tail or skip safely.

How fine should the timestamp be?

Match TS resolution to physics: microseconds for fast droop or UV edges, milliseconds for thermal OT. Record a Timebase-Health bit and Last-Calibration-Offset so analysis corrects drift. If you synchronize to an external cadence, log the sync marker as an event. Absolute RTC is optional unless wall-clock traceability is a requirement.

How large should Pre/Post buffers be?

Size with simple rules: Pre ≥ ceil(T_pre / Tsample) and Post ≥ ceil(T_post / Tsample). Pre captures the prelude to a fault; Post reconstructs recovery and secondary effects. Prefer power-of-two depths for ring buffers, and compress OK-state samples to save bandwidth without losing narrative fidelity in exported evidence.

How do I prevent UV/OV false triggers?

Place thresholds outside the ripple envelope and add hysteresis. Set Min-Pulse long enough to reject EMI spikes yet short enough to keep real UVs. Window comparators and optional dv/dt guards reduce chatter. Validate with scope statistics, then target at least 95% rejection of injected glitches under representative load and temperature.

What integrity checks are recommended?

At minimum, a header CRC16 per record and a per-page PageCRC inside the TailMark. Prefer journal or dual-write so half-writes can roll back. Enforce monotonic EntryID, versioned CfgVer, and optional HashRef to an immutable config blob. Never ship without CRC; treat failed-CRC entries as non-evidentiary during analysis.

How do I export logs without blocking the bus?

Export is paged, throttled, and read-only. Provide READ_PAGE(idx, window) that returns a limited number of records plus next_offset. Rate-limit bytes per second, and schedule readout in idle windows. Set LOCK_RO(true) before export, and log the export session as an admin event to preserve chain-of-custody across teams.

Do I need an RTC for valid analysis?

No. A stable local tick with Timebase-Health and Calibration-Offset is sufficient for ordering, duration, and channel correlation. If wall-clock time matters, add an occasional sync marker to tie the local epoch to RTC or host time. Keeping RTC optional reduces cost, power, and complexity in compact designs.

How should configuration context be recorded?

Store a short CfgVer in the header and a HashRef TLV to a read-only config blob that contains thresholds, scaling, and table IDs. Include BoardRev or TempZone TLVs when relevant. Every entry becomes traceable and comparable across fleets, enabling audits without guessing which configuration produced each record.

What makes a compliant clearing strategy?

Clearing uses a two-step timed window with RO lock engaged during export. Limit scope by range or session ID, erase journal pages, and immediately log an Admin Event that records operator, range, and timestamp. The admin entry itself is not silently removed, preserving a verifiable evidence trail for audits.

How do I correlate multiple rails without a sequencer?

Use a shared timebase and include ChannelID in every entry. Post-analysis aligns by TS and Duration rather than enforcing a power-up order. The logger remains neutral: it records OV, UV, OC, and OT with Pre/Post windows; it does not orchestrate sequencing or PG voting, which are outside this page’s scope.

Reference & CTA

Parameterized selection checklist

Event coverage: OV / UV / OC / OT (+ optional dv/dt).
Threshold granularity: 2–20 mV or 0.5–2% steps; hysteresis available.
Min-Pulse window: 100 ns – 1 ms; validated against ripple/EMI.
TS resolution & health: 1–10 µs or 0.1–1 ms; Health bit + Calibration-Offset.
Pre/Post depth: computed from targets; ring buffer; OK-state compression.
Commit latency & energy: brownout headroom; tail mark; ticket.
NVM type & endurance: FRAM vs EEPROM; page size; wear policy.
Integrity policy: CRC16 header + PageCRC; journal/dual-write; EntryID monotonic.
Export bandwidth: paged + rate-limited; RO lock; expected throughput.
Operating limits: supply, Iq (active/standby), temperature range.