Power Sequencers & Reset Managers

Power Sequencer & Reset Manager: Quick Answer

Select the right sequencing strategy, avoid classic pitfalls, and set robust fault handling—for reliable, multi-rail power design.

What is a Power Sequencer & Reset Manager?

A power sequencer & reset manager is the control hub that ensures every power rail in a multi-voltage system is enabled and disabled in the correct order, with proper PG (power-good) validation, reset stretching, and explicit fault-handling logic. This guarantees that sensitive loads—like FPGAs, SoCs, DDR, and peripherals—start and stop safely under all real-world conditions.

• Sequencing: Up to 20+ rails, controlled enable and disable order
• PG validation: Threshold and window comparators with deglitch/hysteresis
• Reset stretching: Meet all downstream minimum reset and clock-lock times
• Fault policy: Retry, cooldown, latch-off, and controlled discharge

System Overview & Working Principle

From a system viewpoint, power sequencing is a closed loop: qualified PG inputs enter a dependency graph, which schedules staggered EN and coordinates System_PGOOD and nRESET (aligned to PLL_LOCK). Any timeout/undervoltage triggers a fault policy: retry, cooldown, or latch-off, and a controlled reverse shutdown with discharge.

1) Inputs: PG & Sense Front-End

Each rail exposes a power-good source: device PG pin or comparator tap (remote or Kelvin sense). Before entering the scheduler, every PG must be qualified:

• Thresholds: typical 90–97% of V_nom, per-rail specific.
• Hysteresis: 0.5–5% of V_nom, sized against ripple and dV/dt noise.
• Deglitch: programmable 10–1000 µs; reject spikes without delaying protection.
• Window (optional): V_LOW–V_HIGH band defines the “ready region.”

The output of this stage is a set of PG_VALID[i] events (with timestamps) and PG_BAD[i] flags used for fault logic.

2) Dependency Graph & Stable Window

Rails are modeled as a directed acyclic graph where each node N declares prerequisites P(N). A node is ARMED when all P(N) have been PG_VALID for at least its stable-time window T_s(N).

• Stable window: prevents racing on just-crossed thresholds; typical 0.2–5 ms depending on load dynamics.
• Global skew Δt: staggers high-current rails (5–50 ms) to limit I_{in_peak}.
• Bring-up deadline: a total timeout budget avoids “forever wait.”

3) Outputs: EN, System_PGOOD, nRESET

• EN scheduling: assert EN_N only after N is ARMED and its skew slot opens; verify with PG_VALID[N].
• System_PGOOD: logical AND of critical PG_VALID rails with PLL_LOCK.
• Reset stretch: hold nRESET low until max(POR_min) is satisfied and PLL_LOCK is high; optionally align release to a reference clock edge.

4) Fault Handling & Controlled Reverse Shutdown

• Timeout on bring-up: retry N times with cooldown T_c; otherwise latch-off.
• Run-time undervoltage: initiate reverse order shutdown with controlled discharge to prevent backfeed.
• Evidence: log the rail/fault vector and timestamps for post-mortem correlation.

PG Qualification & Filters

An engineering-grade PG is not “above a threshold once,” but “inside a ready window for long enough,” hardened by hysteresis and deglitch to reject ripple, ringing, and load steps.

1) Thresholds & Hysteresis

• PG_TH: 90–97% of V_nom, documented per rail.
• HYS% sizing rule: choose HYS% ≥ max(3× ripple_pp%, noise_guard%).
• Hysteresis prevents chatter near the boundary when load dI/dt or switching ripple is significant.

2) Deglitch Window (10–1000 µs)

• Pick T_DG long enough to ride through the dominant ripple envelope (2–5 ripple periods).
• But keep it short enough not to delay fault response or total boot time.
• Document T_DG per rail; fast CPU rails may use shorter windows than bulk rails.

3) Window Qualification (VLOW–VHIGH)

Declare PG_OK when V_LOW ≤ V_OUT ≤ V_HIGH for at least T_DG. Windows reduce false-ready caused by overshoot ringing or asymmetrical noise.

4) Ripple & Load-Step Impact

• Convert ripple_pp to % of V_nom; size HYS% accordingly.
• If step response crosses PG_TH briefly, increase HYS or T_DG, or add a small RC/IIR pre-filter.
• Improve grounding/return current routing to reduce ground bounce near the comparator reference.

Sequencing Strategies & Dependency Graph

Build a verifiable dependency DAG and a staggered enable plan. Choose between time-based, threshold-based, or hybrid chains to balance correctness, inrush, and boot time. Publish timestamps and inrush evidence so decisions are auditable.

1) Strategy Profiles

2) Dependency Graph (DAG)

Model rails as nodes; edges indicate prerequisites. A node N is ARMED when all P(N) are PG_VALID for at least its stable window T_s(N). Each node carries t_EN,min/max, timeout, and a skew slot.

3) Enable Skew & Inrush Budget

• Choose Δt = 5–50 ms for high-current rails; allow bulk-cap recharge.
• Compute I_in,slot = ΣΔI of rails in that slot; enforce I_in,slot ≤ I_budget.
• Rule: never place two high-I rails in the same slot.

4) Power-Down & Discharge

• Reverse the critical bring-up order; coordinate discharge paths per rail.
• Avoid backfeed via body diodes or pull-ups; clamp energy safely.
• Keep logging active until “black state” if hardware allows.

Reset Management (POR/BOR, Stretch & Sync Release)

Guarantee reset width and release timing meet the strictest downstream tPORmin, under a clean clock after PLL_LOCK. Default to asynchronous assert and synchronous release. Arbitrate manual, watchdog, and PG-derived resets without glitches.

1) Reset Pulse Fundamentals

• Asynchronous assert: immediate reaction to BOR/PG loss.
• Synchronous release: re-time to system/always-on clock to avoid metastability.
• Pick the release clock consciously (fabric or AON) and document it.

2) Reset Stretching

• Set t_RST ≥ max(POR_min across critical domains); typical 10–100 ms.
• Add guard for PLL_LOCK settling and clock-tree enable latency.
• For multi-clock systems, stage releases: core → fabric → peripherals.

3) PLL_LOCK & Clean-Edge Release

• Require PLL_LOCK high and deglitched before release.
• Deassert nRESET on a qualified edge (1–2 reference cycles post-lock).
• If multiple PLLs: vote critical locks or define a composite LOCK.

4) Multi-Source Reset Arbitration

• Inputs: manual, watchdog, PG supervisor, optional thermal fault.
• Assert path is OR-wired; release path is synchronized and filtered.
• Log reset cause and duration; add cooldown to stop oscillations.

Fault Policies & Safe Power-Down

Define a provably safe resolution path for timeout and undervoltage events. Bound retries with a cool-down, cap total bring-up with a global ceiling, and always execute controlled reverse shutdown with discharge to eliminate backfeed and tail current.

1) Timeout Model

• Per-rail timeout T_TO[i]: max time to reach PG_VALID under its stable window T_s.
• Global ceiling T_{BOOT_MAX}: prevents indefinite boot when dependencies never resolve.
• Abort rules: missing prerequisite PG_VALID, queue starvation, over-long skew slot wait.
• Evidence: log failing rail, elapsed time, dependency snapshot at timeout.

2) Retry with Cool-Down

• Fixed N retries: N=2–4 typical; cool-down T_cool allows bulk caps to recharge and thermal to settle.
• Exponential backoff: T_cool,k=T₀·2^k when source droop/thermal stress is suspected.
• Counters: maintain per-rail and global retry counts; stop oscillation across rails.

3) Latch-Off & Service Path

• Enter LAT-OFF when retries exhausted or on fatal faults（OV/OT/short）.
• Re-arm: manual action, power cycle, or authenticated PMIC command.
• Black-box hooks: fault vector, last-N events, millisecond timestamps.

4) Controlled Reverse Power-Down

• Reverse the bring-up order; isolate first, then gate-off sources.
• Provide discharge paths（bleeders or PMIC FET discharge）to avoid tail voltage and backfeed.
• Tail V spec: V(t) below limit by T_{off_spec}; verify on scope and publish curves.
• Keep telemetry/logging alive until safe “black state” if supported.

Interlocks & Inrush Control

Constrain concurrency and cap input current peaks during bring-up. Use mutual-exclusion interlocks, grouped enables for small loads, and Δt staggering for heavy rails. Gate peripherals until System_PGOOD.

1) Mutual-Exclusion Interlocks

• Define conflict sets（e.g., {CPU_VCORE, DDR, GPU_CORE}）that cannot overlap in time.
• Enforce with semaphore tokens or slot capacity limits in the scheduler.
• Record violations; auto-redistribute if deadlines allow.

2) Grouped Enables & Staggering

• Group small loads（refs, IO）in the same slot; isolate heavy rails with Δt=5–50 ms between slots.
• Compute I_in,slot = ΣΔI and enforce I_in,slot ≤ I_budget per slot.
• Publish EN density per slot and total T_boot impact to justify trade-offs.

3) PG-Gated Loads

• Keep key peripherals off until System_PGOOD; then ramp using soft-start or controlled switches.
• Use reverse-block load switches or ideal diodes to prevent sneak currents.

run_id,rail,event,t_stamp_ms,value,result,notes
B01,Core,EN_rise,0.0,1,pass,—
B01,Core,PG_rise,8.7,1,pass,deg=0
B01,PLL,LOCK_rise,11.2,1,pass,—
B01,System,RESET_fall,15.0,0,pass,stretch=20ms
    

BOM Hooks

• PG/RESET pull-ups sized to logic level; avoid RC so large that it hides faults.
• Discharge resistors/FETs sized for stored energy; verify thermal profile.
• Open-drain ORing/isolators for safe PG combine and contention-free aggregation.