AnasSarkiz/usb-c-pd-brushed-motor

docs/PROTOTYPE-TEST-PLAN.md

# Motor-controller validation matrix

A22 review, 2026-10-04. **No physical tests have been performed.** Use only the source/hash-linked prototype and its bring-up firmware. Bring-up firmware remains inhibited until separately approved NVM, receive-provenance and measurement profiles are installed; successful compilation is not live PD qualification.

Initial motor tests require stored mechanical/electrical energy ≤1 mJ, a guarded load and no externally powered back-drive. Expansion to a 20 ms dump pulse, ≤0.5 J per event and ≥10 s between events requires measured clamp voltage, current-regulation overshoot and MOSFET SOA/temperature evidence first. Approximately 2 A continuous remains the design target, subject to measured temperatures and current limits.

## Setup and evidence

Record motor model and rated voltage, cold/hot winding resistance, inductance, no-load/startup/stall current, load inertia and external back-driving conditions. Use a PD analyzer/source emulator, current-limited bench setup, differential motor/VM probes, current probe, thermocouples and guarded load fixture. Never ground an oscilloscope lead to a motor terminal. Log board revision, cable/source capabilities, settings, captures, temperatures and fault results.

The provisional screening assumptions are 2 A continuous; the corrected analytical current-limit upper corner is approximately 2.423 A plus unqualified response overshoot, 0–40°C ambient and 125°C target junction temperature. They are not measured operating ratings. Qualify representative motors at 5/9/12 V rather than requiring one particular motor. Peak duration, 5 V current-limit accuracy and energy/thermal bounds require measurements. No dedicated timed-reversal circuit is added in A4; both rapid reversal tests are mandatory and determine whether a coast delay is needed.

| Case | Required observation / acceptance basis | Current status |
|---|---|---|
| Voltage selection | Verify 5/9/12 V at no-load and full load; check default, DIP default and invalid both-ON selections. An invalid setting must not enable an overvoltage motor rail. Labels and assembly must make the setting unambiguous. | Hardware and linked STM32 runtime implemented; selector/measurement integration regressions pass. Physical continuity and voltage measurements pending. |
| Adequate PD | Verify selected rail requests/accepts a qualified contract, matching advertised voltage AND current. Check15 V/20 V sources individually and together, including3–5 A advertisements; confirm3 A operating and maximum matching the selected source. Verify controller's actual RDO/current limit, not just VBUS voltage. | Linked transport, source generations, policy and serialized commit guard implemented. 5 V mode prefers adequate 15 V; 9/12 V require adequate 20 V with a 5% input reserve. Approved 40-byte NVM and live negotiation/provenance measurements pending. |
| Insufficient PD / non-PD | Test 5 V-only, 9/12 V-only, insufficient 15/20 V current, failed negotiation, charger foldback and weak/long cable. Motor remains disabled; no sustained undervoltage operation. | Analytical qualification tested; no physical evidence. |
| USB unplug/replug | Test unplug while OFF and loaded in either direction; short and long replug, hard reset and PD renegotiation. Capture eFuse, buck, nSLEEP, VM and outputs. No stale power-good signal may keep the motor path enabled. Define whether replug requires OFF re-arming; do not imply an interlock exists before it is implemented. | Default-off hardware, restart sequencing and stale-generation rejection implemented and fault-tested in software; actual brownout/leakage/watchdog captures pending. |
| OFF → FWD | At minimum/mid/max PWM, cold and hot motor, verify commanded polarity, current limit, supply droop and correct indicator. No bridge drive before qualified power and regulated rail. | Datasheet truth table reviewed; untested. |
| OFF → REV | Same checks for opposite polarity and REV indicator. | Datasheet truth table reviewed; untested. |
| FWD → REV | First test only after coasting to rest. Then characterize guarded direct transition at bounded speed/load. Measure current overshoot, braking energy, VM rise, protection and switch bounce. Do not approve arbitrary running reversal from an OFF-to-direction test. | First-order example shows up to twice unrestricted startup demand; safe running-reversal envelope unresolved. |
| REV → FWD | Repeat with reverse initial direction, maximum declared inertia and hot winding. | Untested. |
| Startup current | Capture current/time for each voltage at minimum/mid/max knob settings and worst declared mechanical load. Motor must start within the approved peak duration without charger/eFuse collapse or repeated retries. | Representative motor matrix not measured; no startup guarantee. |
| Stall/current limit | With a guarded, time-limited stall, characterize chopping threshold and overshoot at each rail and temperature. Verify dissipation and restart behavior. End the test at the declared thermal/energy limit; OCP is not the normal regulating threshold. | Nominal 2.222 A reviewed; 5 V accuracy and measured tolerances pending. |
| Regulator current/thermal | Full continuous load and bounded peak in every rail/contract mode; measure buck IC, catch diode, inductor, eFuse, LDOs and bridge temperatures. Verify input-capacitance DC bias, output ripple, stability and actual junction estimates against the design target. | Inductor screening passes under stated assumptions; loop/thermal tests unperformed. |
| Dead time / shoot-through | Scope bridge transitions in both directions, including bounce and overlapping commands. Separate reverse-polarity current from supply shoot-through. Compare timing and current spikes with manufacturer limits. | TI documents internal dead-time generation and 100 ns typical dead time; no physical confirmation or guaranteed external coast interval. |
| Braking / regeneration | Test commanded brake states, current-chop decay, turning OFF under load and declared external back-drive. Measure VM peaks, absorbed energy, clamp/dump waveforms and resistor/TVS temperatures. No component may exceed its pulse/absolute limits; no sustained back-drive rating without sustained-energy proof. | Capacitor/rotor screening shows why energy protection cannot be deleted blindly; hardware untested. |

## Control-state basis

[DRV8874 PWM mode](https://www.ti.com/lit/ds/symlink/drv8874.pdf), PMODE high: IN1/IN2=00 coasts, 10 drives forward, 01 drives reverse, and 11 brakes through the low-side devices. nSLEEP=0 makes the bridge Hi-Z. The SPDT ON-OFF-ON routes timer PWM through common pin 2 to IN1 or IN2. Center opens both, and TI internal 100 kΩ typical pull-downs produce 00/coast. Direction LEDs follow PWM; check loaded timer VOH and brightness. Contact bounce may alternate drive/coast; center travel does not guarantee a stopping interval. The integrated driver generates MOSFET dead time; it is not an external reversal controller.

Reject a prototype that only passes netlist/build or no-load spin tests. Physical stage 7 remains not started until dated measurements are recorded for the declared conditions.


A11 discharge checks: with the motor disconnected and all three selected voltages, inhibit bridge/power and record VM, feedback gates and R68 temperature through full decay. Confirm measured VM≤1 V before branch changes and adequate margin below the 3 s timeout. Repeat at declared supply/temperature/capacitance extremes and rapid replug. Hold VM with external back-drive: timeout must latch inhibition, preserve old feedback and never enable. 9 V/15 V is prohibited by the current contract policy; verify rejection and adequate 20 V operation with a hot eFuse. No timed direction/reversal circuit is added.

## Reset, sensing and transport qualification

- Reset/watchdog/brownout forces both feedback GPIOs off, returning the buck feedback network to 5 V while hardware inhibits the motor and input. Unlike foreground shutdown, reset cannot retain the previous software-driven feedback state. Capture reset at charged 9/12 V VM, verify safe discharge and no re-enable before the VM interval qualifies. Test fault injection during the interrupt-masked commit window and peripheral timeout paths.
- Measure ADC reference/calibration, leakage, sequential-sample skew, acquisition settling, noise and total filter lag before approving a measurement profile. The linked runtime uses 32 MHz ADC clock and 160.5-cycle sampling; bind actual conditions to conservative outward-rounded intervals and oldest sample timestamps. Inject detach, stale samples, rollover and expired qualification.
- Verify I2C PB8/PB9 SCL/SDA rise ≤200 ns, fall ≤60 ns and bus capacitance within the documented timing envelope. Exercise NACK, stuck bus, timeout and partial reads; each must revoke permissions.
- Independently verify all 40 manufacturing NVM bytes through the manufacturer workflow, then capture fresh Source_Capabilities, request readback, Accept and PS_RDY with exact source/request generations. A RAM write or matching NVM is insufficient contract evidence.
- Record SWD image ELF/BIN hashes, real stack high-water, watchdog interval and complete ISR/foreground traces. The static stack screen is 948 bytes against 2048 reserved; no measured high-water exists.