← AXA-012

Circuit review & bench-test guide

AXA-012 — E-stop / power gate PMOD module

Document purpose#

This document explains the axa-012-estop prototype at component level and turns the design evidence into a practical manual-review and bench-test plan. It is based on the generated schematic (generate_design.py, rev 0.1-schematic), the module README, and the actuator-line family rules in ../README.md.

The board is an unfabricated prototype design. Status at the time of writing: schematic generated, ERC clean (0/0), netlist reviewed; PCB layout not started, no board built, no BOM ordered, and no bench evidence of any kind exists. Every voltage, current, resistance, and timing number below is a design target derived from the schematic and manufacturer datasheets — a target to verify on a first article, not proof that an assembled board works.

This is NOT a certified safety device. It is a convenience power interrupt for a hobby bench. It has no redundancy, no monitored (forcibly guided) contacts, no rated stop category, no diagnostics, and a single transistor in the power path whose most common failure mode (drain-source short) defeats the stop entirely. It must never be the only thing between a person and a hazard. Real machine safety uses certified components and engineered systems following ISO 13850-style e-stop principles and ISO 13849 / IEC 62061 functional-safety standards, none of which this board meets or attempts to meet. The module exists to teach fail-safe thinking and the fabric-side supervision lesson, nothing more.

1. What the board does#

The board is a high-side P-channel MOSFET power gate in series with a 5-24 V motor/actuator rail. VIN passes to VOUT only while both conditions hold: the normally-closed (NC) e-stop loop on J4 is intact and the PMOD host drives EN high. The AND is built from a discrete series chain: the P-FET gate can only be pulled low (turning the FET on) through R2, then through the NC loop, then through the 2N7002 EN switch to ground. Opening the loop (button hit or wire cut), dropping EN, or unplugging the host all break the chain and R1 pulls the gate back to VIN — output off. A resistive divider reports VOUT back to the host on STATUS.

The hardware is purely combinational: if the loop recloses while EN is still high, power returns immediately. The no-auto-relatch policy is a fabric contract — the host HDL must latch a STATUS drop and require a deliberate EN off-to-on toggle. This guide tests the hardware truth table; the latch is the HDL deliverable and is tested separately.

Functional block diagram#

J2 VIN 5-24V ──┬──────────────── S  Q1 AO3401A  D ────────┬──> J3 VOUT (gated)
               │                     P-FET                 │
               │   R1 10k            │ G = PGATE           │  R4 100k
               ├──/\/\/\─────────────┤                     ├──/\/\/\──┐
               │                     │                     │          │ ST_DIV
               │   D1 10V zener      │  R2 10k             │  R5 10k  ├─/\/\── STATUS
               └──────|<─────────────┴──/\/\/\── LOOP_A    └─/\/\/\─┐ │ R6 100R  (PMOD 2)
                  (clamps Vsg)                    │                 │ │
                                       J4 NC e-stop loop          GND └────────
                                     (mushroom button / link)
                                                  │
                                               LOOP_B
                                                  │ D
EN (PMOD 1) ──┬────────────────────────── G  Q2 2N7002
              │  R3 10k                          │ S
              └──/\/\/\── GND                   GND

Truth table (hardware level):

2. Safety and scope boundaries#

Repeat: NOT a certified safety device. No redundancy, no monitored contacts, no safety rating. Never let a person's safety depend on it. A shorted Q1 passes full power regardless of the loop; nothing on the board detects that. Certified e-stop systems (ISO 13850 principles, ISO 13849 performance levels) require rated switches, redundant channels, and monitored feedback that this teaching module deliberately does not have.

General bench boundaries:

• VIN is limited to 5-24 V by design. Q1 abs max is -30 V VDS; there is no input TVS, no reverse-input protection, and no bulk capacitance on the module, so use a current-limited lab supply and do not hot-plug VIN.
• Q1 is derated by the design to 2 A continuous despite the 4 A abs-max rating (SOT-23 thermal limits, ~0.24 W at 2 A). Do not plan loads above 2 A.
• There is no reverse blocking: Q1's body diode conducts from VOUT to VIN if the output is ever driven above the input (charged downstream capacitance, motor regeneration). Do not externally drive VOUT, and expect regen from downstream motor drivers to appear at VIN.
• Connect scope grounds only to board GND. PGATE and Vsg measurements at higher VIN are near-rail measurements; use a differential probe or math-subtract two channels for source-to-gate readings.
• ERC-clean schematic and a passing bench matrix are not a safety, EMC, or environmental qualification of any kind.

2.1 Actuator-specific safety (mandatory reading)#

This board sits in series with motor power for boards that move. Treat it with the same discipline as the drivers behind it:

• First power is always current-limited. Set the bench supply feeding J2 to the expected voltage with the current limit at ~100 mA for the first power-up, raising it only after the truth table passes unloaded.
• Test the loop with a RESISTIVE dummy load before any motor. A power resistor (e.g. 12 Ω / 25 W at 12 V for ~1 A) proves the gate, the stop, and the STATUS divider without inductive kick or a mechanism that can move.
• Downstream stall currents pass through this board. Typical estimates for the family's gearmotors: N20-class stall ~0.36-1.6 A, JGA25-class stall up to ~4 A. A stalled JGA25 exceeds the 2 A derating and sits at Q1's 4 A absolute maximum — this board must not carry a JGA25 stall. Budget worst case (stall, not running current) against the 2 A derating, or guarantee an upstream/driver current limit below it.
• Never hot-plug the downstream motor leads. Breaking an inductive load at a screw terminal arcs and rings the switched node; wire, then power.
• Family rail sequencing: logic before motor rail. Bring up the 3.3 V PMOD/host side first so EN and the fabric supervisor are in a defined state before J2 has power. R3 holds EN low for an unpowered host, but sequencing is still the rule.
• Hands clear for the first downstream spin. When a motor module is finally placed behind J3, nobody touches the mechanism during first enablement.
• CRITICAL: verify the e-stop actually kills power under load BEFORE trusting it during any live-motor session. Section 9 step E includes an open-the-loop-while-running test at rated current into the resistive dummy load, with the collapse captured on a scope. Until that capture exists for the specific assembled board, the mushroom button is decoration.

3. Power and control behavior#

1. With VIN present and nothing else, R1 (10 k) holds PGATE at VIN, so Vsg = 0 and Q1 is off. VOUT is dark, STATUS reads ~0 V.
2. R3 (10 k) holds EN at GND whenever the host is absent, unpowered, or tri-stated, keeping Q2 off — default state is OFF from both directions.
3. When the host drives EN high (3.3 V), Q2 turns on. If the J4 loop is closed, the chain R1 -> PGATE -> R2 -> loop -> Q2 -> GND conducts.
4. R1/R2 form a 1:1 divider, so PGATE settles at ~VIN/2 and Vsg = VIN/2: 2.5 V at VIN = 5 V (just enough — AO3401A is specified at VGS = -2.5 V), 6.0 V at 12 V, and a nominal 12 V at 24 V — exactly the FET's +/-12 V gate abs max, which is why D1 (10 V zener, cathode to VIN, anode to PGATE) clamps Vsg to ~9.4-10.6 V for VIN above ~20 V.
5. Q1 turns on and VIN passes to VOUT through ~60 mΩ (at Vsg >= 4.5 V).
6. R4/R5 (100 k / 10 k) divide VOUT by 11 to ST_DIV; R6 (100 Ω) carries the tap to STATUS (PMOD pin 2). As fitted the divider is sized for 24 V rails; see section 7 for the repopulation rule at 12 V and 5 V.
7. Opening the loop or dropping EN breaks the chain. R1 recharges Q1's gate (Ciss 645 pF typical) with a ~6.5 µs time constant, so the FET itself should stop conducting within a few tens of microseconds; how fast VOUT actually collapses then depends on the load resistance and any downstream capacitance. This is a calculated target — measure it (section 9.E).

Design observations to verify rather than assume:

• Q2 is driven with 3.3 V, but the 2N7002's threshold is specified up to 2.5 V max and its RDS(on) is only characterized at VGS = 4.5 V and 10 V. At the ~0.25-1.2 mA chain current this is comfortably sufficient on paper (a few ohms of Q2 resistance is irrelevant against 20 kΩ), but confirm clean saturation on the bench, especially warm.
• The onsemi 2N7002LT1G named in the BOM field has a +/-20 V VGS abs max per onsemi documentation; the Nexperia datasheet fetched for this review states +/-30 V. Either is far above 3.3 V drive, but check the exact orderable part's datasheet at procurement.
• The e-stop loop wets its contacts with only ~0.25-1.2 mA at a few volts. Fine for a new switch; oxidized or marginal contacts may need attention. A cut or open loop is a stop, never a silent fault — that is the point.

4. Interfaces#

Grounds join on the module (family rule). The PMOD carries 3.3 V logic only; the 3V3 pins power nothing on this board (there is no IC) but are flagged for ERC. Note the module draws essentially zero current from 3V3.

5. Component-by-component review#

5.1 Power path and switches#

5.2 Gate network and protection#

5.3 STATUS divider#

5.4 Schematic-only items#

There are deliberately no capacitors on this module: there is no IC to decouple, and added gate or PGATE capacitance would slow the turn-off path through R1 — the stop path. Do not add capacitance to the gate net during debugging.

6. Datasheet summary and design interpretation#

Official references: AO3401A datasheet (Alpha & Omega), 2N7002 datasheet (Nexperia), onsemi 2N7002 datasheet (fetch blocked during this review — check before procurement), BZT52C10 product page (Diodes Inc.) (fetch blocked; VZ range corroborated via LCSC listing). Check the latest revision and exact orderable suffix before procurement; the zener and terminal MPNs are explicitly TBD in the schematic.

7. Expected values before bench testing#

Gate drive (Q1 on state, loop closed, EN high):

The 12 V row is the required gate-Vsg check of section 9.D: measure Q1 source-to-gate at VIN = 12 V in the on state and confirm ~6.0 V. The design divides the gate drive (R1/R2) and clamps it (D1) rather than applying full VIN; a reading near 12 V at VIN = 12 V means R2 or the chain is shorted.

STATUS divider (tap = VOUT x R5/(R4+R5), through R6 into a high-impedance FPGA input; R6 drops ~0 V at input leakage):

The tap can never exceed 3.3 V-safe levels with the listed values. Verify the actual host VIH; the 2.0 V figure is a typical LVCMOS33 value, not a measurement.

Other expected values:

8. Manual schematic and assembly review checklist#

• Verify Q1 orientation (SOT-23 pin 1/2/3 = G/S/D per the AO3401A datasheet; source to VIN, drain to VOUT). A swapped S/D assembles mechanically and fails only under test — via the body diode, partially and confusingly.
• Verify Q2 orientation (gate to EN, source to GND, drain to LOOP_B).
• Verify D1 polarity: cathode band to VIN, anode to PGATE. Reversed D1 makes the board permanently off; shorted/leaky D1 in the 12 V case shows up as a wrong Vsg in section 9.D.
• Measure R1, R2, R3, R4, R5, R6 values in-circuit before first power (R1 and R2 read in parallel with the chain; lift one end if ambiguous).
• Confirm which R4 is fitted against the rail you intend to use (100 k only for 24 V; 39 k for 12 V; 10 k for 5 V).
• Confirm the zener MPN actually ordered matches a 10 V nominal part; the schematic MPN is TBD.
• Inspect J2/J3 copper: the layout (when it exists) must give VIN and VOUT wide pours per the actuator-line rule; check for adequate width at 2 A.
• Buzz the PMOD plug pin 1 orientation against the host socket before ever connecting both power and host.
• Confirm no capacitor was added to PGATE or the loop nets during rework.

9. Ordered bench-test procedure#

Stop at the first abnormal result. Record board serial, equipment IDs, ambient, and operator with every capture. Two bench contexts are covered:

• Context A (standalone): a bench 3.3 V supply stands in for the host (EN driven from 3.3 V through a switch or jumper; STATUS read with a DMM), plus a separate current-limited supply on J2 as the motor rail, plus a resistive dummy load on J3.
• Context B (PMOD host): an FPGA board drives EN and reads STATUS. Do Context A first — never debut untested power hardware on the host.

A. Unpowered inspection and resistance tests#

1. Nothing connected. Complete the section 8 checklist under magnification.
2. Loop continuity with an ohmmeter: across J4 with the mushroom button wired, expect < 1 Ω closed; press the button, expect open; release, expect closed again. Repeat several actuations. With a wire link, expect < 1 Ω. An intermittent or high-resistance loop stops the procedure here.
3. Measure VIN-to-GND, VOUT-to-GND, and VIN-to-VOUT resistance in both meter polarities. VIN-to-VOUT should show Q1's body diode in one polarity (VOUT-positive lead forward-biases it) and high resistance in the other; a hard short either way is a failed/reversed Q1 — stop.
4. Measure EN-to-GND: ~10 kΩ (R3). Measure STATUS-to-GND: ~10.1 kΩ (R5 + R6, with R4 to the dead VOUT in parallel paths — expect ~10 kΩ class, not 0, not open).

B. First power, output must stay OFF (Context A)#

1. J2 from a supply set to 12 V, current limit 100 mA. No load, EN source not yet connected (R3 holds EN low), loop closed.
2. Apply power. Expect: VOUT ~0 V (allow a small body-diode/leakage-related reading into a DMM's high impedance — investigate anything above ~1 V), PGATE = VIN, STATUS ~0 V, supply current < 1 mA.
3. Open the loop. Nothing should change. Reclose it.

C. First enable, no load (Context A)#

1. Connect the 3.3 V EN source through a switch. Loop closed. EN low first: VOUT still 0.
2. Drive EN high. Expect VOUT = VIN (no load), PGATE ~6.0 V below... i.e. at ~VIN/2, STATUS per the section 7 table for the fitted R4.
3. Gate Vsg check at 12 V: measure Q1 source-to-gate (VIN minus PGATE, differential) in the on state. Target ~6.0 V (5.88-6.12 V). This confirms the divider is intact and, by implication, that 24 V operation will rely on a working D1 — also verify at 24 V if that rail will ever be used: Vsg must read 9.4-10.6 V there, never ~12 V.
4. Drive EN low. VOUT must return to ~0 V.

D. Truth-table bench matrix (Context A, then repeat key rows in Context B)#

Run every row; record measured VOUT, PGATE, STATUS. Static rows first at 12 V with a light resistive load (~0.1 A); the dynamic rows follow in E.

Row 9 is not a failure: it demonstrates why the no-auto-relatch rule lives in the fabric. In Context B, row 9 with the supervisor FSM loaded must show the host holding EN low until a deliberate toggle.

E. Loop-opened-while-running under load (the test that matters)#

1. Context A, VIN = 12 V, resistive dummy load sized for the rated test current (e.g. ~6.8 Ω / 25 W for ~1.8 A, or 12 Ω for ~1 A — stay at or under the 2 A derating). Supply current limit just above the load current.
2. Enable (loop closed, EN high). Confirm steady VOUT, load current, and measure the VIN-to-VOUT drop (expect <= ~60 mV/A). Let it soak 10 minutes; log Q1 temperature (expect warm, not hot, at <= 2 A).
3. Scope VOUT (and PGATE if a second/differential channel is available), single-shot trigger on falling VOUT. Physically hit the mushroom button. Capture the collapse; note the time from PGATE rising to VOUT below 10% (expect tens of µs for the FET plus the load RC tail).
4. Repeat the kill via EN-low instead of the button; capture again.
5. Repeat step 3 at least five times. The stop must be clean and repeatable every single time. Until these captures exist, do not run a motor behind this board.
6. Only after E passes: repeat rows 1/8 at 5 V and (if used) 24 V, with the correct R4 fitted for each rail, and re-verify Vsg at 24 V is clamped.

F. Host-context run (Context B)#

1. Power the FPGA host first (rail sequencing rule), J2 second.
2. Confirm the host reads STATUS low with VOUT off and high with VOUT on at the fitted divider's rail.
3. Run the truth-table matrix rows 1, 2, 4, 8, 9 from the fabric, with the supervisor FSM latching row 8 and refusing row 9 until an EN toggle.
4. First downstream motor spin, if any, comes only after E and F pass: current-limited rail, hands clear, button within reach, and the operator has personally seen this specific board kill power under load.

10. Troubleshooting map#

11. Bench record template#

12. Review conclusion#

The design is a coherent, minimal discrete AND gate in the power path, and its fail-safe direction is mostly right: every open failure (loop, R1 chain, Q2, EN) turns the output off, R1 and R3 make both control inputs default-off, and the D1 clamp correctly resolves the otherwise zero-margin 12 V-gate condition at VIN = 24 V. The principal open items are entirely unverified first-article behavior (nothing has been built), the TBD zener and terminal MPNs, Q1 thermal reality at the 2 A derating on real copper, the marginal 2.5 V gate drive on 5 V rails, 3.3 V drive of Q2 outside its characterized conditions, the R4-per-rail repopulation rule (the fitted 100 k divider is blind below ~20 V rails), and the measured loop-open turn-off time under load. The single most important test on this board is section 9.E: seeing the button kill power at rated current, on a scope, repeatedly, before any motor sits behind it.

And once more, because it belongs in the conclusion as much as in the preamble: this is NOT a certified safety device. It is a convenience power interrupt for a hobby bench — no redundancy, no monitored contacts, no safety rating, one transistor whose short-circuit failure silently defeats the stop. It must never be the only thing between a person and a hazard. Real machine safety requires certified components and engineered systems built to ISO 13850-style e-stop principles and functional-safety standards that this teaching module does not meet.