⏱️ Sequencing & Inrush

A rail is not a fact, it is an event: it arrives at some moment, ramps at some speed, and stands in some relationship to every other rail on the board. Two questions decide whether that event is benign or fatal. In what order do the rails come up, and how fast does the first one charge the bulk capacitance behind it. This lesson is the power-side companion to the bring-up order you learned in Module 1. There the rule was “power before logic.” Here we zoom into the word “power” and find it has an internal grammar of its own.

By the end, you can

1. Explain why some SoCs and FPGAs require a power sequence and how out-of-order rails trigger latch-up
2. Choose between a sequencer IC, an RC enable delay, and an enable chain to enforce rail order
3. Calculate the peak inrush current a bulk capacitor draws and the energy a series limiter must absorb
4. Select an inrush limiter (NTC thermistor, soft-start FET, or controlled enable ramp) for a given rail
5. Specify a UVLO/brownout threshold so a sagging input fails gracefully instead of half-booting

Intuition first

Picture filling a row of water tanks from one pump, where the tanks are connected by delicate pipes rated for a maximum pressure difference. If you blast every tank at once they equalize fine. But if one tank fills to the brim while its neighbor is still empty, the pressure across the pipe between them spikes past its rating and the pipe bursts. The chip’s internal rails are exactly those linked tanks: the core and the I/O share silicon, and the diodes and wells between them can only tolerate so much voltage difference. Bring them up in the wrong order and you exceed that difference. That is what an SoC means when its datasheet says “the core rail must reach regulation before the I/O rail.” The order is not a preference. It is a structural limit on how far apart two voltages on the same die are allowed to drift.

Now the second idea, inrush. An empty capacitor is not a gentle load. To the supply in the instant of switch-on it looks like a dead short, because the voltage across an uncharged capacitor is zero and current is whatever the wiring will allow. The supply does not see “a 330 microfarad capacitor,” it sees a piece of wire to ground, and it shoves current in accordingly. Only as the cap charges does the voltage across it climb and the current fall back to something civilized. The whole drama is over in milliseconds, but in those milliseconds the peak current can dwarf the steady-state draw many times over.

Sequencing: the order rails wake up

Some parts genuinely do not care what order their rails arrive. A 3.3 V sensor and a 1.8 V logic block with no shared wells will boot whichever way the rails ramp. But modern SoCs, FPGAs, and many motor-driver and converter chips publish a sequencing requirement, and they mean it. The two common shapes are core before I/O (the internal logic rail must regulate first, then the pad ring powers up) and the reverse, I/O before core. Some parts want both rails within a fixed time window of each other. The datasheet’s “Power Supply Sequencing” section is not boilerplate. It is the boundary of the safe operating area in the time domain.

Violate it and you risk latch-up. Every CMOS chip hides a parasitic pair of bipolar transistors, an inherent PNPN structure formed by the n-wells and p-substrate that make up the transistors. In normal operation those parasitics are reverse biased and invisible. But if a pin is driven above its rail (which is exactly what happens when the I/O rail is live while the core rail is still near ground, so an injected current finds a forward-biased junction), the parasitic pair can turn on, latch each other on, and behave as a self-firing thyristor. Once latched it is a low-impedance short from the supply straight to ground that persists until you remove power, and it draws enough current to destroy the chip by self-heating if your supply is stiff enough to feed it. The board did nothing wrong electrically except wake its rails up in the wrong order.

You enforce order with one of three tools, in rising cost and rising precision:

• An RC enable delay. The cheapest trick. The downstream regulator’s EN pin is held by a resistor-capacitor network tied to the upstream rail’s output, so it cannot turn on until the upstream rail has been up for one RC time constant. A few cents of parts buys you a fixed, monotonic “B comes up roughly $RC$ after A.” Crude, but for a two-rail board with a comfortable timing window it is often enough.
• An enable chain (daisy-chain). Each regulator’s Power Good output drives the next regulator’s EN input. Rail A reaches regulation, asserts PG, which enables rail B, whose PG enables rail C. The order is guaranteed by causality, not by a timer, and the chain reverses cleanly on shutdown if you wire it to.
• A dedicated sequencer IC. A purpose-built part that watches several rails and drives several enables against a programmed schedule, with margining, fault detection, and a defined power-down order. This is what you reach for when a part demands a tight inter-rail window or you have five rails that must come up in a specific staircase. It costs more and takes board space, but it turns sequencing from a hope into a guarantee.

Inrush: taming the first gulp

When the rail switches on, the bulk and decoupling capacitance downstream is empty, and as we said it looks momentarily like a short. The peak current is set by the voltage divided by the total series resistance in the charging path, and that resistance is usually tiny. The consequences ripple outward. The supply or upstream FET sees a current spike that can trip its own protection or sag the whole rail. The inrush can chatter a relay or arc a connector as you plug it in. On a shared rail, one board’s inrush browns out its neighbors. And the FET or switch that carries the surge dissipates a real slug of energy in that instant, enough to damage it if you have not accounted for it.

There are three standard ways to put a temporary resistance in the charging path and then remove it:

• An NTC thermistor in series. A negative-temperature-coefficient thermistor is cold and therefore high resistance at the instant of switch-on, so it throttles the inrush. As current flows it self-heats, its resistance collapses, and within a fraction of a second it is nearly a piece of wire with a small voltage drop. Cheap and effective in switching supplies, motor drives, and audio gear. The catch is in the grounding extract below: it only works cold. Switch off and back on quickly and the still-hot thermistor has not recovered its resistance, so it lets the full inrush through. It is also not short-circuit-proof.
• A soft-start (inrush) FET. A series MOSFET whose gate is ramped on slowly, usually by a resistor and capacitor on the gate, so the FET acts as a controlled variable resistor that eases the rail up over a few milliseconds. This is the modern default on anything that matters: it has no warm-up dependency, recovers instantly, and the same FET often doubles as the enable switch and the reverse-polarity guard. Its constraint is thermal. During the ramp the FET is dropping voltage while passing current, so it must absorb the charging energy without exceeding its safe operating area.
• A controlled enable ramp (soft-start in the regulator). Many regulators have a soft-start pin or a programmable output slew rate. Instead of limiting current at the input you simply bring the output up gradually, so the downstream caps charge at a rate you choose. A higher-voltage version of the same idea is a pre-charge circuit, which charges the bulk capacitance through a current-limited path and only closes the main contactor once the cap is at roughly 90 percent of full charge.

UVLO and brownout: failing on purpose

Sequencing and inrush both assume the input voltage is healthy. But supplies sag, batteries droop, and brownouts happen. The worst outcome is not a clean shutdown, it is a half-boot: the input is high enough to power some rails but not all, or high enough for the SoC to start executing but too low for it to run correctly, so it writes garbage to flash, latches a peripheral in an undefined state, or holds a motor output half-on. The cure is to make the system refuse to operate in the ambiguous band.

That is what UVLO (under-voltage lockout) and a brownout detector do. UVLO sits on the input or a rail and holds the downstream regulators disabled until the voltage is comfortably above the minimum, and it disables them again if the voltage falls back through a lower threshold. The gap between the rising and falling thresholds is deliberate hysteresis, so a noisy supply hovering near the edge does not chatter the system on and off. A brownout detector on the MCU does the same job for the digital core: below its threshold it holds the chip in reset rather than let it run code on a starving rail. Wire these in and a dying supply produces a clean, defined “off,” not a board stuck in a corrupting twilight.

See it: a power-up timeline

No widget here, just the picture in your head made explicit. Read this left to right as time, with each rail’s arrival and the inrush spike marked.

  V                         core PG ── enables ──▶ I/O
  ▲        ┌───────────────────────────────────── I/O rail (3.3V)
  │   core │   ┌───────────────────────────────── core rail (1.0V)
  │   first│   │
  │  ──────┘   │   ← UVLO clears here, supply healthy
  │            │
  │   ╱╲       │        inrush spike on the INPUT rail
  I  ╱  ╲______│___________________________________ steady-state idle
  ▲ ╱    (NTC warms / soft-start FET ramps)
  └────────────────────────────────────────────────▶ t
   t0                                              (ms scale)

The input rail clears UVLO first. Its bulk caps charge through the limiter, which gives the brief current hump and then settles to idle. Only once that input is healthy does the core regulator enable, reach regulation, and assert Power Good, which is the signal that finally lets the I/O rail come up. Order on top, inrush on the bottom, both designed rather than hoped for. If the input sags back below the lower UVLO threshold at any point, every enable drops and the staircase unwinds in reverse.

?A motor-driver SoC's datasheet says the 1.0 V core rail must reach regulation before the 3.3 V I/O rail is allowed to power up. The board brings both up from a single switch with no sequencing. What is the specific failure you are risking?

• A Excess inrush current as both rails' bulk caps charge at once
• B Latch-up: the I/O may be live while the core is near ground, firing the chip's parasitic PNPN structure into a self-held short
• C Slow boot, because the rails settle at different speeds
• D Increased ripple on the 3.3 V rail from the unsequenced turn-on

?You add an NTC thermistor in series with the input to limit inrush. During testing, a brief power glitch switches the board off and immediately back on, and you measure a large inrush spike anyway. Why did the thermistor not limit it the second time?

• A NTC thermistors only limit inrush on DC rails, not after a glitch
• B The thermistor was still hot from the first power-on, so its resistance was low and it could not throttle the second inrush until it cooled
• C The glitch reverse-biased the thermistor, bypassing it
• D The bulk capacitors were already charged, so the spike came from the SoC core

Lab: scope the turn-on edge

You cannot debug what you cannot see, and the whole sequencing-and-inrush story lives in the first few milliseconds after switch-on, far too fast for a multimeter. Put a scope on it. Set the scope to single-shot trigger on the rising edge of the input rail, and capture two traces at once: the input voltage and the current into the board (a current probe, or the voltage across a small series sense resistor). On the first power-up you want to see the input ramp cleanly, a bounded inrush hump that decays to the board’s idle current, and then each downstream rail coming up in the documented order with Power Good asserting between them. Then deliberately abuse it: brown the input down slowly with a bench supply and confirm UVLO drops everything cleanly at the threshold instead of leaving a half-lit board. Toggle power off and on quickly and watch whether your inrush limiter still limits. Anything you cannot explain on the scope is a fault waiting to ship.

↘ The RC charging law, the joule a limiter eats, and why over-current protection hates inrush

The peak inrush is pure RC physics. Connect a discharged capacitor $C$ to a source $V$ through a total series resistance $R$ (trace, switch, ESR), and the current is

$$i(t) = \frac{V}{R}\, e^{-t/RC}, \qquad I_\text{peak} = i(0) = \frac{V}{R}.$$

The capacitor reaches full charge in about $5RC$. The peak is set entirely by $R$, so when $R$ is a few milliohms the peak is brutal: a 12 V rail through $5\ \text{m}\Omega$ peaks at $12/0.005 = 2400\ \text{A}$ in the idealized first instant, clamped in practice by the supply’s own current limit and lead inductance, but still far above the steady draw. The job of an NTC or a soft-start FET is to make $R$ large for the first few milliseconds, dropping $I_\text{peak}$ to something the supply and switch can survive.

Energy is the other half of the story. The charge delivered to the cap is $Q = CV$ and the energy stored in it is

$$E_C = \tfrac{1}{2} C V^2 .$$

Crucially, charging a capacitor through a resistance dissipates an equal amount, $\tfrac{1}{2}CV^2$, in that resistance, independent of the resistance value. So a soft-start FET ramping a $330\ \mu\text{F}$ bank to $12\ \text{V}$ must absorb about $\tfrac{1}{2}(330\times10^{-6})(12)^2 \approx 24\ \text{mJ}$ as heat in its channel, every single power-up, regardless of how slowly you ramp. The ramp time does not change the joules; it changes the power ($E/t$) and therefore the peak die temperature. That is why a soft-start FET is sized by its safe-operating-area curve, not just its steady current rating.

This is also why over-current protection and inrush are natural enemies. As the grounding source notes, a fuse or breaker must react fast to a genuine short but must not trip on the usually-harmless inrush surge, which can briefly exceed the steady-state current by a large multiple. Transformers make this worse: energizing one can draw 10 to 15 times rated current for several cycles, and a toroidal transformer up to 60 times, because at switch-on near a voltage zero-crossing the core can saturate and its inductance collapses to almost nothing. Motors do the same, drawing locked-rotor (stall) current until the rotor spins up enough back-EMF to oppose the supply. The protection engineer’s whole problem is telling these benign first gulps apart from a real fault, which is exactly why purpose-built inrush limiters exist: tame the surge at the source and the protection device can be set tight without nuisance trips.

One note where the lesson and the source diverge. The grounding article frames inrush mostly around AC mains, transformers, and incandescent lamps. Our board-level world is DC rails feeding capacitor banks behind regulators, so the dominant mechanism for us is capacitor charging, not transformer core saturation or filament cold-resistance. The underlying physics (an empty cap is a momentary short, peak set by $V/R$) is identical and faithful to the source; only the usual cause on a low-power DC board differs.

Grounded in Wikipedia: “Inrush current” (CC BY-SA).

Key takeaways

• ▸A rail is an event: it has an order and a slew rate, and a board's survival depends on both, before any code runs.
• ▸Out-of-order rails on an SoC or FPGA can trigger latch-up, a parasitic PNPN thyristor firing into a self-held short that persists until power is removed.
• ▸Enforce order with an RC enable delay (cheap), an enable chain via Power Good (causal), or a sequencer IC (precise); remember power-down has an order too.
• ▸An empty capacitor looks like a short at switch-on; peak inrush is $V/R$, and a limiter (NTC, soft-start FET, controlled ramp) inserts temporary resistance then gets out of the way.
• ▸An NTC only limits while cold: a fast off/on catches it hot and lets full inrush through.
• ▸UVLO and brownout with hysteresis make a sagging supply fail into a clean, defined off instead of a corrupting half-boot.

Practice 1 warm-up

A 5 V rail switches onto a discharged $470\ \mu\text{F}$ bulk capacitor through a total series resistance (trace plus switch plus ESR) of $0.1\ \Omega$. Estimate the peak inrush current and the time for the capacitor to reach roughly full charge.

↘ Show worked solution

Peak inrush is at $t = 0$, where the current is simply the source voltage over the series resistance:

$$I_\text{peak} = \frac{V}{R} = \frac{5\ \text{V}}{0.1\ \Omega} = 50\ \text{A}.$$

The capacitor charges with time constant $RC = (0.1\ \Omega)(470\times10^{-6}\ \text{F}) = 47\ \mu\text{s}$, and reaches roughly full charge in about $5RC \approx 235\ \mu\text{s}$. So a healthy idle draw of a few tens of milliamps is preceded by a 50 A spike lasting a couple hundred microseconds. That spike is exactly what a limiter or a current-limited supply has to blunt.

Practice 2 core

Your board runs from a 5 V input and must not “half-boot.” You add a UVLO that enables the regulators when the input rises through 4.6 V and disables them when it falls back through 4.3 V. (a) What is this 0.3 V gap called and why is it deliberate? (b) The input briefly sags to 4.4 V under a motor stall, then recovers. Does the board reset?

↘ Show worked solution

(a) The 0.3 V gap is hysteresis: the turn-on threshold (4.6 V) is set higher than the turn-off threshold (4.3 V) on purpose. Without it, an input hovering right at a single threshold would chatter the regulators on and off as noise crossed the line repeatedly. The gap forces a clean, decisive transition in each direction.

(b) No. The sag to 4.4 V is above the 4.3 V falling threshold, so UVLO stays enabled and the board keeps running through the dip. UVLO would only drop the rails if the input fell below 4.3 V. This is the point of hysteresis: a transient that stays inside the band is ridden out, and only a genuine collapse past the lower threshold triggers the clean shutdown. (If you wanted to ride out the motor stall with margin to spare, you would also size the input bulk capacitance to hold the rail up during the current spike.)

Practice 3 stretch

A soft-start FET ramps a $1000\ \mu\text{F}$ bulk bank from 0 to 12 V at power-on. (a) How much energy must the FET dissipate during the ramp, and does ramping more slowly reduce it? (b) If you stretch the ramp from 2 ms to 8 ms, what changes, and why is that the lever you actually want?

↘ Show worked solution

(a) Charging a capacitor through any series element dissipates an energy equal to the energy that ends up stored in the cap, independent of the resistance or ramp shape:

$$E_\text{FET} = \tfrac{1}{2} C V^2 = \tfrac{1}{2}(1000\times10^{-6}\ \text{F})(12\ \text{V})^2 = \tfrac{1}{2}(0.001)(144) = 72\ \text{mJ}.$$

Ramping more slowly does not reduce this 72 mJ. The joules are fixed by $C$ and $V$. (This assumes the FET carries the charging current; the same total energy is what the channel turns into heat.)

(b) Stretching the ramp from 2 ms to 8 ms cuts the average power the FET dissipates by a factor of four, from roughly $72\ \text{mJ}/2\ \text{ms} = 36\ \text{W}$ to $72\ \text{mJ}/8\ \text{ms} = 9\ \text{W}$ (order-of-magnitude figures; the instantaneous profile is not flat). Same energy, spread over four times the duration, means a much lower peak die temperature. Temperature, not energy, is what destroys the FET, so the ramp time is the real design lever: you slow the ramp until the predicted SOA temperature rise has margin, accepting the longer turn-on as the price of keeping the silicon alive.