A six-axis cobot joint module in this build is a sealed aluminium housing holding a 48 V bus, a three-phase inverter, a 20-bit absolute encoder and one microcontroller running field-oriented control at 16 kHz. It works two shifts a day beside a press. When the operator hits the E-stop during a fast traverse, the robot stops, the contactors open, and the controller loses its 3.3 V rail for about a second while the bus capacitors drain.
The unit is supposed to come back knowing exactly where it is. About one in twenty does not. The drive reports a position fault, the arm performs a slow re-home that costs the cell roughly 12 s, and in a smaller share of units the encoder offset returns wrong by a few counts and stays wrong until someone power-cycles the cabinet. No connector is loose. The reset is real, and its causes sit in two places in the datasheet: the reset thresholds, and the rule that guards the battery-backed registers.
The part in the socket is an Artery AT32F423TBU7, a Cortex-M4F at 150 MHz with 128 KB of flash and 48 KB of SRAM in a QFN36 body 6 mm on a side. It is supplied from 2.4 V to 3.6 V and rated from -40 °C to +105 °C (p. 11). It is the right class of part for a joint this size. What failed is an assumption in firmware and in the power tree about when the part may trust its own registers.
What the failure looks like in the field
The pattern is narrow enough to look like a software bug at first. It happens only after an E-stop taken under load, never after a clean stop, and it shows up more often on the cold start at six in the morning than on the afternoon shift. It never reproduces on the bench, where a lab supply ramps in microseconds and never sees the load step.
The controller keeps a ring of position records in the battery-backed registers and a longer log in flash. On a good unit the last record before the reset lands within a few milliseconds of the contactor opening, and the next boot reads it back with a valid checksum. On a failing unit the flash log still shows a record written about 40 ms before the reset, but the register block comes back as zeros, so the drive has to assume the worst.
The reset cause register settles the argument. It reports a low-voltage reset, not a watchdog reset and not a pin reset. That single bit moves the investigation off the firmware maths and off the encoder cable, because the part decided on its own that the rail had collapsed.
Two details make the fault intermittent rather than universal. The first is where the rail actually dips. The 3.3 V stage is a 48 V buck with a soft-start and a 470 µF output bank feeding the MCU, the encoder interface and the driver logic. When the inverter stops and the bus collapses, the buck's input falls out of regulation while the output bank is still discharging, so the local rail dips and recovers instead of dying cleanly. The second is temperature: cold electrolyte and a cold oscillator shift the timing of that dip, which is why January is worse than July.
Why it happens at the silicon level
The datasheet guarantees operation from 2.4 V. The low-voltage reset trips between 1.68 V and 2.08 V, with 1.9 V typical, and the power-on reset sits between 1.81 V and 2.4 V (p. 37). Between those two bands there is a window where the rail is below the guaranteed supply but above the reset threshold. In that window nothing has tripped, the core is still clocking, and the part is simply outside its specified operating conditions. A dip that recovers inside it is not a protected state; it is an undefined one.
The second cause is the access rule for the battery domain. Twenty 32-bit registers holding eighty bytes keep their contents through a system reset, a power reset and a wake from standby (p. 20). That is exactly where a joint zero belongs. The same page attaches a condition: if the supply rises slower than 1.3 ms/V, code must wait 60 ms and confirm that VDD is above 2.57 V before it touches the ERTC, LEXT, LICK or BPR registers (p. 20, p. 37). A buck with a soft-start and a large output capacitor is precisely a slow ramp, so the rule applies here by construction rather than by accident.
Nothing warned the controller that the rail was going. The voltage monitor that could have done it stays off until firmware enables it, and this firmware never did. Once enabled it compares VDD against one of seven thresholds and raises an interrupt on the way down and on the way up (p. 38).
| Evidence from the field | Datasheet number | Source |
|---|---|---|
| Core kept clocking below the guaranteed supply | VDD 2.4 V to 3.6 V; low-voltage reset at 1.68 V to 2.08 V | p. 37 |
| Reset window long enough to lose the write | 3.5 ms from VDD passing the power-on threshold before the CPU starts | p. 37 |
| Where the joint zero should live | Twenty 32-bit battery-backed registers, not cleared by a system or power reset | p. 20 |
| Zero read back as garbage on a slow ramp | Ramp slower than 1.3 ms/V requires a 60 ms wait and VDD above 2.57 V before register access | p. 20, p. 37 |
| No early warning configured | Seven monitor thresholds; threshold 4 at 2.47 V to 2.69 V rising, 2.37 V to 2.59 V falling; 30 µA maximum | p. 38 |
| Flash write does not fit the window | One kilobyte sector erase takes 6.6 ms typical and 8 ms maximum; 42 µs maximum per word program | p. 39 |
| Endurance if the log lives in flash | 100 k write cycles; retention ten years at 105 °C | p. 39 |
| Die heat in a sealed housing | 350 mW at 105 °C ambient, 57 °C/W junction to ambient on the QFN36 body | p. 37, p. 86 |
The table says something a schematic review will not: the two failures are independent. Firmware that gates the register access correctly still loses the zero if the rail dips into the undefined band and the flash log is the only copy. Firmware that logs to flash correctly still loses the offset if it reads the battery registers too early after a slow ramp.
The numbers that fix it
Enable the monitor at threshold 4 and treat it as a one-shot. Threshold 4 sits at 2.47 V to 2.69 V rising and 2.37 V to 2.59 V falling, above the reset band and above the 2.4 V floor (p. 37, p. 38). Hysteresis is up to 100 mV, so the interrupt re-enters while the rail wobbles; mask it after the first hit. It costs 30 µA maximum.
Gate every battery-register access behind the ramp rule. After reset, wait 60 ms and check VDD above 2.57 V before reading that block (p. 20). At full clock the wait is about nine million cycles, invisible next to a 12 s re-home, but it has to be a state rather than a delay loop so the watchdog keeps being fed.
Store the zero, the multi-turn count, the encoder offset and a checksum in five of the twenty registers. Do not write flash inside the E-stop path: a one kilobyte sector erase takes 6.6 ms typical and 8 ms maximum, and the rail is gone well inside that (p. 39). Rebuild the flash record on the next boot instead. A checksum on every read is mandatory, because a stale but consistent word is worse than a blank one.
Keep the inverter off until the part is out of reset. The CPU starts 3.5 ms after VDD passes the power-on threshold (p. 37), and on this board the driver's ready line releases sooner. A hardware AND of the two signals is what actually keeps a PWM edge off the bridge.
Hold the rail above 2.4 V through the load step. The floor is a specification, not a suggestion (p. 37). If a 15 A step pulls the local rail under it for a few hundred microseconds, no firmware ordering saves the transaction, and the fix belongs in bulk capacitance or in the brake chopper's sequencing.
Budget the clock at its worst case. The internal 48 MHz oscillator is specified at ±2.5 % over -40 °C to +105 °C, and automatic calibration tightens that to ±0.25 % (p. 51). A 16 kHz loop designed at nominal period runs out of sample window at the cold end.
Respect the thermal number in a sealed housing. The QFN36 body is rated 350 mW at 105 °C ambient with 57 °C/W junction to ambient (p. 37, p. 86). At rated dissipation the die is already at 125 °C, so a housing that adds 20 °C of internal rise has no margin left.
Verification you can run before the next build
- Load-step the 3.3 V rail at the MCU pins with the inverter's real profile, probing VDD and VSS at the package. The pass criterion is 2.4 V minimum through the dip (p. 37).
- Force a slow ramp, 10 ms/V into the buck, and read the battery registers before and after the 60 ms gate. The wrong order must reproduce the zeroed block, or the test proves nothing.
- Sweep the supply down at 50 mV/ms and record both monitor edges. Expect the falling trip inside 2.37 V to 2.59 V, and treat chatter as a masking bug (p. 38).
- Census the reset cause over 200 E-stops. Any low-voltage count above zero means the rail is marginal, whatever the pass and fail log says.
- Soak at -40 °C for two hours, then run 50 stop and restart cycles. The oscillator's ±2.5 % worst case and the cold dip arrive together.
- Write the block with a checksum, then cut power at random phases ten thousand times and count mismatches. Silent corruption is a driver bug, not a memory limit.
- Treat the ESD figures as handling data, not field data: 4000 V human body model, 1000 V charged device model, 200 mA latch-up at 105 °C (p. 36). An encoder cable that leaves the housing needs its own protection.
Frequently asked questions
Does fixing this need a board respin?
No. The change is firmware plus one hardware AND gate on the driver's ready line. Parts in the family that share a package are pin-compatible (p. 11), so a later density change needs no new layout.
Which other parts fail in the same way?
Any controller whose reset threshold sits below its guaranteed minimum supply, and any design that keeps position only in flash written during the stop. The mechanism is the gap between two numbers, not the vendor.
How fast can I check a suspect unit?
One afternoon. Scope the rail during a loaded E-stop, then read the reset cause and the battery registers on the next boot. If the register block is blank while the flash log holds a record, the access rule is being violated.
What does it cost compared with an external supervisor?
The monitor is already inside the part, so the comparison is a comparator, its reference and its quiescent current against 30 µA and two register writes (p. 38). Send us the suffix you intend to freeze and we will quote the version with the supervisor removed.
Sourcing note
The AT32F423TBU7 is Artery silicon in a QFN36 body, and the part number carries the density in the B and the grade in the 7 (p. 87). The same core and peripheral set exists as an automotive branch: the AT32A423CBT7 carries 128 KB in an LQFP48 body, the AT32A423CBU7 keeps 128 KB in a QFN48 body, the AT32A423C8T7 steps down to 64 KB, the AT32A423CCU7 steps up to 256 KB, and the AT32A423RBT7 moves to the 64-pin LQFP64 outline. That branch carries an AEC Q-100 certificate, which matters if the joint module ships to an automotive customer and needs a PPAP file rather than a datasheet.
Tell us the annual quantity, the packing you want and whether you need the automotive branch, and we will quote the tape and reel suffix, the sLib configuration and long-term availability for the code you release.