Why Field Devices Die: Unstable Site Power

Field devices can repeatedly fail because of low voltage, surges, or a supply that cannot support peak load. The symptoms can resemble firmware faults. Measure voltage and reset reasons before replacing software. Match protection to the event: capacitors, stabilisers, UPS units, and surge protectors serve different purposes and need testing against site conditions.

That claim is easy to test. Ask any team running devices across several sites which failures cluster by location rather than by firmware version. The answer is usually the same handful of sites, and the same handful of hours.

What counts as bad power on a site?

Not a blackout. A blackout is the visible, easy case.

SPLN 1:1995 used a 220 V nominal voltage with +5% to −10% service variation, giving a 198–231 V example range (research citing that standard). This is a historical reference, not proof that every present-day 199 V measurement meets the applicable service terms. Check the nominal voltage, current standard, and measurement point with the electricity provider. For design, demonstrate operation throughout the input range claimed by the equipment manufacturer.

Four different events hide under "bad power", and they need four different answers:

UPS capability depends on topology. Standby models generally pass input power within limits and switch to battery outside them. Line-interactive units can include automatic voltage regulation (AVR), while online double-conversion units regenerate output power. The manufacturer’s guide explains these differences. Check transfer thresholds, transfer time, and AVR range rather than assuming every UPS helps only during a complete outage.

The immunity standard IEC 61000-4-11:2020 describes how equipment is tested against dips — 0%, 40%, 70% and 80% of nominal voltage for defined durations, for anything drawing up to 16 A per phase. Ask for actual test reports, levels, ports, and conditions; a label alone does not establish immunity.

Why the cheap adapter fails first

The 5 V adapter in the enclosure carries a label reading "100–240 V", and that label is doing a lot of work.

A poorly specified supply can droop under peak load, especially near the bottom of its input range. That is not inevitable for a correctly rated supply. Espressif's ESP32 hardware guidelines recommend at least 500 mA supply capability; size the complete board for radio activity, peripherals, and measured peaks rather than an average current alone.

What happens next is the part that costs money. The chip has a brownout detector — a circuit that resets the processor when its own 3.3 V supply sags too far. That protects the processor. It does nothing for the SD card, which may be halfway through programming a block at that instant. A card without power-loss protection can lose an entire erase block that way, including data written months earlier. I wrote about that failure in detail in why SD cards die in edge devices.

And a sagging supply rarely produces one clean reset. It produces a loop: boot, radio transmits, rail collapses, reset, boot again. Ten resets in a minute means ten chances to catch the card mid-write. The log looks like a firmware crash. It is an adapter.

Why lightning changes the rules in Indonesia

Java records lightning densities reaching 16 flashes per square kilometre per year, and Bogor — an hour south of Jakarta — holds a Guinness record with more than 300 thunderstorm days annually. Assess lightning exposure at the actual site; climate labels alone do not establish the required protection.

A direct hit is not required. The usual path is induced: a strike lands a few hundred metres away, and the magnetic field it throws out couples a voltage spike into any long conductor nearby. Long conductors are exactly what these systems are made of. Eighty metres of two-wire cable running to an energy meter. A network cable climbing to a rooftop camera. A 24 V pair crossing a yard to a pump panel. The spike arrives on the data pins, and the port dies while the power supply stays perfectly healthy.

IEC 61000-4-5:2014 is the standard that puts numbers on this. It defines surge test levels of 0.5, 1, 2 and 4 kV using a combination waveform — 1.2/50 µs for voltage, 8/20 µs for current — The applicable level depends on equipment, port, installation, and product standard; do not assume 2 kV applies to every industrial data line. Two questions to a vendor settle a lot: which level did this device pass, and on which ports? Passing on the AC input says nothing about the RS-485 terminals.

Protection is per-port and layered. A surge arrester in the distribution panel handles the mains side. Separate protectors sit on the data lines. All of them divert energy to earth, which means an arrester wired to a poor earth connection is decoration. That is the step that gets skipped, and it is the step that decides whether the rest of it worked.

Does the grid pay when it damages your hardware?

Service-quality compensation and damaged-equipment claims are different questions.

Permen ESDM 2/2025 amended PLN’s service-quality rules and took effect on 21 January 2025. The official text, Article 6A, provides outage-duration compensation of 50–500% of the standing charge or minimum bill according to time above the service limit. The baseline is one hour per month, with possible different limits for geographic or network conditions. Article 6C applies compensation to the following month’s bill or prepaid tokens and excludes special-service customers.

Service-quality compensation is different from reimbursement for damaged equipment. Check the applicable indicators, service limits, and compensation process for your area and account; document incidents when raising them with PLN. Do not assume an account credit will cover a gateway, data port, or technician visit. Protective design remains necessary even where compensation exists.

What belongs in the power path

Work from the cheapest change upward. Choose protection after measuring the fault and assessing the load.

Start with a wide-input industrial supply. A DIN-rail unit rated 85–264 V AC in and 24 V DC out must be checked under full load at the bottom of its specified range. Compare the selected product's documented performance and cost. The 24 V choice matters for the next step.

Size hold-up capacitance against your write window. A capacitor on the DC rail stores energy the device can spend after the mains disappears — enough time to flush buffers and unmount cleanly. The energy a capacitor gives up between two voltages is E = ½C(V₁² − V₂²), and the arithmetic is worth doing once.

Say the device draws 2 W and needs 300 ms to finish writing and unmount. That is 0.6 J. These ideal estimates exclude converter losses, capacitor tolerance, ESR, inrush, and ageing. Provide a power-fail signal early enough for shutdown, prevent backfeeding the failed supply, and test the complete circuit.

• On a 24 V rail, usable down to 18 V: C = 2 × 0.6 / (576 − 324) ≈ 4,800 µF
• On a 12 V rail, usable down to 9 V: C = 2 × 0.6 / (144 − 81) ≈ 19,000 µF

Four times the capacitor for the same job, purely because the rail is lower. And halving the write window to 150 ms drops the 24 V figure to about 2,400 µF. Writing less is cheaper than storing more — which is the same conclusion the SD card arithmetic reaches from the other direction.

Add a voltage stabiliser where the site sits low all day. A buck-boost stabiliser corrects sustained low voltage back toward 220 V. Compare it with a suitable line-interactive UPS with AVR or an online UPS. The choice depends on input range, transfer time, load, and required uptime.

Add battery backup only where the device must stay running, not merely survive. A meter logging every 15 minutes may tolerate downtime; verify that it keeps counting and retains readings during a power loss. A gateway that must keep a door controller answering during an outage does.

Protect the long runs. Data-line protectors on anything leaving the building, a surge arrester in the panel, and an earth connection someone actually measured.

Fit an independent hardware watchdog — a separate timer chip that cuts power and reboots the device if the firmware stops checking in. A device that reboots cleanly at 195 V beats a device that hangs there until someone drives out to it.

One warning on that diagram: a single supply feeding gateway, switch and modem is one component whose failure takes the whole site offline. That is the single point of failure pattern in physical form.

How do you prove it was the power and not the code?

Make the device tell you. Three measurements, all cheap.

Log the reset reason on every boot. On an ESP32, esp_reset_reason() reports whether the last restart came from a brownout, a watchdog, or a clean reboot, and shipping that value with the first telemetry message after boot turns a mystery into a count. One caveat from the field: on some IDF versions the value is misreported — a brownout can surface as a watchdog reset (espressif/esp-idf issue #10834) — so treat the serial console message as the more reliable signal and verify the mapping on your own build before you trust the graph.

Log the incoming voltage. If the site already has an energy meter on Modbus — the serial protocol most electrical meters speak — check whether it exposes voltage registers and at what update rate. Poll it and store it beside the device's own health data. The smart breaker register work covers how to get at those values when the vendor documentation is thin.

Line up the timestamps. Reset events only correlate with grid events if both clocks agree, and field clocks drift badly enough to break exactly this kind of investigation. That is a prerequisite, not a detail, and I covered it in when timestamps stop being evidence.

These patterns suggest what to investigate:

• Every site resets within the same few minutes. Investigate a shared upstream event alongside common software and network dependencies.
• One site resets and the others do not. Investigate site wiring, earthing, supply, and site-specific equipment or software differences.
• Failures cluster in the wet months. Investigate surge exposure, moisture, and other seasonal faults. Check the arresters and the earth before replacing devices.
• Resets cluster within seconds of every uplink. Investigate supply peak-current capability alongside radio, network, and firmware activity.

What to ask before you buy

Five questions, answered before the purchase order rather than after the second site visit:

1. What is the specified input voltage range of the power supply, and what is its output at the low end under full load?
2. Which IEC 61000-4-5 surge level did the device pass, and on which ports?
3. How long does the device need to shut down cleanly, and what keeps it powered for that long?
4. Does the device report its own reset cause in telemetry?
5. If this supply fails, what else at the site goes dark with it?

None of that is exotic engineering. It is arithmetic done at design time instead of a technician's travel budget spent later. The sites that stop generating callouts are rarely the ones with better devices. They are the ones where somebody checked what the device was actually being fed.