The prototype works. An ESP32 on a breadboard reads the sensor, drives the relay, and puts the numbers on a dashboard, and it has done so on the bench for a week. The distance from there to a product that can be built fifty times, installed by someone else, and left in a cabinet in Faisalabad for five years is not a matter of tidying up. A product has to answer questions the prototype was never asked, about power, about the field, about the factory, about the law, and the list of those questions is what this guide is.
What the dev board hid from you
A development board is designed to make the first week easy, and it does that by making a set of decisions for you that a product has to make again.
- Power from USB. A laptop's 5 V is clean, current-limited and free of the transients a 24 V industrial supply carries; the board's regulator is chosen for the bench, and the 1117-type part on many of them draws 5 mA doing nothing, which is a year of battery life gone.
- The bootloader, the debug LED and the serial bridge. Convenient on the bench, each a cost in the product: a bridge chip that stays powered, an LED that is on all day, a boot mode that a stray signal on a strapping pin can enter.
- Naked pins. The 3.3 V I/O pins connect straight to the microcontroller. A 24 V wire touched to one, a static discharge from a hand on a dry day, or the inductive kick of a relay coil ends the microcontroller. Every pin that leaves the enclosure needs protection the dev board does not have.
- The module's antenna and its certification. A radio module with a printed antenna was certified in a particular position on a particular board; put it near a ground plane, a battery or a metal enclosure and the range and the certification both change.
- The 25 °C bench. The prototype has never been at 55 °C with the lid on, at 0 °C with condensation, or on a supply that browns out twenty times a day when the grid does.
None of this is a criticism of the dev board; it did its job, which was to prove that the idea works. The product is where each of those decisions is made deliberately.
Power: the first thing to redesign
The power input is where the field meets the board, and it is redesigned first because everything else depends on it. Decide the input range and make it wide: a product on "24 V DC" will see 18 to 30 V from a healthy supply and less during a brown-out, and industrial convention is to accept 9–36 V or at least 18–36 V. Protect against reverse polarity, with a series diode on small currents or a P-channel MOSFET where the drop matters, because someone will wire it backwards. Put a transient suppressor across the input, sized above the maximum working voltage and below what the regulator survives, because a 24 V rail shared with contactors and solenoids carries kilovolt spikes; a fuse in front of it turns a short into a replaceable part rather than a burnt trace. Behind that, a converter chosen for the product: a wide-input buck for a mains-powered device, a low-quiescent regulator for a battery one, with its efficiency read at the current the device actually draws.
Brown-out deserves its own decision. A microcontroller whose supply sags below its threshold and recovers may restart cleanly, may run with corrupted RAM, or may hang; a supervisor or the internal brown-out detector, set above the level at which the flash and the peripherals misbehave, and enough bulk capacitance to ride through the gaps the grid leaves, make it the first of those. For a battery-powered product the whole budget, sleep current, bursts, chemistry and the regulator that suits them, is its own subject, covered in power budgeting for battery devices.
Inputs and outputs that survive the field
Everything that crosses the enclosure wall is a path for energy the board did not ask for, and the standards describe the energy. IEC 61000-4-2 is electrostatic discharge: ±4 kV by contact and ±8 kV through the air is the industrial immunity level, and a dry winter day in Quetta delivers it from a fingertip. IEC 61000-4-4 is the fast transient burst from contactors and relays switching on the same cabinet's wiring; IEC 61000-4-5 is the surge from lightning and switching on longer lines, typically ±1 kV to ±2 kV on power ports and ±0.5 kV to ±1 kV on DC and signal ports. A board built on a dev board's naked pins fails the first of these on a bench with a rubbed balloon.
The protection is not exotic. A series resistor of a few hundred ohms to a few kilohms and a small TVS or clamp diode on every digital input; a TVS on every line that leaves the box; an RC filter that removes what the firmware does not need to see. Where the far end is another supply or a long cable, isolation: an optocoupler or a digital isolator on inputs, a relay or an isolated driver on outputs, so that a fault on the plant side stays on the plant side. Outputs that switch inductive loads need the flyback diode on a relay coil, a snubber or a TVS on a solenoid, and a MOSFET rated for the transient rather than the steady state. Analogue signals get the industrial standards done properly: a 4–20 mA input with its sense resistor, protection and a wide compliance voltage, as set out in how current loops work; an RS-485 port with its termination, its bias resistors, a transceiver rated for the surge and, on a long line between buildings, isolation.
The board itself
The first question is whether to put the microcontroller on your own board or to solder a certified module to it. The module is faster, carries its own radio certification, and costs more per unit and more in board area; the bare chip is cheaper in quantity and gives you the layout, at the price of designing the RF section and certifying the radio yourself. For a few hundred units a year of an industrial product, the module usually wins; for consumer volumes, the chip. Either way the board is yours, and a set of things belong on it that the dev board did not need: test points on every rail and every bus for the production jig; a programming and debug header that the jig can reach; a board identifier and a revision in the copper and, if there is room, in an EEPROM the firmware can read; fiducials for the pick-and-place machine; a panel layout with breakaway tabs or V-scores so the assembler can build ten at once. Power traces are sized for the current with the trace width guide, and the parts that make heat get the copper and the airflow that keeping power semiconductors cool works out, at the temperature of the cabinet rather than the bench.
Then the supply chain, which in Pakistan is a design input. The electronics markets on Hall Road in Lahore and around Saddar in Karachi stock through-hole parts, common connectors, relays, modules and a limited range of surface-mount passives; a specific surface-mount IC, a particular MOSFET or a fine-pitch connector comes from an international distributor with lead time and customs in front of it. So the bill of materials lists a manufacturer part number and an approved alternative for every part that has one, prefers packages and values that are stocked, avoids single-source parts where the design allows, and is checked for availability before the board is laid out rather than after. A product whose one critical part goes on a six-month allocation is a product that cannot be built.
Enclosure, connectors and the environment
The enclosure is a specification before it is a box. Ingress protection: IP20 for something inside a cabinet, IP54 or IP65 for a wall in a workshop, IP66 or better for anything outdoors, and every cable entry through a gland or a sealed connector rated the same, because the box is only as sealed as its worst hole. Temperature: the standard for programmable controllers, IEC 61131-2, asks for 5–55 °C for equipment in a cabinet, and 0–55 °C is the least a Pakistani industrial product should be designed and tested for, with 60–70 °C for a sealed box in the sun. Condensation, when a cold night follows a humid day, deposits water on the board; a conformal coating, a breather vent, or a small heater deals with it, and none of them is on the dev board. Dust in a textile mill or a flour mill, and the fine, corrosive dust of a cement plant, get through anything that is not sealed and settle on anything that is warm.
Connectors are chosen for the installer, not the designer. Pluggable screw or spring terminals that take a 1.5 mm² wire with a ferrule, in a pitch a technician can work with in a cabinet, replace the pin headers and Dupont jumpers of the prototype; the connector's current rating, its wire range and its vibration behaviour are checked. Mounting is a decision too: a 35 mm DIN rail clip for a cabinet, four screw bosses for a wall box, and in either case a layout that lets the wiring be done with the board in place. The PLC, microcontroller or industrial PC guide covers where a custom board like this belongs in an installation and where a bought controller is the better answer.
Firmware for a product, not a demo
The demo firmware does the task. The product firmware does the task and survives everything around it, and the list of what it must survive is long and specific.
- A watchdog, independent of the main clock, that resets a hung device; and code structured so that the reset is safe, the reason is recorded, and the count of resets in the field is reported.
- Brown-out handling. Outputs go to a defined safe state on reset and on power loss, before anything else runs; a relay that closes for a moment while the microcontroller boots is a hazard.
- A field update path: a bootloader that can take a new image over the interface the product has, serial, USB, Ethernet or the radio, verify it before it runs it, and fall back to the previous image if the new one does not start. Without this every bug is a site visit.
- Versioning and logging. The firmware knows its own version and the hardware revision it is running on and reports both; a ring buffer of events with timestamps survives a reset and can be read out on site.
- Configuration storage in EEPROM or a flash sector, with a checksum, defaults for a blank device, and a way to change it in the field without a laptop and a compiler.
- Time-outs on every wait, a sensor that returns nonsense treated as a fault rather than a value, and a communications link that is assumed to drop.
- Provisioning at production: the serial number, the radio keys, the calibration constants and the initial configuration are written by the test jig, not typed in.
Testing and certification
A product is tested by someone other than its designer, against a written standard, and the results are kept. For electromagnetic compatibility an industrial product is tested for emissions to CISPR 11 or CISPR 32 through IEC 61000-6-4, and for immunity to IEC 61000-6-2, which calls up the ESD, burst and surge tests above along with radiated and conducted immunity. A pre-compliance scan on a spectrum analyser with a near-field probe, done early on the engineering prototype, finds the switching converter that radiates and the cable that acts as an antenna while they are still cheap to fix; the accredited test comes at pre-production. Safety is IEC 61010-1 for measurement, control and laboratory equipment, or IEC 62368-1 for information and communication equipment, and both are about creepage, clearance, insulation, temperature and what happens under a single fault.
A radio adds a regulator. In Pakistan the Pakistan Telecommunication Authority requires type approval of equipment containing a radio transmitter before it is imported or sold, under its type approval regulations; a module's existing FCC or CE certification supports the application but does not replace it, and the approval is for the product as a whole, in its enclosure, with its antenna. Build the time and the cost into the plan. Finally, the product is tested in production, every unit, on a jig: pogo pins on the test points, a script that powers the board, programs it, exercises every input and output, checks the current, writes the serial number and the calibration, and records the result against that serial. A burn-in of hours to days at elevated temperature catches the infant failures before the customer does.
Documentation and manufacturing
The assembler needs a package that lets them build the product without asking a question: the bill of materials with manufacturer part numbers, approved alternates and the quantity per board; the Gerber and drill files, the pick-and-place file, the assembly drawing with polarity and orientation marked, the solder paste stencil, and the acceptance criteria, which for most work is IPC-A-610 class 2. The test procedure is a document, with the jig, the script and the pass limits, so that a unit that fails at a customer can be traced to its test record. Traceability runs both ways: the serial number gives the batch, the board revision, the firmware version and the calibration record; the batch gives the reel of every part that went into it, which matters when a supplier recalls a component.
Then the things that only exist for a product: the installation and wiring drawing for the site technician, the user or operator instructions, the label with the serial, the rating and the approvals, a spare-parts policy that says what is held and for how long, and a revision process that records every change to the board and the firmware and what shipped with what. A product that has to be supported in the field for ten years is supported through its documents, because the engineer who designed it will not be the one who takes the call.
How Ahmedonics runs this path
Ahmedonics is an engineering technology company that designs and builds automation, custom hardware and the software around it, and its custom hardware goes through the stages in the figure with a gate between each: a bench prototype that proves the function against written requirements; an engineering prototype on its own board with real power, protected I/O and the enclosure it will live in; a pre-production build that has had its EMC pre-scan, its thermal soak in an oven at the site ambient, its firmware update path and its test jig; a pilot batch of ten to fifty units in the field on a frozen bill of materials, reporting back; and production with the certification, the documentation and the serial numbers in place. Each gate has a list, and a project does not pass it because the calendar says so. The custom engineering and software engineering pages describe the work; this guide is the checklist behind it.
References
- IEC 61000-4-2, Electromagnetic compatibility — Testing and measurement techniques — Electrostatic discharge immunity test
- IEC 61000-4-4, Electrical fast transient/burst immunity test
- IEC 61000-4-5, Surge immunity test
- IEC 61000-6-2, Generic standards — Immunity standard for industrial environments
- IEC 61000-6-4, Generic standards — Emission standard for industrial environments
- IEC 61010-1, Safety requirements for electrical equipment for measurement, control and laboratory use — General requirements
- IEC 62368-1, Audio/video, information and communication technology equipment — Safety requirements
- IEC 61131-2, Programmable controllers — Equipment requirements and tests — operating temperature, humidity and immunity levels for control equipment in cabinets
- IPC-2221B, Generic Standard on Printed Board Design
- IPC-A-610, Acceptability of Electronic Assemblies
- Pakistan Telecommunication Authority, Type Approval Regulations — type approval of equipment containing radio transmitters before import or sale in Pakistan