Why your board works on the bench and fails in the field

A prototype on a bench is a board in the best conditions it will ever see: a clean lab supply, room temperature, a short USB cable, and an engineer watching it. Every one of those conditions disappears in the field, and four failure modes account for most of what comes back.

None of them are exotic. All of them are cheaper to find before you commit tooling.

1. Brown-out, not power loss

The bench supply collapses politely. A battery under a motor-inrush load does not, instead sagging, recovering and sagging again, sometimes for milliseconds at a time. During that window the supply rail sits below the MCU's guaranteed operating voltage but above the level that triggers a reset, and the part executes instructions it cannot execute reliably. Corrupted flash writes and impossible state-machine transitions both live here.

Most MCUs have a programmable brown-out detector that is either disabled by default or set below the useful threshold. Set it deliberately, above the rail your slowest peripheral needs:

// STM32H7: trip at 2.7 V so the MCU stops before the external flash
// loses its own 2.5 V minimum. The default level is below both.
void configure_brownout(void) {
  FLASH_OBProgramInitTypeDef ob = {
    .OptionType = OPTIONBYTE_USER,
    .USERType   = OB_USER_BOR_LEV,
    .USERConfig = OB_BOR_LEVEL3,
  };
 
  HAL_FLASH_Unlock();
  HAL_FLASH_OB_Unlock();
  HAL_FLASHEx_OBProgram(&ob);   // persists across power cycles
  HAL_FLASH_OB_Launch();
}

2. Decoupling that passed review but not reality

Decoupling failures rarely look like decoupling failures. They look like an ADC that reads two counts high, an I²C bus that stalls under load, or a radio whose range is worse than the datasheet promises.

The review question is not "is there a 100 nF near each supply pin". It is how large the loop is between the capacitor, the pin and the return path. A capacitor on the far side of a via stitch, or returning through a split in the ground plane, contributes far less than the schematic implies. Two things to check on the layout rather than the schematic:

• the capacitor's ground via sits next to its pad, not at the end of a trace;
• no high-speed return path crosses a plane split, because the current will take the loop it can find, and that loop is your antenna.

3. ESD on every exposed connector

Anything a user can touch will be touched, and anything touched will be discharged into. A connector that goes straight to an MCU pin survives a bench with a grounded mat and fails on a carpet in winter.

The pattern is the same in each case: clamp at the point the signal enters the board, not next to the part you are protecting.

4. Thermal margin measured, not calculated

A spreadsheet says the regulator dissipates 0.9 W and the package is rated for it. The spreadsheet assumes still air, an ambient you chose, and copper area you have not actually laid out. Then the board goes in a sealed enclosure and the assumption about air disappears.

Measure it instead. Run the worst-case load, in the real enclosure, at the top of the ambient range, and put a thermocouple on the parts you are worried about. Derate what you find. If a part sits at 85 °C in a 25 °C room, it has no margin left for a hot day.

Where this fits in a project

These are bring-up and validation questions, and they are why our process keeps a validation stage with a written test report as its deliverable rather than folding it into "design". Finding a brown-out threshold problem during bring-up costs a firmware change. Finding it after tooling costs a board spin and a recall.

The robotic controller case study is a worked example of where these questions land: a custom control board for a medical device, where the schematic and PCB were prototyped and validated as hardware before the design was taken further.

The short version

Before you commit to manufacture, be able to answer four questions with a measurement rather than an opinion:

1. What rail voltage does the MCU stop at, and is it above every peripheral's minimum?
2. Where does the return current for each fast signal actually flow?
3. What clamps each connector, and is the clamp at the entry point?
4. What is the hottest part in the sealed enclosure, at the top of the ambient range, under worst-case load?

If any answer is a calculation rather than a reading, that is the next thing to test.