# B10B3-TESTD-RESULT — safety timer expiry during CHARGING (v3 supervisor, RAM only)

Date: 2026-10-04 (UTC 2026-10-03 18:29–18:44). **Verdict: NOT PASS / inconclusive** by the agreed rule (the CV criterion started before the
timer mark, no expiry seen). **Observed: with TCHG_MAX 0x01 / TCHG_EN 0x80 the PM8916 did not set CHG_FAILED at t = 480 s, while the USB input
current was still at its full CC level (≈0.42 A), nor afterwards up to t ≈ 843 s.** The timer has still never been seen to fire.
Image `b10/b10b3/out-d/aurora-b10b3d.img` 43739e55 (= Test C DTB + `qcom,charge-timeout-minutes = <8>`; kernel/initramfs/cmdline = Test C,
driver unchanged). aboot/cache untouched, eMMC writes = 0, no manual PMIC writes.

## Profile
Charge 4.10 V (VDD_MAX 0x04), HOLD 4.00 V (0x00), full-min 4.05 V, CV 5 min, IBAT_MAX 450 mA (0x04), timer 8 min (TCHG_MAX 0x01, TCHG_EN 0x80).
Compiled DTB checked numerically: voltage-max-design 4100000, charge-timeout 8, hold 4000000, full-min 4050000, cv-hold 5,
fast-charge-safe-current 500000; DTB inside `Image.gz-dtb` byte-identical. DTB diff vs Test C: only model + timeout (0x200 → 0x08).
Driver behaviour relevant here (v3 source): on CHG_FAILED in CHARGING/HOLD → logical FAULT, **no register writes** afterwards (so an expiry
would show pure hardware behaviour); recovery only via USB re-insert (clears CHG_FAILED + restart edge).

## Bench preparation
Class-A reset (operator local 21:11 down, 21:25 up; no RESET) → B9C, RTC 3 s; checks `pre-testD-classA-check.txt` (+ PON 0x080D 00),
`pre-testD-classA-dump.txt`, `pre-testD-vs-preB-diff.txt` (only ADC/BMS/RTC, 14 lines), `pre-testD-vs-baseline-diff.txt` (same status set as before).
All Test B values were reset. Pre-boot operator: DMM VBAT 4.073 V, USB meter 0.42 A (B9C SBL charge).
`reboot` over telnet with RESET held → fastboot after 12 s → `fastboot boot` 18:29:48 UTC → NCM 18:29:59, monitor (5 s) 18:30:08.

## Timeline (t = 0 at probe, dmesg 0.920 s `safety timer 8 min (TCHG_MAX 0x01), enabled`; per-minute means from 161 samples)
| t (min) | USBIN (VADC) | VADC VBAT | CHG_STATUS 03 samples | state |
|---|---|---|---|---|
| 0–1 | 4.881 V | 4.084 V | 0/9 | CHARGING (INIT→CHARGING at 3.999 V, t 0.04 s) |
| 1–5 | 4.882 V | 4.087 → 4.095 V | 0 | CHARGING, CHG_STATUS 05 |
| 5–7 | 4.882 V | 4.098–4.099 V | 0 | VBAT at the 4.10 V level; supervisor sees the CV bit in its polls (cv_s runs from ≈ t 300 s, one reset) |
| **7–8 (t = 480 s)** | **4.884 V** | 4.099 V | 0/12 | **timer mark: CHG_FAILED 00, CHG_CTRL a0, TCHG 80/01, path 01, VDD_MAX 04, IBAT_MAX 04** |
| 8–9 | 4.887 V | 4.097 V | 0/12 | CHARGING |
| 9–11 | 4.896 → 4.913 V | 4.095 → 4.086 V | 2/12, 7/11 | current taper starts (USBIN sag decreasing) |
| 11.8 (t = 706.8 s) | 4.944 V | 4.083 V | 10/12 | **CHARGING → HOLD** (CV 5 min reached), only VDD_MAX 04 → 00 |
| 12–14 | 5.015–5.018 V | 4.030 → 4.025 V | all | HOLD phase 1 |
| t ≈ 843 s | — | 4.026 V | — | end dump: HOLD, fault none, CHG_FAILED 00, n_latch 0 |

Operator: USB meter 0.42 A at t ≈ 430 s. USBIN sag is a proxy for the input current: unchanged (4.881–4.884 V) from t = 0 to t ≈ 8 min, i.e. the
current at the timer mark equalled the CC level (0.42 A input, ≈ 0.33 A into the battery after the board load); it rises only after ≈ 8.5 min (taper)
and reaches 5.017 V (≈ no current) in HOLD phase 1.
All 161 samples: CHG_FAILED 00, TCHG 80/01, CHG_CTRL a0, CHGR_RT 01, USB path 01; 0 ALERT lines; no FAULT; no 00+01 latch. PMIC max 45.9 °C.

## Answers to the test questions
1. CHG_FAILED changed? **No** (00 throughout, also in the end dump at t ≈ 843 s).
2. Charging stopped at the mark? **No** — input current stayed at the CC level through t ≈ 8.5 min, then tapered normally (CV), then HOLD by the supervisor.
3. CHG_STATUS / CHG_CTRL / path changed at the mark? **No** (05 / a0 / 01; 03 appears only with the CV taper after ≈ 9 min).
4. USB able to carry the system? Yes (no interruption; HOLD phase 1 as in Tests B/C).
5./6. Automatic recovery / driver intervention: **not testable** — there was no expiry.

## Why not PASS
By the agreed rule: VBAT reached the 4.10 V regulation level at ≈ t 300 s and the supervisor's CV criterion started then, before the 480-s mark.
Pure CC (VBAT below the regulation level) lasted only ≈ 300 s. The battery was more charged than estimated from Test C (OCV ≈ 4.0 V after HOLD,
plus SBL charge in B9C; at 450 mA the under-charge VBAT is ≈ 4.08 V from the start).
Note for the interpretation: the input current did not taper before ≈ 8.5 min, so the charger was delivering full current at the mark. If the
PM8916 timer counted fast-charge time with 4-min granularity starting at the probe programming, an expiry at 480 s would have been expected.
Possible explanations (not tested, not claimed): the timer counts only in a charger state this LBC never reports (CHGR_RT never shows
FAST_CHG_ON — 01 in every sample, Tests B/C/D); TCHG_MAX units/encoding differ from `minutes / 4 − 1`; or the timer is restarted/held by the
restart edge (0x21 → 0xa0) at CHARGING entry. Test D does not distinguish them.

## Observations
1. Warm reboot with RESET held again gave POFF_REASON2 0x080D = 0x80 (STAGE3) and RTC 5 s, although RESET was held only ≈ 12 s
   (Test B: ≈ 14 s). So a RESET-held warm reboot regularly ends in a PMIC stage-3 reset on this board. Harmless for RAM tests (driver
   programs everything at probe), but the boot is effectively a PMIC reset, not a pure class B.
2. Full SID0 diff end vs class A (`d1-vs-classA-diff.txt`): identical set to Test B — 0x1040 08→00, 0x1044 00→04, 0x1045 0a→04, 0x1049 90→a0,
   0x1061 1d→01, 0x1642 00→80 (+0x1643), status 0x1009/0x1308, PON 0x080D, temp-alarm/0x06xx driver regs, ADC/BMS/RTC. Unchanged:
   0x1060 80, 0x104A 00, 0x105B 09, 0x10EE 00, 0x1041 08.
3. LTE START OK 63.6 s, ping 4/4; Wi-Fi AP enabled 68.9 s, Pronto running; NCM ok; eMMC w=0.
4. cv_s cosmetic (keeps counting in HOLD) — unchanged.

## Files (logs/b10/b10b3/, copies on 480s)
`pre-testD-classA-check.txt`, `pre-testD-classA-dump.txt`, `pre-testD-vs-preB-diff.txt`, `pre-testD-vs-baseline-diff.txt`; `d1/` (host-actions,
snapshot, dmesg.full, dmesg-end, uart.log); `d1-actions.txt`, `d1-boot.out`, `d1-monstart.out`, `d1-mon.txt` (pull), `d1-mon-board-final.txt`
(161 samples + MON-END), `d1-end-dump.txt`, `d1-end-state.txt`, `d1-vs-classA-diff.txt`. UART `logs/uart/b10b3d-ram1-20261003-212908.log` (480s).
Build/boot: `linux/dts/msm8916-jz08-aurora-b10b3d.dts`, `b10/b10b3/build-b10b3d.sh`, `b10b3d-boot.sh`, `b10b3d-mon-start.sh`, `out-d/`.

## State after the test
Board in HOLD on the Test D RAM image (VDD_MAX 4.00 V, TCHG_MAX 0x01 enabled). Monitor/pull stopped. Class-A reset required before the next test.