Design a voltage-glitching "crowbar" front-end for hardware fault injection.
FUNCTION: On a control pulse from a Raspberry Pi Pico GPIO, momentarily short a
target microcontroller's core power rail to ground (a few nanoseconds up to ~1 µs)
to induce a controlled brownout / voltage glitch. Target is a Microchip
PIC32MK1024MCF100; the rail being glitched is its VCAP core-regulator pin at 1.8 V.
TOPOLOGY: A fast low-side N-channel MOSFET as the crowbar — drain to the
TARGET_VCC node, source to GND — driven by a high-speed single-channel low-side
gate-driver IC whose input is the Pico GPIO. The crowbar only SINKS TARGET_VCC to
GND when triggered; it must NOT source power to the target.
SIGNALS / INTERFACE:
- CTRL_IN : glitch control from Pico GPIO12, 3.3 V logic, active-high, pulses as
short as ~5–20 ns up to ~1 µs.
- VDRV : gate-driver supply, 3.3–5 V (from the Pico's 3V3 or 5V/VBUS).
- GND : common ground, shared with the Pico and the target board.
- TARGET_VCC : output node, connects via a short flying lead/clip to the PIC32
VCAP pin (1.8 V). Low voltage, low current.
REQUIREMENTS:
- Switching speed is the priority. Pick an N-MOSFET with very low total gate
charge (Qg, ideally < a few nC) and low Rds(on). Use a fast low-side gate
driver (e.g. UCC27511-class, multi-amp, with 3.3 V/TTL-compatible input) so the
FET turns fully on in nanoseconds.
- DEFAULT OFF: include a pull-down on CTRL_IN (and ensure the driver output is low
at power-up) so the MOSFET is off by default and never shorts the rail
unintentionally.
- Minimal series gate resistance for speed; provide a small (~1–5 Ω) gate-resistor
position to damp ringing.
- Decouple VDRV with a local bypass cap right at the gate driver.
- Keep TARGET_VCC and GND connections short and low-inductance (call this out for
layout — lead/trace inductance limits glitch sharpness).
- Because the target rail is 1.8 V and low-current, the FET need not be
high-current — prioritise speed / low Qg over current rating.
DELIVERABLES: a schematic with specific recommended part numbers and values
(MOSFET, gate driver, gate resistor, CTRL_IN pull-down, VDRV bypass cap), and a
short note on wiring CTRL_IN to Pico GPIO12, the common GND, and the TARGET_VCC
clip to the PIC32 VCAP pin.
A few tips for getting a good result out of it:
- If Flux pushes a slow or high-Qg power FET, tell it explicitly: "optimise for fastest turn-on, not current capacity — Qg under ~3 nC." For a
tiny 1.8 V rail, speed beats amps.
- Sanity-check the gate driver's input logic threshold is satisfied by 3.3 V (UCC27511-class is fine).
- It may suggest powering the gate driver at 5 V (VBUS) for snappier edges — that's good; just keep the input 3.3 V-tolerant.
Optional — if you also want the trigger-input conditioning designed (since a complete glitcher needs it), append this:
ALSO add a trigger-input stage: a fast comparator or level translator that takes a
target signal (which may be 1.8–3.3 V) and outputs a clean 3.3 V edge into Pico
GPIO14 (the findus trigger input). Note its threshold should be adjustable.