Is a Digital Isolator's Default Output High or Low? Choosing the Fail-Safe State

Bottom line: the default output state of a digital isolator is not for normal operation - it exists for the few moments when the input side cannot be trusted: power-up, power-down, a floating or high-Z input pin, and the window before the input-side supply is established. There is only one selection rule: put the default on the side that does nothing when the system fails. For a CAN transceiver's TXD that means default high (so the node never holds the bus dominant), for RS-485 DE it means default low (never enable the driver), for enable and interlock paths default low (never energise), for alarm outputs default low (never raise a false alarm). Get the last digit of the part number wrong and the whole board's power-up sequence goes with it. And an isolator without fail-safe circuitry does not have a defined output when its input side is undefined - there the system has to carry the risk with communication timeouts and MCU-side pull resistors.

Two questions engineers ask most

First: at the instant of power-up, is the output high or low?

The answer depends on the device. An isolator with fail-safe circuitry forces the output to the level defined by its model when the input side is unpowered or the input pin is open / high-Z. An isolator without it may hold the previous state, or chatter around the threshold - the datasheet truth table usually marks this row "undefined" or simply omits it. So the first thing to look at is not the data rate but the "input open" and "input side unpowered" rows of the truth table.

Second: default high or default low - which one?

Do not choose by convenience, choose by failure direction. Write down what the signal means in the system: when this node is high, does the controlled object act or stay put? If high means action (enable, transmit, alarm, contactor close), the default should be low. If high means safe (the recessive state of CAN, a normally-closed fault loop), the default should be high. This is the plainest rule in functional safety - the de-energised state is the safe state.

First, split "undefined" into four conditions

What the field calls "false action at power-up" actually mixes four different physical conditions. They do not produce the same output, and they do not share the same fix.

Condition	What happens inside the device	Output depends on
Input supply VDD1 not yet established	Input-side modulator is not running, no valid carrier across the barrier	Fail-safe present: default level. Absent: undefined
VDD1 up, but input pin floating / high-Z (MCU not initialised)	Input stage sits near threshold and may self-oscillate	Same as above; MCU-side pull resistors are most effective here
Output side VDD2 powers up before VDD1	Output stage alive, but no valid input	Fail-safe present: default level. Absent: may follow noise
VDD1 lost while VDD2 is held by the secondary supply	Input side dead, output stage still powered	Fail-safe present: pulled back to default. Absent: holds the last state

The fourth row is the one most often missed. Energy-storage PCS and BMS designs frequently run two auxiliary supplies, one per side: the controller dies first while the isolated side is still alive. Without fail-safe circuitry the secondary side keeps the last level the controller wrote. For a CAN TXD channel, if the last frame happened to leave it dominant, that single node holds the bus down indefinitely.

Convention note: HOPERF CMT general-purpose isolators (CMT812X 2-channel / CMT804X 4-channel / CMT826X 6-channel) offer selectable default output high or low, encoded by the last digit of the model (...1 = default high, ...0 = default low), with up to 150 Mbps, propagation delay in the 9 ns range and CMTI up to the ±250 kV/us range. These are typical figures from the manufacturer's public material - the truth table, default state and suffix mapping for the exact part must be confirmed against its original datasheet, and the full part number including suffix must be used when ordering.

Selection rule: derive the default from "do nothing on failure"

Fill every signal into the table below and the answer falls out. Its value is that it turns "default high or low" from a gut feeling into a question about signal semantics.

Signal position	Meaning of logic 1	Dangerous failure direction	Default to choose
CAN transceiver TXD (isolator secondary to transceiver)	Recessive, bus not driven	Pulled low = permanent dominant, bus monopolised, network errors	High
CAN / RS-485 receive side RXD (isolator to MCU)	Recessive / idle, no start bit	Pulled low = MCU sees phantom frames and start bits	High
RS-485 DE (driver enable)	Driver enabled	Pulled high = grabs the bus at power-up	Low
Enable / interlock / relay drive	Enabled, contactor closed	Pulled high = actuates at power-up, mechanical and personal risk	Low
Fault / alarm output	Alarm asserted	Pulled high = false alarm at power-up, operators stop trusting it	Low
Primary-side input of an isolated gate driver	Turn-on	Pulled high = power device falsely turned on, shoot-through	Low (and check primary UVLO)

Three practical notes:

1. Put the full suffix in the BOM. Default-high and default-low versions of the same family often differ only in the last digit. Ordering by family name alone mixes batches, and the line then shows up as "some boards are fine at power-up, others keep reporting bus errors".
2. Make the MCU-side pull resistor agree with the isolator default. During reset the MCU GPIO is high-Z and the isolator input floats. If the isolator defaults high while the MCU side pulls down, the two fight during the power-up window and the result depends on drive strength and time constants - start them in the same direction.
3. Do not add a strong pull-up or pull-down on the isolator output to "fix" the default. That fights the internal output stage, wastes current, and does nothing about the undefined input. The default can only be fixed by the part number plus system-level fallback.

A same-name trap: fail-safe means two different things

Searching for "fail-safe isolator" returns two unrelated concepts, and mixing them leads to the wrong conclusion:

• Isolator fail-safe (default output state): when the input side is undefined, the output is forced to a specified level. It governs the short signal path across the barrier.
• RS-485 fail-safe biasing: bias resistors on the bus guarantee that, with all drivers disabled, the idle differential voltage stays above the receiver threshold (about +200 mV) so the receiver output is a defined high. It governs the whole bus.

They are not interchangeable. Good bus biasing will not stop an isolator with the wrong default from grabbing the bus at power-up, and a correct default will not stop a bus without biasing from producing phantom frames while idle. One sits on the barrier, the other on the wire.

Power sequencing: three hard constraints

flowchart TD
    A["At power-up / power-down,<br/>what is the isolator output?"] --> B{"Does the part have<br/>fail-safe circuitry"}
    B -- "No" --> C["Undefined, or holds the last state<br/>system must carry the risk"]
    B -- "Yes" --> D["Output driven to the model default"]
    D --> E{"Is the default the<br/>'do nothing on failure' side"}
    E -- "No" --> F["Change the suffix<br/>or invert the signal semantics"]
    E -- "Yes" --> G["Match the MCU-side<br/>pull resistor direction"]
    C --> G
    G --> H{"Is the opposite supply still alive"}
    H -- "VDD1 lost, VDD2 alive" --> I["Confirm the part still returns<br/>to default with VDD1 dead"]
    H -- "Both supplies drop" --> J["Only communication timeout<br/>and a hardware watchdog remain"]
    I --> K["Bench retest: VDD1 first, VDD2 first<br/>both power-up and power-down"]
    J --> K

1. Asynchronous supplies are the norm, not the exception. The controller side and the bus side each have their own DCDC and ramp rate. Test "VDD1 first" and "VDD2 first" separately - one order passing means nothing.
2. Nothing is guaranteed below UVLO. Both sides have undervoltage lockout; outside the valid range the output is not specified. The system needs a fallback that does not depend on the isolator: communication timeout, hardware watchdog, and an output-stage enable.
3. The power-down order decides whether the last state gets locked in. When the controller dies first and the secondary supply lingers, a part without fail-safe holds the last level for hundreds of milliseconds to seconds. On a bus where low means occupied, that is long enough for the whole rack to raise a bus fault.

Isolator plus TVS: do not mistake "damaged" for "wrong default"

This is the most common misdiagnosis in the field. Three symptoms all look like "it is wrong from the moment we power up", but the root causes are entirely different:

Symptom	Real cause	Test
Permanent dominant / bus monopolised at power-up	TXD channel defaults low, or an MCU-side pull-down holds TXD	Disconnect the isolator output, see whether the bus recovers recessive
Intermittent errors, occasional bad frames	Common-mode transient coupling across the barrier, output glitches	Device is intact; check CMTI minimum and the coupling path
One batch fails consistently, bus level pinned	Bus-side TVS already shorted, or transceiver pins punched through	Power off, diode-test bus pin to ground against a good board

The third deserves emphasis. The TVS belongs outside the isolator, on the bus side, at the connector - never between the barrier and the transceiver. Put it in the wrong place and the surge energy reaches the isolator first, and the barrier is already damaged by the time the TVS clamps. The clamping voltage Vc must stay inside the absolute maximum rating of the transceiver's bus pins (CAN transceiver bus pins are commonly in the -27 V to +40 V range, RS-485 commonly -8 V to +13 V or wider - refer to the selected transceiver datasheet), while V_RWM must cover the bus swing and fault voltages.

Once the TVS fails short, the bus is pinned at a fixed level and the symptom is nearly indistinguishable from a wrong default. There is only one way to tell them apart: power off and measure impedance. So the troubleshooting order is always "confirm the part is not damaged, then question the logic state". The full two-stage coordination method is in Does an isolator need a TVS next to it; TVS grade and waveform convention are covered in How to select TVS for BMS boards and AMSEMI foldback TVS full series.

Waveform convention (non-negotiable): the AMSEMI 5.0SMDJ family (standard Doc. 8060014 / -N foldback Doc. 8060055) quotes Vc and Ipp on the 10/1000 us convention only; there is no 8/20 us data in the datasheet. Littelfuse 8x20 us figures (for example 273.8 A on the 5.0SMDJ85CA) belong to Littelfuse's own convention and must be attributed as such; the two waveforms are not convertible and must never be subtracted from each other. Default-state and timing reasoning is independent of waveform convention, but any table containing TVS numbers must lock the test condition line by line.

Verification checklist: five steps, none optional

1. Part number audit: BOM, placement program and incoming material agree on the suffix (default high and low must never mix).
2. Power-up order test: VDD1 then VDD2, then the reverse. Two scope channels, one on the input side and one on the output side.
3. Power-down order test: remove VDD1 and VDD2 separately, record how long the output takes to move from the active state to default or last-state, and to what level.
4. Floating-input test: put the MCU GPIO into high-Z (reset state), confirm the output sits stably at the default and does not oscillate.
5. Fault injection: short a bus-side TVS deliberately (simulating failure), confirm the system can diagnose it instead of showing "occasional communication errors".

Steps 1 to 4 belong to the prototype phase, step 5 to type testing. Skipping step 3 is the single most common reason a production batch develops "a few boards that occasionally report bus errors".

Common pitfalls

Pitfall	Symptom	Correct approach
BOM lists only the family name	Some boards fine, others grab the bus at power-up	Full part number, default matched to signal semantics
MCU pull resistor opposes the default	Indeterminate level in the power-up window, worse at low temperature or slow ramp	Same direction on both sides
Only one power-up order tested	Prototype passes, production fails	Both orders, plus power-down
Strong pull-up used to "fix" the default	Current draw, heating, root cause untouched	Change the part, not the passive
TVS placed inside the isolator	Surge reaches the barrier first	TVS at the connector, outside the isolator
Shorted TVS misread as a default-state bug	Isolators replaced repeatedly, still failing	Power-off impedance test, rule out damage first

Related solutions

• Digital isolator selection across communication, drive and sensing → How to select digital isolators
• Isolated CAN and RS-485 transceiver selection → BMS communication isolation
• Two-stage coordination of isolator and TVS → Does an isolator need a TVS next to it
• Common-mode transients and barrier damage → What is CMTI
• Barrier layout, creepage and the secondary supply → Isolation that does nothing
• Migrating from optocouplers → Can an optocoupler be replaced by a digital isolator
• TVS fundamentals and the three-stage voltage window → What is a TVS (Chinese)
• Why BMS boards burn MOSFETs → Why does a BMS burn MOS (Chinese)

FAQ

Q1: Is a digital isolator's default output high or low, and how is it marked on the part number?

Default high and default low are two different part numbers, not two settings of one part. HOPERF CMT general-purpose isolators (CMT812X / CMT804X / CMT826X) encode it in the last digit: ...1 = default output high, ...0 = default output low, with the original datasheet truth table as the final authority. Choose by the "do nothing on failure" rule: where high means action (enable, transmit, alarm) pick default low; where high means safe (CAN recessive) pick default high. The BOM and the placement program must carry the full suffix, because family-name ordering lets default states diverge within one batch.

Q2: At power-up the MCU has not initialised yet - can the isolator output cause a false action?

Yes, and this is the most common source of power-up false action. During reset the MCU GPIO is high-Z, the isolator input floats, and the output is decided entirely by the device: with fail-safe it equals the model default, without fail-safe it is undefined. Three measures run in parallel: (1) choose a part with fail-safe and the correct default; (2) make the MCU-side pull resistor agree with that default; (3) keep a communication timeout and a hardware watchdog in the system rather than relying on the isolator for safety. The floating-input condition must be tested explicitly, not just normal communication.

Q3: The CAN bus fails to communicate and keeps reporting errors as soon as we power up - is the isolator default state wrong?

Rule out two things first. Step one, disconnect this board from the bus and see whether the bus recovers - if it does, the problem is this board's power-up behaviour. Step two, power off and diode-test the bus pins to ground to rule out a shorted interface TVS, which pins the bus at a fixed level and looks almost identical to a wrong default. Only after both are excluded, check the TXD channel default: dominant on CAN is logic 0, so an isolator whose TXD channel defaults low drives the bus dominant from power-up and no node can communicate. Note that the transceiver's internal TXD pull-up cannot save you here - a push-pull output simply pulls it down.

Q4: Is the isolator's fail-safe the same thing as RS-485 fail-safe biasing?

No - they act at completely different places. Isolator fail-safe governs the short signal path across the barrier: when the input side is unpowered or the input is open, the output is forced to the default level. RS-485 fail-safe biasing governs the whole bus: with all drivers off, bias resistors keep the idle differential voltage above the receiver threshold (about +200 mV) so the receiver output is a defined high. Neither replaces the other: with perfect bus biasing, a wrong isolator default still grabs the bus at power-up; with the right default, an unbiased bus still produces phantom frames while idle.

Contact us

Shenzhen Intek Technology Co., Ltd is an authorised distributor for AMSEMI (Anmei Semiconductor) TVS and HOPERF CMT digital isolators, focused on low-clamping / shallow foldback TVS protection for BMS boards, energy storage and telecom power, and on coordinated isolator plus interface TVS selection. If you need to confirm the default-output suffix and truth table of a specific CMT isolator, review a power-up / power-down sequence, or design a two-stage surge protection for an isolated interface, please contact us. Send the schematic, the supply sequencing, the bus type (CAN / CAN FD / RS-485) and the surge test standard, and we will check it against your actual operating conditions.

Shenzhen Intek Technology Co., Ltd — Electronic Components Distributor and System Solutions Provider Tel / WeChat: +86 136-3264-8484 Address: 4F, Building 2, Jingwei Center, 309 Ping'an Avenue, Pinghu Street, Longgang District, Shenzhen, China Website: www.intek.vip

---

Disclaimer: This article is technical education and engineering exchange material about default output states, power sequencing and interface protection coordination. It is not a selection, procurement or business recommendation. Isolator figures (channel count, data rate, propagation delay, CMTI, default-output suffix) are quoted from HOPERF public material as typical values - always confirm against the original datasheet of the selected part. Absolute maximum ratings of CAN and RS-485 bus pins vary by device and vendor and must be checked per part. TVS figures come from AMSEMI public datasheets (standard 5.0SMDJ series Doc. 8060014, -N foldback 5.0SMDJ series Doc. 8060055) and are on the 10/1000 us convention only; the datasheet contains no 8/20 us data. Littelfuse 8x20 us figures are quoted under Littelfuse's own convention and are attributed as such; the two waveforms are not convertible and must not be subtracted. Power-up timing, last-state hold time and bus monopolisation time are engineering descriptions, not datasheet guarantees; final designs must be validated against the original datasheet, measured waveforms and the system test standard.