Jetson Orin SHUTDOWN_REQ* signal — power loss behavior and carrier board design

SHUTDOWN_REQ* is the handshake between the Jetson module and the carrier board that enables controlled power-down. Getting this signal handling right on a custom carrier board prevents both unintended powerdowns during normal operation and filesystem corruption during actual shutdown events. The forum threads on sudden power loss almost always trace back to carrier boards that don’t implement the SHUTDOWN_REQ* timing correctly.

Key Insights

• SHUTDOWN_REQ is active-low, open-drain* — the module pulls it low to request shutdown; carrier board must hold power for ≥100ms after assertion
• The carrier board is responsible for acting on SHUTDOWN_REQ* — the module requests shutdown but cannot power itself off; the PMIC on the carrier board must do so
• Filesystem safety requires ordered shutdown, not just power removal — ext4 journaling survives surprise power loss for data integrity, but in-progress writes may be lost
• QSPI NOR flash is the real risk — bootloader partitions are in QSPI; power loss during a boot partition update bricks the board
• Design for 200ms holdup — size carrier board bulk capacitance to keep the module alive for 200ms after main VIN drops; this covers most graceful shutdown sequences

SHUTDOWN_REQ* electrical behavior

The signal is defined in the Jetson Orin Product Design Guide (PDG):

Condition	Module behavior
Normal operation	SHUTDOWN_REQ* deasserted (high)
Software poweroff	BPMP asserts SHUTDOWN_REQ* low, waits for power-off
Thermal limit exceeded	BPMP asserts SHUTDOWN_REQ* and begins emergency shutdown
PMIC fault detected	BPMP or PMIC asserts SHUTDOWN_REQ* internally
Overcurrent on module	Module PMIC asserts SHUTDOWN_REQ*

Minimum carrier board response: hold VIN power for 100ms after SHUTDOWN_REQ* asserts. NVIDIA recommends 200ms. If VIN drops before SHUTDOWN_REQ* completes, the module abruptly loses power mid-shutdown.

Carrier board SHUTDOWN_REQ* circuit

The standard carrier board implementation:

Jetson Module SYS_RST# / SHUTDOWN_REQ* (pin 212)
    │
    ├── Pull-up to 1.8V via 10kΩ
    │
    └── → Carrier board power controller (PMIC or MCU)
              │
              └── Controls VIN enable gate / load switch
                    │
                    └── VIN to module (5V or 9-20V input)

Implementation on carrier board:

1. Connect SHUTDOWN_REQ* to a GPIO on your carrier board MCU or directly to a PMIC enable input
2. When SHUTDOWN_REQ* goes low:
   • Start a 200ms timer
   • After 200ms, disable VIN to module
3. For voltage supervisor power-loss detection:
   • Use a supervisory IC on your main VIN rail
   • When VIN drops, trigger a GPIO interrupt to the Jetson
   • Jetson calls shutdown → SHUTDOWN_REQ* asserts → PMIC completes holddown

Detecting power loss from software

Implement a power-loss interrupt handler on the Jetson side:

#include <gpiod.h>
#include <stdlib.h>

/* GPIO connected to carrier board voltage supervisor output */
#define PWR_FAIL_GPIO_CHIP  "gpiochip0"
#define PWR_FAIL_GPIO_LINE  42

int main(void) {
    struct gpiod_chip *chip;
    struct gpiod_line *line;
    struct gpiod_line_event event;

    chip = gpiod_chip_open_by_name(PWR_FAIL_GPIO_CHIP);
    line = gpiod_chip_get_line(chip, PWR_FAIL_GPIO_LINE);

    gpiod_line_request_falling_edge_events(line, "pwr-fail");

    while (1) {
        /* Block until falling edge (power failure detected) */
        gpiod_line_event_wait(line, NULL);
        gpiod_line_event_read(line, &event);

        if (event.event_type == GPIOD_LINE_EVENT_FALLING_EDGE) {
            /* Power loss detected — initiate graceful shutdown immediately */
            sync();           /* flush all dirty pages */
            system("poweroff -f");  /* trigger controlled shutdown */
            /* We have ~150ms before capacitors are exhausted */
        }
    }
}

systemd shutdown sequence timing

By default, systemd allows services 90 seconds to stop on poweroff. On a battery-backed or capacitor-hold system this may be too long:

# Reduce timeout to 10 seconds for power-fail shutdown scenarios
# In /etc/systemd/system.conf:
DefaultTimeoutStopSec=10s

# Or per-service for services that must stop quickly:
# [Service]
# TimeoutStopSec=5s

For power-fail scenarios, trigger a forced fast shutdown:

# Skip service stop ordering, sync filesystems, power off immediately
sync && echo o > /proc/sysrq-trigger

Testing SHUTDOWN_REQ* behavior

# Initiate a clean software shutdown and observe SHUTDOWN_REQ* on oscilloscope
sudo poweroff

# Observe:
# 1. Linux filesystems sync (dmesg: "Sending SIGTERM to remaining processes")
# 2. BPMP asserts SHUTDOWN_REQ* (oscilloscope: signal goes low)
# 3. 100-200ms later, carrier board removes VIN

# Test sudden power loss (disconnect power while system is idle)
# After recovery:
dmesg | grep -E "ext4|journal|filesystem"
# Clean journal replay = filesystem survived
# "EXT4-fs error" entries = potential corruption

Protecting QSPI NOR flash during updates

QSPI flash holds MB1, MB2, TF-A, and UEFI — power loss during these writes bricks the board:

# Never run flash.sh on battery power or unreliable supply
# For OTA updates of boot partitions:
# 1. Confirm VIN is stable before starting
# 2. Disable power-save modes during update
# 3. Use A/B partition layout so only the inactive copy is updated

The A/B partition layout (rootfs-ab) means a power loss during an OTA update only corrupts the inactive slot — the device remains bootable from the active slot. For A/B layout setup and slot management, see Jetson Orin rootfs-ab slot switches unexpectedly. For custom carrier board hardware design considerations, see Jetson carrier board hardware design mistakes.

FAQ

What is SHUTDOWN_REQ* on Jetson Orin?

An active-low signal from the Jetson module to the carrier board PMIC requesting controlled power-down. The carrier board must hold power for ≥100ms (200ms recommended) after the signal asserts to allow the module to complete its shutdown sequence.

What happens if power is removed from Jetson Orin without SHUTDOWN_REQ* completing?

Journaled filesystems survive sudden power loss for data integrity. The real risk is power loss during a bootloader (QSPI NOR) update, which can brick the board. Design carrier boards to hold power through the shutdown sequence.

How do I detect power loss on Jetson Orin before it happens?

Monitor VIN with a voltage supervisor IC on the carrier board. When VIN drops, trigger a GPIO interrupt to the Jetson before holdup capacitors are exhausted, giving the software 50–200ms to call sync and poweroff.

Does Jetson Orin support software-initiated power off?

Yes. sudo poweroff triggers a clean shutdown that syncs filesystems and asserts SHUTDOWN_REQ* before powering off.

---