How can i protect my circuit from clueless plebs - Page 1
Forum section: electronics / projects

author: iwtommo
author_rank: Contributor
timestamp: January 05, 2018, 01:29:06 pm
content: Hi guysI'm designing a circuit that i would like to put into a small production run (say, 50 ish). I will be selling this product into a, uh, non electrically minded marketplace. So i think it wise to think about circuit protection. This is not something i have actually had to put to much effort into before, surprisingly, and it will be my first production run. I am now trying to think about what sort of protections i should be designing into my circuit.It is a servo driver that uses a 0-5v input to drive a 2 wire motor to a position using a feedback pot built within the motor. Here is the circuit. Max usable specs are 46v, 4a cont, 25wI think what i am looking to know is what are the typical idiot errors that could occur when wiring connecting this up that i should be designing protections for, and thus the best ways to implement these protections.Over voltageOver current (fuse? use the microcontroller to cut power?)Reverse polarity (crowbar circuit?)Over voltage on mcu pins (use a 5.1v zener to ground? Resistors?)Anything else i haven't thought of? (temp? interference? impact wrench used on screw terminals? Sledgehammer strikes?)Just after thoughts really. Thanks

author: capt bullshot
author_rank: Super Contributor
timestamp: January 05, 2018, 01:38:10 pm
content: Reverse power supply, output short, blocked motor - check what the L298 can stand in terms of overcurrent and short circuitMiswired motor and sense - this can lead to full battery voltage on your 5V rail or the sense input, same for the setpoint input.Never expose unprotected MCU pins to the outside, protect the MCU isense input from spikes due to output overload

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 01:45:20 pm
content: Quote from: iwtommo on January 05, 2018, 01:29:06 pmYou should divide max current by 2, it seems you did not read the datasheet properly. Also it's completely outdated to use L298, especially considering huge power loss/dissipation on it.

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 01:53:57 pm
content: The is no ESD protection. But I also see suspicious setpoint input which has +BATT on the connector. I guess, it means full power voltage possible on the input of attiny. Also what about voltage regulator? Up to 46V on it's input. I don't see particular part number, but I doubt that you've thought about this properly.EDIT: also I don't think it's a good idea doing this without a local bulk capacitor like 1000-2200uF. Voltage regulator sure won't be that happy when you start/stop the motor.

author: max_torque
author_rank: Super Contributor
timestamp: January 05, 2018, 01:56:59 pm
content: Quote from: iwtommo on January 05, 2018, 01:29:06 pmPretty sure 4 x 46 isn't 25 ??

author: tggzzz
author_rank: Super Contributor
timestamp: January 05, 2018, 01:58:27 pm
content: You cannot completely protect it from fools, since fools are so damn ingenious.Early in my career I made a box for the production test department. It delivered a measured current/voltage burst to a solenoid, to verify that the solenoid was operating correctly. I protected it against reverse input voltage, excessive input voltage, open outputs, shorted outputs, reversed outputs.After a few weeks one of them was sent back; the PCB had been set on fire.The test technician, known byallas "bigfoot", had followed this chain of "reasoning":oneUUT was marginally failingmarginal failures are often caused by poor power suppliespoor power supplies are often due to too much ripplelarge capacitors reduce rippletherefore I'll add a very large capacitor across the outputI won't stop to think that one UUT marginally failing might be why the tester was built/used in the first place

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 02:02:42 pm
content: Quote from: max_torque on January 05, 2018, 01:56:59 pm25W is total power dissipation of L298, dunno why op used it as a spec. Also each channel is only rated for 2A, therefore in bridge configuration, it's still remains 2A.

author: RoGeorge
author_rank: Super Contributor
timestamp: January 05, 2018, 02:05:23 pm
content: There is 'waterproof', or 'dustproof', but there is no such thing like 'idiotproof'.

author: iwtommo
author_rank: Contributor
timestamp: January 05, 2018, 02:10:56 pm
content: Max_torque from pistonheads technical on the eevblog forum? Small world eh.The Vreg is a MIC2940A. It accepts up to 60v in with various overcurrrent/reverse polarity/temp protections built in so i am happy the 5v supply side is safe enough.4a 46v is indeed not 25w but these are the maximum limits of the L298. It seems it means that if you use 46v you only get to play with 0.5a or you can get the full 4a if you use 6v. Ish. The chip has 2 output drivers onboard which i have paired together to get this output current.Not that this matters if this chip is antiquated. Is there a better commonly used choice with similar specs i should be aware of?I somewhat expected this... No talk of protection because it turns out my design is horrific and needs fixing. Typical

author: tszaboo
author_rank: Super Contributor
timestamp: January 05, 2018, 02:19:21 pm
content: There is no such thing as idiotproof. I had people connecting 12V battery on a up to 5V output. People connecting 230V AC on a 12-24V DC input. People connecting everything in reverse. People forcing stuff, so they can connect it in reverse. People breaking USB plug five minutes after I give the card in their hands.

author: iwtommo
author_rank: Contributor
timestamp: January 05, 2018, 02:32:13 pm
content: "Never expose unprotected MCU pins to the outside"What would you reccomend to protect the MCU? I was thinking a 5v zener between the input pin and ground. That way any excess voltage gets fed to ground.

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 02:40:44 pm
content: Quote from: iwtommo on January 05, 2018, 02:10:56 pmI forgot that L298 has 4 outputs but paralleling them does not give you 2x of the current because it won't be shared equally. How bad impalance will be depends on particular IC. In app note ST says it's good for 3.5A. I personally would use 4 separate or 2 dual mosfets for the task. Of course that would need a few additional components to drive them. This also would mean, you don't need any heatsink as power loss/heat dissipation will be minimal. All you'll need are some copper pours on the PCB to dissipate the heat from mosfets.EDIT: however you can avoid using diodes on the output as mosfets have intrinsic body diode.

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 02:43:30 pm
content: Quote from: iwtommo on January 05, 2018, 02:32:13 pmThere are special ESD protection devices like TVS, varistors, TVS arrays which work much better than zeners for this task. Also putting a resistor in series with input when possible can greatly improve protection.

author: David Hess
author_rank: Super Contributor
timestamp: January 05, 2018, 03:22:05 pm
content: Quote from: iwtommo on January 05, 2018, 02:32:13 pmThat just means trading a hard kill of the MCU for a hard kill of the protection circuit or both which still results in a hard kill. The current must be limited (on every pin) which means some type of series protection or a high impedance input to any other pin. That is how voltmeter and oscilloscope inputs can withstand 400 volts while set to their most sensitive ranges.

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 03:53:21 pm
content: QuoteMIC2940A requires 10uF capacitor on the output (can be lower for low currents). Also it should not be ceramic capacitor, otherwise you may have oscillation problems. You need to use 100nF only for attiny decoupling but not directly at LDO pins.

author: fcb
author_rank: Super Contributor
timestamp: January 05, 2018, 04:22:48 pm
content: L298's are notoriously easy to blow. Make sure you can't disconnect the driver from the motor easily.

author: Siwastaja
author_rank: Super Contributor
timestamp: January 05, 2018, 04:40:45 pm
content: Quote from: iwtommo on January 05, 2018, 02:32:13 pmReally really depends on your budget and expected usage environment.Simplest: just expose the pins. Look what Arduino, Raspberry etc. are doing. Some boards are blown sometimes, people are happily replacing them, and debugging hard-to-find possibly esd-related issues. Manufacturer/designer is never blamed for skipping even the most basic protection in this environment.Almost as cheap: simple series resistor (typ. between 47R to 220R). Now the internal protection diodes in the MCU has better chance clamping, since the power is not dissipated 100% in the protection diodes, and as the current is somewhat limited by that resistor. Especially powerful to decouple large capacitive loads, prevent destructive ringing and EMI disasters. I often go for this in products that are designed for the "maker" market, perfectly happy even with the Arduinos. This is definitely more robust than Arduino, provides basic slew rate and EMI control, and allows you to directly connect some LEDs. Also consider a capacitor (after the resistor) directly at the input pin, if the pin is never used as an output, and if it never needs to sample fast signals.A bit more expensive: simple series resistor aided with external protection diodes more capable than the internal ones. Zener might not be fast enough, but combined with the internal protection diodes, often good enough as a combination. Two schottkys are fast, but you might need to clamp the power rail with a zener then - things like that to keep in mind. Many TVS diodes are fast compared to zeners.Then, using an external transceiver IC, even just some simple logic buffermightprovide better ESD protection specs than an MCU IO pin - but definitely check out the details, I have seen stupid designs where an unnecessary standard extra CMOS gate is used in the false sense of security that it's somehow much better than the CMOS IO of an MCU.Even more expensive: isolation (optical, or using transparent magnetic digital isolator ICs, or relay).Even more expensive: fibre optical communication.But - 99% of time designers talk big about foolproofing their "good" circuits from "stupid" users, it's actually their circuits that are poorly designed. Remember that when designing. I'm sure, for example, that L298 is far from a robust design choice. Layout and bypassing is also super important in motor drive designs, not to forget the reaction time and robustness of the current sense subsystem.Also note that ceramic caps, especially sizes over 0805, are destroyed in a very nasty and hard-to-predict way if the board is bent - i.e., they may become low-value resistors starting a fire a yearafterthe board was bent. You can't shift the blame to the end user, you need to keep this in mind while designing the mounting hole positions, and writing documentation about mounting.

author: iwtommo
author_rank: Contributor
timestamp: January 05, 2018, 05:35:27 pm
content: Some really helpful posts here.The L298 is out. After a bit of hunting i found the TLE5206 which is a much more efficient, more capable part and also has a few features which means i can condense my design down a lot. 40v, 5a, short circ/overtemp/overcurrent/undervoltage protected as well as motor brake and internal freewheel diodes. For less money than the l298. Thanks for the tip there!This has has a few additional benefits to my design. This part has an open drain 'error signal' pin in its pinout, which means i can doaway with the Isense connection from the previous schematic and use a direct connection from the attiny to the tle5206. This means i can sense over current without having to protect the mcu from motor voltage spikes ect ect.Even more additionally, because the driver has internal freewheeling diodes rated to 5a, i think i can use them, coupled with a fuse, as part of a crowbar circuit for reverse polarity protection for my device. So that does make for a good start on the protection circuitry.Thanks for the tips with the capacitors, implemented.Because i've dropped the Isense line, that only leaves 2 MCU inputs left to protect. I really like the resistor/zener idea (or resistor, TVS, ect). For the sake of 2 components if it protects my 5v attiny from 40v of battery supply then we are definitely onto a winner. (Those resistors values are wrong, i screenshotted to keenly) Truth be told i have never used a tvs or varistor - i am reading and learning about them now. In the mean time i have specc'ed a 5v zener in the schematic but this is obviously subject to change once i begin to elevate myself off of my own self proclaimed status of clueless pleb.

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 05:43:03 pm
content: TLE5206 is still much less efficient,less robustand more expensive than just using mosfets. EDIT, although it has output protection in place.Quote

author: wraper
author_rank: Unknown
timestamp: January 05, 2018, 05:51:15 pm
content: Quote from: iwtommo on January 05, 2018, 05:35:27 pmYou still need 100n for MCU decoupling. And edited caps on your circuit are not polarized.

author: viperidae
author_rank: Frequent Contributor
timestamp: January 05, 2018, 11:05:19 pm
content: What's the spec for minimum voltage? If you use the tle5206, it won't turn on until it gets 5.3v. that means you can't use it for a system with only 5v available, not even for testing. The error output will be active.

author: ConKbot
author_rank: Super Contributor
timestamp: January 06, 2018, 09:55:11 am
content: While not nice on component count or board space, jfets or depletion mode mosfets used as current limiting clamps on IOs can be very effective. Ive used a 350v FET, resistor, and reverse blocking diode to get an optocoupler that could be fed with anything from 2.2v to (in theory) 350v. I only had ~240V of DC power supplies to test it on though. Tried it on 120v mains successfully, but it wouldn't stand up to any transients or surges, so not really appropriate to properly protect against mains.Mind your power dissipation if you're expecting high voltages though.A search for "depletion mode mosfet current limiter" will turn up plenty of appnotes from mosfet manufacturers.

author: max_torque
author_rank: Super Contributor
timestamp: January 06, 2018, 02:34:24 pm
content: IME, the Infineon smart switches and drivers such as the TLE5206 (and the matching 5205 - check the datasheet for the (subtle) difference!) are pretty robust as they are target ted at the OEM automotive sector. I have used them in various projects and they have (so far) been "customer proof".If you want really high current H bridge, you can use a pair of BTN8982 to form a full bridge!I have demonstrated that they are effectively 0 ohm short circuit proof at full rated current (shorting output terminals directly together!) and recover without damage when the short is removed (they also have thermal limitation, but it's better if your control application can spot the short and disable the output before the driver goes into current limitation and then thermal derate)In all cases the power supply needs to be suitably protected (rated TVS) and have sufficient filtering, snubbing and a decent layout to avoid excessive parasitic inductance etc.The one thing to watch out for is that the ratiometric current sense output is not that stable with device current and temperature (you can of course compensate your control uC to deal with these variations if required (requires on board temp sensor) but for precision current control you'll want to add a stand alone current sensing capability and not rely on the built in one.

author: max_torque
author_rank: Super Contributor
timestamp: January 06, 2018, 02:46:56 pm
content: BTW, i forgot to ask, what is the target environment of this product? This makes a big difference as to how "Protected" your device needs to be? ie any way anyone can accidentally wire AC mains to it in any form? Or connect the supply power backwards etc etc. If you protect against the most likely f-ups you will get a lot of real-world robustness for not too much cost.Also, consider, how and when the device can fail under incorrect application! eg, say it's battery powered, and the person installing it wires the supply backwards, you have a choice of a few different levels of robustness0) zero robustness: device goes bang immediately and is permanently destroyed1) some robustness: device blows a replaceable fuse, but that part must be changed to make the device function again2) Partial robustness: Device isn't damage in any way, but stops working during the fault state. When the fault state is removed, device recovers automatically3) Full Robustness: Device ignores fault state, device operates as normally during faultFor example, reverse battery connected:0) unprotected so reverse current destroys power regulation or uC or driver etc1) Protected with a fuse and a crowbar clamp across the supply, fuse blows, must be changed to make it work again2) Protected by a thermal (automatically reseting) fuse and crowbar. Reverse connection trips fuse, which resets when supply is correctly connected3) Uses a fully rectified input. device automatically rectifies the reversed supply and works normallyAlso, consider if you want to be able to tell if your customer has subjected your device to a "prohibited" state, ie connecting it backwards! i often put a small diode and resistor across the supply, that should it be reverse connected, that resistor goes pop as a tell-tail........

author: SparkyFX
author_rank: Frequent Contributor
timestamp: January 06, 2018, 05:53:17 pm
content: Quote from: tggzzz on January 05, 2018, 01:58:27 pmTurns out this is a constant problem in production: if the last thousand were OK, the assumption is the test is broken, not the unit under test.Next is morphing the problem in a way to avoid doing the hard work... by rather blaming/forwarding to internal sources instead of coming up with proper measurements and full documentation of the issue.

author: iwtommo
author_rank: Contributor
timestamp: January 06, 2018, 07:23:06 pm
content: Ha, funny you ask.When i am hacking together electronics projects in the garage my usual plan of attack is to separate the project into modules and then buy each module on ebay. For example, the last project was a wireless 3 phase hydraulic pump for a man sized bottle jack - Sourced all the bits from work, buy the 3 phase inverter, the 24vac power supply module, lowering valve, the 2channel car fob wireless relay module, the contactor, and then buy a few enclosures and wire everything together. Minimal 'design' work required, and doable cheaply using cheap 'industrial lego' boards mentality.This project initially came about trying to drive a Mahle 03F145725G wastegate actuator to replace the boost control solenoid on my Mazda Mx5, using my microsquirt ecu. (i appreciate this will mean more to some than others!) Ive got a 0-12v configuarable output to play with, and a 5 wire box of tricks to connect it to (2 wire brushed motor, 3 wire hall sensor). Looking on ebay, nothing. "Well, ill build one then!"Then a few friends have announced their interest in this little box of tricks, (for various other uses)... "Well sod it ill build a handful of them then"Everyone's recommendations have been really helpful, thank you. Ive attached a picture of what i think is a finished schematic. Well, it is finished, for now, as i've put an order in for 3 at oshpark so its as finished as it gets for now until i manage to break them all in prototyping/testing/ect.F1 is a 5a (? 7.5a?) micro blade fuse. This is obviously for overcurrent protection, and will also blow in reverse polarity situation thanks to the freewheel diodes in the TLE5206. Both the setpoint and feedback inputs have resistors and zeners as an overvoltage/overcurrent protection and the capacitor is there to act as a snubber/low pass filter (values to be tuned as reqd)I think this means that any wiring combination error on P1 is protected for, and the samecan be said for P2 thanks to the setpoint filtering circuitry, the generous output protection of the motor driver, and using D1 and R5 to keep voltages higher than 5v of the 5v rail. Overcurrent on 5v is handled thanks to the vreg and this also has undervoltage lockout should p1 v fall too low.I'll be honest, and it has probably become apparent by now, but maths is not my strong point so little actual engineering has gone into this but i think (barring any other blatant oversights) this is good enough to start testing. Should i need/decide to swap the zeners for TVS's i shall and as above i suspect exact component values will need tuning, but i will probably get there with experimentation (not that this means i am deaf to further/past advice, my ears are always open!)I also had a pin left to use on the mcu so wired that to an error LED - Not certain yet on strategies to use this but im sure something will happen. Oh, and i think ill leave the icsp pads unpopulated on the finished ones of these things i sell. You never knowI believe that, short of connecting this thing up to AC mains or an ign HT lead, i think what i have in there so far is 'enough'.Now would probably be a good time to learn how to code.EDIT: Attach the friggin picture

author: max_torque
author_rank: Super Contributor
timestamp: January 06, 2018, 10:15:00 pm
content: A few things to add for the next respin of the pcb1) Load dump protection (iehttp://www.vishay.com/docs/88387/sm8s.pdf)2) Small low ESR capacitance for the power feed to the H bridge3) Some common mode and differential input filtering to prevent conducted EMC issues propogating upstream from the driver into the rest of the vehicle4) Some series resistance between your input clamping zeners and the micro (as it is, the internal diodes will almost certainly conduct before your external one, defeating the point of having it. I use a split R scheme, ie seriesR -> zener clamp (or diode to vcc and gnd, a BAT54S is handy here) then another seriesR. Depending on the bandwidth requirement of the input, you can run a large total resistance to provide a large over voltage protection. (of course, any analogue input should have a suitable hardware AAF inline anyway, and you can use the C of a RC filter to provide suitable charge for the ADC's sample and hold capacitor to prevent that high input impedance from skewing the results.5) Be careful when programming or when you have the programmer attached to the ISP, as you share these with the PWM output, hence programmer will also drive the H bridge!6) It's generally good practice to use high value resistors to pull signal and data lines to known states during programming/brownout etc.7) you'll have to disable the RESET pin, as your ErrorFlag pulls low

author: wraper
author_rank: Unknown
timestamp: January 07, 2018, 02:46:48 am
content: Quote from: max_torque on January 06, 2018, 10:15:00 pmNice way instantly making the circuit financially non viable. If you sell some industrial stuff for a lot of money, then sure, but otherwise...EDIT, Placing cheap TVS like P6KExx on power is more than enough.

author: wraper
author_rank: Unknown
timestamp: January 07, 2018, 02:51:41 am
content: Quote from: max_torque on January 06, 2018, 10:15:00 pmHow to make vastly inferior protection compared to specialized ESD protection devices and not save any money.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: January 07, 2018, 05:28:22 am
content: In addition to what max_torque said about the series resistance on the feedback and setpoint inputs, I would change those 2.2K resistors to something like 4.7K or 10K. If those inputs ever get 24V+ and assuming you are using common 1/4W resistors, with 2.2K they will be dissipating more than their rating and may burn up if the situation is prolonged.

author: max_torque
author_rank: Super Contributor
timestamp: January 07, 2018, 01:08:19 pm
content: Quote from: wraper on January 07, 2018, 02:46:48 amer, no one said anything about cost! The title of the thread was "how do i protect my circuit from clueless plebs" not "how do i optimise the cost to robustness characteristic for my product"..that ^^ TVS diode is basically industry std in the automotive industry. Open up pretty much any OEM control unit and you'll find one lurking in there (and that's because it's qualified to meet the full ISO 7637-2 and SAE J1113-11 standards for load dump on 12 and 24v (nom) systems. Your dinky little 600w device is going to get vapourised unless you can protect it with some upstream impedance, which for a device that needs significant power (several amps of more) becomes difficult)So, given that OEMs don't like spending money, and want to get every single cent of cost out of their products, do you think they are fitting that "expensive" TVS diode for fun??

author: max_torque
author_rank: Super Contributor
timestamp: January 07, 2018, 01:09:52 pm
content: Quote from: wraper on January 07, 2018, 02:51:41 amexplain your statement please?

author: max_torque
author_rank: Super Contributor
timestamp: January 07, 2018, 01:17:51 pm
content: For "slow" AVR type inputs (analogue and slow digital ones) i regularly use a 4k7 either side of a diode clamp, for a total of nearly 10k total input resistance to the micro pin. Use a suitable capacitor downstream of the resistance to not only provide the necessary AAF, but also to provide de-bouncing / HF noise rejection and a suitable charge source for the ADC's SaH cap etc10k allows for continuous accidental connection to 24v (nominal, up to 32v continous) systems, and in my testing also provides several hundred volts of transient protection (ESD / Load dump etc)