Failsafe control lines - Page 1
Forum section: electronics / projects

author: uberblitz
author_rank: Newbie
timestamp: September 10, 2013, 02:14:37 am
content: Hello,I am working on a project that involves turning high current loads on and off in a potentially harsh environment (temperature). In this circuit I have a microcontroller on one PCB controlling relays on another PCB. I am looking for a bit of advice on how to make a failsafe interface to the relays. I would like to make it such that the relay board does not need any digital logic on it (or very little) for simplicity and BOM cost.I would like the interface to be fail-safe against the microcontroller coming out of reset and turning the relays on accidentally, and also I would like it to be fail-safe against the microcontroller locking up or having clock failure or failing from temperature.My first pass attempt at this involved a series of logic gates that needed a specific input combination to produce an output, but that does not guard against the micro going out to lunch.Another idea that I am throwing around is to have a sort of charge-pump setup, where every time through the control task on the micro I would toggle the charge pin, and that would act as the enable line for the output logic. This may work, but it isn't very elegant.Any thoughts?

author: David_AVD
author_rank: Super Contributor
timestamp: September 10, 2013, 02:27:53 am
content: Could you extend that charge pump idea to drive either the relay coil directly or at least its driver transistor?

author: AlfBaz
author_rank: Super Contributor
timestamp: September 10, 2013, 02:35:40 am
content: Quote from: uberblitz on September 10, 2013, 02:14:37 amI actually like this idea. Some supervisory chip, circuit or even another micro that activates a low side mosfet or relay on the common leg of the relays. A simple 8 pin micro can engage in a challenge response scenario that if fails will turn off the common leg to the relays.There are lots of measures that can be implemented but really it depends on your risk analysis for this implementation

author: fcb
author_rank: Super Contributor
timestamp: September 10, 2013, 12:57:18 pm
content: I designed something for the petroleum industry a decade or so ago. The fail-safe was achieved by using two relays in series and driving them both from their own tuned charge-pumps - this was good enough for the regulatory authorities.This doesn't stop badly written code, but we had an external watchdog as well.

author: uberblitz
author_rank: Newbie
timestamp: September 11, 2013, 02:59:00 am
content: How did you tune them? Just a simple RC / LC filter?

author: poorchava
author_rank: Super Contributor
timestamp: September 11, 2013, 11:45:47 am
content: It's also important how you generate the signal for the charge pumps. This has to be done in SW, because if you use hardware (ie. output compare module) a situation may happen where the controller crashes or enters endless loop, but the hardware module still generates the signal to charge pump.Other than that, using strong external pull-down resistors if often helpful.

author: fcb
author_rank: Super Contributor
timestamp: September 11, 2013, 07:27:38 pm
content: Quote from: uberblitz on September 11, 2013, 02:59:00 amFrom memory (it was 1998/99) and I don't have the schematics, the gist is below:1. two lines from the micro (PIC17C756), drove a simple transistor half-bridge on the 12V rail, this was @ ~1KHz.2. the output from the H-bridge went (via a resistor) to one side of a capacitor (C1)3. the otherside of C1 was connected to a parallel LC tank (connected to ground) - 2.2uF & 10mH rings a bell.4. a simple diode bridge rectifier was across the tank, the output of this drove the relay coil.There were some other diodes etc..The basic operation was that a 12Vpp from the half-bridge would drive the LC tank, and at resonance the LC tank would allow sufficient voltage to develop to drive the relay. If you tune the LC right (don't use electrolytics!) it's pretty effective, it's also fairly passive so it's easy to explain.

author: geraldjhg
author_rank: Regular Contributor
timestamp: October 11, 2013, 11:45:40 pm
content: hii would consider auxiliary contacts asociated with the main contactor (very common above certain size)saludos

author: Andreas
author_rank: Super Contributor
timestamp: October 12, 2013, 10:08:45 am
content: Quote from: uberblitz on September 10, 2013, 02:14:37 amDepends on how security relevant the whole thing is.When the risk is high you have much more to do to get out of all single cause failures.- what happens if the voltage regulator has a short between input and output (and kills the processor).- short cirquits or open load (to gnd or supply) on the relay lines between the PCB: do you have to detect it and do countermeasures?- with high risk a charge pump is not sufficient, you might need a watchdog (with own clock) which asks randomly questions to the processor and switches off the load if the question is not answered correctly in a time window. The answer has to be calculated from all security relevant software parts by cryptographic methods so that it is shure that the processor is working properly.- Self test of processor RAM/ROMwith best regardsAndreas

author: bookaboo
author_rank: Frequent Contributor
timestamp: October 12, 2013, 10:20:43 am
content: I'd go for two different micros (preferably different brands and software languages to make sure any glitches are not copied) operating 2 x force guided relays.Feed back one pole of each relay to both relays and have them both monitor each other. For added security use watchdogs as others have suggested.Relays:http://www.farnell.com/datasheets/1651252.pdfRemember all the fancy electronics in the world is null and void if your relay contacts stick undiscovered.

author: Bertho
author_rank: Regular Contributor
timestamp: October 12, 2013, 10:30:15 am
content: Quote from: uberblitz on September 10, 2013, 02:14:37 amAny static system is prone to failure because it is able to lock up in that static state. The standard way is to use dynamic systems, which require signals to change periodically to determine "it is still alive" (f.x. using pulses, AC couplings and current-loop systems).The problem in a control systems (including electronic and mechanic) is that any and all component can fail in a multitude of ways, causing a static state that can then lead to catastrophic result. The mitigation of such state is a question of risk management. The standard way is to use two ore more completely independent systems, and as such have less chance to fail in exactly the same way, reducing the risk. The more independent systems must "agree", the less chance of failure. The independence of those systems is paramount to risk management. That includes independent throughout design and implementation (i.e. not the same location, different PCB, independent power source, different component choice, independent software design/development, etc.).You still only manage risk and reduce the chance of complete failure. You can never eliminate it completely. The amount of residual risk you are willing to accept is often a matter is cost.

author: Rufus
author_rank: Super Contributor
timestamp: October 12, 2013, 02:30:16 pm
content: Quote from: uberblitz on September 10, 2013, 02:14:37 amI designed a watchdog for a large PC controlled test system. The watchdog fed an opto-isolator LED controlling the system power supplies. I used two charge pumps driving both ends of the LED. To be unsafe the watchdog would have fail with the controller generating two ac signals or with two charge pump circuit or cable failures.If the output needed to drive a relay coil I think I would have done the same with higher power charge pumps.