Emergency Drone Motor Disconnect - Page 1
Forum section: electronics / projects

author: frasdoge
author_rank: Contributor
timestamp: January 23, 2023, 12:58:41 am
content: Hi all,I'm looking to create an emergency disconnect for a drone and its forward flight motors. To keep a long story short, we have a VTOL aircraft that, should it exceed a geofence, must be forced into a glide or otherwise halt forward flight. For aircraft safety reasons there must be an independent system to achieve this if the flight controller is no longer responding, such that it falls out of the sky if necessary.I wanted to poll potential methods of achieving this disconnect. Assume there is an independent control signal in this scenario, such as a transmission from the ground station or a secondary flight controller only responsible for this geofencing etc. The ESC for the forward flight is rated for 60V 160A, but we could expect the forward flight motors to draw 40A on average.Initial suggestions have included disabling the control lines to the ESC via switches, shorting its outputs going to the motor, placing a MOSFET between the battery and the ESC, and creating a crowbar using a MOSFET shunted across the ESC with a fuse.I like the idea of the last solution in that it guarantees a physical disconnect without necessarily destroying the ESC or other components, and just swapping out a fuse on the ground. My concerns are getting the specifics correct such that the fuse blows safely before the MOSFET, and the impact the short may have on the rest of the system until the fuse blows.Would love to hear your thoughts on the most effective means to do this.

author: uer166
author_rank: Super Contributor
timestamp: January 23, 2023, 01:17:16 am
content: I'm not sure if this is 100% appropriate, but I've see it done on redundant power steering systems in EVs, using a full 3-switch disconnect to isolate the motor. There is some public info I found here:https://www.infineon.com/cms/en/applications/automotive/chassis-safety-and-adas/fail-operational-electric-power-steering/#.Basically 3 series switches guarantee that another BLDC driver can engage for a fail operational use case. For you it's much easier, you simply disconnect that and it lets go of the motor completely. Since this is a regulatory issue, doing a full disconnect at the motor such as this would make it easy to prove that it works.

author: moffy
author_rank: Super Contributor
timestamp: January 23, 2023, 01:20:13 am
content: If it is a fail safe situation, I would have something like a MOSFET or relay that has to be enabled to supply power say to the motors. You have to actively turn ON the switch to enable the motors, no signal no power.

author: uer166
author_rank: Super Contributor
timestamp: January 23, 2023, 01:25:52 am
content: Quote from: moffy on January 23, 2023, 01:20:13 amOP has no need for fail operational it seems. I was just providing an example of a phase disconnect system that's already in use in cars all over for a different purpose, so it's proven to work. @OP there are even dedicated phase disconnect gate drives such as:https://www.allegromicro.com/en/products/motor-drivers/bldc-drivers/a6861-a6862. One chip drives 3 FETs. You enable the chip if motor drive is allowed, and disable if not.

author: frasdoge
author_rank: Contributor
timestamp: January 23, 2023, 02:01:02 am
content: In this scenario we're using a set of brush-less DC motors. Linked in are theESCandmotor.My concern with the active MOSFET solution is that it could fail short. Though, considering this is what they're using for the automotive safety application, maybe there's more to it.

author: uer166
author_rank: Super Contributor
timestamp: January 23, 2023, 02:22:08 am
content: Quote from: frasdoge on January 23, 2023, 02:01:02 amFor the automotive case it's not a problem in case of a single fault: you can still keep pushing current through the shorted FET, or switch over to the redundant inverter. In your case, I assume that you don't need single fault tolerance on this system, since it'salreadyredundant.You need to take great care for the avalanche energy here: take the worst case energy that can be stored in the windings, and size FET appropriately to be able to dissipate it. Architecturally, an upstream FET switch probably works better for you, but by doing so, the motors may not coast/windmill as easily since they'll backfeed the ESC. Idk This may matter if you need to glide back to the allowed geofence, less so if you're ok dropping fast.

author: moffy
author_rank: Super Contributor
timestamp: January 23, 2023, 02:26:51 am
content: Quote from: frasdoge on January 23, 2023, 02:01:02 amThen use a relay or multiple switches in series.

author: BradC
author_rank: Super Contributor
timestamp: January 23, 2023, 03:07:39 am
content: Quote from: moffy on January 23, 2023, 02:26:51 amOur old dishwasher used that technique on the heater plate. 2 relays in series, both with different drivers and logic. I haven't seen it done often, but thought it was a pretty good idea.

author: Berni
author_rank: Super Contributor
timestamp: January 23, 2023, 08:27:05 am
content: I would say the easiest thing is to cut the DC power input to the ESC.No mater what failiure the ESC won't be able to put power into the motor if it has no power input. Sounds like this is a last resort emergency safety measure that can be a one shot deal. For that a MOSFET shorting out the power and blowing fuses seams the best solution. The MOSFET doesn't have to actively carry current in normal operation so it doesn't introduce extra losses while it is a good idea to have a fuse anyway (especially since batteries can supply a ton of current and ESCs can easily fail short).This can also be a two stage system where the ESC is first asked nicely to turn throttle back to zero, and monitoring the battery current. If the current doesn't fall to near zero within a few seconds then it assumes the ESC has gone unresponsive and throws in the short across the DC rail to kill it for good.

author: frasdoge
author_rank: Contributor
timestamp: January 24, 2023, 02:02:25 am
content: The shunt MOSFET + fuse configuration is what I was originally looking towards. Sizing of the components is something I am not familiar with however.Taking a look I've come across somefast-acting semiconductor fuses. At 40A average current (I'd test to see what we peak at), I'd select say a 60A fuse from this line so it doesn't accidentally blow.From the typical loss figures of those fuses I'd expect around 2.5mOhm effective resistance + 3mOhm from the MOSFET = 5.5mOhm. The battery maxes out at 50C 23Ah = 1150A which would be achieved in this instance. That looks like it would blow the 60A fuse model in 2ms.What parameters of the paired MOSFET do I need to consider here? It would need to last 'significantly' longer than the fuse such that the fuse is guaranteed to open. Ideally it would remain undamaged such that the fuse can be replaced and the aircraft relaunched. Living for 2ms is very short but 4kW of I^2R losses is also significant.

author: Berni
author_rank: Super Contributor
timestamp: January 24, 2023, 06:24:17 am
content: That is a rather beefy fuse for this application (They are rated for interrupting 50kA of fault current at 500VDC). You can probably get away with much smaller fuses, but doesn't hurt to have extra safety margin.For the MOSFET you just want a device with a high rated peak current rating (into the high 100s of amps) you also want something with a high avalanche energy (into the Joules) so that it survives the turn on pulse. At these speeds actually cooling the MOSFET is useless, it has to use its own thermal mass to absorb the energy since there is not enough time for heat to flow any significant distance. You also want to turn on the MOSFET as fast as possible, for the large MOSFETs this might mean pushing a few amps worth of current into the gate.You could possibly limit the current the MOSFET has to survive by giving it some series resistance. Something like a high current shunt resistor is a good choice for that, giving you some 10s of miliOhms while being designed to handle the high currents. This could reduce the peak current trough the MOSFET and since the shunt is then the highest resistance component most of the voltage will appear across that, so most of the heat from the energy of the pulse ends up in the robust shunt resistor rather than the switching transistor.That being said MOSFETs fail into a short circuit most of the time (unless you have enough current to literally explode it to bits) so even if the MOSFET dies in the middle of trying to blow the fuse, it will turn itself into a short and blow the fuse anyway. Only issue there is that upon replacing the fuse it will instantly blow again since the transistor is still shorted. So both the fuse and transistor would need to be replaced

author: Jon_S
author_rank: Contributor
timestamp: January 24, 2023, 11:16:55 am
content: For solutions that cut the DC-bus to the motor controllers, there are a couple of methods other than a crowbar approach that might be of interest.You could consider a 'logic fuse'/'externally-triggered fuse'. We use them for Lithium pack secondary protection, a small heater energised via a third terminal blows the fuse in an emergency.https://atcsemitec.co.uk/reliable-secondary-protection-for-battery-packs-in-high-current-applications/I haven't personally seen any rated above 45A though.Littelfuse have some chunkier ones!https://www.littelfuse.com/products/battery-protectors/itv-three-terminal-fuses.aspxAnother option might be the pyrotechnic disconnects used for EV applications, they may be prohibitive on size/mass though:https://www.autoliv.com/safety-solutions/pyrotechnical-safety-switches

author: Psi
author_rank: Super Contributor
timestamp: January 24, 2023, 11:23:26 am
content: You could have a small sail winch servo (or even a normal servo) with its internal controller removed so you can just drive the motor with DC to start it winding.Then, if you want to cut power, you apply DC power to the servo motor and the winch servo spool winds up a cable that unplugs the XT60 battery connector.It's a pretty low tech and simple solution.Sail winch servos are be nice as they have spools to wind up cables, but in theory you could make it work with any servo if you have a big enough lever-arm.Without the servos internal controller you might have issues hitting the servo end stops. But if it cuts power its going to stop the servo anyway. You'd have to remember to wind the servo back to the correct position if you wanted to fly again after a trip had occurred.Maybe its easier to leave the electronics in the servo intact and just build a circuit/MCU to drive the servo normally with a servo signal.

author: buta
author_rank: Contributor
timestamp: January 25, 2023, 10:37:57 am
content: It sounds like the ground controlled termination system (the kill switch) in rockets. A VTOL drone loses its airspeed when the pusher stops (and assume the VTOL motors are off when cruising), the drone properly will dive and results a intentional crash.Above fellows already suggest various solutions. When determining the merit of each solution, it depends on the system requirements, what is the requirements e.g the weight / size budget and reliability?OP mentioned the ECS spec is rated for 60V 160A and the average motor current is 40A. If designing the fuse / crowbar, what is the rating of the fuse OP will select to ensure the fuse will not blow under any normal operations except halting forward flight? I answer this question because I observe current spikes exceeding the ESC rating current when testing some COTS ESCs, BLDC motors and pushers.I agree Berni states "MOSFETs fail into a short circuit most of the time". However will "most of the time" meet the reliability requirement of a safety feature? What OP will test to show CASA the fuse / crowbar will behave as expected?Is this requirement "must be forced into a glide or otherwise halt forward flight at geofence" one of the outcomes of the CASA's SORA process to assess some specific drone applications (e.g. BVLOS)?I like the EV protection devices.

author: oz2cpu
author_rank: Frequent Contributor
timestamp: January 25, 2023, 11:24:23 am
content: it is a bad idea to "cut" the 3 wires to the motors, they contain AC and it is also a bad idea EMC wise,much smarter to cut/control the power to the motor supply rail or ground rail, it is DC and you only need ONE mosfet to handle that.just select a mosfet that is overrated for the job, and test its function at every power on sequence,to prove it is still opperational. a pass will let you lift off

author: Doctorandus_P
author_rank: Super Contributor
timestamp: January 26, 2023, 12:18:37 am
content: I'm with Bernie to add a series resistor. It could be simple piece of copper or steel wire, and then make it so that you draw at most 200 A or so out of the battery. The "cement" resistors are cheap and have a bit of mass that needs to heat up, and this takes more energy, so it probably wont get very hot even if the fuse takes a second or so to blow.MOSfet's that can handle 300A safely for a short time are readily available. When you want to stop that much current quickly then even small inductances (such as just from the wiring itself) can become a problem.

author: Siwastaja
author_rank: Super Contributor
timestamp: January 26, 2023, 01:44:15 pm
content: Quote from: Doctorandus_P on January 26, 2023, 12:18:37 amResistive current limiting is completely impractical. OP did not state voltage, but assuming 20V, R would be 20V/200A = 0.1ohms. With OP's specified 40A average current draw, the resistor would dissipate (40A)^2 * 0.1ohms = 160W during normal operation. This would seriously sacrifice the efficiency, and also require active cooling, which then increases weight.However, the idea of havingsomeseries resistance can be utilized when designing the cutoff circuit. Relays and fuses have maximum interrupt capability. MOSFETs have SOA curves. So you have to know what will be the maximum current (short circuit current) you will ever be dealing with.And if the intention is to protect against shorted ESC, this is the series (sum) of* battery DC ESR (with a fresh battery, at high temperature like +50degC, when it's lowest)* wiring R* fuse R* Rds_on of the MOSFET or Rcontact of the relay of the protection circuit itself* Any current sense resistors,* Any added explicit current limiting resistorIf the intention is to be able to cut power to the ESC when the ESC is functional (while allowing the protection circuit to fail short if ESC fails short; it can't rotate the motor then anyway), then add to that sum the parallel combination of (ESC input capacitor ESR) || (motor winding resistance + 2*Rds_on of the ESC MOSFETs). Or something like that - do the thinking thoroughly.I did once design a semiconductor based switch for a robotic application which was kinda safety critical. I tested it thoroughly with short circuits of various resistances, inductive and capacitive loads, and during testing, including early development, never blew a single MOSFET. And it wasn't that difficult - basically just understand what the SOA curve is and respect it. I used current sensing over the combined resistance of fuse + Rds_on of the back-to-back MOSFETs, fed this to a comparator which then pulled down the gate. The key to success was modeling all relevant datasheet parameter worst case (MIN/MAX) values and their combinations in Excel, which resulted in quite large spread in triggering current, but that is OK as long as worst case is well within SOA curves.Additional idea I used was using all N-channel MOSFETs, which require higher than V_battery gate supply, and provide this supply by MCU toggling a simple single transistor charge pump on a GPIO pin. Code that turned the IO high/low was divided in two different parts of code, with some self-checks, so that haywire code is very unlikely to keep toggling the charge pump. After a few dozen milliseconds in either state, capacitor at Vgs runs out, Vds starts to increase and then the desaturation comparator pulls the gate down quickly.QuoteOr even 1000A. That's not a problem. But this time will be very short, maybe just tens of microseconds. Always check the SOA curves.

author: Berni
author_rank: Super Contributor
timestamp: January 26, 2023, 01:53:06 pm
content: Quote from: Siwastaja on January 26, 2023, 01:44:15 pmThe idea is to add the resistor in series with the MOSFET that causes the short across the supply rails. The actual ESC and battery would be directly connected with just a fuse between them.Basically the MOSFET would place the resistor across the power rails like it is a resistive load. This would draw a few 100s of amps from the batteries and blow the fuse in the process. The resistor is what determines the current that can flow, so that way the MOSFET doesn't get to experience the full wrath of the batteries short circuit current capability (that may be like 5000A or something)So this way there is no extra power loss in the system under normal operation. The only power loss in normal operation is the resistance of the fuse, but you want to have a fuse anyway so not like you can optimize that out.

author: Siwastaja
author_rank: Super Contributor
timestamp: January 26, 2023, 02:12:54 pm
content: Quote from: Berni on January 26, 2023, 01:53:06 pmOh, I missed the context because both series switches and crowbars have been discussed.With crowbar idea, I would be careful with added resistance, too. This only slows down the fuse from blowing up and makes the crowbar switch (MOSFET, DIAC or TRIAC) see the smaller current for much longer time, for somewhat similar I^2t (fuse behaves that way, after all).I do see the resistor as added risk because now you are dissipating so much more heat during significantly longer time (probably many seconds), so you either need to heatsink it, or use a physically massive resistor, or you risk overheating and blowing the resistor in open-circuit, in which case crowbar goes nonfunctional. With less R_crowbar, the ratio between R_fuse : R_crowbar and therefore P_fuse : P_crowbar, is on the side of fuse - make the fuse dissipate the energy, not the crowbar.Very small amount of R might be a good idea in some cases yes, but don't overdo it, make sure the fuse blows quickly (and that the battery has enough short circuit current available to blow that fuse). Maybe aim for at least 10-20*I_n of the fuse.Then again, the fuse is probably as expensive as the complete crowbar circuit, so I would just make the whole crowbar module (fuse, MOSFET/thyristor, control) a replaceable module, in which case it does not matter if the semiconductor switch fails short. One still needs to be sure it does not fail open, which can happen if it's seriously undersized - it first blows short, then open. But dimensioning which would be marginal for a series switch, would work for a crowbar just fine; it's extremely unlikely to blow open circuit, and if it fails short, just replace it.

author: Berni
author_rank: Super Contributor
timestamp: January 26, 2023, 03:40:25 pm
content: Yes one would want to choose a resistor value low enough so that it blows the fuse in under 1 second. We still want to really overload the fuse by a lot, just not be at the mercy of many 1000s of Amps that the battery might be able to give as this might get into MOSFET physically exploding territory.While yes this does mean the time is longer but the heat disipation in given resistance is I^2/R so reducing the current has a drastic effect. Power resistors in the miliOhm range are pretty much bars of metal aloy, so there is a lot of thermal mass there to take up the energy before they would get to metal melting temperatures. Point is the large bulky power resistor absorb more of a energy pulse than a transistors tiny piece of silicon. Additionally MOSFET transistors at some point saturate there channel at large currents, this means there channel resistance starts to rise as you increase current (and so shifts the power dissipation over to the transistor again)Tyristors are a good idea too. They are capable of handling massive peak currents, and you do want it to stay turned on until the fuse blows anyway.

author: Siwastaja
author_rank: Super Contributor
timestamp: January 26, 2023, 04:10:01 pm
content: Another reason to use a thyristor is the simplicity of drive - it stays on after a gate pulse as long as the fault current flows. You only need the trigger. Very widely seen in crowbars.

author: berke
author_rank: Frequent Contributor
timestamp: January 26, 2023, 06:22:08 pm
content: Quote from: Jon_S on January 24, 2023, 11:16:55 amThat's really neat, I was wondering if that kind of thing existed.The Littelfuse ones seem to take "<1 min" to operate, however.

author: frasdoge
author_rank: Contributor
timestamp: January 27, 2023, 01:08:11 am
content: Having difficulty finding anything on the cheap that will do the job in a single MOSFET or thyristor.High current MOSFETs might claim 300A but then are lead-limited to 160A. Thyristors are looking at hundreds of dollars. Maybe I'm just not getting the parametric search right?A few MOSFETs in parallel with a shared gate seems straight forward to me. Might introduce issues with load balancing between them? Not sure if there's other unforeseen issues with that.

author: james_s
author_rank: Super Contributor
timestamp: January 27, 2023, 01:34:39 am
content: What about cutting power to the microcontroller in the ESC? A brushless motor cannot possibly run without the micro operating.

author: frasdoge
author_rank: Contributor
timestamp: January 27, 2023, 04:40:03 am
content: I'm not sure about cutting the ESC's microcontroller power - is that possible given the model linked in?

author: buta
author_rank: Contributor
timestamp: January 27, 2023, 05:59:50 am
content: Most of COTS ESCs have only 2 wires from batteries so cutting ESC's MCU power requires to modify the ESCs. OP's ESC is 60V 160A, it should have a voltage regulator to supply the MCU (60V to 3.3 V, 5 V or ..., linear or SMPS). You can try to add a control signal to the voltage regulator circuit (if possible) to disconnect / disable the MCU supply.If OP designs the fuse / crowbar, what is the rating of the fuse OP will select to ensure the fuse will not blow under any normal operations except halting forward flight?I like the following EV protection devices.Quote from: berke on January 26, 2023, 06:22:08 pm

author: Berni
author_rank: Super Contributor
timestamp: January 27, 2023, 06:58:35 am
content: Quote from: frasdoge on January 27, 2023, 01:08:11 amFor a short while it is fine to exceed that since it would take a while for the pin to melt. Go ahead and try to calculate what is the width of PCB traces required to carry such currents. You will get ridiculous numbers that don't even make sense. In reality you can just add lots of solder on them to give them thermal mass (Yes i know it does almost nothing for trace resistance, that is not the point here) and it will hold for the 10s or 100s of miliseconds it needs to survive it for.Tyristors are not that expensive. Here is one that can do 700A peak for under 3 bucks:https://www.digikey.si/en/products/detail/ween-semiconductors/BT155W-1200TQ/6680528As for current sharing you can use the miliohm resistor that limits the current as separate resistors at each MOSFET to make each one of them see the same current. Each resistor can be smaller then

author: james_s
author_rank: Super Contributor
timestamp: January 27, 2023, 07:42:55 am
content: Quote from: buta on January 27, 2023, 05:59:50 amObviously it would require modifying the ESC, is that not an option?

author: Jon_S
author_rank: Contributor
timestamp: January 27, 2023, 09:32:34 am
content: Quote from: berke on January 26, 2023, 06:22:08 pmThe datasheet terminology is terrible, that 'cut time' at <1min is for a 2xIratedoverload, not a cut via the heater.The heater cut time depends on the heater power you can provide and the fuse size. They have graphs in each datasheet. It depends on the fuse size too, but they all seem to be under a second at reasonable heater powers. The little ones we use measured at about 100ms, from memory, with the heater being driven full chat.Thinking about this application more, I would personally go for a pyrotechnic disconnect on the DC bus to the ESCs. It is the option that would cause the least hassle during an FMECA.

author: Siwastaja
author_rank: Super Contributor
timestamp: January 27, 2023, 10:00:42 am
content: Quote from: frasdoge on January 27, 2023, 04:40:03 am1) Find the 3.3V regulator on ESC board2) Short the output with a MOSFET3) ???4) Profit

author: buta
author_rank: Contributor
timestamp: January 27, 2023, 10:11:46 am
content: Quote from: james_s on January 27, 2023, 07:42:55 amTechnically it is a viable option for hobbyists.But will it be a viable option for a commercial product, bothbothtechnical and commercial requirements should be considered, e.g.will it void the ECS warrantywill it require re-testing for safety, EMC, ...will it pass the reliability assessmentwill it be cost effectivewill the supplier develop a new model with OP's required safety feature if OP buys few K's per year...

author: james_s
author_rank: Super Contributor
timestamp: January 27, 2023, 05:56:45 pm
content: If it's a commercial product then have a batch of custom ESCs made. Many ESCs bring the 5V out on the input connector to power the radio receiver in a conventional model airplane, on that type you can short this to ground.

author: buta
author_rank: Contributor
timestamp: January 27, 2023, 11:12:42 pm
content: Quote from: james_s on January 27, 2023, 05:56:45 pmIt is Battery Elimination Circuit BEC which is common in RC planes' ESC.I tested some high power ESCs from US, China and oz for heavy lift uavs, per my limited observations none of them has internal BEC. I have not updated my ESC knowledge for a year, if you find high power ESCs with internal BEC, could you share with us.