Failsafe parallel reduntant circuit schematic opinions? - Page 1
Forum section: electronics / projects

author: RNorton84
author_rank: Newbie
timestamp: October 06, 2016, 02:27:43 pm
content: This is my first foray into electronics and schematic design so be gentle on me, apologies if I have over looked something simple. That said I am designing a circuit for use in an ignition system that must have some redundancy and be +3.3V logic controlled. I've included a PDF of the circuit in question, follows is a list of the components I have specified.Q1-4Fairchild FQD8P10TM_F085Digi-Key FQD8P10TM_F085CT-NDQ5-6NXP BCW31.215Digi-Key 568-6119-1-NDI've tried running a simulation with components that are fairly close with good results but I feel like the circuit is missing somethings. Ideally I would like to ESD protect the INPUT and OUTPUT but that is beyond what I have learned. Anyone care to take a look at this and see if they have any comments or concerns?

author: RNorton84
author_rank: Newbie
timestamp: October 06, 2016, 03:04:58 pm
content: I've debated with myself on this quite a bit and the best answer I can give is that I want to avoid loss of proper operation with a single point failure. The circuit is designed to ensure that the switch will behave as commanded by logic during any single point failure mode (which can be identified with separate feedback circuits).The circuit is controlled manually by a switch so the risk of accidental ignition turn on is low regardless of failure mode. Also, I've intentionally used a pull up resistor on Q5 so that if the micro-controller fails the circuit will fail closed and follow the operation of the mechanical switch.At this point I am concerned that the components I've specified may not behave like I expect them to. Reading a MOSFET datasheet makes my head hurt just thinking about it.Also "IGNITION" refers to a automotive style ignition system, this circuit is a part of a larger automatic engine shutoff device.

author: Ian.M
author_rank: Super Contributor
timestamp: October 06, 2016, 03:25:20 pm
content: One MOSFET fails with blown gate oxide. This takes out its driver transistor which is likely to fail S/C, dragging down the gate of the other MOSFET on the same side. Depending on the resistance of the blown gate, this can either leave the input shorted to ground or the output permanently on. To cure this you need resistors between each individual gate and the driver transistors, and either they have to be high enough value to survive indefinitely with the full supply voltage acrooss them, or they need to be fusible and the driver beefy enough to pass their fusing current without damage.However there is another issue: How do you plan to detect a single component failure? If you cant detect it, its going to stay in service until another fault causes total failure.

author: RNorton84
author_rank: Newbie
timestamp: October 06, 2016, 03:41:06 pm
content: Quote from: Ian.M on October 06, 2016, 03:25:20 pmThat is an interesting view and one that I will take a look at, that is partly the reason I've come here. Your comments highlights the vulnerability of Q5 or Q6, either one of those fail and the circuit will fail to shutoff in some cases.To answer your last question, there will be feedback loops going to the various parts of the entire circuit monitored by a micro-controller. During each power up cycle each side of the circuit will be switch on/off independently as well. Some of that circuitry is not shown, partly because it clutters the picture and partly because I feel like I understand them better.

author: max_torque
author_rank: Super Contributor
timestamp: October 07, 2016, 12:48:44 pm
content: Some more questions:1) Define "safe". Nothing is 100% safe. Everything has a failure probability. Usually, dual redundancy isn't "safer" than single because it leaves you with no overall valid state. Most redundant systems are triple redundant, so the majority vote can be determined. Unless you can tell what is a failure and what isn't then there is no advantage, and the extra complexity could actually bring more failure modes and an overall lower level of robustness.2) If you are simply trying to make your system more reliable, you've be better off just fully optimising as few components as well as possible, by specifying them carefully and controlling their environment as well as possible. Adding more components just adds more failure modes and a very similar overall probability of failure3) You say this is for automotive use. Well, the components in the host vehicles systems are almost certainly not dual redundant, they are just very well specified and very well tested / validated. Redundancy does not remove the requirement for robust validation!IME, outside of some very specific circumstances (aeronautics/space and certain Military systems) after anaylysis, the KISS (Keep It Simple Stupid) priniciple also works to bring the highest overall level of robustness