3
\$\begingroup\$

I want to do a relays output with enhanced safety level (redundancy and EDM).

For that, I plan to use two force-guided relays driven each by N-channel MOSFETs. However, I'm wondering if I can use only one MCU outputs to drive these two MOSFETs or if I should use one MCU output by MOSFET.

Can I assume the MCU transistor output will never be shorted when used to drive MOSFET ? Or should I use two MCU outputs (one per MOSFET).

Here is my schematics :

  • Relay1 is the MCU output
  • Relay_1_EDM is connected to MCU input and is used for External Device Monitoring
  • START_STOP_COM and START_STOP are the relay output with enhanced safety level

EDIT :

This device is intended to be used on a crane.

Currently, this crane works with a button box without any safety at all (except limit switches). It has a power line contactor driven by a start button with self-maintain and a stop button Each motor has its contactor. There is any E-stop, external monitoring on contactor or safety device.

Crane schematic can be viewed below : enter image description here

My work is to replace the button box by a radio remote.

In order to have a safe communication between RF remote and station, the station MCU will send a heartbeat with nonce (autoincrement byte) and the remote MCU should reply to this heartbeat with the right nonce value within a timeout delay. In case of problem, the station MCU will stop the crane by acting on the power line contactor (On the schematic above, START_STOP will be connected to terminal 3 and START_STOP_COM to terminal 1 which is connected to P power line contactor coil).

This is why I need this output with enhanced safety level.

For now, I think the redundant force-guided relays output with EDM and, as proposed by Dan, driven with two charge pump (one for each relay) and two MCU outputs would be a good solution. I would also include the crane power line contactor monitoring into the EDM.

\$\endgroup\$
5
  • 1
    \$\begingroup\$ I think it would be worth expanding your post to explain what the device will be used for and what safety category you are trying to achieve. Maybe an expanded schematic too, showing the complete setup - at least in block form. \$\endgroup\$
    – Transistor
    Oct 18, 2017 at 23:13
  • \$\begingroup\$ I edited my post to give some explanation on the application. \$\endgroup\$
    – Loïc GRENON
    Oct 19, 2017 at 16:26
  • \$\begingroup\$ I love the wasp on the drawing. I think that's a first! \$\endgroup\$
    – Transistor
    Oct 19, 2017 at 17:23
  • 1
    \$\begingroup\$ What is EDM in this context? \$\endgroup\$
    – pericynthion
    Oct 20, 2017 at 2:32
  • 1
    \$\begingroup\$ EDM stand for External Device Monitoring. It will monitor safety circuits and let the user know if a relay has any issues, such as a welded contact. \$\endgroup\$
    – Loïc GRENON
    Oct 20, 2017 at 6:22

4 Answers 4

Reset to default
6
\$\begingroup\$

I would never assume any such thing in a safety critical application, and in fact would probably be getting rather more serious about my stuck relay detection as well (You want to be able to detect if any relay is not in the expected position, not just that BOTH have failed).

Further, I would be very nervous about a situation where a micro pin in a steady state could cause a dangerous condition, far better to use a charge pump to drive the mosfet gate so that to engage a relay the processor must keep a pin (or better, two) toggling at a few kHz (And do the toggling from within the main loop), this means that a failed program will probably cause the relays to drop out.

One further thought, remember that testing a non trivial program for "If A and B and not C then D within 100ms" is straight forward, what is much harder is proving that D ONLY occurs if A and B and not C.... The state space for that is MUCH larger.

I hope your software development process (And requirements process) is suitably robust for this sort of safety critical work.

Editing to add a charge pump example...

schematic

simulate this circuit – Schematic created using CircuitLab

In reality I would probably use a dual diode in a SOT23 or such and the cap values will need tuning to taste, but it gives the basic idea.

The resistor discharges C2 making the relay turn off shortly after the pulsing goes away on the micro pin.

\$\endgroup\$
9
  • \$\begingroup\$ The External Device Monitoring will let me known when one relay has failed, not both. In normal operation, RELAY_1_EDM should be the reverse state of RELAY_1. This condition can not be met is one relay is stuck at its position. Right ? \$\endgroup\$
    – Loïc GRENON
    Oct 18, 2017 at 16:31
  • \$\begingroup\$ As you have drawn it, EDM only signals if BOTH relays are stuck, you need the contacts 21,22 wired in parallel between the two relays not series if you want to detect a single stuck relay. I would actually monitor the two relays separately, that way I can detect stuck in either state, but whatever works. \$\endgroup\$
    – Dan Mills
    Oct 18, 2017 at 16:47
  • \$\begingroup\$ @LoïcGRENON actually RELAY_1_EDM only tells you if that side of the relay works. The signal from that may be fine but the START_STOP signal could be stuck on or off. \$\endgroup\$
    – Trevor_G
    Oct 18, 2017 at 17:14
  • \$\begingroup\$ @Trevor The OP has specified relays with force guided contacts, which by design cannot have one contact set NC active while the others NO is still active or vice versa, that is the whole point of the things. Expensive, and actually generally less robust then the normal kind, but the monitoring contacts will not change over if the power contacts are welded. \$\endgroup\$
    – Dan Mills
    Oct 18, 2017 at 17:19
  • 1
    \$\begingroup\$ Not PWM as such... You want something toggled by your main program loop, not by a hardware PWM or interrupt that may continue to run with the main loop crashed. Use a charge pump (two caps, one dual diode, a resistor or two) to produce mosfet gate voltage only if the micros pin is toggling, it has the advantage that it is a passive network and can be verified on system startup. \$\endgroup\$
    – Dan Mills
    Oct 18, 2017 at 18:36
1
\$\begingroup\$

You should look for safety MCU, like TI's Hercules R-ARM MCU or some other manufacturer if you want to have a safety output.

But maybe the most viable solution is to use a attested safety relay that you can buy.

\$\endgroup\$
7
  • \$\begingroup\$ Using a safety relay is not a solution for me because this kind of device needs generally two inputs (channels) to work : how to drive theses inputs ? From MCU output so we return to the same problem. \$\endgroup\$
    – Loïc GRENON
    Oct 18, 2017 at 21:25
  • \$\begingroup\$ @LoïcGRENON Generally the MCU/PLC is not a safety device and it can't be trusted. Therefore all the safety switches, E-Stop,..is wired directly to the Safety relay, that outputs a monitor signal. However you can place a two contact relay in the safety chain with NC contacts, then issue a command from PLC to break up the chain -but this is rather an enhancement to stop the machine even if all safety switches are in the safe position, something like safety zone keylock. \$\endgroup\$
    – Marko Buršič
    Oct 19, 2017 at 9:17
  • \$\begingroup\$ @LoïcGRENON Anyway, what are the conditions that make the need of machine to emergency stop? Those conditions (switches) have to be safety approved. \$\endgroup\$
    – Marko Buršič
    Oct 19, 2017 at 9:23
  • \$\begingroup\$ I edited my post to give some explanation on the application. \$\endgroup\$
    – Loïc GRENON
    Oct 19, 2017 at 16:26
  • \$\begingroup\$ @LoïcGRENON 1. Buy a crane controller, 2. use a safety relay, wire E-stop button, rest button, safety limit switch, power contactor and remote control with E-stop relay output. 3. instead of safety relay use a safety PLC (the expensive solution) like S7-1200FC , same as 2. \$\endgroup\$
    – Marko Buršič
    Oct 20, 2017 at 7:21
0
\$\begingroup\$

Why stop there?

Micro is a single device that can fail.. so how about doubling up the micro.. and then maybe the power supplies, backup power generator... and on and on. How far back do you want and can you afford to go....

Doubling up is really not a great safety approach. Better to have something else monitor and some other shutdown method.

Further, having the Micro, or even another independent circuit have the ability to monitor the outputs and that things are switching as expected is prudent. Better to detect a fault and, if need be, crow-bar a fuse than rely on doubling up.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ Usually there is one state that is considered safe, the art is not zero failures, but to ensure so far as is possible that the failures fail to the safe state. Power is easy, you make the safe state the one that the relays and contractors default to in the absence of power. Micros are a bigger can of worms, but there are standard best practises at least for SIL 3 stuff, SIL 4 you are into redundant controllers and voting logic, which is a pain in the arse. Safety in design is very much a systems issue and while high rel micros and protection from SEU is part of that, it is only a part. \$\endgroup\$
    – Dan Mills
    Oct 18, 2017 at 16:58
  • \$\begingroup\$ @DanMills well said, that was my point. \$\endgroup\$
    – Trevor_G
    Oct 18, 2017 at 17:03
0
\$\begingroup\$

I agree with all points made by Dan Mills.

  1. Both transistors can fail open or short. With the right impulse they'll probably both fail the same way.
  2. Both transistors are fed from the same output. This is a critical design flaw.
  3. CORRECTION (from original post). The 21/22 contacts are correctly shown in series. Normally these are used to ensure both drop out.
  4. For fault indication a parallel pair of normally-closed contacts could be used.

See my answer to Symbol or marking on safety relay for an in-depth explanation of a dual-channel safety relay and make sure you understand the principles of operation.

\$\endgroup\$
6
  • \$\begingroup\$ I do not agree with the point 3. With contacts in series, I can know in one relay is stuck when RELAY_1_EDM input is not at the reverse state of the RELAY_1 output (within the relay commutation time, of course). In parallel this failure will be masked. Point 2 is exactly the point of my answer ;) \$\endgroup\$
    – Loïc GRENON
    Oct 18, 2017 at 16:40
  • \$\begingroup\$ Not seeing it, if relay one welds in the on state, how can you detect this? Relay 2 is still switching normally and is in series with the EDM signal. With the 21/22 contacts in parallel between the two relays, either relay sticking on will cause EDM to be active when you switch off the drive, which is a fault condition and should latch an inhibit into the system. Of course you cannot detect a relay stuck in the off state this way, but that is usually the safe state unless you are doing reactor cooling or something. \$\endgroup\$
    – Dan Mills
    Oct 18, 2017 at 16:52
  • \$\begingroup\$ @DanMills: if relay one welds in the ON state, when RELAY_1 become at OFF state, RELAY_1_EDMwould not be at ON state (5V) so RELAY_1_EDM is at the same state of RELAY_1, so I can detect this failure. (However, it would be good to connect relay pins 24 to GND, to ensure the OFF state). I also can detect a relay stuck at OFF state. With contacts in parallel, the failure would be masked ! I think I misunderstand what you really want to say. Do you agree that you are telling me to connect the pin 22 of each relay to 5V and the pin 21 of each to RELAY_1_EDM ? \$\endgroup\$
    – Loïc GRENON
    Oct 18, 2017 at 17:41
  • 1
    \$\begingroup\$ I would have probably connected 21 on both relays to 5V, then monitored 22,24 on both relays (4 inputs total) but I like belt, braces and string, that way your trousers don't fall down... Looking again at your circuit I can see the logic, embarrassingly I misread the wiring! \$\endgroup\$
    – Dan Mills
    Oct 18, 2017 at 18:51
  • 1
    \$\begingroup\$ Sorry, all. I am short of sleep. I've made a correction regarding the normally closed contacts. Again, sorry for the confusion. \$\endgroup\$
    – Transistor
    Oct 18, 2017 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.