In a project I'd like to control a heating circuit with an SSR, and I'd need a contingency plan for when the SSR fails closed, and the microcontroller cannot turn off the heating element, which would be unsafe.

The easiest option I can see is to have two SSRs in series, and do a check on startup to check that turning off either will interrupt the current, and display an error as well as refuse to operate.

What would be considered best practice here?

  • 2
    \$\begingroup\$ Would a thermal fuse not be appropriate here? It would be easier, assuming you expect the relay not to fail. \$\endgroup\$ – piojo Jan 18 at 3:59
  • \$\begingroup\$ @piojo, somewhat, but for the fuse to melt, the device would have to reach the "danger" temperature once. Might be good to have this as an additional failsafe (because it isn't dependent on the microcontroller). \$\endgroup\$ – Simon Richter Jan 18 at 4:04
  • \$\begingroup\$ install an overcurrent fuse and a crowbar circuit \$\endgroup\$ – jsotola Jan 18 at 4:05
  • 1
    \$\begingroup\$ SSRs more often fail closed. So it is a real concern and you should anticipate it and where possible include a mechanical relay, contactor, or breaker that shuts off the load if and when the SSR fails closed. Sometimes, you can use a quick-break fuse selected so that it allows enough current to meet the load inrush, but won't support the SSR's fail-closed surge current. Use your imagination. perhaps include a bimetal thermostat which will open up if the heating element's temperature rises too much. Etc. But your question is a good one. It will be interesting to see good answers here. \$\endgroup\$ – jonk Jan 18 at 4:09
  • \$\begingroup\$ @jonk, since it's a heating element, there's no difference in current between normal operation (turned on) and failed relay. I have a temperature sensor on the microcontroller though, so I can detect a failed relay rather quickly. \$\endgroup\$ – Simon Richter Jan 18 at 4:14

I would add a normally open mechanical relay in series with the SSR. Let the microcontroller close the relay on boot, and make sure the pin's state is such that the relay is open when the controller boots and before any code runs (most controllers boot with tristated GPIO pins, so add a pullup/pulldown to your relay driver transistor. Do not rely on the software pullup/pulldown to disengage the relay). Enable the watchdog on the micro, so that a reset disengages the mechanical relay if the software crashes.

I assume that you have a temperature sensor for measuring the process parameter. Add a timeout and a threshold to detect a failed open SSR or a misplaced/disconnected temp sensor: When the micro decides to engage the heater and the measured temp does not rise e.g. 2 degrees in 30 seconds, bail out and open the mechanical relay. Also make the micro turn off the relay when the temp is unsafely high. Further, add a temp fuse or temp switch in series with the relay and the SSR with a temp a little bit above the software limit, to disengage the heater in case of fatal damage to the control hardware.


The best solution for this situation is to use the single SSR to electronically control the heater. But then add a couple more items to increase the safety aspect of the product.

  1. Add an AC voltage detector circuit with an optocoupler that feeds into your microcontroller. When ever you have the SSR on have the software look to see that the AC voltage detector shows voltage present. Likewise when the SSR is off have the software check to see that the AC voltage is off. It is a good idea to have the software do the AC voltage checks periodically to detect when the SSR is not maintaining proper operation.
  2. Install a circuit breaker in the AC line in front if the SSR. The best circuit breaker to use for this is one that has a built in solenoid trip circuit that will open the breaker under command of the microcontroller software. You would so this under conditions that the SSR has shown a failed condition according to the monitoring of item (1) above.
  3. An alternate method to provide a somewhat lower cost solution than the remote activated circuit breaker (which can be spendy) is to install a fuse instead of the circuit breaker in the AC line in front of the SSR. You then install an additional circuit that intentionally places a load on the AC line that exceeds the rating of the fuse so as to intentionally blow the fuse where there is a detected fault condition with the SSR.

I do not recommend the idea of placing two of the same SSR in series. Similar components have a risk that they could both fail due to some aberrant condition. It is better to use different technologies for your safety strategy due to overall different failure scenarios for each.


It really depends on whether you are trying to achieve the highest MTBF (which can be applied to each component such as an SSR) or the highest equipment reliability which involves component redundancy used in a design.

The easiest option I can see is to have two SSRs in series, and do a check on startup to check that turning off either will interrupt the current, and display an error as well as refuse to operate.

This is a great strategy overall for high reliability, but is dependent on the absolute stress for each series component. In your case where a heater is involved you need to ensure you lower the stress on BOTH SSR's or else you compromise the achievable reliability.

A heater typically has a significant power up stress profile, it draws much more current at turn-on and until it heats up (3-6 times rated current is not unusual). Since your strategy is to have two in series to increases redundancy both carry the surge current and therefore are exposed to the same stress rating at startup.

  1. To reduce surge current stress, you need to soft start the heater (phase control).

  2. To reduce voltage stress you select SSRs with a higher voltage rating and put surge suppressors across the mains input.

  3. To reduce thermal stress you need good cooling. Hot components have much reduced MTBF rates.

A good place to start is here with Crydoms reliability report.

Since SSRs (Triac and SCR based) typically have quite large voltage drops they can become quite hot and as the graph below shows even 65degC case temperature can significantly reduce the MTBF.

enter image description here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.