I'm building a device that regulates the atmospheric composition of a space using a gas sensor and a control loop to actuate a solenoid valve to release compressed gas into the space. Due to the nature of this task, it should be clear that such a device could easily create a serious safety hazard if it malfunctions.
Regardless of how reliable or fail-safe a device like this is designed to be, any install of such a device must of course be accompanied by the install of an external gas monitor and evacuation alarm system. However, I don't want to rely on that as the only safety measure. I'm planning for an independent watchdog MCU from the main control MCU for to exclusively perform fault detection, and it's not hard to add an additional interlock relay to let the watchdog MCU cut power when it's in a resettable "soft" fault state.
However, for other fault types (i.e. those that could indicate damage to the device, or where one more fault could allow the device to start reading itself as 'OK' again while operating unsafely), I need a way for the system to cut off more permanently, such that the device will need to be serviced and re-inspected in order to function normally again.
I'd also rather have this happen in a way that's more robust beyond just writing some bits into nonvolatile memory, and put it completely beyond the scope of a mere software glitch or electrical failure to re-activate things.
Right now, the best I've been able to come up with is a crowbar circuit for letting the watchdog MCU intentionally blow the solenoid valve fuse:
I'd have to imagine there's already some kind of device available to do what I want more directly though, and that doesn't depend on having the 24VAC input energized at the point the fault occurs.
What type of device should I be looking at to perform this function instead?
Here's another version that's probably better, fusing the input coil to a single relay and blowing the fuse with the controller's power supply rather than the solenoid valve's power supply; that way the gas controller can present just a single relay output for driving whatever solenoid from whatever power supply.