Intentionally tripping a fuse to disable a circuit in an unrecoverable fault condition?

Question

I'm building a device that regulates the atmospheric composition of a space using a gas sensor and a control loop to actuate a solenoid valve to release compressed gas into the space. Due to the nature of this task, it should be clear that such a device could easily create a serious safety hazard if it malfunctions.

Regardless of how reliable or fail-safe a device like this is designed to be, any install of such a device must of course be accompanied by the install of an external gas monitor and evacuation alarm system. However, I don't want to rely on that as the only safety measure. I'm planning for an independent watchdog MCU from the main control MCU for to exclusively perform fault detection, and it's not hard to add an additional interlock relay to let the watchdog MCU cut power when it's in a resettable "soft" fault state.

However, for other fault types (i.e. those that could indicate damage to the device, or where one more fault could allow the device to start reading itself as 'OK' again while operating unsafely), I need a way for the system to cut off more permanently, such that the device will need to be serviced and re-inspected in order to function normally again.

I'd also rather have this happen in a way that's more robust beyond just writing some bits into nonvolatile memory, and put it completely beyond the scope of a mere software glitch or electrical failure to re-activate things.

Right now, the best I've been able to come up with is a crowbar circuit for letting the watchdog MCU intentionally blow the solenoid valve fuse:

^{simulate this circuit – Schematic created using CircuitLab}

I'd have to imagine there's already some kind of device available to do what I want more directly though, and that doesn't depend on having the 24VAC input energized at the point the fault occurs.

What type of device should I be looking at to perform this function instead?

---

Here's another version that's probably better, fusing the input coil to a single relay and blowing the fuse with the controller's power supply rather than the solenoid valve's power supply; that way the gas controller can present just a single relay output for driving whatever solenoid from whatever power supply.

^{simulate this circuit}

Answer 1

A fuse will probably work, but that's not how it is done in industry. For starters, you have to deal with replacing a fuse each time there is a fault. I worked on steel annealing furnaces where the possibility of explosive gases building up and exploding could potentially happen if it weren't for all the safeties being designed into the system. I can tell you some of the ways they did it, and some of the ideas can be incorporated into your design. First, they used a Maxon valve, which is basically a valve that must be opened manually with an actuator arm and then is held in the open position until there is an emergency condition or power loss. This gets a human involved to see what happened. Maxon is the trade name, but basically it is manual-open, power-loss on the coil to close. The coil must already be energized to allow the arm the valve to open. You don't need to blow a fuse for a safe shutdown, just de-energize the holding coil.

Secondly, there was a "valve integrity check". At the start of a cycle, the system would close two valves that were facing the furnace, and then open a third valve that would pressurize a section of pipe with natural gas. The feed valve would close and then a pressure sensor would watch the gas trapped in the pipe. If the pressure held, then the integrity was proven. If it decreased, as would happen during a leak, then the system would indicate a fault and require a reset. You might consider this method of making the system safer.

There were other checks as well, such as presence of oxygen when there should/shouldn't be. I don't know if this would be applied to your system.

Using electrical contractors that latch electrically for the purpose of logic was highly frowned upon, as how I was told by the instructors in the classroom and should be designed out. The reason for this is because the system is in an unknown state at start-up. I want to be clear I am not talking about a latch that resets upon loss of power, but the kind of latch that holds its state upon power loss.

I don't know all the details of what you need, so have to end it here, but it sounds like you will also need a pressure release valve.

Answer 2

I would design a current limited shunt that would trip a breaker with an indicator or alarm signal in worst case acceptable time but would not damage or overstress any components. A Triac Crowbar can be triggered easily at zero crossing with with optical isolation and maintain power to the control system but guarantee interrupted power to the compressed valve solenoid until serviced. This can be easily tested under simulated conditions to see if the result causes any unintended EMI to other systems.

Answer 3

Fault sensitive equipment should not use OPEN LOOP stop circuits. In case of wire failure your circuit will not stop the power supply. Use CLOSE loop stop which incorporates UVT equipped circuit breaker. UVT= Under Voltage Trip. https://www.relectric.com/blog/2017/10/27/circuit-breaker-under-voltage/#:~:text=An%20under%20voltage%20release%20is,breaker%20does%20not%20power%20it.

So basically you provide power to your critical circuit via circuit breaker which has an UVT. The power to the UVT coil is provided by the safety circuit. If the safety loop is broken the CB will trip. Any fault in safety loop will cause the CB to trip, wire breakage, power lost to circuit, or actual fault. Making this design very reliable and robust even for highest of standards of safety. As its function does not rely on power supply being present.