1
\$\begingroup\$

I'm making a commercial product for the first time and I am worried about the stability of my circuit over time.

The product is a door interlocking system. It locks and unlocks doors using solenoid locks. I am using an ATmega8 for the microcontroller. But I'm worried that it may go into an undefined state for any reason and "hang" resulting in people being trapped in the room.

This is the list of things I've done in order to make sure the circuit is stable/safe:

  • The locks are fail-safe, so if there is no power to the circuit the doors will open
  • Built-in brown-out detection of the ATmega8 is set to 4.0 volts
  • Watchdog timer is enabled
  • 7805 used for regulator with 47uF and 0.1uF capacitors at input and output pins
  • A fuse before the power supply
  • A fuse after the power supply
  • A 13v zener after the power supply to short it and burn the fuse in case of an over voltage.
  • There is a relay which provides power to all the locks. This relay is normally active using a transistor which is pulled up to the 12v input power. When this relay is active no power is provided to the locks. When the microcontroller turns on it pulls down the transistor and deactivates the relay, enabling power to the doors. This means if the 7805 dies or the MCU dies the relay will remain active and no power will be provided to the locks. (Top right of the schematic).

Schematic: enter image description here

But I'm still worried about the possibility of the microcontroller hanging in an undefined state. Should I be worried?

\$\endgroup\$
11
  • 5
    \$\begingroup\$ Of course you should assume that the electronics will eventually fail. Provide a reliable mechanical backup to protect life and property. \$\endgroup\$ Oct 7, 2021 at 15:04
  • 7
    \$\begingroup\$ People in the room should definitely have a manual unlocking mechanism. Like always. \$\endgroup\$
    – Eugene Sh.
    Oct 7, 2021 at 15:04
  • \$\begingroup\$ But I'm still worried about the possibility of the microcontroller hanging in an undefined state. Should I be worried? 1) Do what is mentioned in the other comments: have a backup. 2) in the micro, implement a watchdog timer. The program needs to reset a (hardware) timer every x number of seconds. If the program hangs, the timer expires and resets the micro. Note how the engineer's approach is: don't worry that it fails but assume that it will fail. Then do something to deal with that. \$\endgroup\$ Oct 7, 2021 at 15:23
  • \$\begingroup\$ watchdog timers are not a complete solution, the device may continue to fail for various reasons. The watchdog is not a safety net but is instead a hail Mary, better by far than just staying hung. You should of course do extensive testing of the product through various scenarios, power glitches, outages, temperature, humidity/moisture, etc... as well as understanding that no two components from the pcb to the resistors to the mcu are identical to each other so have margin in your design. (certainly if it can lead to a hang for some reason). \$\endgroup\$
    – old_timer
    Oct 7, 2021 at 15:32
  • \$\begingroup\$ Sidenote - seeing LPL channel on Youtube... Those relay locks can be bypassed easily with a magnet. If you have a relay accessible from the outer side, it's a security flaw because it can be bypassed even without touching the lock with a strong magnet. \$\endgroup\$
    – NStorm
    Oct 7, 2021 at 15:59

1 Answer 1

0
\$\begingroup\$

You can use a hardware watchdog:

There is a relay which provides power to all the locks. This relay is normally active using a transistor which is pulled up to the 12v input power. When this relay is active no power is provided to the locks. When the microcontroller turns on it pulls down the transistor and deactivates the relay, enabling power to the doors.

You can implement that in many ways, like a logic chip (I think 74HC123 will do the job) or just AC-couple the signal through a cap, into the base of a transistor that discharges a cap that is otherwise charged by a resistor to VCC.

You can use a simple edge-triggered retriggerable monostable circuit that requires the micro to output a square wave signal on a pin to keep the output enabled. If the micro hangs and outputs a constant level, whether it is 0 or 1 or anything in between, the monostable will expire and turn off the relay that powers the locks, opening them.

This signal should be generated via software, not via a PWM timer, and not in an interrupt. Just in the main loop. This way, if the software hangs, even in nasty ways like an infinite loop inside a low-priority interrupt, or whatever reason, then it will stop executing the main loop code, and stop outputting the square wave signal.

\$\endgroup\$
1
  • \$\begingroup\$ Good idea. I will look into this. Thanks. \$\endgroup\$
    – Pouria P
    Oct 7, 2021 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.