Safety circuit to control maximum voltage

Question

I am looking for a way to control an analog signal from another system that changes between 0-1 V.

The user could define the maximum voltage value, for example 0.793 V (the analog signal has resolution of 3 mV). If the input of the analog signal is above the user requirements, I need to open the other control circuit (my boss told me using a relay is safer).

I have two options in my head: the first - sample the analog signal with A2D, and in the uC program compare it to the required user value, but I'm afraid about the safety aspect (the software might crash).

Second - create an analog signal from D2A and compare it to the input signal, but again I depend on the software.

Which option is safer? Maybe another solution?

One of the capabilities of this system is to perform a scan of the eye and display a three-dimensional retinal image. The problem is that the scan is done using an external laser device, which outputs its scanning power in volts from some possible analog wire to sample it. The range is defined by us, the standard set by us, and according to the professional standard.

The maximum output in any case is between 0-1 V. If we sample a voltage that is above the desired value (the value is not yet in our hands and it is a lot of trial and error) then the card will close the device and the laser in less than 25 ms so that the patient's eye will not be damaged. My manager's recommendation is to use a relay to close the voltage and it is also safer, something that is mechanical and ensures full galvanic isolation. There should also be real-time samples of the voltages so that the engineer in the field can set the value to a certain threshold (it varies in each system) and then close the card and the box and that's it.

Answer 1

If you already have the microcontroller, then a PWM output with an R-C lowpass filter will be more than suitable as a reference voltage source.

But a simple potentiometer and a comparator - or two comparators for redundancy - would be just as suitable. The enclosure of the device would have a threaded hole through which the technician can adjust the potentiometer. Once the adjustment is done, a screw goes into the hole and closes it. Two such holes can be provided - the other one can have a pad or a turret terminal underneath, so the technician could insert a multimeter probe and measure the voltage (relative to enclosure ground).

With suitable reed relays, the reaction time to overcurrent should be 1ms or less. 25ms is "forever".

A general design approach to such a circuit would be fail-safe behavior: any one component can fail, in any imaginable failure mode, and the overcurrent protection is not lost.

^{simulate this circuit – Schematic created using CircuitLab}

The analysis below is only meant as an educational example. Consult a professional engineer with relevant experience to design anything going into a product.

A simplistic look at failure modes:

1. R1,R2 open -> IREF=0V -> fail safe, load off
2. R1,R2 short - unlikely
3. R3 open -> small change of IREF
4. CMP1 or CMP2 inputs fail shorted to 0V or VCC -> small change of IREF, the other channel maintains protection
5. D1 or D2 shorts or opens: comparator output overstressed and fails -> other channel maintains protection
6. RLY1 or RLY2 shorts -> other channel maintains protection
7. RLY1 or RLY2 opens -> fail-safe, load off
8. R4-R7 short -> no consequence
9. R4-R7 open -> channel behavior arbitrary, other channel maintains protection
10. I_SENSE_INPUT open: R8 pulls up the inputs, causing both channels to trip (thanks to pstechpaul)
11. Q1-Q2 and Q3-Q4 form SCRs that latch the fault condition and drop the reference current to 0, causing relays to open (thanks to pstechpaul)
12. Failures of Q6, R11, Q7, Q1-Q4, etc. are fail-safe or only remove functionality. The failure mode analysis of those is left as an exercise to the reader.

As pstechpaul has mentioned, this circuit would also need means for self-test and calibration check.