Actuators & Control · Study deck
Actuator Safety: Protection and Fail-Safe Design
A jammed vent can heat its driver while the screen still says closing.
Motor Max is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: Using the labelled 0.650 V at 10.0 mA reference, $n=1$, and $V_T=25.85$ mV, this chapter's 80 mA case adds 53.8 mV and predicts 0.704 V.
- Explain: Independent low-temperature fallback: A simple mechanical or independent electronic thermostat can be wired so heating starts at a low protective setpoint even if the smart controller is offline.
- Explain: The safety issue is not the brand of controller; it is the architecture: one smart device has become the only path between a cold building and a working furnace.
Major section
Start With the Story
The screen may still show "closing" while the driver heats and the plants lose airflow.
- The safe design begins with what must happen when motion, sensing, software, or power fails.
- An actuator is a device that changes the physical world.
- Firmware means the software stored on a device.
Major section
Start With the Story (continued)
Jam the motion, remove position feedback, freeze the firmware, lose communication, interrupt power, and restart.
- This test does not certify machinery or replace local safety law.
- The deeper sections show driver protection, stored energy, current and heat limits, isolation, watchdogs, emergency stops, and fail-safe review for the full output path.
- Actuator safety is the plan for that moment, not an afterthought after the circuit works once.
Major section
Putting Numbers to It
The induced voltage is $V = -L \frac{dI}{dt} = -0.1 \times \frac{0.08}{0.000001} = -8000$ V (negative indicates reverse polarity).
- The stored energy $E = \frac{1}{2}LI^2 = \frac{1}{2} \times 0.1 \times 0.08^2 = 0.32$ mJ must dissipate somewhere.
Major section
Phoebe's Field Notes: Why The Clamp Barely Moves At 80 mA
Using the labelled 0.650 V at 10.0 mA reference, $n=1$, and $V_T=25.85$ mV, this chapter's 80 mA case adds 53.8 mV and predicts 0.704 V.
- Once the driver is protected electrically, the next failure is liveness.
Major section
Design Scenario: Smart Thermostat Fail-Safe Behavior
If the relay coil is normally open, the relay opens when the thermostat is dead.
- A firmware bug, weak battery, loose terminal, or failed power supply can still leave the thermostat unable to command the heating system.
- The fundamental problem is that "safe" depends on the hazard.
- In summer, that prevents overheating.
Major section
Design Scenario: Smart Thermostat Fail-Safe Behavior (continued)
Relay selection: For heating-critical installations in cold climates, use a latching relay that maintains its last state without power.
- The safety issue is not the brand of controller; it is the architecture: one smart device has become the only path between a cold building and a working furnace.
- A normally open heating relay makes loss of control equal to furnace OFF.
- That answer often requires an independent fallback, not just better firmware.
Major section
Design Scenario: Smart Thermostat Fail-Safe Behavior (continued)
Independent low-temperature fallback: A simple mechanical or independent electronic thermostat can be wired so heating starts at a low protective setpoint even if the smart controller is offline.
- If the thermostat was calling for heat when it died, the furnace continues running until manual intervention.
- Outcome: The design review changes from "does the app control heat?" to "what protects the building if the app, controller, supply, or network is gone?".
- In a freeze-protection application, it can be the wrong safe state because the building needs enough heat to protect pipes and occupants.
Deck summary
Key takeaways
The screen may still show "closing" while the driver heats and the plants lose airflow.
- Jam the motion, remove position feedback, freeze the firmware, lose communication, interrupt power, and restart.
- The induced voltage is $V = -L \frac{dI}{dt} = -0.1 \times \frac{0.08}{0.000001} = -8000$ V (negative indicates reverse polarity).
- Using the labelled 0.650 V at 10.0 mA reference, $n=1$, and $V_T=25.85$ mV, this chapter's 80 mA case adds 53.8 mV and predicts 0.704 V.
- If the relay coil is normally open, the relay opens when the thermostat is dead.
Retrieval practice
Recall check
Motor Max says: answer from memory, then check your reasoning.
Q1Your control loop normally takes 80ms. You set the watchdog timeout to 100ms. What happens if SD card logging causes one loop iteration to take 150ms?
Show answer
Answer: C Watchdog timers are hardware-based safety mechanisms.
Print reference
Answers
Answer key.
- C · Watchdog timers are hardware-based safety mechanisms.