Actuators & Control · Study deck

Actuator Safety: Protection and Fail-Safe Design

A jammed vent can heat its driver, the circuit that supplies power to its motor, while the screen still says closing.

Motor Max is your guide for this deck.

safety
Motor Max, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: Using the labelled 0.650 V at 10.0 mA reference, n=1n=1n=1, and VT=25.85V_T=25.85VT​=25.85 mV, this chapter's 80 mA case adds 53.8 mV and predicts 0.704 V.
  • Explain: Current Limiting Resistor: A series resistor protecting LEDs, transistor bases, and low-current loads from excessive current; calculated as R = (Vsupply: Vdrop) / Imax; omitting this for LEDs results in immediate burnout.
  • Explain: Galvanic Isolation: Electrically separating the low-voltage control circuit from high-voltage actuator circuits using optocouplers, transformers, or optical SSRs; prevents mains voltage from reaching the microcontroller through any failure mode.
Cross-section of a diode: a metal lead passes through a cut-away black rectangular body, exposing its internal layers.
Cross-section of a diode: a metal lead passes through a cut-away black rectangular body, exposing its internal layers.
iotclass.org

Major section

Start With the Story

The screen may still show "closing" while the driver heats and the plants lose airflow.

  • The safe design begins with what must happen when motion, sensing, software, or power fails.
  • An actuator is a device that changes the physical world.
  • Firmware is stored device software.
  • This test does not certify machinery or replace local safety law.

Key terms

Actuator safety
Actuator safety is the plan for that moment, not an afterthought after the circuit works once.
iotclass.org

Major section

Start With the Story (continued)

Jam the motion, remove position feedback, freeze the firmware, lose communication, interrupt power, and restart.

  • The deeper sections show driver protection, stored energy, current and heat limits, isolation, watchdogs, emergency stops, and fail-safe review for the full output path.
  • Actuator safety is the plan for that moment, not an afterthought after the circuit works once.
  • Every output path needs a safe default, a protected driver, and a way to stop or detect unsafe action.
iotclass.org

Major section

Key Concepts

Inductive current-decay path: A rated path absorbs stored magnetic energy when an inductive load is switched off.

  • A diode can clamp a single-polarity DC relay or solenoid coil; reversible motors use their H-bridge recirculation paths, and AC coils need AC-rated suppression.
  • Current Limiting Resistor: A series resistor protecting LEDs, transistor bases, and low-current loads from excessive current; calculated as R = (Vsupply: Vdrop) / Imax; omitting this for LEDs results in immediate burnout.
  • Galvanic Isolation: Electrically separating the low-voltage control circuit from high-voltage actuator circuits using optocouplers, transformers, or optical SSRs; prevents mains voltage from reaching the microcontroller through any failure mode.
Several small axial diodes and two larger three-lead rectifier packages arranged side by side to compare physical forms.
Several small axial diodes and two larger three-lead rectifier packages arranged side by side to compare physical forms.
iotclass.org

Major section

Flyback Diode Protection

The photographs below make diode (rectifier / protection) a physical comparison: look for changes in package, exposed interfaces, mounting, scale, and service access before treating the forms as interchangeable.

  • They share a capability name, but packaging and installation change the electrical, mechanical, environmental, and maintenance constraints.
  • Inductors resist changes in current.
Small glass diode with red and black bands and a metal lead at each end, showing the axial package used for circuit protection.
Small glass diode with red and black bands and a metal lead at each end, showing the axial package used for circuit protection.
iotclass.org

Major section

Putting Numbers to It

The induced voltage is V=−LdIdt=−0.1×0.080.000001=−8000V = -L \frac{dI}{dt} = -0.1 \times \frac{0.08}{0.000001} = -8000V=−LdtdI​=−0.1×0.0000010.08​=−8000 V (negative indicates reverse polarity).

  • The stored energy E=12LI2=12×0.1×0.082=0.32E = \frac{1}{2}LI^2 = \frac{1}{2} \times 0.1 \times 0.08^2 = 0.32E=21​LI2=21​×0.1×0.082=0.32 mJ must dissipate somewhere.
A diode with two wires extending from opposite ends, designed for reverse-bias installation to protect actuators from voltage spikes.
A diode with two wires extending from opposite ends, designed for reverse-bias installation to protect actuators from voltage spikes.
iotclass.org

Major section

Phoebe's Field Notes: Why The Clamp Barely Moves At 80 mA

Using the labelled 0.650 V at 10.0 mA reference, n=1n=1n=1, and VT=25.85V_T=25.85VT​=25.85 mV, this chapter's 80 mA case adds 53.8 mV and predicts 0.704 V.

  • Once the driver is protected electrically, the next failure is liveness.

Let Max unpack the logarithm behind the chapter's 0.7 V flyback clamp.

Once the driver is protected electrically, the next failure is liveness. The controller must not keep an actuator energized just because firmware stopped making progress.

iotclass.org

Major section

Design Scenario: Smart Thermostat Fail-Safe Behavior

If the relay coil is normally open, the relay opens when the thermostat is dead.

  • A firmware bug, weak battery, loose terminal, or failed power supply can still leave the thermostat unable to command the heating system.
  • The fundamental problem is that "safe" depends on the hazard.
  • In summer, that prevents overheating.

Why it matters

In a freeze-protection application, it can be the wrong safe state because the building needs enough heat to protect pipes and occupants.

iotclass.org

Major section

Design Scenario: Smart Thermostat Fail-Safe Behavior (continued)

Relay selection: For heating-critical installations in cold climates, use a latching relay that maintains its last state without power.

  • The safety issue is not the brand of controller; it is the architecture: one smart device has become the only path between a cold building and a working furnace.
  • A normally open heating relay makes loss of control equal to furnace OFF.
  • That answer often requires an independent fallback, not just better firmware.
iotclass.org

Major section

Design Scenario: Smart Thermostat Fail-Safe Behavior (continued)

Independent low-temperature fallback: A simple mechanical or independent electronic thermostat can be wired so heating starts at a low protective setpoint even if the smart controller is offline.

  • If the thermostat was calling for heat when it died, the furnace continues running until manual intervention.
  • Outcome: The design review changes from "does the app control heat?" to "what protects the building if the app, controller, supply, or network is gone?".
  • In a freeze-protection application, it can be the wrong safe state because the building needs enough heat to protect pipes and occupants.
iotclass.org

Deck summary

Key takeaways

The screen may still show "closing" while the driver heats and the plants lose airflow.

  • Jam the motion, remove position feedback, freeze the firmware, lose communication, interrupt power, and restart.
  • Inductive current-decay path: A rated path absorbs stored magnetic energy when an inductive load is switched off.
  • The photographs below make diode (rectifier / protection) a physical comparison: look for changes in package, exposed interfaces, mounting, scale, and service access before treating the forms as interchangeable.
  • The induced voltage is V=−LdIdt=−0.1×0.080.000001=−8000V = -L \frac{dI}{dt} = -0.1 \times \frac{0.08}{0.000001} = -8000V=−LdtdI​=−0.1×0.0000010.08​=−8000 V (negative indicates reverse polarity).
iotclass.org

Retrieval practice

Recall check 1 of 5

Motor Max says: answer from memory, then check your reasoning.

Q1A motor can stall and draw excessive current. What protection should the design review seek?

AA flyback diode alone, treated as protection against sustained stall current and motor overheating.
BA software speed command alone, relied on to limit current when the motor stops moving.
CA larger supply alone, because its extra capacity prevents a motor stall from becoming damaging.
DA suitable fuse or current limit, with a safe shutdown path after a motor stall.
Show answer

Answer: D Overcurrent protection must cover the load fault and its aftermath.

iotclass.org

Retrieval practice

Recall check 2 of 5

Motor Max says: answer from memory, then check your reasoning.

Q2Which turn-off protection best fits a reversible motor driven by an H-bridge?

AUse one plain diode across the motor, because the diode can clamp switching energy in either commanded direction.
BUse a supply fuse alone as the path for the motor's inductive turn-off current.
CUse an open driver at turn-off and leave the motor current without a rated decay path.
DUse the H-bridge recirculation path rated for the reversible motor's turn-off current.
Show answer

Answer: D The path must match the motor and switching mode.

iotclass.org

Retrieval practice

Recall check 3 of 5

Motor Max says: answer from memory, then check your reasoning.

Q3Your control loop feeds the watchdog only after each iteration, with no other task feeding it. It normally takes 80ms, and the watchdog timeout is 100ms. What happens if SD card logging makes one iteration take 150ms?

AThe watchdog waits past 100 ms for the delayed loop to finish before acting.
BThe system switches to backup power when the 100 ms watchdog expires.
CThe watchdog resets the controller when the loop misses its 100 ms deadline.
DThe watchdog cancels only the slow operation and leaves the rest of the loop running.
Show answer

Answer: C With feeding only at loop end, a 150ms iteration misses the 100ms watchdog deadline and resets the controller.

iotclass.org

Retrieval practice

Recall check 4 of 5

Motor Max says: answer from memory, then check your reasoning.

Q4A heating relay loses controller power. How should its default state be chosen?

AAlways choose normally open contacts.
BAlways hold the last software command.
CChoose the relay with the lowest coil current.
DFrom the specific hazard the output must avoid.
Show answer

Answer: D A safe default depends on whether heat loss or overheating is worse.

iotclass.org

Retrieval practice

Recall check 5 of 5

Motor Max says: answer from memory, then check your reasoning.

Q5A motor driver passes a short bench test but shuts down after sustained use. What should the team check?

ACheck only that the motor turns once on the bench, treating short-run success as thermal proof.
BCheck only the controller clock speed, treating the driver's heat as unrelated to duty cycle.
CDisable thermal protection in firmware, treating shutdown as a nuisance rather than evidence.
DCheck driver heat loss and cooling during the full, sustained motor duty cycle.
Show answer

Answer: D Thermal protection may trip only after heat builds up.

iotclass.org

Print reference

Answers

Answer key.

  1. D · Overcurrent protection must cover the load fault and its aftermath.
  2. D · The path must match the motor and switching mode.
  3. C · With feeding only at loop end, a 150ms iteration misses the 100ms watchdog deadline and resets the controller.
  4. D · A safe default depends on whether heat loss or overheating is worse.
  5. D · Thermal protection may trip only after heat builds up.
iotclass.org