Actuators & Control · Study deck

Actuator Safety: Watchdogs and Interlocks

A watchdog that trips too soon stops sound work; one set too late lets harm grow.

Motor Max is your guide for this deck.

safety

Motor Max, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: A conveyor moving at 0.5 m/s travels the same 0.10 m in only 200 ms, so a cloud timeout or app command is too slow for personnel protection.
Explain: A practical design uses driver current limiting near the allowed peak, a fuse for wiring faults, and firmware that cuts drive if high current persists beyond the expected acceleration window.
Explain: But if the actuator can cause damage after 150 ms of uncontrolled motion, the software architecture must change; slow logging or network work belongs in a background task.

Major section

Pull-Downs on Relay Boot

The mistake: A smart irrigation controller uses GPIO pins to control 8 solenoid valves via relays.

Floating pins can be pulled HIGH by electromagnetic coupling or internal leakage currents, randomly energizing relays.
Weak enough that firmware can override by driving pin HIGH.
Bench testing often uses short power cycles where floating pins stay LOW by chance.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection

A heater usually fails safe by turning off.

A greenhouse vent may fail safe by opening.
A fire-exit lock may fail safe by unlocking.
A laboratory exhaust damper may fail safe by opening, even though a security door may fail safe by locking.
Two design choices carry much of the fail-safe weight.

Equipment safety interlock panel showing guard position, safety interlock, temperature status, normal operation, guard-open stop, emergency stop, and maintenance lock-down modes.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

Each unsafe condition forces a bounded local response; that hierarchy connects the safe-state choice to the energy and travel calculations below.

If the controller must keep that coil energized to hold the safe state, a power loss removes the energy needed for safety.
Hardware defaults come first, local controls second, and network supervision last.
A relay board driven from a 3.3 V GPIO should not float while the controller boots.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

A conveyor moving at 0.5 m/s travels the same 0.10 m in only 200 ms, so a cloud timeout or app command is too slow for personnel protection.

If a 12 V door actuator normally draws 1.5 A, its running power is 12 V x 1.5 A = 18 W.
If the mechanism jams and stall current reaches 6 A, the wiring, driver, and fuse must account for a 12 V x 6 A = 72 W fault.
Stall current can therefore be many times the running current, all of it turning into heat in the windings.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

A practical design uses driver current limiting near the allowed peak, a fuse for wiring faults, and firmware that cuts drive if high current persists beyond the expected acceleration window.

A 10 kOhm pull-down draws only 3.3 V / 10000 ohm = 0.33 mA, but it defines the input while firmware is not yet running.
Across eight relay outputs, that is 8 x 0.33 mA = 2.64 mA, a tiny standby cost compared with valves or motors energizing during reset.
Copper heating is I^2R = 1.5^2 x 2 = 4.5 W.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

At stall, speed is zero and back-EMF is zero.

For high-current drivers, apply the same rule to the enable pin: hardware should hold it disabled until firmware explicitly proves it is healthy.
If the critical loop normally completes in 80 ms and has a measured worst case of 120 ms, a 200 ms watchdog leaves margin.
A cloud alert or thirty-second timeout cannot protect that motor.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

But if the actuator can cause damage after 150 ms of uncontrolled motion, the software architecture must change; slow logging or network work belongs in a background task.

A watchdog is useful only when its timeout is shorter than the physical hazard time and the reset state actually removes actuator energy.
A spinning motor generates back-EMF, a voltage opposing the supply that rises with speed, and that back-EMF is what limits its running current.
When a motor stalls, speed is zero, back-EMF is zero, and the only thing limiting current is the winding's small resistance.

Major section

For Kids: Meet the Actuator Crew!

"Safety meeting!" called the microcontroller, gathering the team. "Before we connect any actuators, we need to talk about protection.".

"From YOU, Danny!" said Max with a smile. "When you stop spinning, your coils create a nasty voltage spike -- like a tiny lightning bolt.
Without a flyback diode to catch it, that spike could fry my circuits!".
We call it fail-safe!".

Deck summary

Key takeaways

The mistake: A smart irrigation controller uses GPIO pins to control 8 solenoid valves via relays.

A heater usually fails safe by turning off.
Each unsafe condition forces a bounded local response; that hierarchy connects the safe-state choice to the energy and travel calculations below.
A conveyor moving at 0.5 m/s travels the same 0.10 m in only 200 ms, so a cloud timeout or app command is too slow for personnel protection.
A practical design uses driver current limiting near the allowed peak, a fuse for wiring faults, and firmware that cuts drive if high current persists beyond the expected acceleration window.

Retrieval practice

Recall check 1 of 5

Motor Max says: answer from memory, then check your reasoning.

Q1A geared actuator jams against an obstruction. Why does this threaten to overheat or start a fire, and which protections address it correctly?

AA stall removes back-EMF, so current and heat surge

BA stall raises back-EMF, so only the driver overheats

CA stall opens the winding, so current falls to zero

DA stall is harmless if firmware sends a stop command

Show answer

Answer: A Stalling removes the back-EMF that limits current, so locked-rotor current surges and heats the windings; current limiting, thermal cutoffs/PTC, firmware stall detection, and de-energize-to-safe wiring with a hardware E-stop protect against it.

Retrieval practice

Recall check 2 of 5

Motor Max says: answer from memory, then check your reasoning.

Q2A watchdog timer is set to 3 seconds. What happens if the main control loop takes 5 seconds to complete one iteration?

AThe watchdog waits for the loop to finish

BIt resets because the loop missed the timeout

CThe watchdog disables the actuators but keeps the system running

DNothing -- the watchdog only activates on power loss

Show answer

Answer: B Answer: B) The watchdog resets the entire system because it was not fed within the 3-second timeout.

Retrieval practice

Recall check 3 of 5

Motor Max says: answer from memory, then check your reasoning.

Q3Why should IoT actuators default to a safe state on power loss rather than maintaining their last commanded state?

AIt saves energy when power returns

BUncontrolled actuator states can cause physical harm

CIt makes the software simpler to write

DMicrocontrollers always reset to zero on power-up anyway

Show answer

Answer: B Answer: B) Uncontrolled actuator states can cause physical harm -- a heater stuck ON could cause fire, a valve stuck OPEN could cause flooding.

Retrieval practice

Recall check 4 of 5

Motor Max says: answer from memory, then check your reasoning.

Q4An IoT motor controller drives a conveyor belt in a food processing plant. A maintenance technician needs to clear a jam while the system is powered on. What minimum safety features must the IoT controller implement?

AA software stop button in the mobile app that sends a command to the controller

BAn automatic speed reduction when the sensor detects a person nearby

CA timeout that stops the motor if no sensor readings are received for 30 seconds

DHardwired e-stop plus lockout/tagout for maintenance

Show answer

Answer: D Industrial actuator maintenance requires a hardware stop path that physically disconnects power, independent of software or network connectivity.

Retrieval practice

Recall check 5 of 5

Motor Max says: answer from memory, then check your reasoning.

Q5Place each actuator safeguard where it lives so you can contain electrical energy, protect people from motion, and drive faults to a safe state.

AOvercurrent Protection (Fuse)

BVoltage Clamping (Flyback Diode)

CThermal Management

DMechanical Guarding

EEmergency Stop

FFail-Safe Design

Show answer

Answer: A Separate electrical protection, physical hazard controls, and stopping behavior so you can build layered actuator safety instead of relying on one software check.

Q6Complete the actuator safety watchdog implementation:

Awatchdog_timer = Timer(0)

Bwatchdog_timer = Pin(0)

Cwatchdog_timer = PWM(0)

Dwatchdog_timer = machine.reset()

Show answer

Answer: A A hardware Timer acts as a watchdog: after 5000 ms (5 seconds), it fires once (ONE_SHOT mode) and calls emergency_stop to disable the motor.

Print reference

Answers 1 of 2

Answer key.

A · Stalling removes the back-EMF that limits current, so locked-rotor current surges and heats the windings; current limiting, thermal cutoffs/PTC, firmware stall detection, and de-energize-to-safe wiring with a hardware E-stop protect against it.
B · Answer: B) The watchdog resets the entire system because it was not fed within the 3-second timeout.
B · Answer: B) Uncontrolled actuator states can cause physical harm -- a heater stuck ON could cause fire, a valve stuck OPEN could cause flooding.

Print reference

Answers 2 of 2

Answer key.

D · Industrial actuator maintenance requires a hardware stop path that physically disconnects power, independent of software or network connectivity.
A · Separate electrical protection, physical hazard controls, and stopping behavior so you can build layered actuator safety instead of relying on one software check.
A · A hardware Timer acts as a watchdog: after 5000 ms (5 seconds), it fires once (ONE_SHOT mode) and calls emergency_stop to disable the motor.