Actuators & Control · Study deck

Actuator Safety: Watchdogs and Interlocks

A watchdog is a timer that detects a control loop that stops making progress.

Motor Max is your guide for this deck.

safety

Motor Max, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Calculate a watchdog timeout from task and bus delays.
Design relay boot states, interlocks, and stall protection.
Explain: A watchdog is a timer that detects a control loop that stops making progress.
Explain: The mistake: A smart irrigation controller uses GPIO pins to control 8 solenoid valves via relays.

Major section

Start With the Decision

A watchdog is a timer that detects a control loop that stops making progress.

An interlock blocks motion when a safety condition is not met.
A watchdog that trips too soon stops sound work; one set too late lets harm grow.
Its limit must follow measured loop time.

Major section

Pull-Downs on Relay Boot

The mistake: A smart irrigation controller uses GPIO pins to control 8 solenoid valves via relays.

In this example, the valves open during each controller reboot until the outputs are initialized.
Floating pins can be pulled HIGH by electromagnetic coupling or internal leakage currents, randomly energizing relays.
These snapshots do not establish water wasted per boot.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection

A heater usually fails safe by turning off.

A greenhouse vent may fail safe by opening.
A fire-exit lock may fail safe by unlocking.
A laboratory exhaust damper may fail safe by opening, even though a security door may fail safe by locking.
Two design choices carry much of the fail-safe weight.

Equipment safety interlock panel showing guard position, safety interlock, temperature status, normal operation, guard-open stop, emergency stop, and maintenance lock-down modes.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

Each unsafe condition forces a bounded local response; that hierarchy connects the safe-state choice to the energy and travel calculations below.

If the controller must keep that coil energized to hold the safe state, a power loss removes the energy needed for safety.
Hardware defaults come first, local controls second, and network supervision last.
A relay board driven from a 3.3 V GPIO should not float while the controller boots.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

A conveyor moving at 0.5 m/s travels the same 0.10 m in only 200 ms, so a cloud timeout or app command is too slow for personnel protection.

If a 12 V door actuator normally draws 1.5 A, its running power is 12 V x 1.5 A = 18 W.
If the mechanism jams and stall current reaches 6 A, the wiring, driver, and fuse must account for a 12 V x 6 A = 72 W fault.
A 10 kOhm pull-down defines the input while firmware is not yet running.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

A practical design uses driver current limiting near the allowed peak, a fuse for wiring faults, and firmware that cuts drive if high current persists beyond the expected acceleration window.

For high-current drivers, apply the same rule to the enable pin: hardware should hold it disabled until firmware explicitly proves it is healthy.
If the critical loop normally completes in 80 ms and has a measured worst case of 120 ms, a 200 ms watchdog leaves margin.
A watchdog is useful only when its timeout is shorter than the physical hazard time and the reset state actually removes actuator energy.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

But if the actuator can cause damage after 150 ms of uncontrolled motion, the software architecture must change; slow logging or network work belongs in a background task.

A spinning motor generates back-EMF, a voltage opposing the supply that rises with speed, and that back-EMF is what limits its running current.
When a motor stalls, speed is zero, back-EMF is zero, and the only thing limiting current is the winding's small resistance.
Stall current can therefore be many times the running current, all of it turning into heat in the windings.

Major section

Deep Dive: Failure Energy, Interlocks, and Stall Protection (continued)

A 12 V actuator motor with 2 ohm winding resistance may generate 9 V of back-EMF at normal speed.

Copper heating is I^2R = 1.5^2 x 2 = 4.5 W.
At stall, speed is zero and back-EMF is zero.
The same winding sees the full 12 V, so current becomes 12 V / 2 ohm = 6 A and copper heating becomes 6^2 x 2 = 72 W.

Major section

For Kids: Meet the Actuator Crew!

"Safety meeting!" called the microcontroller, gathering the team. "Before we connect any actuators, we need to talk about protection.".

"From YOU, Danny!" said Max with a smile. "When you stop spinning, your coils create a nasty voltage spike -- like a tiny lightning bolt.
Without a flyback diode to catch it, that spike could fry my circuits!".
We call it fail-safe!".

Deck summary

Key takeaways

A watchdog is a timer that detects a control loop that stops making progress.

The mistake: A smart irrigation controller uses GPIO pins to control 8 solenoid valves via relays.
A heater usually fails safe by turning off.
Each unsafe condition forces a bounded local response; that hierarchy connects the safe-state choice to the energy and travel calculations below.
A conveyor moving at 0.5 m/s travels the same 0.10 m in only 200 ms, so a cloud timeout or app command is too slow for personnel protection.

Retrieval practice

Recall check 1 of 6

Motor Max says: answer from memory, then check your reasoning.

Q1A geared actuator jams against an obstruction. Why does this threaten to overheat or start a fire?

AA stall raises back-EMF, so only the driver overheats

BA stall opens the winding, so current falls to zero

CA stall is harmless if firmware sends a stop command

DA stall removes back-EMF, so current and heat surge

Show answer

Answer: D Stalling removes the back-EMF that limits current, so locked-rotor current surges and heats the windings; current limiting, thermal cutoffs/PTC, firmware stall detection, and de-energize-to-safe wiring with a hardware E-stop protect against it.

Retrieval practice

Recall check 2 of 6

Motor Max says: answer from memory, then check your reasoning.

Q2A relay turns on briefly while its controller boots. Which design change addresses the boot fault?

AUse a later relay-off command in setup, after the brief boot pulse has already energized the coil.

BUse a higher relay supply voltage, because stronger coil drive prevents a boot pulse.

CUse no startup interlock, because software initialization holds the relay safely until boot completes.

DUse hardware inactive polarity so the relay stays off throughout the controller boot interval.

Show answer

Answer: D A defined hardware input state with the driver’s inactive polarity keeps the load safe before firmware runs.

Retrieval practice

Recall check 3 of 6

Motor Max says: answer from memory, then check your reasoning.

Q3A control loop feeds its watchdog only at the end of each iteration, with no other task feeding it. The timeout is 3 seconds. What happens if one iteration takes 5 seconds?

AThe watchdog waits for the four-second loop to finish because its timeout is checked between loop iterations.

BThe watchdog resets the controller when the loop misses the three-second timeout.

CThe watchdog disables actuators only, while the stalled controller keeps running.

DThe watchdog stays idle because it responds to power loss rather than a missed feed.

Show answer

Answer: B Answer: The watchdog resets the controller because it was not fed within 3 seconds.

Retrieval practice

Recall check 4 of 6

Motor Max says: answer from memory, then check your reasoning.

Q4A smart greenhouse uses IoT-controlled motorized vents. During a WiFi outage, the controller loses cloud connectivity and the vents stop responding to commands. On a hot day, the greenhouse temperature reaches 45C, damaging the plants. What safety design principle was violated?

AThe system should have used a more reliable wireless protocol like LoRaWAN

BFail-safe design -- the actuator should default to a safe state

CThe controller should have cached the last cloud command and continued executing it

DA backup battery should keep the WiFi module running during outages

Show answer

Answer: B Fail-safe design requires actuators to move to a safe state when control signals are lost.

Retrieval practice

Recall check 5 of 6

Motor Max says: answer from memory, then check your reasoning.

Q5A conveyor belt jams in a food processing plant. Before a maintenance technician reaches into the machine, which stop path and maintenance procedure are needed?

AA mobile-app stop button that sends a software command before the technician enters the jammed machine.

BA proximity sensor that slows the belt automatically while the technician clears the jam.

CA missing-reading timeout that stops the belt after 30 seconds without maintenance isolation.

DA hardwired emergency stop followed by lockout/tagout before the technician enters the machine.

Show answer

Answer: D A hardware stop path removes actuator power without relying on the app, network, or control firmware.

Retrieval practice

Recall check 6 of 6

Motor Max says: answer from memory, then check your reasoning.

Q6Complete a one-shot motor run timeout demonstration.

Awatchdog_timer = Timer(0)

Bwatchdog_timer = Pin(0)

Cwatchdog_timer = PWM(0)

Dwatchdog_timer = machine.reset()

Show answer

Answer: A A one-shot Timer requests emergency_stop after 5 s if its callback executes.

Print reference

Answers 1 of 2

Answer key.

D · Stalling removes the back-EMF that limits current, so locked-rotor current surges and heats the windings; current limiting, thermal cutoffs/PTC, firmware stall detection, and de-energize-to-safe wiring with a hardware E-stop protect against it.
D · A defined hardware input state with the driver’s inactive polarity keeps the load safe before firmware runs.
B · Answer: The watchdog resets the controller because it was not fed within 3 seconds.

Print reference

Answers 2 of 2

Answer key.

B · Fail-safe design requires actuators to move to a safe state when control signals are lost.
D · A hardware stop path removes actuator power without relying on the app, network, or control firmware.
A · A one-shot Timer requests emergency_stop after 5 s if its callback executes.