Electronics and microcontroller question

[Glom]

I'm working to design a simple control system for my Group Project and wondering whether this idea I have is horrible or not.

The system will control some fail-closed valves on the fuel supplies to a combustion system.  It's just a little rig for combustion experiments.

Naturally, there will be an ESD, which will open the circuit supplying power to the valves.  But, I don't want the valves to just open again when the ESD alone is reset.  I want all switch to be reset first before the circuit will allow the valves to be reopened.  So there will be an electronic switch connected to a microcontroller.

In order to detect the state of the valve switches, even if there is no power going to them, I thought about adding a second power connection at heavily reduced voltage.  The voltage will not be enough to power the valves, but will be enough for the microcontroller to detect when the switches are closed.  That way it won't send the command to close the electronic switch until it detects that all other switches are where they are supposed to be.

The attached picture shows some doodling of mine.  Hopefully, you can make out the microcontroller on the left and the three reactant supply valves on the right and the connections to the microcontroller for detection of voltages, indicating switch states.  On the far left is a reset switch for the operator to press once all the important switches are where they are supposed to be.  If they are, the microcontroller will send the signal.

Is having a secondary reduced power supply to provide instrumentation voltages a good idea or a terrible one?  This is of course safety critical.

[ka9q]

ESD? Electrostatic discharge?

It would help if you described the behavior of the valves.

[Glom]

ESD is Emergency shut down.

The valves will be fail closed valves so the electrical current is needed to keep them open.

[ka9q]

OK, now I think I understand what you're trying to do. Sort of.

What specific error or failure mode(s) are you concerned about? Somebody forgetting to turn the switches off? The switches appearing to be off but are actually on because of an internal short? Have you estimated its likelihood? What are the consequences of a failure?

[Glom]

OK, now I think I understand what you're trying to do. Sort of.

What specific error or failure mode(s) are you concerned about? Somebody forgetting to turn the switches off? The switches appearing to be off but are actually on because of an internal short? Have you estimated its likelihood? What are the consequences of a failure?

So basically, someone presses the ESD and that cuts power to the valves causing them to close.  Fuel (and air) are stopped flowing from the sources to the burners.  Without any further logic, if someone just twisted the ESD button, the button itself would reset and the valves would open again, which may not be a good idea in the circumstances (something caught fire that shouldn't have etc).

So I want to make sure that the system is fully reset.  Basically, it works like this.

Operating normally: ESD closed, electronic safety switch closed.  Closed valve switches to supply electrical power to respective valves.

ESD pressed: electrical supply is cut to the valves and they close.  Electronic safety switch opened by the micro-controller though at this point it makes little difference.

ESD reset: electronic safety switch still open so still no power to the valves.

System reset button pressed: micro-controller looks at the state of the valve switches and the ESD.  If the valves switches are off and the ESD is reset, it closes the electronic safety switch.  Else, it leaves it open.

That's why I'm needing the low voltage to bypass the ESD and electronic safety switch so that the state of the valves switches can be read.  The idea is to have only a small voltage, which will be insufficient to actually power the valves, but enough for the micro-controller to detect as on, indicating closed switches.

[VQ]

What you are describing sounds like a normal latched relay, which is a common way of managing on/off control. I do not understand the bit about the system reset being interlocked with the valve switches, though. In what situation would the ESD switch be activated but the valve power switches be closed?

More generally, usually actuator position feedback is a separate circuit than the actuator power, ie a separate position switch or positioner, rather than "leaking" reduced voltage to the actuator.

[ka9q]

I was about to make just that suggestion. Use on/off buttons (rather than toggle switches) and latching relay circuits to control the valves.

There are mechanical latching relays, but I'm not talking about them. Take an ordinary normally-open relay where a spring keeps the contacts open unless current flows through the coil. Wire it with the contacts in parallel with the "on" button such that when push it, the relay closes and keeps itself on. Put a second button with normally closed contacts in series with the circuit so that when you push it, you interrupt the supply current and the relay drops out. That opens the contacts, so when you release the "off" button the relay stays de-energized and the contacts remain open.

Add indicator lights to show the state of the circuit. You might consider having both "on" and "off" lights, with the "off" light powered by the normally closed contacts of the relay.

Instead of finding a push button with normally closed contacts, you could instead use a toggle switch as your "off" control. Label it as "enable" when the contacts are closed and "off" when open. So now if you put the "enable" switch in the "disable" position, pushing the "on" button has no effect. Put the enable switch in the "enable" position and nothing happens until you push the "on" button again to activate the relay and open the valve. Turn the enable switch to "disable" and the relay opens and the valve closes, and again the "on" button has no effect.

Put your "emergency shut off" switch in series with the supply to all three relay circuits so that opening it shuts power off to them all. If you then close that switch again, the relays will remain off and the valves closed.

If you don't want to use electromechanical logic you could do this with logic circuits, but I recommend the old-fashioned stuff for its simplicity and ease of understanding, and also because it can be made to work at the oddball voltages required to control the valve -- "oddball" in the sense that they're probably different from logic levels, and you'd need level shifters and a drive transistor to control the valves with logic signals.

My high school electronics lab used exactly this mechanism to control the AC power to the lab benches. A set of ordinary wall switches, wired in series, were placed around the classroom as "emergency off" switches. Turn any one off, and the power dropped and stayed off even if the emergency switch was turned back on. The teacher had to momentarily activate a key switch on a panel to turn the power back on.

[Glom]

Interesting thoughts.  Thanks.

This week has been about the plumbing itself, but I'll be getting back to the control system soon.

[VQ]

Keep us posted!

[ka9q]

If you need me to sketch out a more detailed schematic, let me know.

[Glom]

I resisted the urge to claw my face off shopping for valves.  The clawing will resume later.

So I think I understand the relay concept.  Attached is a zoom in on a case for a single valve.  I also checked and Maplin do indeed have (one) push-to-break button so that is an alternative to the toggle switch.

It would then be simple to add all the LED's I want for the different states and/or send signals to the microcontroller.

This way I don't need the microcontroller to worry about the toggle switch state (if I even have one).  The valves won't reopen until they are specifically instructed to reopen.  That would indeed be preferable to leaking current.

I can apply this to entire circuit to allow master system reset without needing to go through a microcontroller.  However, I have other uses for the microcontroller (e.g. receiving instrumentation inputs and setting trips) so I'll probably keep that anyway, but it creates options if we need to downsize our scope (again).

[ka9q]

Not quite. You have the relay coil in series with the valve coil. You want them in parallel.

[ka9q]

Oh, in case you haven't noticed it, you have a short circuit across the relay coil. It will never close. The valve will momentarily close when you hit the on button and then open again when you release it.

[ka9q]

Here, try this. Omit any indicator lights you don't need. I do recommend them, however, as they unambiguously show the state of the system at all times. This was more important back with incandescent pilot lamps that could often burn out, but they're still desirable now.

[Glom]

Thanks.

I did actually have the relay coil in parallel to begin with, but edited it for some reason that eludes me.  The original is correct I think.

Tomorrow I hope to have a play with a demo circuit once I make the trip to Maplin.  If I don't electrocute myself, I'll report back.