In this lesson, you will learn how to design physical output interfaces that guarantee a system defaults to a safe state when power is lost or the microcontroller enters an undefined condition.
The Concept of Passive Safety
In safety-critical systems, we must assume that software will eventually fail and power supplies will eventually drop. A "fail-safe" state is the predefined physical condition of an actuator—such as a motor stopping, a heater turning off, or a valve closing—that minimizes harm. We achieve this by designing hardware that favors a "de-energized" or "passive" state as its default when the controlling logic is absent.
Hardware-Level Default States
If you are controlling a high-power heater, you should use a configuration where the absence of a control signal ensures the heater is off. For example, using a pull-down resistor on the Gate of a MOSFET ensures that if the microcontroller pin floats (e.g., during a system reset or power-down), the transistor remains in the cutoff region, effectively isolating the heater from the power source.
Consider this logic for a safety-critical relay:
/* Ensure the pin is configured for a safe default state */
void setup_safe_outputs(void) {
/*
* Pull-down resistor on external hardware ensures relay
* is OPEN (OFF) when the GPIO pin is in high-impedance mode
* during CPU reset or brown-out.
*/
GPIO_Init(RELAY_PORT, PIN_1, GPIO_MODE_INPUT_PULLDOWN);
}
Eliminating Ambiguity
When designing fail-safe states, you must account for the "glitch" period during microcontroller startup. Before your code executes its initialization routines, GPIO pins typically default to a high-impedance (floating) state. If your hardware relies on an "active-high" signal to hold a critical system in a safe state, you risk a transient failure where the system briefly engages an actuator before the software can assert control.
Always design your hardware interface so that the safe state is the natural state of the hardware circuit, independent of the microcontroller's signal. If an actuator requires an active signal to remain safe, implement an external hardware watchdog or a "dead-man" circuit that requires a heartbeat to maintain that state.
Key Takeaway: Design your hardware so that the absence of control signals (due to power loss, reset, or software crashes) inherently drives actuators to their least hazardous state.