Failsafe Arduino

Question

I want to read an RFID tag using an Arduino, which controls some relais. This is easy.

For me the more complex part is to build it fault-tolerant. So I thought I could use the watchdog. The tricky part is, my relais module should keep a certain state (change of state is rare), no matter what happens to the Arduino.

My first thought was to put some condensators to the relais. Calculate the RC component so it can last the watchdog timeout plus booting up.

Now there is the problem, that the relais module is keeping its state while booting. I guess I can't use a pull up/down resistor, since the state of the relais can be low or high at random.

My second thought was using a latch relay. But this has the disadvantage, that it probably can hide problems. For example if the arduino died, and the latch relay holds a certain state, it masks the problem. In that case it's not possible to notice a faulty Arduino.

1. Those are the reasons I tend to think condensators are better?

2. Are those ideas feasible? Are there easier ways to accomplish this?

3. Are there more problems to think about?

(I was already reading about millis at gammon's page. Apparently it's not a problem after all.)

• per1234: Please explain why and where you would need a pull up/down resistor.
• jsotola: you are contradicting yourself in your statements ......... relais module should keep a certain state (change of state is rare), no matter what happens to the arduino ........ and if the arduino died, and the latch relay holds a certain state, it masks the problem
• Jot: It is impossible to solve. You need to be able to detect all problems for everything. When the wire of the rfid coil breaks or shorcuts, how can you detect that? A smoke detector can detect smoke and a low battery voltage. That's all. To make it reliable, a good quality smoke detector is required and it should be tested every month (some manuals say: every week). You need therefor the best quality hardware and software to start with.
• duedl0r: @jsotola: this is due to unclear requirements. I wasn't sure about them. After thinking a bit more: I think I want to keep the state only for a certain amount of time. Enough time for the arduino to recover. Or else go into default state, where nothing happens, and I can see a problem. If the state is kept infinite, then I don't see the problem easily.
• duedl0r: @jot: I think the only requirement I have: If the rfid reader tells me he read a certain tag, it should be true. if he fails, nothing is working, and I can detect the problem. I think with a timed latch I can go to a default state, where I shut down the relais module. So I hope I should be fine.

Answer 1

Consider constraining your design with clear requirements. As it is highly unlikely any design can protect its self for all situations.

my relais module should keep a certain state (change of state is rare), no matter what happens to the arduino

Consider latching relays where there is a set coil and a reset coil. Such as this one. Such a device does not need to be continuously powered. Only pulsed to set and a pulsed to reset.

So I thought I could use the watchdog.

Watchdog timers are fine if your program can get stuck waiting for an event that may never happen. Like waiting to read the data from and RFID chip. If you think this might happen, then add the watchdog timer to your design.

Now there is the problem, that the relais module is keeping its state while booting.

Most embedded processors with bi-directional GPIO pins force those pins to be inputs when booting up. This appears as high impedance to the outside world. Consider using pull ups or pull downs on these pins to prevent them from floating to a state which may change the relays during booting of the processor.

• duedl0r: Yes you're totaly right. My requirements are not clear. Even I am not sure about them. Good point. I was thinking about a timed latch. If I go into default state, nothing happens and I can detect a problem. If there is a state other than default, I want to be sure it's the proper one.