Robotics Fundamentals 1, Chapter 10: Challenge 2 solution (safety review of a given design)

Formulas: stopping distance  d(stop) = v x t(latency) + v^2 / ( 2 a ) ;   the largest v for a threshold d:  v^2 / ( 2 a ) + t v - d = 0
          wire heat  P = I^2 R ;  R(26 AWG) = 0.133 ohm/m (jumper wire, contacts excluded);   short-circuit current of a pack = C-rate x capacity (at least; the real figure can be higher)
Design: 3S LiPo 3000 mAh 20C; v = 0.8 m/s, threshold 0.15 m, latency 0.15 s, braking 2.0 m/s^2.

(a) Faults found (the ones stated and the ones that follow from them):
     1. No fuse anywhere: a short has nothing to stop it.
     2. Motor current through 26 AWG breadboard jumpers: rated under 1 A, the contacts and thin wire heat and may burn.
     3. The power switch cuts only the controller's 5 V: the motors and drivers stay live whenever the pack is connected.
     4. The "stop" is a software button: if the program is frozen or the sensor is broken it does nothing.
     5. No hardware e-stop in the motor supply.
     6. No watchdog: a frozen program leaves the last motor command running.
     7. The driver's enable pin is not pulled down: at power-up and reset the pin floats and the motors may twitch or run.
     8. A linear regulator feeds the controller and a servo from 11.1 V: (11.1 - 5.0) x I is wasted as heat (6.1 W at 1 A), and the servo's start-up surge can brown out the controller (logic and servo share one supply).
     9. No battery monitor and no low-voltage cutoff: the pack can be run below 3.0 V per cell.
    10. Charged by a bench supply set to 12.6 V: no balancing, no proper constant-current and constant-voltage termination, and no current limit.
    11. Charged overnight, unattended, on a sofa: a fire hazard on soft furnishings, with nobody there to react.
    12. The pack is left fully charged in the robot for months: it ages quickly and sits in the machine, not in a bag.
    13. The 0.15 m obstacle threshold is shorter than the stopping distance (part c).
    14. Not stated, but missing: no stall rule or current limit, no speed cap for first runs, no common-ground plan or strain relief, and no mention of any tests of the stops.

(b) The five most dangerous, in order:
    1. Overnight, unattended charging on a sofa with an unsuitable charger (11, 10): the likeliest way to start a house fire.
    2. No fuse with thin 26 AWG motor leads (1, 2): a short passes tens of amps through leads rated under 1 A (part d).
    3. No hardware e-stop, a software-only stop and no watchdog (4, 5, 6): nothing can stop a robot whose program has failed.
    4. The stopping distance exceeds the threshold (13): at 0.8 m/s the robot hits whatever is ahead (part c).
    5. No battery monitor or cutoff, and storage fully charged (9, 12): an over-discharged pack that is later charged is a classic fire.
    (The switch that leaves the motors live, 3, comes next.)

(c) Stopping distance:  reaction 0.8 x 0.15 = 0.120 m;  braking 0.8^2 / ( 2 x 2.0 ) = 0.640 / 4.0 = 0.160 m;   d(stop) = 0.280 m.
    That is almost twice the 0.15 m threshold (0.28 / 0.15 = 1.87): NOT enough.   After the 0.120 m of reaction only 0.030 m is left to brake, so the impact speed is
        v = sqrt( 0.8^2 - 2 x 2.0 x 0.030 ) = sqrt( 0.64 - 0.12 ) = sqrt( 0.52 ) = 0.72 m/s:  the robot hits almost at full speed.
    Fastest speed that stops within 0.15 m:   v^2 / 4 + 0.15 v - 0.15 = 0, i.e. v^2 + 0.6 v - 0.6 = 0,   v = ( -0.6 + sqrt( 0.36 + 2.4 ) ) / 2 = ( -0.6 + 1.661 ) / 2 = 0.531 m/s   (no margin)
    With a margin of 2 (stop within 0.075 m):   v^2 + 0.6 v - 0.3 = 0,   v = ( -0.6 + sqrt( 0.36 + 1.2 ) ) / 2 = ( -0.6 + 1.249 ) / 2 = 0.324 m/s
    Or keep 0.8 m/s and raise the threshold: a margin of 2 needs 2 x 0.28 = 0.56 m; a threshold of 0.60 m gives a margin of 0.60 / 0.28 = 2.14.   (Or cut the latency: a faster loop and sensor shorten the reaction part, but braking alone is 0.16 m.)

(d) Heat in the 26 AWG leads (0.25 m each way, R = 0.133 x 0.5 = 0.0665 ohm) at a 10 A stall:
        P = 10^2 x 0.0665 = 6.65 W,   voltage dropped 10 x 0.0665 = 0.665 V   (more with the breadboard contacts):  several watts in a few centimetres of thin wire: it melts its insulation.
    Short-circuit current of the pack: at least 20C x 3.0 Ah = 60 A.   At 60 A the leads would dissipate 60^2 x 0.0665 = 239 W:  they would fail in seconds, with the pack still delivering: a fire.

(e) Corrected design (one fix per fault):
     1. Fit a fuse in the positive lead next to the pack (a 5 A class fuse, rated above the 12.6 V pack).
     2. Motor wiring in 20 AWG (or thicker) silicone wire, soldered or in screw terminals; breadboards for signals only.
     3. Put the main switch in the positive lead after the fuse, rated for the stall current in DC, so the whole robot is off.
     4. Keep a software stop for ordinary stops, but do not call it an e-stop.
     5. Add a normally-closed hardware e-stop in the motor supply, rated for the stall current in DC.
     6. Add a hardware watchdog (about 5 times the loop period) that resets the board and drops the motor outputs.
     7. Pull the driver's enable and PWM pins low with 10 kohm resistors, so the motors are off at reset.
     8. Replace the linear regulator by a buck converter, and give the servo its own supply or a bulk capacitor and separate star branch.
     9. Add a battery divider and a cutoff at 3.3 V per cell under load (9.9 V for 3S), with a warning above it, latched.
    10. Charge with a proper balance charger at 1C or less (3.0 A), set to 3S, not a bench supply.
    11. Charge only while you are present, in a fire-resistant bag or on a non-flammable surface, never on a sofa.
    12. Store the pack at about 3.8 V per cell (11.4 V for 3S) in a fire-resistant bag, outside the robot.
    13. Raise the threshold (0.60 m at 0.8 m/s) or lower the speed (0.324 m/s with the 0.15 m threshold and a margin of 2), and re-measure the real braking.
    14. Add a stall rule, a duty cap for first runs, a star ground with strain relief, and a written test of each stop before the robot is ever left to run on its own.