An engineers' guide to watchdog supervisors and wired communication interfaces in building control HMIs
Building control systems are found in many commercial and industrial facilities. They may be dedicated to a specific item of machinery, such as a heating, ventilation, and air conditioning plant, or have a broader function to control everything from operating the lighting in communal areas to managing tenant and visitor access to offices and shared spaces. Whatever type of equipment they may control, safety and reliability of operation are key factors that shape the design of such systems.
The reliability of any control system depends not only on continuously receiving inputs from sensors, switches, and the operation of actuators but also on the system monitoring its performance. For example, transient high voltage spikes (dV/dt) may cause sensitive semiconductor components to lock up or become permanently damaged, resulting in erratic system operation or the inability to detect critical safety conditions.
This article investigates some of the causes of unpredictable system behaviour and highlights components that can prevent it from happening.
An introduction to building control systems
Building control systems and their associated control panels perform vital management and supervisory tasks across a wide variety of buildings, from offices, museums, factories, and public facilities. The types of functions also vary, from air conditioning and ventilation control to enforcing entry and exit access permissions and smoke and fire monitoring. Some control systems group together multiple tasks within a single unit, while others focus on a single role. From a user perspective, the control system human-machine interface (HMI) allows interaction with every aspect of the system.
The essential architecture of a building control HMI tends to be independent of the controlling tasks. Figure 1 highlights the major architectural blocks of a typical HMI used for building control purposes.
Figure 1 - The primary functional blocks of a building control HMI (source ST)
The display and HMI aspects form significant parts, including control input methods such as touch sensing and audio input. Display wake-up functions can include a proximity sensor to detect a hand placed close to the display surface. A microelectromechanical system (MEMS) accelerometer can detect finger taps to the screen or display enclosure.
The HMI's control functions and operational status depend on receiving inputs from multiple sensors throughout the building, with processing capabilities provided by a microcontroller or microprocessor.
If your smartphone suddenly locks up during use, we usually just have to switch it off and back on to restore regular operation. That's acceptable if you have it in your hand, but what about the building control HMI when nobody is there in the middle of the night?
To protect and maintain the safety and integrity of any building, a control system must operate continuously and reliably. Watchdog circuits achieve this requirement by offering a mechanism that can force a microcontroller to reset should it lock up or run erroneously.
Causes of erratic system operation
Typically, a watchdog operates like a timer circuit. The microcontroller resets the timer regularly to indicate that it is still working correctly. If the microcontroller suddenly stops, the watchdog timer (WDT) times out and instigates a hard reset of the microcontroller. WDTs are available as separate ICs or fabricated on the same die as the MCU. Either approach works, but the WDT must have no dependency on the MCU operation. For this reason, many embedded developers prefer to implement a WDT using a separate IC.
There are several potential reasons why an MCU may suddenly halt. An embedded software error may be responsible, but today's static code analysis, testing, and validation regimes significantly reduce the incidence of software-related problems. The most significant causes of MCU problems are electrostatic discharge (ESD), power supply rail disturbances, and electromagnetic interference (EMI). Glitches on the power rail are known to result in an MCU freezing up or entering an unpredictable state, so much so that hackers and adversaries attempt to replicate these conditions to create a security breach.
ESD is of particular concern for any HMI application due to the potential discharge from a person's finger to the display or touch sensing surface.
EMI may be either conducted into the MCU through external signal lines or induced into PCB tracks from an external source. Motors and other electrical switchgear can create high voltage transients (dV/dt) lasting just microseconds that play havoc with sensitive semiconductors. Floating MCU pins, short power supply rail brownouts, and dry-solder joints all potentially impact the MCU performance. Despite rigorous hardware and software testing, embedded systems engineers cannot anticipate every real-life scenario entirely; hence, implementing a WDT is paramount.
Protecting control systems from disruptive and damaging conditions
There are several steps that engineers can take to protect their designs from erratic and unreliable behaviour. In this part of the article, we'll review some techniques and showcase a small selection of relevant ICs. We've already highlighted how a watchdog circuit can assist, and we'll cover that shortly. Another method of keeping electrically noisy signal lines and potential sources of EMI away from a microcontroller uses galvanic isolation.
Watchdog and supervisory ICs
A microcontroller supervisory IC typically incorporates a watchdog function and a voltage comparator. The comparator monitors the MCU supply rail (Vcc) for out-of-tolerance conditions such as brown-outs against a precision voltage reference. Examples are the STM632x and STM682x series of five-pin supervisor IC with a watchdog timer and push-button reset. These compact devices offer extremely low power characteristics, typically 3 uA, and are available for the popular nominal Vcc voltages of 5 V, 3.3 V, 3 V, and 2.5 V.
Figure 2 illustrates the logic diagram of the STM682x family, highlighting the three sources of generating a reset pulse - WDI Vcc, or a manual reset (MR). The watchdog timer expires after typically 1.6 s, after which a reset is asserted.
Figure 2 - The logic block diagram of the STM682x 5-pin supervisory ICs with watchdog timer and manual reset (source ST)
The nature of the reset output, active low or active high, as well as other features, are device-dependent - see Figure 3.
Figure 3 - The primary characteristics of the STM632x and STM682x supervisory and watchdog ICs (source ST)
Protecting against accidental system reset is another consideration for building control HMIs. Operators unfamiliar with system operation might inadvertently press a reset button when, for example, checking system status. To protect against such a reset event, the STM6522 Smart Reset IC is a valuable addition to any control HMI. Featuring two inputs (SR0 & SR1), the STM6522 can utilise either a single or dual button input with a capacitor-configurable reset delay feature. If the push-button is closed for a short time, the reset delay feature causes that the processor is only interrupted. If the system still does not respond properly, holding the push-button(s) for the extended setup time causes a hard reset of the processor. Occupying just 2 mm x 2 mm x 0.75 mm, the STM6522 has a low consumption profile of just 1.5 uA. Figure 4 illustrates the STM6522 configured as a dual-input Smart Reset function. Momentary presses of either push button do nothing, but if both buttons are pressed and held together, a hard reset of the MCU takes place.
Figure 4 – The ST STM6522 configured to provide a dual-input smart reset function (source ST)
The STM6522 can also be configured to respond to momentary button presses, for example, by generating an interrupt pulse to the MCU rather than a hard reset.
Protecting RS-485 & RS-422 serial communication from electrostatic discharge (ESD)
Figure 5 illustrates the functional circuit diagram of the ST485ERB, a low-power RS-485/RS-422 serial interface transceiver. The inputs and outputs of the ST485ERB are protected against +/- 15 kV electrostatic discharge and are compliant with the +/- 8kV ESD specification IEC-1000-4-2. Equipped with a single driver and single receiver, the ST485ERB suits bi-directional data communication on half-duplex, multipoint bus transmission lines.
Figure 5 - The internal architecture of the ST485ERB a +/- 15 kV ESD protected low power RS-485/RS-422 transceiver (source ST)
The ST485ERB has a low quiescent current consumption of 300 uA and operates from a single 5 VDC supply.
Achieving galvanic isolation
Galvanic isolation achieves the electrical separation of circuits, offering the ability to restrict conducted EMI from entering and disrupting sensitive processing devices. Figure 6 illustrates the internal block diagram of the STIS0621, a dual channel digital isolator. Capable of operating in high data rate circuits up to 100 Mbps and performing 3 V to 5 V level translation, the STIS0621 offers 6 kV input to output isolation.
Figure 6 - The functional block diagram of the STISO621 dual channel digital isolator (source ST)
Schmitt triggers on each input improve the isolator's robustness to noise and a high-speed switching characteristic.
Integrated EMI and ESD protection
An example of a combined EMI and ESD protection device, for protecting the high speed communication lines for example to the HMI display, which any operator may touch, is the ST EMIF04-1005M8 - see Figure 7. Fabricated in a micro QFN package, it combines a 4-line low capacitance symmetrical EMI filter and ESD protection. It offers high efficiency of EMI filtering at cellular frequencies, typically - 34 dB from 900 MHz to 1.8 GHz. ESD compliance is to IEC 61000-4-2 for 15 kV air discharge and a contact discharge up to 8 kV.
Figure 7 - The functional diagram of a 4-line EMI and ESD protection IC, ST EMIF04-1005M8 (source ST)
Designing reliable building control HMIs
The microcontrollers and other sensitive semiconductors utilised in building control HMIs need adequate protection from electrical disturbance that might cause the system to lock up or operate erroneously.
The ST integrated circuits highlighted in this article provide the necessary ESD and EMI protection capabilities.
EBV is an authorised STMicroelectronics distributor.
About Author
Bernard Vincens
Bernard has more than 30 years experience within the Electronics world. After a few years in telecom...
ebv content library/articles/an-engineers-guide-in-building-control-hmis
An Engineers' Guide in Building Control HMIs | EBV Elektronik
