Bucket Elevator Interlock and a Thermostat Reading That Trips on Cold Mornings
A medium rice mill in Polonnaruwa has automated its bucket elevator with a small microcontroller. Three inputs feed the controller: L, a level probe in the feed hopper (1 = grain present); D, an inspection-door interlock input; and T, a thermostat on the drive motor (1 = winding temperature above 75 °C). The motor must run only when grain is present, the inspection door is closed and the motor is not overheated. The interlock uses a normally-closed (NC) switch with a pull-up resistor, wired so that a healthy closed door holds the input at logic 0. The technician, assuming 1 meant 'door closed', wrote the control expression as R = L·D·T̄. On commissioning, the elevator ran with the inspection door wide open, and it also ran after a wire to the interlock broke. Separately, the motor tripped repeatedly on cold mornings. The thermostat is read through an 8-bit ADC whose output is in two's complement and stored in an unsigned char; the check is if (temp > 60) trip();. A cold-start reading of 0xF2 caused a trip even though the winding was cold.
1. Derive the correct minimal expression for the motor output R from a truth table, and explain why the technician's expression runs the motor with the door open and after a broken interlock wire. State the fail-safe principle and give a corrected wiring-plus-logic arrangement.
Read the worked answer
Let D_s be the raw interlock input. With an NC contact and a pull-up, D_s = 0 when the door is closed and healthy, and D_s = 1 when the door is open or the wire is broken, because the pull-up wins. The sensor is therefore active-high for 'unsafe'.
| L | T | D_s | R |
|---|---|---|---|
| 0 | x | x | 0 |
| 1 | 1 | x | 0 |
| 1 | 0 | 0 | 1 |
| 1 | 0 | 1 | 0 |
Minimal SOP: R = L · D̄_s · T̄ (the L·T̄·D_s pattern is the only 1-cell, so it cannot be simplified further; the two 0-rows for T=1 are separate minterms).
The technician used the same raw input but read it as '1 = closed'. Physically 1 means open, so his expression energised the motor exactly when the door was open. After the wire broke, the pull-up again produced 1, which his logic read as 'closed', so the motor ran with no interlock at all.
Fail-safe principle: wiring and software must be arranged so that the default state of an input (broken wire, no supply, unplugged connector) maps to the safe state of the actuator, which here is 'motor stopped'. The NC contact with a pull-up achieves this only if the software also treats 1 as unsafe, i.e. uses D̄_s. Had a normally-open contact been used, a broken wire would read 0 = 'closed' and the motor would run: a latent dangerous failure that shows up only when someone is at the door. Adding a second, oppositely-sensed interlock channel and a watchdog that stops the motor if the controller stops refreshing its output gives redundancy against a single stuck input.
2. Explain, using two's complement arithmetic, why the raw value 0xF2 caused a trip on a cold motor, and why simply declaring temp as signed would not fully fix the design. Give the corrected code and one further safeguard.
Read the worked answer
0xF2 = 1111 0010. The MSB is 1, so the value is negative. Taking the two's complement of the magnitude: invert → 0000 1101, add 1 → 0000 1110 = 14, so the raw reading means −14 (in whatever unit the transducer uses, here degrees on a cold start).
Because the byte is stored in an unsigned char, the bit pattern is interpreted as 242. The test 242 > 60 is true, so the controller trips a perfectly cold motor. The error is one of interpretation, not of the sensor: the same eight bits mean different things under signed and unsigned typing.
Simply changing the declared type of temp is not enough, because the assignment temp = adc_read() already performs an unsigned read; the conversion must be a signed reinterpretation of the byte:
int16_t raw = (int8_t) adc_read(); /* sign-extend the 8-bit value */
if (raw > 60) trip();
A deeper design flaw remains: the 8-bit two's complement range is −128 to +127, but a winding can exceed 127 °C. At 130 °C the value would wrap to −126 and, with signed typing, the motor would never trip - a silent, safety-critical failure that only appears in the fault condition. The safeguard is to size the container to the measurand: read the ADC as unsigned with a documented offset, widen to 16 bits before any comparison, range-check the result and treat an out-of-range reading as a fault that stops the motor. A small hysteresis band (trip at 75 °C, reset at 65 °C) also prevents chattering near the threshold.