When a humanoid robot operates near people, safety is non-negotiable. The safety system PCB is the hardware layer that guarantees the robot stops within milliseconds of detecting an anomaly — an emergency stop button press, a collision with a person, a joint torque exceeding safe limits, or a communication failure with the main controller. This board operates independently of the main compute stack, with redundant monitoring paths and hardwired power-cutoff logic.

Safety Architecture: Redundancy and Independence

• Dual-channel safety MCU: Two independent MCUs (e.g., TI TMS570 Hercules or Infineon AURIX TC3xx safety family) running lockstep or diverse software. Both must agree to keep power enabled. If either channel detects a fault, power is cut. This achieves ASIL-D / SIL-3 diagnostic coverage (>99% single-point fault detection)

• Independent from main controller: The safety PCB has its own power rail (backup supercapacitor or small battery), its own sensor inputs, and a direct hardwired path to the motor power contactor. Even if the main CPU/GPU crashes or its software hangs, the safety system still functions

• Watchdog architecture: The safety MCU expects a heartbeat from the main controller at a fixed interval (e.g., every 5 ms). If the heartbeat stops for >2× the interval, the safety MCU triggers an E-stop. This is a hardware timer — not software-based — so it cannot hang

Emergency Stop Hardware

• E-stop button interface: Dual-channel NC (normally-closed) contacts. Two independent 24V loop circuits run through the E-stop button. If either loop opens (button pressed or wire broken), both safety MCU channels detect the event within 1 ms. This redundancy ensures a single broken wire doesn't prevent E-stop

• Power cutoff path: The safety MCU drives a safety relay or high-side MOSFET array that disconnects all motor power (48V bus) within 10 ms of an E-stop trigger. The contactor is normally-open, held closed by a PWM-driven coil — loss of PWM = immediate open

• Dynamic braking: Upon E-stop, the motor phases are shorted through braking resistors (3-phase short-circuit braking) to halt joint motion within 50–100 ms. The braking MOSFETs are driven directly by the safety MCU, bypassing the servo driver entirely

Collision Detection Circuits

• Joint torque monitoring: Each joint's current sensor (shunt + INA240 amplifier) reports motor current to both the servo driver and the safety MCU. If current exceeds a pre-calibrated safe threshold, the safety MCU triggers a protective stop. Dual-redundant current sensing paths prevent a single amplifier failure from masking an over-torque condition

• Skin/contact sensors: Capacitive or resistive tactile skin on the robot's arms and torso connects to the safety PCB via I²C or SPI. Contact detected anywhere on the body triggers a speed reduction (not necessarily an E-stop — collaborative robots reduce speed rather than stopping outright). Response time: <5 ms from contact to speed reduction

• IMU-based collision detection: The safety MCU reads a dedicated safety IMU (separate from the navigation IMU). A sudden acceleration spike (>5g within 2 ms) indicates a collision. Combined with torque data, this provides a robust collision detection path independent of vision or lidar

PCB Design for Functional Safety

• Galvanic isolation: Safety-critical I/O (E-stop loop, contactor drive, braking MOSFETs) is isolated from non-safety domains using digital isolators (TI ISO7741) with 5 kV reinforced isolation. Prevents a ground fault in the main system from propagating to the safety domain

• Creepage and clearance: 48V power domains: 3.2 mm creepage per IEC 60664. Safety-critical traces routed on inner layers with no adjacent high-voltage nets. Conformal coating on both sides for environmental protection

• Redundant power supply: The safety PCB is powered from both the main 48V battery (via an isolated DC/DC) and a backup supercapacitor (3F, 5.5V stepped up). If the main battery is disconnected, the supercapacitor provides 500 ms of hold-up — enough to complete a safe shutdown and log the fault

• Layer stackup: 6 layers. L2: solid GND for safety domain. L5: solid GND for non-safety domain. The two grounds are connected at a single star point via a 0Ω jumper (removable for isolation testing). No overlapping of safety and non-safety traces on adjacent layers