I have designed and built lots of systems where failures cost BIG bucks or damage things that you just don't want damaged (like people). Getting a robust set of protections implemented is well worth the effort. Getting them to work in such a way that they don't interfere with normal operation can be a real pain.
You need to look at EVERY single component and decide what happens if it opens/shorts/drifts/gets eaten by elves/gets crapped on by gremlins and how to detect and minimize the damage when (not if) that happens. The same with the code. Every comparison and branch is evil incarnate, just waiting to make your day miserable. Never forget that they are all out to get you.
My capacitive discharge spot welder has a rediculous amount of code and hardware (well over 50%) dedicated to fault monitoring and protection. The idea was to make it so no single point of failure could kill the caps or blow the FETs. Not easy to do considering it tosses around 20,000 amp pulses without breaking a sweat. Well worth the effort, though. It has only fried once (during a test while a protection feature was disabled... can you say Chernobyl?).
My high power (300+ watt) LED dimmer/driver has a similar protection philosophy. It can protect against low or high battery voltage, thermal overload, temperature sensor failure, fan failure, etc. So far it has not killed any LEDs or batteries... either of which is a $50-$200 boo-boo. Not too shabby considering the whole thing fits in 1K of compiled code. Again half of that is protection related.
You need to look at EVERY single component and decide what happens if it opens/shorts/drifts/gets eaten by elves/gets crapped on by gremlins and how to detect and minimize the damage when (not if) that happens. The same with the code. Every comparison and branch is evil incarnate, just waiting to make your day miserable. Never forget that they are all out to get you.
My capacitive discharge spot welder has a rediculous amount of code and hardware (well over 50%) dedicated to fault monitoring and protection. The idea was to make it so no single point of failure could kill the caps or blow the FETs. Not easy to do considering it tosses around 20,000 amp pulses without breaking a sweat. Well worth the effort, though. It has only fried once (during a test while a protection feature was disabled... can you say Chernobyl?).
My high power (300+ watt) LED dimmer/driver has a similar protection philosophy. It can protect against low or high battery voltage, thermal overload, temperature sensor failure, fan failure, etc. So far it has not killed any LEDs or batteries... either of which is a $50-$200 boo-boo. Not too shabby considering the whole thing fits in 1K of compiled code. Again half of that is protection related.