Project Start
Worked for 5 mins 56 sec
Created 5 project docs
Firmware Starter — WeLift Gate Controller
Arduino/PlatformIO starter for U3 ESP32-S3-WROOM-1U-N16R8. The mapping below is grounded in the live U3 netlist; TXD0/RXD0 GPIO identities a...
Board Bring-Up Plan — WeLift Gate Controller
Use an isolated, current-limited bench source, DMM, oscilloscope with appropriate differential probing, electronic load, USB data isolator w...
FCC/CE TCF Draft and RF Integration Notes — WeLift Gate Controller
Host controller using U3 ESP32-S3-WROOM-1U-N16R8, a Wi-Fi/Bluetooth module with U.FL external-antenna interface, plus an optional plug-in LT...
Preliminary Safety Analysis and FMEA — WeLift Gate Controller
The product presents only isolated, normally-open dry contacts to command inputs of an independently certified gate operator. It does not sw...
Show 1 More
The schematic is complete and ERC-clean, with firmware, bring-up, compliance, safety, and manufacturing files created.
Open blockers
- PCB stackup repeatedly reverts to two layers due to a platform persistence fault, so routing cannot safely proceed.
- Cellular-area placement remains unroutable.
- Production also requires the TVS, cellular connector, fuse-inrush, mounting-hole, and relay-surge items listed in the Manufacturing Readiness Checklist.
Completed files
The stackup fault has been reported internally; routing and manufacturing export remain intentionally unfinished rather than producing an unsafe board.
Fix blockers and review
Fix PCB blockers
Replace input TVS
Verify cellular connector
Review BOM cost
Refine this doc
Ask about this doc
Preliminary Safety Analysis and FMEA — WeLift Gate Controller
Safety claim and boundary
The product presents only isolated, normally-open dry contacts to command inputs of an independently certified gate operator. It does not switch motor power and must not replace or bypass photo-eyes, sensing edges, limits, emergency release, UL 325/ASTM F2200 functions, or any operator safety logic. A CLOSE relay closure is only a request to the certified operator.
Mandatory fail-safe requirements
- K1/K2 outputs default OFF electrically via 100 kΩ gate pull-downs and in firmware before any network/modem initialization.
- Loss of Wi-Fi, cellular service, backend connection, authentication state, time validity, firmware task, or communications must not actuate either relay.
- Reset, brownout, watchdog, bootloader, USB flashing and OTA must leave COM–NO open.
- OPEN and CLOSE relays are mutually interlocked; pulse duration is bounded in two independent software checks. No sustained closure or automatic retry after communications recovery.
- Commands require authenticated, authorized, replay-protected transport in production. The starter’s local serial token interface is development-only.
- Position inputs are monitoring signals only; inconsistent states must raise a diagnostic and never directly cause motion.
Preliminary FMEA
Table
| Hazard / failure mode | Local effect | Potential hazardous effect | Existing control | Required verification / action |
|---|---|---|---|---|
| MCU pin floats during reset | Relay driver could turn on | Uncommanded gate request | 100 kΩ gate pull-downs; active-high coils | Scope GPIO4/5 and contacts through power/reset/brownout/flash; zero closure allowed |
| Firmware hangs with relay on | Extended dry-contact closure | Operator interprets sustained command unexpectedly | Pulse timer, absolute timeout, interlock | Add independent watchdog/task supervision; fault-injection test; consider hardware monostable if operator data warrants |
| Communications loss/reconnect | Stale command replay | Unexpected actuation | Default no action; no auto-retry | TLS, nonce/sequence, expiry, idempotency and audit log; disconnect/reconnect tests |
| Authentication compromise | Unauthorized command | Gate movement request | Placeholder token only in starter | Production secure provisioning, mTLS/strong credentials, rate limits, signed OTA, key rotation |
| Both relays active | Conflicting OPEN/CLOSE request | Undefined operator behavior | Software interlock; separate drivers | Attempt concurrency/fault injection; production requirement: never overlap |
| Relay contacts weld | Command remains closed | Continuous operator input | Dry-contact relay isolation | Obtain operator input voltage/current/inrush; qualify contact rating and fault response; maintenance diagnostics |
| Relay/field surge | Contact/PCB damage or unintended closure | Loss of control or fire/damage | Contacts kept floating; no unverified clamp | Gate-interface data and outdoor cable surge target required; system-level surge test |
| Optocoupler input open/short | Wrong position report | Incorrect status displayed | Galvanic isolation, debounce | Plausibility diagnostics; never use state alone to bypass safety or initiate close |
| Brownout from cellular burst | MCU reset | Possible transient command | U4 current limit/soft start; bulk C20; pull-downs | 2 A pulse test while monitoring rails/contacts; no reset-induced closure |
| Input overvoltage/surge | D1 conduction/failure, regulator damage | Smoke, loss of function | Fuse, bridge, TVS, 100 V buck | Replace D1 with 40–43 V bidirectional ≥600 W qualified part; define surge standard and pass level |
| Fuse inrush nuisance-open | Loss of controller | Loss of remote service | 2 A fuse selected provisionally | Validate 9400 µF cold/hot inrush; revise only after time-current and copper review |
| Wrong modem pinout/connector | Short or control inversion | Damage/reset/unintended behavior | Modular interface, switched/current-limited rail | Verify J7 footprint and numbering; module-specific harness review before connection |
| Water/dust/condensation | Leakage/corrosion/short | Unintended relay request, shock from external system, loss of function | Intended external IP enclosure | Select IP65/IP67 enclosure, glands, venting/coating process; ingress, condensation and corrosion testing |
| Antenna/enclosure integration | RF degradation/EMC emission | Loss of comms; regulatory noncompliance | Pre-certified module strategy | Approved antenna/cable only; RF exposure/EMC testing in final enclosure |
| Installer connects powered status output | Overstress isolation input | Damage/loss of indication | J4/J5 specified volt-free only | Labeling, keyed documentation, voltage withstand/miswire assessment |
| PCB mounting/clearance undefined | Mechanical stress/short | Latent failure | None finalized | Define mounting-hole size/location, supports, torque and enclosure clearances before fabrication |
Safety validation acceptance criteria
- No COM–NO closure in any power-up/down, reset, bootloader, brownout, network-loss or malformed-command test except an explicit authenticated bounded pulse.
- Relay command pulse ≤2.0 s configured maximum and ≤2.5 s absolute fault maximum; no overlap.
- Dry contacts remain isolated from all board rails/grounds.
- Communications recovery produces status synchronization only, never an actuation.
- Closing is always executed by and subject to the certified gate operator’s entrapment protection.
Residual and system-level work
Environmental/IP enclosure design, cable glands, lightning/surge/EFT/ESD testing, relay contact surge/rating validation, field wiring rules, installation manual, cybersecurity lifecycle, final modem/antenna compliance and a qualified safety review remain required. This preliminary FMEA does not establish UL 325 product certification or authorize connection to motor circuits.
Safety claim and boundary
Mandatory fail-safe requirements
Preliminary FMEA
Safety validation acceptance criteria
Residual and system-level work
