Here are some of the parts I think I've figured out regarding the problem posed in my prior post about the Big Thud:
The ATmega PWM in "Phase Correct" PWM mode outputs clean DC at PWM values of 0 and 255, meaning at 0 the H-bridge is off, and at 255 it is in full-on conduction (well, two of its legs are).
We use a GPIO pin to set the motor direction at the MOSFET driver chip, giving us the equivalent PWM range of -255 to +255, where zero in each direction has the H-bridge in the same state (no legs are on).
One important thing I forgot to mention in the original post is that our gearmotors have built-in friction brakes that are normally engaged, and need DC applied to release them and permit the motor to rotate. The DC comes from a second PWM directly driving a MOSFET. So removing external power SHOULD have engaged the friction brakes!
Clearly, removing external power did NOT remove power from the system. And the only other power source is the now motor with a 350 kg load attached. We expect a motor to become a generator under these circumstances.
But how did this power get to the brakes?
And why/how was the polarity correct? Why didn't the system get fried by reverse voltage from the motor?
There is only one possible answer: The H-bridge served as a bridge rectifier, routing power to the supply bus instead of cleanly shorting the motor.
When external power was removed, the motor became a generator and immediately started powering the system. And because the logic power supplies took power from the same bus as the H-bridge motor power, those supplies never lost their input power, and the processor never stopped running. Which means it's state of driving downward is still active, and prevented power being removed from the friction brakes!
So, current was still flowing through the motor: Shouldn't this have slowed the descent? Well, it probably did, a little, but not obviously enough to matter.
OK then, if there wasn't enough current for significant dynamic motor braking, why didn't the voltage climb high enough to damage any circuitry?
There are two key pieces of data I don't (yet) have: 1) What is the current through the motor when its input is shorted with a 350 kg load applied? 2) What is the voltage on the open motor output with a 350 kg load applied? In other heavy-load systems, I've seen shorted motor currents of several hundred amps (but zero volts), and open circuit voltages of hundreds of volts (but zero amps).
Our system was somewhere between these two extremes.
The first element to fry would/should have been the buck switcher module. While we were using it with an input of 28V, it was rated up to 42V, and would probably survive 50V or higher for the few seconds it took for the load to fall to the floor.
Releasing the friction brakes takes about 3 amps at 12V, and the PWM to the MOSFET was set for a 43% duty cycle, for an average current draw of 1.3 amps at 28V. The logic supplies pull under 100ma from the 28V bus, and so aren't as important a load as the friction brakes.
Bottom line, TWO things had to go wrong for the load to crash to the floor: The motor wasn't shorted, and power wasn't removed from the friction brakes. If either of these had happened, the load would not have come crashing down.
What did we do wrong?
First, there were no diodes present to block reverse current from the motor to the 28V bus. These diodes would go between the 28V supply and the H-bridge. Oh yes, they were present in the initial design, but we INTENTIONALLY removed them when someone noticed we could recover power from the system by doing regenerative braking during descent. And that effect was in full evidence when going down at full speed: The current on the 28V supply bus was indeed reversed, and we were supplying current back to the supply (which had other large loads). But the regenerative braking didn't permit nearly as much current to flow as would a true shorting of the motor leads.
Second, why didn't the H-bridge short the motor? Remember, two of the legs were in full conduction during the descent, and that didn't change when the supply was disconnected (because the electronics driving it never had power removed). When a MOSFET is on, the body diode essentially "goes away" because its forward voltage drop is never reached, so it can't be driven into conduction. The only available current path was to the supply bus, not shorting the motor.
What's the fix? Well, what if we never remove external power? While that sounds impractical, it turns out that adding an internal pair of AGM batteries (only slightly larger than motorcycle batteries) can provide enough power for our system under all required operational scenarios. The external 28V bus is attached to a heavy-duty battery charger instead of directly to the system. Instead of a peak current draw of 60A and a reverse current of 10A, the external supply now sees a load current that can't exceed the charger's draw limit of 7A.
But isn't that a kluge? Yup, it sure is, but it does have other benefits (such as independent operation). What's the REAL fix?
One key flaw is the ability of the motor (in generator mode) to power the friction brakes. If the friction brakes had engaged, everything would have come to a safe and immediate halt. The friction brakes would engage if power to its MOSFET were removed, or the MOSFET itself were turned off. Which means a related flaw is the motor being able to power the electronics.
If we gave up regenerative braking, the solution would be to insert the blocking diodes mentioned earlier. But now that we are using internal batteries for primary power, regenerative braking allows us to meet our operational requirements using smaller batteries than we would need otherwise.
Are we in a "Catch 22"? We haven't yet found a simple or elegant way to ensure the motor can't power the brakes or electronics and still keep regenerative braking. There are lots of complex approaches that use reverse current sensors and relays, but they add complexity and cost (more than the batteries and charger did), and may reduce overall reliability (new failure modes).
What do you think the right approach should be?
(Yes, I've wandered a bit from the intent of this thread. But it's still a question, so *technically* it can still go in this thread. Please don't banish me!)