Protection Timing¶
The protection ladder says what fires and in what order. This page explains the timing: why some rungs cut instantly, why others wait, and where the specific numbers come from. It is the reasoning to read before moving any of the over-voltage thresholds or times to act.
The problem being solved¶
Every field cut is a mechanical event. An alternator under load resists the crank with real torque; chopping the field removes that torque in tens of milliseconds, and the engine feels it — a lurch, a belt snap, a rev flare at idle. A regulator that cuts instantly on every brief excursion is felt constantly, and most of those cuts buy nothing: the excursion would have resolved on its own under the proportional current shed.
So the design question is not "how fast can the regulator cut" — it can cut in milliseconds — but "how fast does it actually need to cut." The answer is set by the other protection system on the bus: the battery's own management system (BMS).
What a lithium BMS actually does¶
The controlling hazard on a lithium bank is the BMS opening its charge path under load. An alternator feeding a bank that suddenly disconnects is the classic load-dump scenario: the field is energized, the load vanishes, and the bus voltage flies until something absorbs it. The regulator must therefore always act first — the BMS should never be the device that ends a charge event.
A survey of the charge-disconnect criteria published for marine lithium batteries supports two conclusions:
- No known BMS opens its charge path on any event shorter than 0.5 seconds. Where qualification delays are published at all they run 1 to 4 seconds; the rest publish threshold-only criteria whose practical response is no faster.
- The voltage comparators are per-cell, referenced to the highest cell. Published charge-disconnect voltages start at about 3.6 V per cell (14.5 V on a 4-cell 12 V bank) and run up toward 3.9 V per cell. Current-side disconnects, where published at all, sit near 1C with hold times from half a second to minutes.
Two design facts follow. First, a transient shorter than half a second — whatever its amplitude, within reason — is invisible to every BMS: there is no race to win, so there is no reason to cut the field over it. Second, any sustained violation must be fully resolved, field de-energized, before that half-second is up.
The 0.4-second rule¶
De-energizing the field is not instant: the coil's stored energy takes roughly 100 ms to bleed after the cut (the actual figure is measured for each installation during commissioning — the field-decay characterization). Budgeting that out of the 0.5 s floor leaves 0.4 seconds as the working rule:
Any excursion that persists is cut within 0.4 s of crossing the lowest trip line. Anything shorter is ridden through while the proportional shed works on it.
That single rule generates the timed tiers, and the margin arithmetic below generates the thresholds.
The ladder, and why each rung is where it is¶
12 V lithium defaults shown; every voltage scales with the system voltage class (× class/12).
| Rung | Threshold | Time to act | Why it is there |
|---|---|---|---|
| Proportional shed (Group 2) | target + 0.10 V | continuous | Sheds current in proportion to the excess. Resolves most excursions with no cut and nothing felt at the engine. |
| Timed cut, LOW tier | target + 0.10 V | 0.4 s | The 0.4-second rule itself. It rides the shed line, so the shed always gets the whole dwell to win first. |
| Timed cut, MID tier | target + 0.20 V | 0.15 s | A larger excess earns less patience — an inverse-time characteristic, like a breaker curve. |
| Software hard cut | 14.2 V absolute | instant | The amplitude bound. Logged, lockout-managed, recoverable — the preferred hard trip. |
| Hardware shutdown (INA228 alert pin) | 14.3 V absolute | instant, electrical | Fires with no firmware involved. Exists for exactly one case: firmware that is hung, crashed, or mid-update. |
| BMS charge disconnect | ~14.5 V and up | ≥ 0.5 s | Never reached. That is the point. |
The two absolute rungs are deliberately ordered software-first. The software cut produces a named reason, a counter, an adaptive lockout, and a managed recovery; the hardware pin produces a bare electrical fact. In a healthy system every hard trip should be a software trip, and a nonzero hardware-cut count is itself diagnostic — it means software failed to act.
The timed tiers measure their dwell against the same filtered voltage the shed uses, and the clock is strict: one tick back under the line resets it. A ripple crest that flirts with the line accumulates nothing; only a genuinely pinned bus runs out the timer.
Placing the two absolute rungs for a specific battery¶
The defaults are placed against the lowest surveyed BMS floor, so they are safe for an unknown battery. For a known battery they can be set precisely:
- Find the BMS charge-disconnect voltage per cell in the battery documentation (it may be called high-voltage disconnect, overvoltage protection, or charge cutoff). Multiply by the cell count for the pack-referred value.
- Set the Hardware Shutdown Voltage 0.2 V (× class/12) below it. The margin is 0.2 rather than 0.1 because the BMS trips on its highest cell while the regulator sees pack voltage — on a 12 V bank, 0.1 V of pack margin is only 25 mV per cell, which routine cell imbalance can consume.
- The Alternator Hard Shutdown Voltage (software) sits 0.1 V (× class/12) below the hardware value; the firmware enforces the order on every write and at boot.
For flooded and AGM lead-acid there is no BMS in the picture, and every lead-acid damage mechanism integrates over minutes to years — a brief bounded excursion above bulk does the battery no measurable harm. Their hardware ceiling (16 V on a 12 V bank) instead protects the connected DC loads, whose published continuous ratings top out near that level, with the software cut 0.1 V under it.
Why the hardware rung cannot be the timed one¶
The obvious alternative — make the independent hardware comparator the 0.4-second layer — is not available, and the reason is worth recording. The INA228's alert compares against its internally averaged reading, and the chip has exactly one averaging depth shared by every input: slowing the voltage comparison to hundreds of milliseconds would slow the battery-current measurement to the same cadence, starving the load-dump detector and the charging loop of the ~5 ms current samples they run on. The averaging is therefore left shallow (about 4.3 ms while the field is live), the pin stays instant, and the timed behavior lives in software where each tier can carry its own clock.
Timing on the current side¶
The same philosophy, applied where time constants appear in the current protections:
- Hard overcurrent (the electronic fuse) debounces for 40 ms — comfortably above sensor noise, still far inside the budget of any real fault.
- Load-dump detection cannot wait: it exists to catch the one event class where the bus can run away in milliseconds. Each tier's time to act — its consecutive-sample count times the ~5 ms sampling interval — is shown directly under its setting, so the trade is visible rather than implied.
- The sustained current-excess supervisors already work on a time-averaged signal (75 ms averaging); their response time is set by the threshold-versus-ripple margin, not by a debounce, and needs no adjustment under this rule.
What to expect in practice¶
With the ladder timed this way, brief excursions — an RPM blip cresting over target, a moderate load step, a wave-induced surge — end under the proportional shed with no cut and no lurch. Field cuts still happen, but each one now means something specific: a bus that stayed pinned above a trip line for its full dwell, an absolute threshold crossed, or a genuine load dump. The lifetime overvoltage history on the Safeties and Protections page records which rung caught each event; a healthy installation accumulates shed engagements and little else.