Chapter intent (why this must come first)

UV-C safety fails when the design focuses on “turning UV on” instead of proving a closed chain: permission → controlled emission → continuous monitoring → deterministic cutoff → auditable evidence. This chapter locks the boundary and defines success criteria that can be measured on the bench and in production.

System boundary (what this page owns vs ignores)

• UV source (black box): UV-C LED arrays or lamps are described only by measurable radiometric output, warm-up behavior, temperature dependence, and aging drift. The internal driver topology is out of scope.
• Optics / enclosure: defines where UV is allowed to go (aperture) and where it must never go (seams, vents, cable exits). This is the primary surface for leakage risk.
• Target plane: the plane where “dose” is defined (dose is not a property of source current; it is delivered energy at the target).
• Safety control: interlock chain, timers/watchdogs, dose & leakage monitors, and logging (the core of this page).

Practical rule: if a feature does not directly change “dose correctness” or “exposure prevention”, it does not belong on this page.

The control & safety chain (the invariant backbone)

Treat UV-C as a state machine with explicit proofs per transition. Each block below must have (1) an input condition, (2) a measurable output, and (3) a fail-safe behavior.

1. 1
   Enable

   Interlocks valid + arming policy satisfied → emission permitted.

   Proof: latched interlock status + arm reason logged.
2. 2
   Emit

   UV source active only while safety conditions remain true.

   Proof: emission state + runtime counters recorded.
3. 3
   Monitor dose

   Corrected irradiance → integrated dose accumulator at defined plane.

   Proof: irradiance_raw/irradiance_corr + dose_accum + sampling health.
4. 4
   Monitor leakage

   Perimeter/stray UV sensing monitors forbidden regions continuously.

   Proof: leakage level + persistence time + trip cause.
5. 5
   Cut off

   Any unsafe condition forces a hard transition to SAFE_OFF (critical faults latch).

   Proof: cutoff timestamp + reason + clear method (manual acknowledge / key-cycle).
6. 6
   Log

   Event records make safety auditable and debuggable.

   Proof: fixed schema + retention policy + integrity checks.

Success criteria (measurable, testable, non-negotiable)

• Dose correctness class: explicitly label whether the system proves target-plane dose (direct or verified sensing) or only estimates dose (model/proxy). Define the associated error budget and the “worst-case low dose” margin (used as acceptance threshold).
• Leakage thresholding concept: define threshold, persistence window, and reset policy. Engineering-friendly rule form: leakage > T for Δt ⇒ SAFE_OFF + LATCH + log.
• Interlock stop time: define maximum time from “interlock open” to “emission terminated”, and verify it by measurement.
• Fail-safe defaults: any power-up/reset/brownout must land in SAFE_OFF; no automatic resume-to-ON after restart or fault.
• Traceability: every exposure session can be reconstructed from logs: initial conditions, sensor readings, computed dose, cutoffs, and faults.

Evidence to capture (minimum record set that prevents “hand-wavy safety”)

Define the evidence schema early; later chapters must populate it without exceptions:

• Interlock snapshot: door/key/e-stop/service bits + debounced state + open duration
• Emission state: SAFE_OFF / ARMED / EMITTING / FAULT_LATCHED + state transition timestamps
• Dose telemetry: irradiance_raw, irradiance_corr, dose_accum, dose_target, integration health
• Leakage telemetry: leakage_raw, leakage_corr, persistence_ms, trip threshold, trip flag
• Timing: session_timer, cumulative_timer, watchdog events, power anomaly counters
• Calibration: coefficient version, date, validity, temperature range assumptions
• Fault: fault_code, latch flag, clear method, last-known sensor snapshot
• Runtime/aging: runtime hours, temperature (at least one), maintenance counters

Acceptance test list (what will be proven on the bench / in production)

• Default OFF: prove SAFE_OFF after power-up/reset/brownout (no “resume ON”).
• Interlock stop time: measure “interlock open → emission stops” and compare to requirement.
• Timer cutoff: prove max-session and cumulative limits force SAFE_OFF under fault injection.
• Leakage trip: induce controlled leakage and verify SAFE_OFF + latch + logged evidence.
• Audit trail: verify required log fields exist for every session and every cutoff event.

Dose is an integral, not a setting

Dose is delivered energy per area. In engineering terms, dose is computed by integrating irradiance over time at a defined plane (the target plane): dose (mJ/cm²) = ∫ irradiance (mW/cm²) dt. Any dose claim is incomplete unless it states (1) where irradiance is defined, (2) how it is sampled, and (3) which corrections are applied.

• Irradiance: instantaneous UV-C power per area at a specific plane and orientation.
• Dose: time-integrated irradiance; integration must be robust to dropouts, saturation, and filtering delay.
• Minimum guaranteed dose: conservative value after subtracting negative contributors in the error budget.

Discrete-time integration (what the firmware must decide)

Real systems integrate samples. The implementation choices below directly change dose accuracy and safety margins.

• Sampling cadence: choose a cadence that captures expected intensity changes (warm-up, PWM windows, motion).
• Missing samples: define a rule (hold-last, decay-to-zero, or invalidate session) and log when it happens.
• Clipping/saturation: if the sensor or ADC saturates, the dose estimate becomes untrustworthy; handle as a fault or conservative bound.
• Timebase integrity: dose is proportional to time; track timebase health (watchdog resets, clock drift indicators).
• Filtering: avoid filters that delay detection of unsafe spikes; separate “display smoothing” from “safety decisions”.

Geometry and environment terms (why “stable output” can still under-dose)

Even if UV source output is stable, delivered irradiance at the target plane can vary due to geometry and medium effects. These effects belong in the error budget as bounded factors (not as vague warnings).

• Distance & orientation: off-axis targets reduce effective irradiance; sensor cosine response matters.
• Shadowing: occlusions create local under-dose zones that near-source sensors may not detect.
• Reflectance paths: reflectors can boost dose locally while increasing seam leakage risk.
• Airflow / turbidity (context): scattering/absorption changes energy delivery; treat as a correction factor if the product’s application includes it.

Error budget template (spreadsheet-ready, design-decision forcing)

A useful error budget forces decisions. It must separate contributors by source, sign, and evidence method. The goal is to compute a conservative worst-case low dose that is still above the minimum required dose.

• Sensor calibration: reference uncertainty, linearity, repeatability, spectral mismatch, dark offset.
• Placement/model mismatch: sensor sees a different flux than the target plane; geometry tolerance & baffle effects.
• Temperature: responsivity changes with temperature (sensor) and output shifts with temperature (UV source).
• Drift & aging: source aging, window contamination/yellowing, sensor drift; define runtime-based bounds.
• Integration: sample cadence, missing-sample policy, saturation handling, timebase integrity.

Worst-case low dose margin (how to turn the budget into a safety criterion)

Avoid using nominal calculated dose as the acceptance criterion. Use a conservative margin based on the lowest plausible delivered dose. A simple, design-driving form is: dose_min = dose_nominal × (1 − cal_err − placement_err − drift_err − temp_err − integ_err). The exact combination rule depends on whether contributors are independent, but the output must be conservative and repeatable.

• Step 1: define dose_nominal at the target plane for a controlled, repeatable setup.
• Step 2: assign bounds for each negative contributor (with an evidence method).
• Step 3: compute dose_min and require dose_min ≥ required_minimum_dose.
• Step 4: log the assumptions (cal_version, runtime, temperature range, sampling policy) so the proof is reproducible.

What this chapter solves

Placement is usually the #1 source of dose measurement errors. This chapter explains how to correctly position sensors to avoid errors such as over-reads, under-reads, and shadowing. It also covers how optical coupling influences sensor readings and what to do to ensure accurate measurements.

Placement strategies and failure modes

Multi-sensor strategy for uniformity & diagnostics

• Goal: Use 2–4 sensors to diagnose uniformity issues and ensure accuracy in readings.
• Strategy: Place sensors at different positions to measure the consistency of light across the target area.
• Failure Mode: If one sensor reads differently, it signals an issue in the system (e.g., shadowing, leakage).
• Action: Cross-check readings between sensors and adjust placement accordingly.

Failure modes & evidence fields

• Over-read: The sensor picks up more light than it should due to direct light paths. Capture: sensor_fov_check
• Under-read: The sensor fails to capture all available light due to shadowing. Capture: shadow_suspect_flag
• Contamination: Sensor lens contamination reduces readings over time. Capture: sensor_window_status
• Leakage: Incorrect readings from leakage points. Capture: leakage_detection_flag

Figure F5: Placement options & failure modes

What this chapter solves

This chapter turns calibration into a repeatable SOP and ensures its validity over time by addressing factory calibration, in-field checks, and drift & aging compensation.

Factory calibration setup

• Reference radiometer setup: Use a calibrated radiometer with fixed geometry.
• Multiple points: Calibrate at multiple points across the target plane.
• Store coefficients: Save calibration coefficients for later use and validation.

In-field verification

• Quick check routine: Perform a self-test intensity window, using a reference target in service mode.
• Service mode: Allow easy access for calibration checks and adjustments.

Drift sources

• Sensor drift: Over time, sensor response can change due to internal factors.
• Window yellowing: The optical window may degrade, impacting light transmission.
• LED/lamp aging: The light source may degrade over time, affecting emitted energy.
• Temperature dependence: Sensor response may vary with temperature.

Compensation strategies

• Temperature correction: Use temperature coefficients to adjust for temperature-induced variations.
• Runtime-based derating model: Adjust for aging over the lifetime of the device.
• Periodic recalibration triggers: Set triggers to recalibrate when significant drift is detected.

Calibration records structure

Store calibration records with the following details:

• calibration_date: Date of calibration.
• coefficients_version: Version of the calibration coefficients.
• reference_setup_id: ID of the calibration setup used.
• pass_fail_bounds: Pass/fail limits for each calibration test.

Figure F6: Calibration loop over product life

Design intent & non-negotiables

Interlocks must be hardware-first and software-assisted. The hard-disable path must remain effective even when firmware is stalled, misconfigured, or partially functional. Software may add diagnostics and logging, but must never be the only barrier between “unsafe” and “UV emission.”

Interlock sources & how to treat them (concept-level)

Hardware-first architecture: safety chain → hard disable

Use a series safety chain that drives a hard cutoff element (a hardware gate/enable input or equivalent). Firmware monitors each interlock node, validates re-arm policy, and logs evidence — but the chain must cut off emission even if firmware is not executing.

Redundancy patterns & when to use them

Redundancy is selected by risk level. For higher-risk exposure, prefer two-channel interlocks or diverse sensing. The goal is to avoid a single point of failure that silently disables safety.

Safe states & re-arm policy

Define safe states explicitly so behavior remains predictable and testable. A practical policy uses default OFF on fault, latched OFF for critical violations, and a clear re-arm sequence that prevents repeated unsafe retries.

Evidence to capture & acceptance tests

Interlocks are only credible when response time and behavior are measured. Capture requirements and measured results as part of validation.

Figure F7: Interlock hard-disable chain

Design intent: verify containment continuously

Leakage sensing is not “shield it once and hope.” It is a continuous verification layer that detects stray UV paths, enforces immediate cutoff, and provides traceable evidence for containment performance over time.

Where leakage happens (generic leakage points)

Sensing strategy: perimeter sensors + threshold + time filter

A practical architecture uses a perimeter ring of leakage sensors focused on seams/vents/exits. Each sensor uses thresholding plus a short time filter to avoid nuisance trips from brief transients while still reacting fast to real leakage.

Containment verification during production test (generic)

Containment must be verified at production with a repeatable scan plan. Define test points around seams/vents/exits, measure leakage envelope, and enforce pass/fail bounds with clear rationale.

Evidence to capture: leakage map, threshold rationale, trip logs

Figure F8: Leakage sensing perimeter map

Why timing is a safety barrier (not a convenience)

Timed cutoffs exist to guarantee SAFE_OFF even when commands, sensors, or firmware become unreliable. The design target is simple: no single fault can keep emission enabled indefinitely.

Maximum exposure timers (three complementary gates)

Watchdogs (three layers, one goal)

The goal is not “reboot”; the goal is “OFF is guaranteed and measurable.”

Power anomaly handling: default OFF and no resume-in-ON

Re-arm rules (policy-level, but testable)

Re-arm is a controlled sequence that reduces unsafe retries. A practical minimum is: acknowledge → re-validate safety conditions → grant a one-shot enable.

Evidence to capture & fault-injection checklist

Figure F9: Fail-safe timing ladder

Firmware boundary: dose + safety + proof (without protocol creep)

Firmware is where dose estimation, safety triggers, and audit-ready evidence converge. The scope here is strictly internal: sampling → correction → integration → fault logic → state machine → logs.

Dose accumulator (engineering-grade, not hand-wavy)

Fault logic (layered triggers with deterministic actions)

Each fault needs: trigger condition → action (SAFE_OFF/latch/degrade) → log fields.

Event logging schema (ring buffer + critical snapshot)

{
  "ts_ms": 123456789,
  "state": "ACTIVE",
  "irradiance_est_mw_cm2": 4.12,
  "dose_acc_mj_cm2": 52.8,
  "dose_target_mj_cm2": 60.0,
  "sample_dt_ms": 10,
  "missing_sample_cnt": 0,
  "interlock_state": "CLOSED",
  "leak_state": "OK",
  "timer_session_ms": 42000,
  "fault_code": "NONE",
  "trip_reason": "NONE",
  "cal_version": "CAL_3",
  "reset_cause": "NONE"
}

Minimum retention policy (auditable but practical)

Evidence fields checklist (copy into a requirements doc)

Figure F10: Firmware dataflow

Typical Symptoms in UV-C Devices

The following are common symptoms faced in field debugging of UV-C devices. For each symptom, follow a 4-step process: diagnose, measure, isolate, and fix.

4-Step Debug Process for UV-C Symptoms

For each symptom, enforce a structured 4-step troubleshooting process:

Evidence to Capture During Debug

During the debugging process, ensure the following evidence is captured:

Figure F11: UV-C Debug Decision Tree