A heating controller is not a phone. Nobody replaces it every two years. It goes into a basement or a plant room. It has to run for 10 to 15 years with almost no service. Getting the first prototype to work is the easy part. The hard part is the thousandth unit, still working ten years later, long after the engineer who designed it has left.
Almost every long-life field failure we have been asked to investigate started with a decision made in the first few weeks of the project. So that is where the design work belongs.
What actually kills these products
Electrolytic capacitors, most of the time.
Their lifetime roughly halves for every 10 °C increase in operating temperature. A capacitor rated for 2,000 hours at 105 °C may last well over a decade in a lightly stressed design, or only a few years if exposed to high heat and ripple current. That is why we derate them generously, place them away from hot components, and use polymer or long-life types where the budget allows.
Relays are next. Every relay has a limited number of switching cycles. That number drops fast under inductive loads such as motors, pumps, and solenoid valves. A relay controlling a pump just a few times per hour can still accumulate millions of operations over the product’s lifetime. So we size it for the real duty cycle, not the headline number in the datasheet. On the 12 kW three-phase water heater controller we built for HotSet, we moved the switching to TRIAC stages with zero-cross detection. That removed the mechanical wear completely.
Then there is the power environment, which is not a single component. Brown-outs, mains spikes, condensation, and surge events are normal in a plant room. They are not rare cases. Surge protection, reverse-polarity protection, and a wide-input supply should be part of the design from day one. If you only add them after a field failure, you end up paying for a redesign.
The firmware has to outlive its chip
Hardware is only half of the problem. A connected device needs security patches and bug fixes for as long as it is in the field. Under the EU Cyber Resilience Act, that is now a legal duty, not a favour to the customer. None of it works unless the firmware was built for it. That means a clean separation between the application logic and the hardware abstraction. It means deterministic state handling, watchdogs, safe states, and signed OTA updates.
The hardware abstraction layer matters more than it sounds. Over 15 years, a microcontroller will go end-of-life. That is certain. A layered architecture lets you move to a new chip without rewriting the whole product. We have done exactly this for a client whose original chip disappeared from the market. We carried the existing behaviour onto a new part.
This is why we run every project through PrecisionPath 7™, our seven-gate development process. A capacitor lifetime question is free when it is one line in a Gate 1 requirements document. The same question becomes a recall when the field finds it for you. So lifetime targets, EN 60335 scope, and duty cycles get fixed before anyone draws a schematic. Derating and end-of-life flagging happen during detailed engineering. And active management of the parts list at volume keeps the product buildable as components change underneath it.
Build the long life in at the start, or pay for it later in warranty claims. There is no third option.
Top comments (0)