Safety

This is the volume the rest of the series has been deferring to. Every path in the decision tree of Vol 1 — buy a kit, build the ATMega clock, design your own board — ends at the same place: a glass tube with a couple of hundred volts on its anode, a switching boost supply (the supply of Vol 3) manufacturing that rail out of a wall-wart, and a reservoir capacitor behind it that does not politely discharge itself when you pull the plug. The good news is that a nixie clock is a gentle member of the high-voltage family — it runs an order of magnitude below the kilovolts of the hub’s scope/CRT clocks, and its tubes are low-pressure glow devices that cannot implode the way an evacuated CRT can. The bad news is that “gentle” is not “safe”: 180 V DC across the chest is well past the threshold that stops a heart, sustained DC is the kind of shock that is hard to let go of, and the reservoir cap will deliver that jolt seconds after the clock is unplugged. The discipline that keeps you alive around this rail is small, learnable, and the same every time, but it is not optional. Read this volume before you energize anything in the series, keep the first-power-up checklist of § 10.6 within arm’s reach of the bench, and treat it as a pre-flight ritual rather than a suggestion. Throughout, a ⚠ marks a step where the rail is live or the stored charge has not yet been verified gone.

The hub-wide baseline lives in the shared safety note (_shared/safety.md), which classes the nixie family as the second-highest voltage tier in the entire Clocks project — below the Scope/CRT builds, well above anything mains-only. Vol 1 stated the hazard once, up front, in its § 1.9; this volume is the full law.

10.1 The hazard, honestly scaled

The first job of a safety brief is to size the danger correctly — neither shrugging it off nor inflating it into something it is not. A nixie clock is not a CRT and it is not a microwave-oven transformer; pretending otherwise breeds the wrong fears and, worse, the wrong habits. Here is the honest picture.

The anode rail of a nixie clock sits at roughly 170 to 200 V DC — strike voltage plus the headroom the supply of Vol 3 budgets for the anode resistor’s drop and rail sag. That is a hundred times less than the several-kilovolt anode of a scope CRT, which is why this volume frames the hazard in volts, not kilovolts. But the threshold that matters for a human heart is far lower than either number: a few tens of milliamps across the chest can fibrillate a heart, and the body resistance that sets that current — hand to hand, through sweaty or broken skin — can fall to a few hundred ohms. Above roughly 50 V, a source can push a dangerous current through a person; the nixie rail sits three to four times above that line. “It’s only 170 volts” is therefore a dangerous attitude, not a reassuring one — and unlike a kilovolt rail, which everyone treats with visible respect, a “low” hundreds-of-volts rail invites the casual one-handed poke that kills.

Two properties make DC at this level specifically nasty. First, sustained DC is hard to let go of: a steady DC contact can clamp the hand shut around the conductor (the “no-let-go” effect), holding you on the rail. Second — the property that bites experienced people — the reservoir capacitor stays charged after power-off. The clock can be unplugged, dark, and apparently dead while its reservoir cap still holds the full rail, waiting behind the off switch for a reaching hand. Unplugging the clock does not make it safe; only discharging and verifying the reservoir makes it safe (§ 10.2).

How much energy is in that reservoir? Enough to hurt, not enough to throw you across the room. Work it for the typical nixie reservoir — a 10 µF cap (the § 3.4 value) charged to 180 V:

  E = ½ · C · V²
    = ½ × 10 µF × (180 V)²
    = 0.5 × 10×10⁻⁶ F × 32 400 V²
    = 0.162 J  ≈ 0.16 joule

A sixth of a joule is a small number against a CRT’s aquadag capacitance (many joules at kilovolts) or a camera flash cap — but it is delivered in a tiny fraction of a second into whatever path it finds, and across the chest it is a genuine, memorable, potentially heart-stopping jolt: enough to make you flinch, drop a tool, weld a screwdriver tip, or — if your other hand is on the chassis — route current through your heart. Treat the reservoir as a charged jolt waiting to happen, every time, even on a 3.6 W clock. The wattage of the running supply is irrelevant to the hazard; the stored charge and the rail voltage are what hurt you.

FIGURE SLOT 10.1 — Hazard scale: a horizontal voltage axis marking the ~50 V “danger begins” threshold, the ~170-200 V nixie rail, and the multi-kV CRT rail an order of magnitude higher, annotated with “stored charge persists after power-off” on the nixie reservoir cap. Diagram: project original.

10.2 The discharge procedure and the mandatory bleeder ⚠

Never trust a “it has probably bled down by now.” Discharge actively, then verify with a meter, every time — this is the single most important procedure in the volume.

10.2.1 The permanent bleeder — the part that does the work for you

The finished clock should discharge itself. As § 3.7 details, a bleeder resistor fitted permanently across the reservoir capacitor drains the stored charge to a touch-safe level on its own, in a known and bounded time, the instant power is removed. This is not optional and it stays fitted in the finished build. The worked value from Vol 3 is 220 kΩ / ½ W across a 10 µF reservoir:

  τ = R · C = 220 kΩ × 10 µF = 2.2 s
  Time to fall from 180 V to a touch-safe < 50 V:
        t = τ · ln(180/50) = 2.2 s × ln(3.6) = 2.2 × 1.28 ≈ 2.8 s

So a healthy bleeder takes the rail from 180 V to under 50 V in under three seconds; five time constants (≈ 11 s) puts it under 1 %. The feedback divider alone (the ~1.5 MΩ string of § 3.5) bleeds far too slowly to rely on — τ ≈ 15 s, ~45 s to genuine safety — which is why a dedicated bleeder exists. The danger case is the build with no bleeder, or a bleeder whose solder joint has cracked: that reservoir holds 180 V for minutes, and the builder who reaches in ten seconds after unplugging gets the full jolt. Verifying the bleeder is present and connected is step one of every power-down (§ 10.6) — a dead bleeder turns the rest of this procedure into your only line of defence.

10.2.2 The manual discharge — when you cannot trust the bleeder

When you are about to put hands inside a board — a board you did not build, a board whose bleeder you have not yet confirmed, or a board you just powered down and do not want to wait on — discharge the reservoir manually, through a resistor, never through a bare screwdriver:

1. Power down and unplug at the wall. Do not rely on the switch — a switch can be on the low-voltage input side and leave the charged reservoir isolated and live.
2. ⚠ Discharge through a series-resistor tool, not a bare blade. A bare screwdriver across a charged HV cap makes a bang, a pit in the blade, a welded contact, and a current spike that can damage the cap and startle you into the chassis. A discharge tool is trivial to make: a 1-10 kΩ, ≥2 W resistor with one lead to an insulated-handle probe tip and the other to a flying lead with an alligator clip. Clip the lead to the supply ground first, then touch the probe tip to the reservoir’s positive terminal and hold it there for a few seconds so the RC settles. (For a nixie’s modest 0.16 J the resistor can be smaller than the megohm-class tool a CRT demands — a few kilohms limits the peak current to tens of milliamps and drains 10 µF in well under a second, with no bang.)
3. ⚠ Verify 0 V with a meter before you touch anything. Confirm the discharge actually happened — set a DMM to DC volts and read the reservoir against ground. Only a verified reading near 0 V clears the node for contact. Do not assume; measure. This step is what separates a safe procedure from a hopeful one.
4. Re-verify after any pause. Capacitors exhibit dielectric absorption — they can recover a surprising fraction of their charge minutes after a quick discharge, as the dielectric relaxes. If you walked away, discharge and re-measure before reaching in.

FIGURE SLOT 10.2 — The manual discharge tool: an insulated-handle probe, a 1-10 kΩ/≥2 W series resistor in line, and a clip lead to supply ground, shown touching the reservoir cap’s positive terminal; inset the RC discharge curve from 180 V to <50 V. Diagram: project original.

10.3 Working rules

These are non-negotiable around any energized nixie clock, and they are the same rules the shared baseline states for every high-voltage build in the hub — scaled to this rail, but not relaxed.

• ⚠ The one-hand rule. When a hand must be near a live HV node, keep the other hand in your pocket or behind your back. This is the rule that keeps current off the hand-to-hand path that runs across your heart. A shock through one hand to a foot is survivable far more often than one hand to the other across the chest. This single habit prevents most fatal outcomes at this voltage.
• ⚠ Never work on a powered, energized board. The default state for hands-in work is unplugged, discharged, and verified (§ 10.2). The only time the board is live with the case open is a deliberate measurement (§ 10.4), and then the one-hand rule is in force.
• No jewelry. Rings, watches, and metal bracelets are low-resistance conductors that turn a brush against a terminal into a burn or a dead short. Take them off before the bench.
• Work on an insulated bench, in good light. A grounded metal bench top gives the rail a ready return path through you; an insulating mat does not. Good lighting is a safety control, not a comfort — you cannot keep a probe off a node you cannot see, and the spare hand should rest away from the chassis, never braced on it.
• Isolation if a mains-derived timebase is used. A nixie clock fed from a wall-wart has the wall-wart’s transformer as its mains barrier and needs no further isolation. But if the build derives its timebase from the mains (a 50/60 Hz line reference, Vol 5) through a direct, transformerless connection to the line, put a bench isolation transformer between the wall and the clock before any hands-in work — it breaks the path to earth that turns a single touch into a circuit. Most nixie clocks do not need this; the few that tap the line directly do.

10.4 Measuring HV safely ⚠

A nixie rail is, conveniently, within the direct DC range of any decent multimeter — a CAT III 600 V DMM reads 180-200 V on its volts range without a second thought, so unlike the kilovolt rails of the scope-clock hub you do not strictly need a high-voltage probe to read this rail. (This is the one place a nixie is genuinely easier than a CRT: no 1000:1 probe, no special insulation, just a competent meter on its ordinary volts range.) The danger here is not the meter’s range; it is the act of probing a live node. The discipline:

• ⚠ Check the meter and its leads are rated for the job. Any meter rated to a few hundred volts DC covers this rail with margin; what matters more is that the probe insulation is sound, the probe tips are not cracked, and the leads are in the correct jacks (volts, not current — a meter left in the 10 A current jack becomes a near-short across the rail). A cheap meter is fine on volts; a damaged meter is not.
• ⚠ Clip, don’t poke. With the supply off and bled down (§ 10.2), clip the ground lead to supply ground, then clip the positive lead to the rail. Then power up and read. Probing a live 180 V point with a hand-held tip is how you put current across your chest the moment the tip slips off a tube pin.
• ⚠ One hand behind your back whenever a hand must be near a live HV node, and never probe a live node one-handed while distracted — talking, reaching for a part, reading the meter on the far side of the bench. The fatal mistakes happen during the half-second of inattention, not during the careful measurement.
• Mind the meter’s loading on high-impedance nodes. A DMM presents ~10 MΩ. On the stiff reservoir rail that is irrelevant, but if you probe the feedback divider tap or the raw top of a 1.5 MΩ string, the meter’s 10 MΩ loads the node and reads low. Measure regulation at the reservoir cap, not in the middle of the divider (§ 3.6).
• For wider margin — or if a particular build multiplies the rail higher — a 10× HV probe or a deliberate high-impedance series divider (e.g. 10 MΩ into 100 kΩ for ×101, read and multiply) drops the meter voltage to a fraction and puts insulation between your hand and the rail. For a plain 180 V nixie rail this is optional; for anything stiffer it is good practice.

10.5 NOS tube handling

Nixie tubes are almost always new-old-stock (NOS) — surplus that was manufactured in the 1960s-70s and has sat in a drawer ever since (Vol 1). They need a different kind of care than the supply does, and it helps to be precise about which fears are real and which are not.

Implosion is not a risk — and this is worth stating plainly, because it is the opposite of the CRT. A scope/CRT tube is a high-vacuum envelope; crack it and the atmosphere collapses it inward and sprays glass. A nixie is the reverse: a low-pressure neon-filled envelope, not an evacuated one. Crack a nixie and the worst that happens is a soft pfft as the neon escapes and air leaks in — the tube simply dies (the glow goes patchy then dark as the gas fill is spoiled). There is no implosion, no glass thrown across the bench, and so — unlike handling a bare CRT — no eye-protection-against-implosion requirement. The hazard with a nixie is purely mechanical fragility, and that is a real and expensive one: the glass envelope is thin, the long lead wires are soft and fatigue easily, and a NOS tube can cost more than the board it sits on.

The handling rules follow from that:

• Handle by the glass body, support the leads. The leads enter the glass through delicate press seals; bending a lead at the glass cracks the seal and ends the tube. When forming leads, grip each lead with pliers between the bend and the glass so the force is taken by the pliers, not the seal, and form gently with a large radius — no sharp kinks, no repeated back-and-forth (metal fatigue snaps a lead after a few flexes).
• ESD is a non-issue. A nixie is a passive cold-cathode gas device with no semiconductor junction to puncture; you cannot zap it the way you can a MOSFET. Skip the wrist strap for the tube (you still want it for the driver ICs of Vol 4) — the care a nixie needs is mechanical.
• Seat and socket gently. Insert and remove straight and slow; a cocked tube bends leads. If soldering directly, solder quickly with a heat sink on the lead to keep heat off the glass seal.

10.5.1 Testing a NOS tube safely

Before you commit an unknown tube to a finished clock, test it — but test it current-limited, because the one way to kill a healthy nixie electrically is to run it without a current limit and let it draw runaway current that sputters cathode metal (Vol 2).

⚠ Bring the tube up on a current-limited supply through the correct anode resistor, never straight onto the bare rail:

1. Set a bench supply (or the clock’s own bled-down, verified rail) and put the tube’s specified anode resistor in series with the anode — the per-tube current-limiting resistor sized in Vol 4 (for a ~180 V rail and ~2.5 mA, on the order of 22 kΩ). The resistor, not the supply, sets the cathode current; never connect a nixie anode directly to the rail.
2. Ground one cathode at a time through the driver (or a clip lead) and confirm each numeral 0-9 lights cleanly, fully formed, no missing segments and no neighbours glowing.
3. ⚠ Keep one hand behind your back — the anode is at the full rail. Bring the rail up slowly if the supply allows, watching that the current stays at the per-digit value and does not run away.

10.5.2 Reviving a hazy tube — the anti-poison burn-in

A NOS tube that has sat unused for decades, or been multiplexed unevenly, often shows cathode poisoning — a hazy, sputtered film on the less-used cathodes, dim or speckled digits, unlit patches (the mechanism is Vol 2’s subject). Many such tubes recover with a gentle burn-in / anti-poison routine: run each cathode at (or slightly above) its rated current for an extended period so the discharge slowly cleans the film back off the numerals. Do it current-limited through the anode resistor as in the test above, ⚠ run it for hours not seconds, and do not over-drive it chasing a fast fix — too much current sputters more metal and worsens the haze. A tube that will not clear after a long, patient burn-in is at end-of-life; one whose getter or fill has failed is simply dead. The detailed schedule is Vol 2’s; the safety point here is that the procedure runs on a current-limited rail with the one-hand rule in force, because the anode is live throughout.

FIGURE SLOT 10.3 — NOS-tube test/burn-in rig: a current-limited supply feeding the anode through the per-tube anode resistor, a single cathode grounded through a clip, the meter reading per-digit current, with the lead-forming detail (pliers gripping between bend and glass seal) called out. Diagram: project original.

10.6 First power-up checklist ⚠

Run this every time you energize a board — even one you powered down five minutes ago. Habit is what saves you on the day you are tired and distracted. It mirrors the staged bring-up of Vol 6: prove the low-voltage logic before you raise the rail, raise the rail current-limited, verify it with a meter, confirm the bleeder, then the tubes.

1. No conductive tools, solder offcuts, or stray wire clippings on or under the board.
2. Bleeder resistor present and connected across the reservoir cap (§ 10.2.1) — eyeball it and, ideally, ohm it out with the board unpowered and discharged.
3. Anode resistors fitted, one per tube, the right value for your tubes (Vol 4) — no tube anode wired straight to the rail.
4. No jewelry; insulated bench; good light; you know where the wall plug is and can reach it without leaning across the chassis.
5. Low-voltage logic first. Power only the 5-12 V logic rail (HV converter disabled or disconnected if the design allows) and confirm the MCU/RTC and drivers behave before any HV exists on the board.
6. ⚠ HV up on a current-limited supply. Bring the boost stage up with the bench supply’s current limit set just above the expected draw (~20-25 mA for a six-tube clock, § 3.1), so a wiring fault trips the limit instead of cooking a part — or your hand.
7. ⚠ Verify the rail with the meter — clip-on, not hand-held (§ 10.4) — reads ~170-200 V and is steady. One hand behind your back.
8. Confirm the bleeder works: power down, and confirm the rail falls to under ~50 V within a few seconds (§ 10.2.1). If it does not, stop and fix the bleeder before going further.
9. Then the tubes. With the rail verified and the bleeder confirmed, light the digits. Watch the first power-up for runaway current, an over-bright or flickering glow, or a tube that will not strike.
10. Any hands-in adjustment after this point: unplug, discharge, verify 0 V (§ 10.2) first.

10.7 Troubleshooting the safe way

Most nixie faults can be diagnosed with the board powered down and discharged, or by observing a powered board without putting hands inside it — and that is the safe way to work. The cardinal rule mirrors the supply volume: prove the rail before you blame the tube, and discharge-and-verify (§ 10.2) before probing anything with power removed; observe the one-hand rule (§ 10.3) on the rare measurement that must be live.

Symptom	Likely cause	How to check — safely
No glow at all	HV rail dead; converter not running; blown input fuse; anode resistor open	Observe powered first (no hands in); clip-measure the rail at the reservoir (§ 10.4) — a dead/low rail is the converter (Vol 3), not the tube. Then power down, discharge, verify, and ohm the input fuse and anode resistors.
Dim or flickering digits	Ripple / poor regulation; under-sized reservoir; sagging input brick	Clip-measure the rail and watch for sag as the digit count changes; a rail that “breathes” with the count is a feedback/filtering problem (§ 3.5), not a tube. Observation plus a clipped meter — no live poking.
Cathode haze / patchy digits	Cathode poisoning on a NOS tube	A display-only symptom — diagnose by looking, then run the current-limited anti-poison burn-in (§ 10.5.2). No live probing.
One digit / one tube dead	Open cathode lead, dead driver channel, cracked tube seal	Power down, discharge, verify; then check continuity from driver to tube pin and the driver channel (Vol 4) cold, and swap the suspect tube into a known-good position. Almost never needs the rail live.

The pattern across the table is the same: no glow is power (prove the rail), dim/flicker is the supply’s ripple and regulation (§ 3.5), haze is the tube (burn-in), and one-digit-dead is the driver or the wiring (cold-continuity). Each branch is diagnosable with the board off and discharged or by pure observation; the live, hands-in measurement is the exception, and when unavoidable the one-hand and clip-don’t-poke rules of § 10.4 are in force. The detailed fault tables live in their own volumes (Vols 2, 3, 4) and the cheatsheet of Vol 11 — this section’s only claim is that you can find nearly every nixie fault without ever working live.

10.8 References (Vol 10)

• Clocks hub shared safety baseline, _shared/safety.md (hazard tiers and the rules common to every high-voltage clock build; classes the nixie family one tier below the Scope/CRT clocks).
• This series, Vol 1 § 1.9 (the hazard stated once up front) and Vol 3 (the HV boost supply this volume protects against — the 180-200 V rail, the reservoir cap, the worked bleeder of § 3.7, and measuring the rail in § 3.6).
• This series, Vol 2 (glow-discharge physics, cathode poisoning, and the anti-poison mechanism behind the § 10.5.2 burn-in) and Vol 4 (the per-tube anode resistor and the high-voltage drivers).
• This series, Vol 6 (the owned ATMega Cool Nixie Clock and its staged bring-up, which the first-power-up checklist of § 10.6 mirrors).
• Telefunken ZM1210 and Soviet IN-12 / IN-14 nixie tube datasheets (strike/maintaining voltage and rated cathode current — the per-digit current limit enforced when testing a NOS tube).
• General high-voltage bench-safety practice: capacitor discharge through a series resistor, dielectric absorption, the one-hand rule, and the ~50 V threshold above which a source can drive a dangerous current through the body.