A microcontroller board and watchdog module with a lime status light and an unplugged actuator socket.

What you need

Use a software simulator or a low-energy controller bench with actuators disconnected. Define fault handling before enabling the watchdog.

Example timing budget. Timeout: 100 ms; Monitor interval: 10 ms; Approximate detection bound: 110 ms.
Example timing budget. Original Academy diagram using illustrative values; not a measured hardware result.
Read the diagram as a data table
Values used in the illustration
Condition or componentms
Timeout100
Monitor interval10
Approximate detection bound110

The calculation

t_detect_max ≈ t_timeout + t_check

t_timeout is the configured missing-progress interval and t_check is the maximum delay before the monitoring task evaluates it.

Worked example

Illustrative numbers. Replace them with your measured inputs.

With a 100 ms timeout and a monitor checked every 10 ms, detection may take about 110 ms after the last valid progress update. Restart and actuator response add further delay; they are not included in this simple estimate.

Try it step by step

  1. Define what completion of a healthy control cycle means and refresh the watchdog only after those checks succeed.
  2. Inject a blocked task, missed sensor update and communications failure in the bench setup.
  3. Design the fault response so outputs and stored state do not create an unintended automatic restart.
  4. Check recovery, logging and repeated-fault behavior, keeping machinery-safety functions independent of an ordinary application watchdog.

How to check the result

The test record should show the fault injection time, detection time and final output state for each failure mode.

Common mistake to avoid

A watchdog reset does not guarantee safe motion cessation. A reboot can itself create hazards if outputs or power-loss behavior are not properly designed.

Reference reading

Primary references for the underlying models, APIs or application context. The worked numbers and plots above are educational calculations, not results reported by these sources.

Read our methods, limitations and safety notes.

Previous in this pathFrame robot serial messages so corrupted data is rejectedNext in this pathGive a robot simulation physically meaningful mass and inertia