Watchdog Timer — Robotics/Safety Supervision

Watchdog Timer

Robotics / Safety Supervision

Reports a signal that has stopped moving. With frozen = ( |u[k] − u[k−1]| ≤ Freeze Tolerance ), the block counts consecutive frozen samples – count ← frozen ? min(count + 1, Stuck Samples) : 0 – and drives ok to 0 once that run reaches Stuck Samples.

A dead sensor rarely reports an impossible number: a frozen encoder, a CAN frame repeating its last payload and an unplugged input all hold a perfectly plausible value. Checking the LEVEL cannot see any of them, which is what this block adds to the Model Verification family.

Ports

• u – the monitored signal, a scalar [1,1]: a wheel speed, a joint angle, a pressure, a battery voltage. To watch several, use one block per signal – the run length is per signal and cannot be shared.
• ok – a scalar [1,1]: 1 while the signal is considered live, 0 once it has been frozen for Stuck Samples consecutive samples. Ready to drive an enable, a switch or an Assertion.
• count – a scalar [1,1]: how many consecutive samples the input has been frozen for, saturating at Stuck Samples. Useful as a health margin – it climbs before ok falls.

Parameters

• Freeze Tolerance – a scalar ≥ 0: how much movement between consecutive samples still counts as frozen. Size it above the signal's quantization step (an encoder's LSB, an ADC count) and below its smallest real motion; at exactly 0 only a bit-identical repeat counts, which a noisy analogue input will never produce.
• Stuck Samples – a whole number ≥ 1: how many consecutive frozen samples raise the alarm. It is a count, not a time – at a 10 ms rate 50 samples is half a second.
• Initial Input – a scalar: the value that stands in for u[−1], since the first sample has no predecessor. It decides only whether the run starts at 0 or 1.
• Sampling Time (s) – zero or less inherits the solver's rate; a positive value runs the block at that period.

Code export

All ten targets: Python, MATLAB, Java, Rust, C, C++, VHDL, Verilog, SystemVerilog and PLC Structured Text. Every parameter is baked into the body at export time; there is no tunable parameter object.

The three HDL targets are genuine synthesizable Q16.16: one subtraction, one absolute value, two comparisons and an increment, with no division and nothing transcendental. The counter is carried as a fixed-point whole number and compared against one, so it never has to be converted out of fixed point.

Simulink bridge

None. Nothing in the installed libraries latches on signal staleness: the Model Verification blocks assert on a value against a bound, and Detect Change reports the single sample on which a signal differs from its previous one rather than accumulating a run of samples on which it did not. The watchdog blocks that do exist ship in toolboxes this machine does not carry. The bridge entry therefore reports the block with that reason instead of dropping it silently, and no parity testbench is owed – the documented consequence of Support::None. Code export verification still covers all ten languages.

Notes

• Stateful and inherently discrete (setDiscreteOnlyBlock(true)): "the previous sample" only means anything per sample, and there is no derivative to integrate.
• It does not latch. ok returns to 1 on the first sample that moves, because a watchdog reports current health. To hold a fault until an operator clears it, feed ok into Emergency Stop Ramp, whose latch is exactly that; for a hard stop, feed it into Assertion.
• The counter saturates at Stuck Samples rather than running free – nothing downstream needs a larger number, and an unbounded counter would leave the fixed-point range on the HDL targets after a few minutes of a genuinely dead signal.
• Nonlinear, and deliberately carries no state space. The comparison and the counter are not describable by A/B/C/D, so model reduction correctly refuses the block.
• On the HDL targets the comparison is made in Q16.16, so a sample whose movement sits within one quantum (about 1.5e−5) of Freeze Tolerance can be classified the other way from the software targets. The consequence is a run length off by one, which can move ok by a sample – a decision output, not a rounding error, exactly as in Argmax Decision. Choose a tolerance the signal's own steps do not sit on top of.
• Choosing the pair is the whole design. A tolerance below the signal's own noise floor never fires; one above its slowest real motion fires on a healthy signal held briefly at a limit. Read count on a healthy run before choosing either.