Products details
The Watchdog (WD) module serves as a critical fail-safe monitoring component within the FSC (Fail-Safe Control) system, continuously validating the integrity of core system operations, electrical stability, and hardware functionality to ensure reliable, fault-free performance in mission-critical industrial environments. Its comprehensive monitoring scope encompasses five key system parameters, each designed to detect anomalies and trigger protective actions before potential hazards or system failures occur:
Application Loop Maximum Execution Time Monitoring: Tracks the upper threshold of the control program’s loop execution duration. This function identifies instances where the processor becomes stuck in an infinite loop (hang-up) or experiences abnormal delays, ensuring the process executes its preconfigured logic completely and within defined timeframes. By flagging extended execution times, it prevents system stagnation that could compromise process safety or control accuracy.
Application Loop Minimum Execution Time Monitoring: Oversees the lower threshold of the program loop’s execution time. This capability detects scenarios where the processor is skipping critical program segments—whether due to hardware malfunctions, software corruption, or unexpected interrupts—guaranteeing that all control logic, safety interlocks, and data processing steps are fully executed. This prevents partial program runs that might lead to incorrect control outputs or failed safety checks.
5 Vdc Power Supply Voltage Monitoring: Provides real-time surveillance of the system’s 5 Vdc core power rail, with built-in thresholds for overvoltage and undervoltage conditions (±5% of the nominal 5 Vdc, equivalent to 4.75 Vdc–5.25 Vdc). Voltage deviations outside this range can destabilize processor operations, corrupt memory, or disable critical hardware; the WD module promptly identifies such issues to initiate protective responses.
Memory Error Detection: Aggregates and monitors memory error signals from the Central Processing Unit (CPU), Communication (COM), and Memory (MEM) modules. In the event of a memory fault—such as data corruption, address line errors, or module communication failures—the WD module immediately de-energizes its watchdog output, triggering a system-wide fail-safe state to prevent erroneous control actions based on invalid data.
Galvanically Isolated ESD Input Monitoring: Features a dedicated 24 Vdc Emergency Shutdown (ESD) input, galvanically isolated from the system’s internal 5 Vdc circuitry to eliminate cross-talk and ensure signal integrity. This input enables independent de-energization of the watchdog output, bypassing the processor to initiate an immediate fail-safe shutdown in response to external emergency signals—providing an additional layer of safety for operators and equipment.
To ensure its own reliability and eliminate single-point failures, the WD module is engineered as a 2-out-of-3 voting system. It comprises three independent, redundant monitoring sections, each simultaneously tracking the full suite of parameters outlined above. A fail-safe action (e.g., de-energizing the watchdog output) is only triggered if at least two of the three sections concur on an anomaly, minimizing the risk of false alarms while ensuring no critical faults go undetected.
In terms of output capabilities, the WD module’s primary WDG OUT output provides a maximum current of 900 mA at 5 Vdc, protected by a 1 A fuse to prevent overload damage. A key system design consideration: if the total current draw of all connected output modules (sum of their individual WD input currents) exceeds this 900 mA limit, a Watchdog Repeater (WDR) module (model 10302/1/1) must be integrated into the system. The WDR expands the available current capacity, allowing the load to be distributed between the WD module and the WDR—ensuring stable power delivery to all output modules while maintaining the integrity of the watchdog monitoring function.
This robust design, combining comprehensive parameter surveillance, redundant voting logic, and flexible load management, makes the WD module indispensable for maintaining the safety and availability of FSC systems in high-risk industrial applications such as oil & gas, chemical processing, and power generation.、
Technical data
Hardware & Interface Details
Module Structure and Installation: Occupies 4 TE (4 HP) rack space with a height of 3 HE (3U) and
must be installed in the FSC Central Part rack. During installation, note that it can only be plugged or
unplugged when the Central Part is powered off; otherwise, it may cause system malfunctions or
hardware damage.
Connection and Adaptation: The front end is interconnected with the system via the 10005/O/1
watchdog horizontal bus or S-BUS and must be connected to all output modules with WDG inputs. It
supports collaborative work with modules such as Diagnostic and Battery Module (DBM) and Single
Bus Driver (SBD) to obtain power backup and system status signals.
Jumper Configuration: Includes three factory-preset solder jumpers (SO1, SO2, SO3). Among them,
SO3 is used for start-up mode selection: Position 1 is manual start mode, and Position 2 is power-on
automatic warm start mode (a manual cold start is required after the system fails and powers off). J1-
J3 must be configured according to standard positions to ensure normal monitoring logic.
