🛠 Watchdog et conception faille-sûre en environnement industriel

Objectives

Make an Opta program robust in production: a hardware watchdog (STM32H747 IWDG) restarts the board if the control loop freezes, and fail-safe design ensures that upon restart, relays return to a safe state (open contacts). You will also cover environmental constraints: −20…+50 °C, IP20, pollution degree 2, MTBF 766,205 h.

Hardware

• Arduino Opta powered by 24 VDC (plan for external relays for any safety load)
• Arduino IDE, mbed_opta core (access to registers via the example below)
• Stopwatch or logic analyzer to measure the reset delay
• Test load on OUTPUT1

Complete Code

// opta_watchdog.ino — IWDG STM32H7 : reset si la boucle gelle
// Registres IWDG (RM0399) ; API Arduino standardisee non exposee sur ce core.
#define IWDG_KR  (*(volatile uint32_t*)0x58004800)
#define IWDG_PR  (*(volatile uint32_t*)0x58004804)
#define IWDG_RLR (*(volatile uint32_t*)0x58004808)
#define IWDG_SR  (*(volatile uint32_t*)0x5800480C)
#define IWDG_KEY_RELOAD 0xAAAAu
#define IWDG_KEY_ENABLE 0xCCCCu
#define IWDG_KEY_ACCESS 0x5555u

void watchdog_init(uint32_t delai_ms) {
  IWDG_PR  = 4;                      // diviseur /64 => 32 kHz/64 = 500 Hz
  IWDG_RLR = delai_ms / 2;           // rechargement en ms (500 Hz -> 2 ms/unite)
  while (IWDG_SR);
  IWDG_KR = IWDG_KEY_ENABLE;         // demarre le watchdog : ne s'arrete plus
}

void watchdog_refresh { IWDG_KR = IWDG_KEY_RELOAD; }

void setup {
  Serial.begin(9600);
  pinMode(RELAY1, OUTPUT);
  digitalWrite(RELAY1, LOW); // etat sur : contact ouvert au demarrage
  watchdog_init(2000);       // reset si inactif > 2 s
}

void loop {
  digitalWrite(RELAY1, HIGH);
  delay(500);
  digitalWrite(RELAY1, LOW);
  watchdog_refresh;        // « je suis vivant »
  // Test : remplacez refresh par delay(5000) -> la carte redemarre.
}

Expected Verification

In normal operation, the cycle runs indefinitely. By commenting out watchdog_refresh (or by looping infinitely), the board resets within ~2 s and the relays fall back to open. >

Common Errors

• Believing that a watchdog replaces an emergency stop: the Opta is not a PL (Performance Level) device; safety functions (ISO 13849) require certified safety relays upstream of the outputs.
• Forgetting the refresh in all branches: any blocking wait (network wait, Modbus) longer than the delay triggers a legitimate reset — pace the refresh or extend the delay.
• Undefined safe state at boot: without an explicit digitalWrite(LOW) in setup, the state of the outputs during sketch upload is left to the firmware's randomness.
• Out-of-range environment: beyond 50 °C in a loaded cabinet, the electronics drift; derating and ventilation are mandatory.