Mesa 7i76e - Is a charge pump even needed?

I have a Mesa 7i76e (not D) Ethernet interface board.  The card has its own watchdog and linuxcnc seems to be aware when control has been lost.  I have connected some 24V relays to the outputs of the 24V GPIO (i.e. hm2...output-02 etc).  The relays do not "flutter on" during FPGA boot (good).  They all drop out if I pull the ethernet cable or if linuxcnc is stopped.  Is a charge pump even needed with these safeguards?

I'm trying to think of a scenario where a charge pump is actually needed when using this board. The only one I can think of is this.  If the stepper logic is really its own free-running hardware state machine, and if the watchdog is a separate free-running state machine, there is the possibility of there being an error in the flash storage or code download on the FPGA that could keep just the watchdog code from working and the stepgens would continue chugging along and crashing my mill.  But in that case, my stepgen-04 (which is how I generate my charge pump signal) is going to keep going anyway, so I would still get the crash. 

I have considered making a low frequency charge pump with a 100Hz threshold.  Linuxcnc would read input-01, invert the result, sends that to output-01.  Output-01 is wired to input-01, forcing the loop to oscillate at the card update frequency.  Less than 100Hz and the detector would drop out a relay and shut everything down.  Is this silly and unneeded? 

 

A corrupted bitfile will not load. A driver bug could cause a watchdog failure however.

If you wanted a second layer of protection, you could use a field output
to enable the drives. The field I/O has a second independent watchdog

PCW wrote:

...
If you wanted a second layer of protection, you could use a field output
to enable the drives. The field I/O has a second independent watchdog

I was not aware of the second watchdog!
Is this documented somewhere?

Thank you.  That 2nd watchdog is reassuring.  In that case  I will plan to use halui.machine.is-on (which I think of as "control-on") to drive a relay that will enable the drives (vfd, stepper, cooland pumps, air solenoids, aux spindle, etc). It gets turned on by the axis gui "on" F2 button that becomes available after the "e-stop" F1 button has been reset. If anyone thinks this is a poor decision, I'm open to suggestions. 

If you have an external estop (or a series of external estops), you should be using estop-latch.
You can trigger external relays with something like

net latch-out iocontrol.0.emc-enable-in <= estop-latch.3.ok-out
net estop-out estop-latch.3.fault-out
# --- E-STOP RED WARNING LIGHT ---
net estop-out hm2_7i76e.0.7i76.0.0.output-00
# --- E-STOP STEPPER DRIVE DISABLE ---
net estop-out hm2_7i76e.0.7i76.0.0.output-05

If you have say a low lubricant alarm, consider add it to the estop-latch chain so it has to be OK before coming out of estop.