Hardware Watchdog in a Signage Mini PC: After the Reset

A watchdog reset brings the player back to life, not back to work: the screen lights up, but the playlist is usually still empty, stale or half-written.

That gap is where most unattended signage projects lose their budget. The reset is a single register event; the recovery is a chain of five steps, and any one of them can break after a hard reboot. This is what a mini PC driving a screen with no member of staff in front of it has to get right.

1. Why the reset is the easy half

A hardware watchdog does one thing well: when the timer expires, it pulls the reset line and the board starts again. It does not know what the machine was doing, whether the storage was mid-write, or whether the content on screen was correct before the freeze. Those questions are answered by everything that runs afterwards.

The recovery chain has five links: firmware boot policy, operating system start-up, the player service, content validation, and a status report that reaches whoever manages the estate. A player that clears the first four and fails the fifth is still a black screen that nobody hears about until a customer complains.

Write the chain down before choosing hardware. A digital signage player is judged on that chain, not on its processor, and the list turns a vague requirement — the screen should come back — into five acceptance checks that a supplier can be held to.

2. What "back online" has to mean when nobody is watching

Three conditions, in order. The display shows the right content; the playback loop is actually running, not frozen on a frame; and the device appears in the monitoring system with a recent timestamp. A machine that satisfies only the first is the most expensive failure, because it looks healthy from the floor.

This is where a rollout across Tokyo and Mumbai differs from a single digital signage kiosk in a mall. Nobody walks past the screen at 3 a.m., so the recovery has to be observable from a desk: a heartbeat, a screenshot, a playback log, or at minimum a boot counter that increments when the watchdog fires.

Decide the check interval at the same time. A player that reports every five minutes makes a failure visible within ten; one that reports daily turns a weekend outage into a Monday incident.

3. The boot chain has three places to fail

Firmware. A watchdog reset normally re-runs POST and boots the operating system without help, which is why the timer is useful in the first place. A power cut is a different event: whether the machine starts again depends on the restore-on-AC-loss setting in firmware. Sites that mix both failure modes need both settings confirmed, not one.

Operating system. Automatic login, the player service, and network readiness are three separate dependencies. A service set to start automatically can still fail if it starts before the network has a lease, so the player needs a retry loop rather than a single attempt at boot.

Application. The player has to open the last known playlist, not an empty one, and it has to deal with content that was being downloaded when the reset happened. A half-written package should be discarded and the previous version kept; that rule belongs in the player, not in the deployment manual.

4. Content integrity after an unclean shutdown

The reset almost never arrives at a convenient moment. It arrives while the player is writing a log, replacing a video, or updating the playlist index — and that is exactly the file the next boot depends on.

Four habits remove most of the risk. Keep the system image read-only so a hard reset cannot corrupt the operating system. Put content on a separate partition. Write new content to a temporary path, flush it, then rename it into place, so the visible file is either the old one or the new one. And validate the playlist at start-up against a stored hash, falling back to the previous version if the check fails.

None of that needs a database. A directory, a manifest and a rename are enough, and they survive a power cut far better than an embedded database that has to replay its journal on a device with no UPS.

5. Software watchdog and hardware watchdog are not interchangeable

A software watchdog is a process that watches another process. It is cheap, it restarts a single service quickly, and it stops working at the exact moment the kernel or the display pipeline stops scheduling it. A hardware watchdog lives below the operating system and resets the board, which is why it covers the freeze that the software layer cannot see.

Most signage players ship with the first and call it a watchdog. That is not dishonest, but it answers a different question. Ask which layer the timer sits in, what it resets, and whether it can be disarmed during a content update — a reset in the middle of a download is how the recovery problem in section four gets created.

6. A test matrix you can run before deployment

Six tests, thirty cycles, one afternoon. Run them on the actual player build and the actual content package, not on a clean demo unit.

◆ Hard reset while playing. Freeze the player process, wait for the timer, and confirm it returns to the same playlist without manual input.
◆ Power cut while downloading. Remove power mid-transfer, restore it, and confirm the previous package still plays and the partial file is gone.
◆ Network absent at boot. Start with the cable unplugged; the local loop should run, and the device should rejoin monitoring when the link returns.
◆ Storage full. Fill the content partition and confirm the player keeps the current playlist instead of deleting it to make room.
◆ Update interrupted. Kill the update halfway and check that the device stays on the old version rather than an empty state.
◆ Repeated resets. Let it reset ten times in a row and confirm the boot counter and reset reason are readable afterwards.

Log the time from power-on to first correct frame in every run. That number, not the boot time on a bench, is what the site experiences after a watchdog event.

7. What to put on the purchase order

◆ Does the watchdog reset the board or only restart the player service?
◆ Who feeds the timer, and can that interval be configured per site?
◆ Can the timer be disarmed for content updates and shutdown?
◆ Is restore-on-AC-loss enabled separately, and what is its default?
◆ Does the player reopen the last playlist after an unclean shutdown?
◆ Is content written atomically, and is the manifest checked at start-up?
◆ Where is the reset reason stored, and how is it read remotely?
◆ What is the measured time from reset to first correct frame?

A box PC that answers these eight questions is a signage player. One that answers only the first is a computer with a screen attached, and the difference shows up on the third weekend after installation.

The short version

The watchdog gets the machine back; the boot chain, the content layout and the status report get the screen back. Specify all four, test them under a hard reset rather than a clean reboot, and measure the recovery in time to a correct frame. A compact fanless embedded computer with a wide port mix is a sensible carrier for that design — the recovery rules are what make it a player.