AU677722B2

AU677722B2 - Watchdog timer circuit

Info

Publication number: AU677722B2
Application number: AU79047/94A
Authority: AU
Inventors: Vinay Deo; Peter Field; Stefan Keller-Tuberg; Rosemary Lidgett; Joseph Nour
Original assignee: Alcatel Australia Ltd
Current assignee: Nokia Services Ltd
Priority date: 1993-12-10
Filing date: 1994-11-28
Publication date: 1997-05-01
Anticipated expiration: 2014-11-28
Also published as: AU7904794A

Description

P100/0O11 28/5/91 Regulation 3.2

AUSTRALIA

Patents Act 1990 S S

S

*5

S

o 0 0 *5 *5 S o 5* 0*

ORIGINAL

COMPLETE SPECIFICATION STANDARD PATENT Invention Title: "WATCHDOG TIMER CIRCUIT" The following statement is a full description of this invention, including the best method of performing it known to us:- Col1 96 58 2 8 NOV 94 This invention relates to a method and arrangement for improving the effectiveness of watchdog timer circuits used to maintain proper functioning of microprocessors.

Known watchdog timer arrangements include a monostable device arranged to produce a re-boot signal to restart the microprocessor if the monostable device is not reset before its time delay expires. The reset signal for the monostable device is generated by the microprocessor executing a "housekeeping" routine stored in the memory associated with the microprocessor. When the microprocessor has executed the watchdog routine, it continues to execute application routines stored in the memory. The execution period of each application routine is kept shorter than the watchdog timer monostable delay. Long application routines can be broken up to shorter routines and the microprocessor is directed to execute the watchdog timer routine at the end of the application routine or the segments of long application S routines.

Preferably the watchdog routine can be executed more than once during the monostable delay.

We have found that such a watchdog timer can be defeated by some faults in which the microprocessor continuously executes a loop which includes or simulates the watchdog timer routine. For example this may be caused by corruption of an instruction or data in RAM which causes the microprocessor to mistake the address of the application routine of the watchdog timer routine.

Consequently a watchdog reset signal is generated each time the watchdog routine is executed and the watchdog monostable device is prevented from generating a re-boot signal for the microprocessor. As a result the microprocessor may continue to execute the loop indefinitely and fail to perform its intended functions.

According to the invention there is provided a watchdog timer arrangement for a microprocessor includes a first instruction to generate a first intermediate watchdog timer reset signal at a first address in the microprocessor's operating memory, and at least one further instruction to generate a further intermediate watchdog timer reset signal, the or each further instruction having a corresponding address substantially different from the or each other instruction to generate an intermediate watchdog timer reset signal, the microprocessor being programmed to execute both or all of the instructions to generate an intermediate watchdog timer reset signal at least once during the watchdog timer delay period, and wherein the intermediate watchdog timer reset signals generated by the execution of the instructions are applied to a logic circuit to produce a synthesized reset signal to reset the watchdog timer.

In a further embodiment there are two instructions to generate intermediate watchdog timer reset signals and the logic circuit comprises an RS flip-flop with the first intermediate watchdog timer reset signal being connected to the set input of the RS flip-flop and the second intermediate watchdog timer reset signals being connected to the reset input of the RS flip-flop.

In an alternative embodiment, there are two instructions to generate intermediate watchdog timer reset signals and the logic circuit includes a second monostable device having a delay period longer than the repetition rate S of the first intermediate reset signal, and wherein the first intermediate reset signal is applied to the first input of an AND gate, and the second intermediate i reset signal is applied to the input of the second monostable, the output of the second monostable being applied to the second input of the AND gate whose output is the synthesized reset signal.

The invention will be described with reference to the accompanying drawings in which: Figure 1 is a block diagram of an arrangement including the improved watchdog timer.

Figure 2 is a time diagram showing the synthesis of the reset signal from the intermediate signals.

Figure 3 shows an embodiment of the logic circuitry.

Figure 4 shows a generalized state machine for use with the invention.

Figure 1 shows a microprocessor 1 connected to a memory 2 via address and data bus which is also connected to an address and decoding logic circuta 3. The address and decoding logic circuit has outputs WD1 and WD2 which are applied to inputs of a watchdog timer state machine 4 which performs the logic function of identifying the presence of the intermediate signals on WD1 and WD2. The output of the state machine 4 is applied as a reset signal to the watchdog timer monostable circuit 5, whose output is applied via OR logic 6 to the non-maskable interrupt input NMI of microprocessor 1 and additionally via a delay/pulse train generator 7 to the reset input of microprocessor 1.

The operation of this arrangement will be described with the aid of Figure 2.

At the end of each application routine, the microprocessor 1 is instructed to implement the watchdog timer (WDT) routine which involves addressing both (or all where there are more than 2) ';cations in the memory 2 where the instruction to generate the intermediate WDT reset signals are stored. As mentioned previously, these locations are logically separated in the memory. In addition they are accessed at different times during the execution of the WDT routine. The instructions are transmitted via the bus to the decoding logic 3 .ooo which produces the outputs WD1 and WD2 shown in Figure 2.

see These signals are applied to the state machine 4 which, in the embodiment illustrated in Figure 2, is an RS flip-flop. WD1 causes device 4 to change from a first state to a second state and WD2 causes a change from the second state to the first, as shown at TRIG. The signal TRIG resets monostable 5 e.g. on the rising edge of each pulse.

When one of the signals WD1 or WD2 is no longer generated then, even if the other of this pair continues to be generated, the TRIG pulses are inhibited because the RS flip-flop no longer changes state. Thus, after the monostable delay has expired, the output of the monostable changes state, and this may be used to generate a reset pulse for the processor 1.

In chis embodiment, a series of reset pulses are generated in pulse generator circuit 6 because the microprocessor may not reset in response to a single reset pulse. The reset pulses are spaced apart by a sufficient period to allow the WDT circuit to recognize when the microprocessor has been successfully reset so that no further reset pulses are generated because the output of the monostable 5 will be returned to its normal operating state.

Because the two WDT instructions are widely separated logically in the

II

memory, the probability of both being involved in a erroneous continuous loop is greatly reduced.

Figure 3 shows an alternative logic circuit in which the RS flip-flop is replaced by AND gate 31 and monostable 32. WD1 is applied to one input of AND gate 31 and WD2 is applied to the monostable 32. The monostable 32 provides a period longer than the repetition period of WD1 so that when WD1 and WD2 are being generated AND gate 31 produces the reset signal for the WDT monostable device In a general form, the inventor provides a state machine having two or more inputs from various hardware and/or software function testing means, the state machine including means to analyse the inputs and produce an error signal in response to predetermined signals on one or more of the inputs.

The state machine may implement a checking algorithm as a hard wired logic device or via a software routine or a combination of both.

In one embodiment, the state machine is programmable.

Figure 4 show's a block diagram of the state machine 40, having inputs 41 to n, and output State machine 40 performs the logical function of analyzing inputs 41 to n which may be designed to obey a predetermined relationship, occurring in sequence or with certain inputs occurring at a different rate from others, or occurring within predetermined time periods. If the relationship is violated, the state machine 40 generates an error signal on output While the present invention has been described with regard to many particulars, it is understood that equivalents may be readily substituted without departing from the scope of the invention.

Claims

1. A watchdog timer arrangement for a microprocessor including a first instruction to generate a first intermediate watchdog timer reset signal at a first address in the microprocessor's operating memory, and at least one further instruction to generate a further intermediate watchdog timer reset signal, the or each further instruction having a corresponding address substantially different from the or each other instruction to generate an intermediate watchdog timer reset signal, the microprocessor being programmed to execute both or all of the instructions to generate an intermediate watchdog timer reset signal at least once during the watchdog timer delay period, and wherein the intermediate watchdog timer reset signals generated by the execution of the instructions are applied to a logic circuit to produce a synthesized reset signal to reset the watchdog timer.

2. An arrangement as claimed in claim 1, wherein there are two instructions to generate watchdog timer reset signals and the logic circuit comprises an RS flip-flop with the first intermediate WDT reset signal being connected to the set input of the RS flip-flop and the second intermediate WDT reset signal being o connected to the reset input of the RS flip-flop.

3. An arrangement as claimed in claim 1, wherein there are two instructions *'20 to generate intermediate watchdog time reset signals and the logic circuit includes a monostable device having a delay period longer than the repetition rate of the first intermediate reset signal, and wherein the first intermediate reset signal is applied to the first input of an AND gate, and the second intermediate reset signal is applied to the input of the second monostable, the 25 output of the second monostable being applied to the second input of the AND C gate whose output is the synthesized reset signal.

4. A watchdog timer arrangement substantially as herein described with reference to the accompanying drawings.

A method of providing a watchdog timer facility for a microprocessor according to the arrangement of any one of claims 1 to 4.

6. A method of providing a watchdog timer facility substantially as herein described with reference to the accompanying drawings. DATED THIS EIGHTH DAY OF NOVEMBER 1994 ALCATEL AUSTRALIA LIMITED 000 005 363) p p pp LT CI ABSTRACT A watchdog timer circuit for a microprocessor 1 is arranged to eliminate a fault including an erroneous loop which continuously activates the watchdog timer reset instruction which prevents the microprocessor from detecting the error. The inventive arrangement includes two or more watchdog timer reset instructions held in widely spaced addresses in the microprocessor's memory. The reset instructions are applied to a state machine 4 which generates reset pulses for the watchdog timer circuit 5 only if all the reset instruction signals occur when they should. If the state machine 4 does not reset the watchdog timer circuits, the circuit 5 generates a RESET signal to reset microprocessor 1. Figure 1. 6.w. S. P o** @P S S