CN103713960A

CN103713960A - Watchdog circuit used for embedded system

Info

Publication number: CN103713960A
Application number: CN201210378479.3A
Authority: CN
Inventors: 胡喜; 卓越
Original assignee: Siemens Power Automation Ltd
Current assignee: Siemens Power Automation Ltd
Priority date: 2012-09-29
Filing date: 2012-09-29
Publication date: 2014-04-09
Anticipated expiration: 2032-09-29
Also published as: CN103713960B

Abstract

The invention provides a watchdog circuit used for embedded system. The circuit comprises a watchdog unit (210), an awakening signal generating unit (220), and an awakening control unit (240). The awakening signal generating unit (220) responds an enable signal (S2) to selectively select awakening clock signals (S1) or normal awakening signals (S4) from a system (SYS) as awakening signals (S5) to send to the watchdog unit (210). The awakening control unit (240) is generated in a system starting time frame (T1) as the enable signal 9S2) with effective value. The awakening signal generating unit (220) takes the awakening clock signals (S1) as the awakening signals (S5) to send to the watchdog unit (210) when the enable signal (S2) is in effect.

Description

Watchdog circuit for embedded system

Technical Field

The present invention relates generally to embedded hardware systems, and more particularly to a watchdog circuit for use in an embedded hardware system.

Background

Watchdog (WD) is actually a timer that is usually used to monitor whether a program in a software system or an embedded hardware system is running properly. If the system's program is running properly, the system can time the WD for a predetermined period of time (or WD reset timeout period (t)_WD) A wake up signal (colloquially referred to as a "feeding" signal) (e.g., a falling or rising edge) is sent internally to WD, causing WD to reset and retime. On the contrary, if the timeout period is reset at the WDIf the internal system fails to send out the wake-up signal in time due to a program failure, WD will send out a reset signal due to the timeout of its timer, thereby forcing the system to restart, thereby preventing the system from crashing or entering into dead loop.

WD may be implemented in hardware or software in general. Fig. 1 exemplarily shows a case where WD is implemented in hardware in an embedded hardware system. In fig. 1, WD is a hardware timing chip (for example, a MAX6366 or similar WD chip) whose input WDI receives a wake-up signal S4 from an I/O interface of the system SYS (or an extended I/O interface of the system SYS), and whose output RST is connected to a RESET of the system SYS. The embedded hardware system SYS runs an application program, and the application program is burned in a storage unit (e.g., flash). The application program contains a so-called wake-up code which periodically (within a WD reset timeout period) sends a valid wake-up signal S4 from the I/O interface of the system SYS to the WDI. When the wake-up signal S4 of the WDI end is effective, the WD is reset and counts again, and the RST end of the WD outputs an ineffective signal. Conversely, if the wake-up signal at the WDI end is continuously inactive, resulting in WD timeout, the RST end outputs an active reset signal, for example, for a reset period (t)_RP) Low level of (2). An active reset signal at the RST terminal can cause the system SYS to restart, thereby preventing the system from entering an abnormal state, such as entering an endless loop or running away.

In fig. 1, in order to prevent WD from timing out, a wake-up code for waking up WD needs to be embedded in each of different program segments in an application program running on the system SYS. Each time the system SYS executes the wake-up code, it sends a valid wake-up signal S4 from its I/O port to the WDI of the WD, thereby ensuring that the WD does not time out. If an exception occurs in the program on the system SYS, the wake-up code cannot be run in time, and thus the WD times out, and the system SYS is forced to restart.

At startup or restart of the system SYS, that is, before an application program on the system SYS runs, the system SYS undergoes a system boot and system initialization process, which is collectively referred to as a system startup process. The system start-up process typically takes several seconds, which is typically longer than the WD timeout period of existing WD chips. Therefore, if the wake-up signal is not issued during system startup, the system will always restart due to WD timeout, eventually resulting in system startup failure.

To solve the WD wake-up problem during system startup, one existing solution is to embed the WD wake-up code also in the underlying functional modules of the system. For example, the wake-up code is embedded in a boot-loader, a driver, an operating system initialization module, and so forth. However, in actual applications, the underlying functional modules, such as drivers, are typically provided by independent vendors, and the application developer typically does not need and has no ability to modify the code of the underlying functional modules, as modifying the underlying functional modules is likely to cause errors in the underlying functionality and increase unnecessary workload for the application layer developer.

In view of this, there is a need in the art for a hardware implementation method and apparatus that can implement WD wake-up without modifying the underlying functionality of the system SYS.

Disclosure of Invention

It is an object of the present invention to provide a solution for a Watchdog (WD) in an embedded hardware system. With this approach, WD can still be woken up during system startup without the need to embed additional code in the system's underlying functions.

According to one aspect of the invention, the invention provides a circuit for use as a watchdog in an embedded hardware system, comprising: the watchdog unit starts timing after power-on or in response to an input effective wake-up signal, and outputs a reset signal after a watchdog reset timeout period expires; a wake-up signal generating unit for selectively feeding a wake-up clock signal or a normal wake-up signal from a system as the wake-up signal to the watchdog unit in response to an enable signal; a wake-up control unit generating the enable signal for the wake-up signal generating unit, the enable signal being set to be valid during a system start-up period; wherein the periods of the wake-up clock and the normal wake-up signal are shorter than the watchdog reset timeout period, and the wake-up signal generating unit causes the wake-up clock signal to be fed to the watchdog unit as the wake-up signal when the enable signal is active. Preferably, the wake-up control unit generates the enable signal in response to a reset signal from the watchdog unit. More preferably, the system start-up period is about 1 minute. It is particularly preferred that the wake-up control unit comprises a one-shot timer which times a system start-up period in response to the reset signal.

In one embodiment of the present invention, preferably, the enable signal (S2) is also valid during a firmware update period of the embedded hardware system.

In one embodiment of the present invention, when the enable signal is active high, the wake-up signal generating unit includes: a NAND gate performing a NAND logic operation on the enable signal and the wake-up clock and generating a first intermediate signal; an OR gate performing OR logic operation on the enable signal and the normal wake-up signal and generating a second intermediate signal; and the AND gate performs AND logic operation on the first intermediate signal and the second intermediate signal so as to obtain the wake-up signal. Preferably, the wake-up control unit further comprises a configuration circuit, which sets the enable signal to a valid value in the firmware update period. More preferably, the configuration circuit comprises a jumper.

In addition to the WD circuit proposed according to the present invention, it is also preferable to keep WD from timing out during the firmware update period as well. Moreover, for the firmware updating period, the switching between the system starting mode and the firmware updating mode can be realized by only changing a jumper without adding an additional wake-up circuit or a wake-up signal.

The foregoing aspects and advantages of the invention will become more apparent by referring to the following detailed description of various embodiments of the invention, taken in conjunction with the accompanying drawings.

Drawings

The drawings are only for purposes of illustrating and explaining the present invention and are not to be construed as limiting the scope of the present invention. Wherein,

FIG. 1 is a schematic diagram of a prior art WD used in an embedded hardware system;

FIG. 2 is a block diagram of a WD circuit according to one embodiment of the invention;

FIG. 3 is a schematic diagram of a WD circuit according to another embodiment of the invention;

FIG. 4A is a waveform diagram of various signals of the circuit shown in FIGS. 2 and 3 during system startup;

fig. 4B is a waveform diagram of signals of the circuits shown in fig. 2 and 3 during firmware update.

FIG. 5 is a schematic diagram of a WD circuit according to yet another embodiment of the invention;

fig. 6 is a waveform diagram of signals in the wake-up control unit 540 in the circuit shown in fig. 5.

Detailed Description

In order to more clearly understand the technical features, objects, and effects of the present invention, embodiments of the present invention will now be described with reference to the accompanying drawings.

In view of the shortcomings of the watchdog circuit shown in fig. 1, the inventors of the present invention propose a novel Watchdog (WD) circuit. Such WD circuits are able to automatically deliver a valid wake-up signal to the WD chip during the start-up period of the system SYS (or preferably also during the firmware update period) to maintain WD against timeouts, while continuing the wake-up signal S4 generated by the wake-up code in the application on the I/O port of the system SYS to maintain WD against timeouts after the application on the system SYS takes over the system.

Fig. 2 schematically illustrates a block diagram of a WD wake-up apparatus 200 according to one embodiment of the present invention. As shown in fig. 2, WD wake-up apparatus 200 includes WD unit 210, wake-up signal generating unit 220, wake-up clock 230, and wake-up control unit 240. WD unit 210 is similar in structure and operation to WD shown in FIG. 1. The input of WD unit 210 receives an active wake-up signal S5 from unit 220. If WD210 times out because it fails to receive wake-up signal S5 in time, its output RST outputs a reset signal S8 to system SYS to force system SYS to restart. The wake-up signal generating unit 220 has two inputs, one of which is connected to the wake-up clock 230 for receiving a periodic clock signal, referred to as the wake-up clock S1. The period of wakeup clock S1 is shorter than the WD reset timeout period of WD 210. And the other is connected to an I/O output of the system SYS for receiving a normal wake-up signal S4 issued during normal operation of the system SYS. The wake-up signal generating unit 220 is controlled by the wake-up control unit 240. The wake-up control unit 240 provides an enable signal S2 to the unit 220 for controlling whether the wake-up signal generating unit 220 feeds the wake-up clock S1 or the normal wake-up signal S4 as S5 to the input of the WD 210. For example, during system startup or during firmware update, the wake-up clock S1 is provided as S5 to the WD210 under the control of the wake-up control unit 240, and the normal wake-up signal S4 is provided as S5 to the WD210 during normal operation of the system SYS. Therefore, before the application program takes over the system SYS, the WD210 may be woken up by the wake-up clock, and the WD is kept not overtime, so that the wake-up of the WD may be realized by hardware without embedding a wake-up code in a bottom functional module of the system SYS.

Fig. 3 schematically illustrates a specific embodiment of one of the block diagrams shown in fig. 2. In the WD circuit 300 shown in FIG. 3, the WD210 is the same as that shown in FIG. 2 and will not be described again. Wakeup clock 330 is a standard clock generator with a clock period shorter than the WD reset timeout period of WD 210. The wake-up signal generating unit 320 specifically includes a NAND (NAND) gate 321, an OR (OR) gate 323, AND an AND (AND) gate 325. The wake-up control unit 340 generates an enable signal S2 for controlling the wake-up signal generating unit 320. The enable signal S2 and the wake-up clock S1 are sent to the nand gate 321, and the nand gate 321 and the nand gate 325 are sent to an output S3 obtained by nand logic operation. Meanwhile, a normal wake-up signal S4 and an enable signal S2 from the I/O interface of the SYS are sent to the or gate 323, and an output S7 obtained by performing an or logic operation between the normal wake-up signal S4 and the enable signal S2 is also sent to the and gate 325. S3 and S7 are anded to obtain a wake-up signal S5 that may be sent to WD 210. Where the enable signal S2 is asserted, the wake-up clock S1 is sent to the WD210 as S5. When the enable signal S2 is inactive, the normal wake-up signal S4 is sent to the WD210 as S5. Fig. 3 only exemplarily shows a case where the wake-up signal generating unit 320 is implemented by a logic gate. In practical applications, the unit 320 may also be implemented by using other logic, and is not limited to the case shown in fig. 3.

Fig. 4A and 4B illustrate waveform diagrams of S1, S2, S3, S7, and S5 in fig. 3 during system boot and during firmware update, respectively. Fig. 4A shows a waveform diagram of points in the WD circuit shown in fig. 3 at system start-up. As shown in fig. 4A, the wake-up clock S1 outputs a series of clock signals from the time t1 when the system SYS is powered on. The enable signal S2 is asserted from time t1 when the system SYS is powered on, and is deasserted after the system is started (or called as when the application takes over the system, i.e., time t 2). In other words, the enable signal S2 is a valid pulse during the system start (T1 to T2), and the pulse width T1 is greater than the time required for the system start. And NAND operation is performed on the S1 and the S2 to obtain a signal S3. S3 includes a periodic wake-up clock signal only within T1 (T1-T2). The normal wake-up signal S4 is not present until the system start-up is completed (time t 2). S4 generates a periodic normal wake-up signal only after time t2 as a result of the system SYS executing the wake-up code. The OR operation of S4 and S2 results in signal S7. As can be seen from S7, S7 becomes available only after the system boot is complete (time t 2) as a normal wake-up signal. Thus, both S3 and S7, when anded, result in a wake-up signal S5 that may be fed to WD 210. As can be seen, S5 is the same signal as the wake-up clock S1 before time t2, and is the same signal as the normal wake-up signal S4 after time t 2. In this way, a wake-up signal is sent to the WD210 throughout the system power-up and system operation, so that the WD does not reset the system SYS due to timeouts.

Fig. 4B shows a waveform diagram of various points in the WD wake-up apparatus shown in fig. 3 in the case of a firmware update. For an embedded hardware system, an application program running on the system SYS is burned in a storage unit such as a FLASH, and each time the application program is updated, the application program needs to be downloaded first, then the downloaded application program is burned in the FLASH, and then the system SYS is restarted. This process is generally long, requiring several minutes. For this reason, unlike fig. 4A, in fig. 4B, the enable signal S2 is always active throughout the entire process of firmware update (from T3 to T4, i.e., T2). Meanwhile, since no application is running in T2, the normal wake-up signal S4 is not present in T2. Thus, the wake-up signal S5 obtained by the structure shown in fig. 3 is always the same clock signal as S1 in the period T2 from T3 to T4. After the firmware update is completed, the SYS is restarted and accordingly outputs a wake-up signal S5 to the WD210 according to the waveform shown in fig. 4A.

The enable signal S2 in fig. 3 and 4 may be obtained in a variety of ways. For example, the enable signal S2 may be implemented by a timer. The timer starts counting time and outputs a high level after the system is powered on or restarted, and outputs a low level after a predetermined period of time (e.g., T1). S2 may be set to a valid value at the beginning of the firmware update and to invalid after the end of the firmware update. According to practical requirements, a person skilled in the art can select an appropriate circuit structure to obtain the enable signal S2 in combination with a common circuit.

Fig. 5 schematically illustrates a specific WD circuit 500. As shown in fig. 5, the WD circuit 500 includes a WD chip U1, a start wakeup signal generation circuit 520, a wakeup clock 530, and a wakeup control circuit 540. In fig. 5, the WD chip U1 is a MAX6366 chip, although other commercially available WD chips may be used as U1. The WD chip U1 has a WDI terminal as an input terminal and a RST terminal as an output terminal. The operation principle of the WD chip U1 is the same as that of the WD210 mentioned earlier. In addition, the wake-up signal generating circuit 530 specifically includes a nand gate U5, an or gate U6, and an and gate U4, and the structure and operation principle thereof are the same as those of the wake-up signal generating circuit 330 shown in fig. 3. Here, details of the WD chip and the wake-up signal generating circuit 530 are not repeated.

Unlike the configuration of fig. 3, the wake-up control circuit 540 includes a one-shot timer 543, such as the commonly used 555 series timer. In fig. 5, the timer 543 outputs a single pulse having a predetermined width at its output Vo in response to a valid trigger signal received at the trigger terminal TR. The broadband T1 of the single pulse can be determined by resistor R1, capacitor C2, T1=1.1 × R1 × C2. In the embodiment of FIG. 5, T1 is set to be greater than the time required for actual system startup, e.g., T1 is set to approximately one minute.

In the example shown in fig. 5, the WD chip U1 maintains its output RST at a low level for a reset period when Vcc is above the reset threshold or when reset due to a timeout, as shown by the first waveform in fig. 6. And the trigger terminal TR of the one-shot timer 543 is triggered by a rising edge. To do so, an inverter U2 is added to invert the RST of U1, thereby converting the valid RST into a trigger signal that is also valid for the timer 543. Fig. 6 shows waveform diagrams of the output RST of the U1, the output TR of the U2, and the output Vo of the timer (i.e., the control signal S2). As shown in fig. 6, after the system SYS is powered on, the RST of U1 is maintained at a low level for one reset period. Accordingly, inverter U2 inverts RST to form a positive going pulse. The positive going pulse at TR triggers the timer 543 to start timing, so that the timer 543 forms an active pulse with a pulse width T1 at its output Vo, which may be used as an enable signal S2 to control the wake-up signal generating circuit 520 as shown in fig. 3.

In the example shown in fig. 5, circuit 500 has two modes of operation. One mode of operation is a system startup mode, and the other mode is a firmware update mode, and the two modes can be distinguished by a configuration circuit. In the example of fig. 5, the configuration circuit is a jumper X1 in the wake-up control unit 540. Specifically, in the system start mode, the 3 terminal and the 2 terminal of the jumper X1 are shorted. Thus, the output S6 of the timer 543 is used as the enable signal S2 to control the wake-up signal generating circuit 520. Thus, during system start-up, the clock signal S1 may be automatically fed to the input of the WD chip U1 to ensure that WD does not time out. The waveforms of the signals in this operating mode are shown in fig. 4A. In firmware update mode,

terminals

1 and 2 of jumper X1 are shorted, with terminal 1 connected to Vcc. Thus, during the firmware update phase T2, the clock signal S1 may be automatically fed to the input WDI of the WD chip U1 to ensure that WD does not time out. And changing the jumper from 1-2 short circuit to 2-3 short circuit before the firmware updating is finished and the system is restarted. The waveforms of the signals in this operating mode are shown in fig. 4B.

Although in fig. 5, a jumper is used to implement the switching between the two different modes, in practical use, a person skilled in the art may choose to implement the switching in other ways. For example, a hardware switch is provided which causes the control signal S2 to go high at the beginning of the firmware update and the control signal S2 to go to the output of the timer 543 at the end of the firmware update.

It should be understood that although the present description has been described in terms of various embodiments, not every embodiment includes only a single embodiment, and such description is for clarity purposes only, and those skilled in the art will recognize that the embodiments described herein may be combined as suitable to form other embodiments, as will be appreciated by those skilled in the art.

The above description is only an exemplary embodiment of the present invention, and is not intended to limit the scope of the present invention. Any equivalent alterations, modifications and combinations can be made by those skilled in the art without departing from the spirit and principles of the invention.

Claims

1. A circuit for use as a watchdog in an embedded hardware system, comprising:

a watchdog unit (210, U1) which starts timing after power-up or in response to an incoming valid wake-up signal (S5) and resets a timeout period (t) at the watchdog_WD) Outputting a reset signal (S8) after the expiration;

a wake-up signal generating unit (220, 320, 520) for selectively feeding a wake-up clock signal (S1) or a normal wake-up signal (S4) from a system (SYS) as the wake-up signal (S5) to the watchdog unit (210, U1) in response to an enable signal (S2);

a wake-up control unit (240, 340, 540) generating the enable signal (S2) for the wake-up signal generating unit, the enable signal (S2) being set to be valid for a system start-up period (T1);

wherein the periods of the wake-up clock (S1) and the normal wake-up signal (S4) are shorter than the watchdog reset timeout period, and the wake-up signal generating unit (220, 320, 520) causes the wake-up clock signal (S1) to be fed to the watchdog unit (210, U1) as the wake-up signal (S5) when the enable signal (S2) is active.

2. The circuit of claim 1, wherein the wake-up control unit (540) generates the enable signal (S2) in response to a reset signal from the watchdog unit (U1).

3. The circuit of claim 1, wherein the system start-up phase (T1) is about 1 minute.

4. The circuit of claim 2, wherein the wake-up control unit (540) includes a one-shot timer that times a system start-up period (T1) in response to the reset signal (S8).

5. The circuit of any of claims 1-4, wherein the enable signal (S2) is also valid for a firmware update period (T2) of the embedded hardware system.

6. The circuit of claim 1, wherein, when the enable signal (S2) is active high, the wake-up signal generating unit (320, 520) comprises:

a NAND gate (321, U5) performing a NAND logic operation on the enable signal (S2) and the wake-up clock (S1) and generating a first intermediate signal (S3);

an OR gate (323, U6) performing an OR logic operation on the enable signal (S2) and the normal wake-up signal (S4), and generating a second intermediate signal (S7);

and gates (325, U4) performing an and logic operation on the first and second intermediate signals (S3, S7) to obtain the wake-up signal (S5).

7. The circuit of claim 5, wherein the wake-up control unit (540) further comprises a configuration circuit (X1) which asserts the enable signal (S2) for the firmware update period (T2).

8. The circuit of claim 7, wherein the configuration circuit comprises a jumper (X1).