7
\$\begingroup\$

Can anyone explain a little more about watchdogs, specifically in the circuitry level?

If there is some kind of problem in the chip, how can I guarantee that it will be kept running? It is implemented in a different silicon and later attached to the main chip circuit to avoid temperature problems? Which kind of interface circuit it is commonly used to avoid counting/resetting errors? It is common to implement any kind of redundancy?

\$\endgroup\$
1
  • \$\begingroup\$ In addition to what stevenh said below in his answer, if (for some reason) you don't trust the system upon recovering from a watchdog reset, you can also completely disable the watchdog. But the idea here is that your code never gets into a condition where it gets lost in la-la land and doesn't ping the watchdog timer to reset it. \$\endgroup\$
    – Dave
    Commented May 26, 2011 at 13:03

2 Answers 2

10
\$\begingroup\$

The watchdog is just a timer on the same die as the rest of the microcontroller. It's mainly meant to catch software errors, there are no precautions for a malfunction of the watchdog itself. Typically one would reset the watchdog timer in the program's main loop. If for some reason the main loop will no longer be executed the controller will reset.
If you don't trust the microcontroller hardware you can always add an external watchdog IC.

\$\endgroup\$
7
  • 2
    \$\begingroup\$ @stevenvh While most microcontrollers do include a watchdog, I would omit the phrase "on the same die as the rest of the microcontroller", since that's not an important feature/misfeature of the microcontroller. Any hardware failure that would take out a uC would likely be unrecoverable. But, +1 for saying that it is meant to catch SW errors. It will also catch the odd event, like a cosmic ray, but those are secondary. \$\endgroup\$
    – user3624
    Commented May 26, 2011 at 13:02
  • 3
    \$\begingroup\$ @David - I included that phrase because OP suggested that the watchdog maybe was "implemented in a different silicon and later attached to the main chip circuit", which definitely isn't so. It would be too expensive that way, and of little use, because the hardware is much more reliable that the software. \$\endgroup\$
    – stevenvh
    Commented May 26, 2011 at 13:11
  • \$\begingroup\$ @David - about cosmic rays, I don't know how big a problem this is on earth. I can imagine, however, that rad-hard devices for use in space do have more comprehensive security measures than a simple watchdog timer. \$\endgroup\$
    – stevenvh
    Commented May 26, 2011 at 13:40
  • 2
    \$\begingroup\$ @stevenvh Cosmic rays are in fact a problem - if my old-school professor is to be believed (he has a beard and wears suspenders, so I assume he knew what he was talking about) then the first computers were plagued by single-bit errors that couldn't be reliably traced. Turned out it was cosmic rays. The more you know! \$\endgroup\$
    – AngryEE
    Commented May 26, 2011 at 14:00
  • \$\begingroup\$ @AngryEE - I would have expected that modern controllers would be more vulnerable, given the small feature size of the die and the smaller signal levels (voltage and current) involved. But of course I believe your professor. Suspenders never lie. :-) \$\endgroup\$
    – stevenvh
    Commented May 26, 2011 at 14:14
6
\$\begingroup\$

Watch Dog

Like others have mentioned, the watchdog timer is able to catch "odd" errors that cause the program to go into an odd state. The microcontroller is reset and everything acts as if it had just been turned on again. For many applications this is the best solution. A consumer would be annoyed if their TV remote reset itself as they were trying to use it, but a watch dog timer would catch an odd event and reset it. I can assure you the consumer would be much more happier with a random reset then having to remove the batteries and putting back in before it recovers.

There are also situations where you might have no ability to reset the device, such as it being in a sealed container or in some place that you just can't get to it. In these situations it would be much better to just reset instead of having to break into a container or what not.

Safety Critical

It sounds like you are looking for something that is more along the lines of safety critical in which you want a hardware failure to not cause something to go very wrong.

There are processors that are specifically designed for this. In general it is just able to alert you that an error has occurred, this alert can then be used to shut down your systems in a safe manner.

I saw a demo of a chip that did this, I think it was a TI ARM, maybe the TMS570. But anyway, one method of protection is to have 2 parallel processing cores that are offset by half a clock cycle. The results of every operation can then be compared between the two cores. The offset makes it so that it is less likely that an external event would cause both of the cores to make the same exact error.

If the comparison comes out true then you go on with life normally, if it were to be false then what you do would depend on your application. At least in this situation you will be made aware of an error and have full engineering control of how you want to recover from it.

\$\endgroup\$
1
  • 1
    \$\begingroup\$ The (miserably failed) Intel iAPX432 also has some level of fault tolerance by having two iAPX432s in tandem. \$\endgroup\$
    – stevenvh
    Commented May 26, 2011 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.