How to guarantee “grid-looping clock” is running when dynamically driving VFD tubes

Question

I'm driving old Soviet VFD tubes using Atmel AVR8 processors (e.g. ATmega328 and ATmega1284) and VFD driver chips Microchip HV518/HV5812/HV6810. Some of these tubes can only be driven dynamically, i.e. looping over the grids (e.g. IV-27M). However, the voltage for dynamically driving these tubes are typically twice as high as the voltages for driving them statically, e.g. 25V and 50V.

So I'm trying to solve the problem of these tubes being ruined by 50V when the processor for whatever reason stops running and there is 50V statically on the segments that are lightened at that moment (depending on the bit string currently in the VFD driver chip).

There are two "solutions" to improve the situation that come to mind:

1. use a "non-maskable interrupt" to make sure the grid loop keeps running, but I don't think such a thing exists on AVR8, as there is no interrupt hierarchy and all interrupt service routines themselves run uninterrupted (except when their ISR_NOBLOCK flag is set)
2. make sure that the high-voltage output lines of the VFD driver chip are disabled when the MCU power is gone by using an AND port on the driver chips' enable input

But what I really need to make sure (I think) is something that verifies that all the high-voltage output lines of the VFD driver chip to the grids are flashing rather than being stuck at 1.

(although I'm using old-school tubes and driver chips, I assume this issue is the same for all dynamically-driven VFD tubes/drivers, so I didn't include these specifics in the title)

---

Thanks! So here is what I'll do:

1. as suggested use the internal watchdog in Interrupt and System Reset mode: I'll use the ISR to write out a string of 0's to the driver chips, and after latching them to the output lines, I'll activate the DISABLE line of the driver chips; then I'll go into RESET; after such a RESET, the system will come up in maintenance mode
2. from the HV518 datasheet (i.e. the 'Input and Output Equivalent Circuits' section) I understand that data out = 0 when the 5V power (Vdd) is lost, which means the high-voltage output will be blocked when Vdd is lost and Vpp is still there; so an external (voltage) watchdog won't be necessary here
3. I'll use some additional logic to connect the RESET line to the DISABLE line of the VFD driver
4. I could add an external watchdog that simply checks whether there is still a bitstream coming from the MCU; since the grid loop always addresses one of the grids, there will always be 1's in there even when all segments are off; are there watchdog chips that trigger on "logic silence" rather than voltages? or would this require adding and programming a tiny MCU?

Answer 1

I see the following options, depending on what level of protection you want to achieve:

1. Use AVR's internal watchdog. Kick the watchdog in the same place where you send data to the driver chip. If you fail to kick watchdog for some reason, MCU will reset and presumably software will work properly again. Alternatively, you can detect that the reset was due to watchdog and disable the driver and just hang there.
2. Previous option will not protect you if MCU is kept in reset (e.g. during programming) or if the power of MCU is lost. To detect this situation, you need external watchdog chip. During normal operation you would send pulses to the watchdog chip. If watchdog does not receive those pulses, it will disable the driver chip.
3. However, previous options will not protect you from the bug in software which would send "bad data" to the driver, potentially stopping the looping. To detect this situation, you can use second MCU to monitor outputs of the driver chip and disable the chip, if outputs are stuck.