Read a single-chip watchdog circuit

The watchdog timer is a counter. The basic function is to restart the system after a software problem occurs and the program runs away. The watchdog counter automatically counts when it is working normally. The program flow periodically resets it to zero. If the system is stuck or running somewhere, the timer will overflow and will enter the interrupt. Some reset operations are performed in the timer interrupt to restore the system to normal operation. That is, during the normal operation of the program, the watchdog is reset as scheduled to ensure that the selected timing overflows to zero, and the processor is restarted. Software reliability has always been a key issue. Anyone who uses the software may experience a computer crash or a runaway problem, which is also true in embedded systems . Due to the limited anti-interference ability of the single-chip microcomputer , in the instrumentation of the industrial field , it often causes a crash due to voltage instability and arc interference. In the case of unattended water meters, electricity meters, etc., it is also impossible to restart due to system interference. In order to ensure that the system can automatically return to normal after interference, the use of the Watchdog Timer is very valuable.

Some of the popular MCUs on the market today are embedded with internal WDTs such as TI's MSP430 series, Philips' P87XXX and P89XXX series, Microchip's PIC column, Atmel's AT89SXX series and Holtek's Htxxx series. However, there are some errors in these internal watchdogs at work. Some engineers in the design process, because of this, caused the system to be abnormal. MSP430 series MCU is a new generation of MCU developed by Texas Instruments (TI) in recent years. This series is a 16-bit, new concept hybrid MCU with a reduced instruction set and ultra-low power consumption. Among the many MCU series, it has become a dazzling star because of its low power consumption, rich on-chip peripherals and convenient and flexible development tools. It has its own watchdog and reset circuit. In theory, if the program runs away, it can be reset by the watchdog. However, in the actual use process, the role of the watchdog was found to be not foolproof. The following experiment proves this. The experimental circuit is shown in Figure 1.

Test program list: #include Void main(void){p1dir l=0x0f; //Set p1.2-.p1.0 to output for(;;){volatile unsigned int i;wdtctl=wdtpw+wdtcncl;//reset wdtpiout==0x0t;i =5000;do(i--)while(i!=0);}} After the above experiment is started, if the program runs normally, the LED will flash. By default, the watchdog of the MSP430 is allowed, and the running program continuously accesses the watchdog. In theory, this system will not fail to start, because even if the startup fails, the watchdog should start within hundreds of milliseconds to reset the entire system. Based on this idea, the reset of the microcontroller is tested. K2 is disconnected and is continuously generated with K1. Reset signal, test the success rate of the watchdog to restart the system. When K2 is closed, the reset terminal is high. In theory, K1 cannot effectively generate a reset pulse to observe whether the watchdog is active. Experimental results and analysis The experimental results are as follows: K2 disconnected, continuous switch K1, power-on restart system, average 155 failures once (LED does not flash), that is, watchdog failure probability 0.6%; K2 closed, continuous switch K1 An average of 18 failures (LED does not flash), and once failed, will continue to fail, the watchdog inefficiency accounted for about 5.5%. In addition, when other series of single-chip microcomputers with the same built-in watchdog are used instead of the MSP430 in the experiment, the experimental results are still roughly the same when the program block is modified accordingly. This shows that the problem faced by the single-chip microcomputer with built-in watchdog is the same. After analysis, there may be the following reasons: 1 Since the clock of the watchdog is not independent, the counting clock and the system are the same crossover link, so the watchdog cannot operate effectively when there is a problem in the system. 2 Since the clock can be set by software, when the startup fails, the power-on clock may be in the neutral state, and no clock watchdog cannot take effect. 3 Some watchdogs need to be set or started by software. Therefore, after the startup fails, the initialization program is not activated, and the CPU may jump to the random code to disable the watchdog. Such a watchdog needs to have a reliable power-on reset as a guarantee. Therefore, in theory, the original design is unreasonable. Based on the above analysis, the off-chip watchdog dedicated chip TPS3823 is used to provide counting pulses by an independent frequency division oscillating circuit. The experimental circuit is shown in Figure 2.

In the above circuit of the MCU watchdog circuit, the TPS3823 outputs a timing overflow signal to the Reset terminal. In the block, the CPU should continuously output the dog feed signal through the I/O port to clear the watchdog counter. In this circuit, the same action of K1 and K2 in the above test is repeated, and the system restart success rate reaches 100%.

Future built-in watchdogs must have independent and reliable clocks. After the system is powered up, the watchdog is enabled and requires no software settings. It can only be disabled by external hardware jumpers or internal fuses. At present, external watchdogs must be considered if high-reliability embedded systems are required. Another problem with the built-in watchdog is that after a system reset, the program should determine whether the reset is normally powered-on or the program is running away from the watchdog, thereby determining whether the field data should be retained. This is also a consideration in watchdog applications.