Management method of watchdog circuit of fault-tolerant control system

Abstract

The invention provides a management method of a watchdog circuit of a fault-tolerant control system, which comprises the following steps of: 1, electrifying the system; 2, resetting the watchdog circuit of the system, clearing a watchdog timer; 3, starting the timing by the watchdog timer, presetting a timing period between a watchdog failure recovery task period and a watchdog failure management period; 4, carrying out software input operation by an application program in each minimum control period; 5, judging whether the application program carries out input operation in the timing period; 6, enabling the output of the watchdog circuit to be effective, keeping enough pulse width for enabling the system to enter interrupt service time; 7, judging whether the system in a debugging development state; and 8, generating an interrupt signal of a processor by the watchdog circuit, latching a failure indication signal, prohibiting a failure computer from outputting a command, and inhibiting the failure from spreading. The management method of the watchdog circuit of the fault-tolerant control system is used for carrying out failure recovery through failure management after the failure occurs, thus the fault-tolerant capability of the system is improved.

Description

technical field [0001] The invention relates to a fault-tolerant control system, in particular to a watchdog circuit management method of the fault-tolerant control system. Background technique [0002] In the embedded computer system, in order to prevent the software from running away or entering an endless loop due to external interference, a hardware watchdog circuit is usually designed. The software should trigger the watchdog circuit (commonly known as feeding the dog) within the specified time period, otherwise the watchdog circuit will notify the system through a hardware signal (dog barking signal) to generate a system reset or interrupt. In most embedded applications, when the watchdog times out, the system will be reset directly. In a few embedded applications, an interrupt will be generated after the watchdog times out, and then the program will stop running. However, in a highly reliable N-mode redundant system such as a flight control system, it is unacceptable...

AI Technical Summary

Problems solved by technology

In most embedded applications, the watchdog will directly cause the system to reset when it times out. In a few embedded applications, the watchdog will generate an interrupt after the watchdog times out and then the program will stop running.

However, in a highly reliable N-mode redundant system such as a flight control system, it is unacceptable to directly reset the system due to watchdog timeout

First of all, if the fault source is not eliminated, it will cause the fault system to reset repeatedly, and become a fault source that continuously interferes with other computer systems in the redundancy system. Secondly, the software scene when the dog barking occurs is not recorded, and the cause of the fault cannot be analyzed afterwards.

Shutdown after watchdog failure also has the disadvantage of degrading the system too quickly

Images