A watchdog circuit and a method for fault recovery of a spaceborne computer combining software and hardware

Abstract

The present invention discloses a watchdog circuit and a method for recovering a satellite computer fault that combines software and hardware, and belongs to the field of aerospace computer security design. The watchdog circuit proposed by the present invention generates three dog bite signals, and measures are taken in sequence according to the severity of the fault, which can ensure that the fault is effectively resolved. The satellite computer fault recovery method that combines software and hardware of the present invention adopts a redundant dual-machine cold standby design for the satellite computer, and a single machine has a watchdog circuit that can generate non-maskable interrupts, system resets, and signals to open the other machine in sequence; if a hardware failure causes continuous abnormal resets, it is impossible to enter the normal working mode. The software adopts the following strategy: the host machine switches to the standby machine after being reset 6 times in a row, and the standby machine switches to the minimum mode after being reset 6 times in a row. The present invention has been implemented and verified in actual projects, and can effectively solve various software and hardware failures.

Description

Technical Field

[0001] The present invention belongs to the field of aerospace computer security design, in particular to a watchdog circuit and a software and hardware integrated onboard computer fault recovery method. Background Art

[0002] Common monitoring circuit chips, such as the MAX706 from MAXIM, can output reset commands during power-up, power-down, and brownout conditions. Their watchdog timer has a 1.6s period. If the monitoring signal remains unchanged within this period, a low-level signal is output, acting as an NMI interrupt. However, practical applications often require a variable watchdog period, the ability to respond to multiple watchdog bite events, and the ability to select whether to enable the watchdog function. Programmable logic devices such as FPGAs allow for flexible watchdog configuration, but implementation is complex and costly due to radiation resistance requirements. Furthermore, using hardware-only design methods can also lead to unexpected failures due to component failure. Summary of the Invention

[0003] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a watchdog circuit and a method for recovering a satellite-borne computer fault by combining software and hardware.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] A watchdog circuit includes a dog feeding and dog prohibiting module, a counter circuit, a dog biting module and a reset module;

[0006] The dog feeding and dog disabling module is used to receive the NDOG# signal when the watchdog is disabled. The NDOG# signal changes from low to high, and is output as a high level after passing through the Q end of the trigger. After passing through the two-stage OR gate, it is still high and is output as the reset signal CR of the counter. The counter will always be in a reset state and the watchdog circuit is disabled. When the dog is fed normally, it is used to receive the reset signal and the dog feeding signal P0. At this time, the dog feeding signal P0 is set to a low level, and is high after passing through the inverter and the two-stage OR gate. It is output as the reset signal CR of the counter, and the counter is reset to achieve normal dog feeding.

[0007] The counter is used to receive the reset signal CR and the initial frequency signal CLKI, generate a certain frequency by configuring resistors and capacitors, and output a signal of 14-bit count value Q0~Q13. The count value is increased by 1 for each rising edge of the initial frequency signal.

[0008] The dog bite module is used to receive signals as Q8, Q12 and Q13 bits of the counter, and generate a primary dog bite signal NMI, a secondary dog bite signal DRST# and a tertiary dog bite signal ONB through an internal combination circuit;

[0009] The reset module is used to generate a reset signal.

[0010] Furthermore, the dog feeding and dog prohibiting module circuit includes a fourth D trigger, a first OR gate, a second OR gate, a first inverter, a second inverter, a third resistor and a fourth resistor, a second capacitor and a first diode;

[0011] The dog feeding signal P0 is connected to the GPIO port of the processor, pulled up to VDD through the fourth resistor and connected to the input of the second inverter, the output of the second inverter is connected to the second input of the first OR gate, and the output of the first OR gate is connected to the first input of the second OR gate; the dog disabling signal NDOG# is connected to the negative end of the first diode, the positive end of the first diode is connected to the second end of the third resistor and the second capacitor, and the CLK end of the fourth D flip-flop, VDD is connected to the first end of the third resistor and the second capacitor, and the D input of the fourth D flip-flop; the Q output of the fourth D flip-flop is connected to the first input of the first OR gate, the reset signal is connected to the CLR end of the fourth D flip-flop and the input of the first inverter, and the output of the first inverter is connected to the CR end of the counter.

[0012] Furthermore, the counter circuit is composed of a counter and a resistor and a capacitor configured with an initial frequency, the resistors include a first resistor and a second resistor, and the capacitor is a first capacitor;

[0013] The first end of the first capacitor, the first resistor and the first end of the second resistor are connected together, the second end of the first capacitor is connected to the CLKO end of the counter, and the second end of the first resistor is connected to the CLKO end of the counter. The second end of the second resistor is connected to the CLKI end of the counter, the CR end of the counter is connected to the output end of the dog feeding module, and the Q8, Q12 and Q13 ends of the counter serve as the input of the dog bite module.

[0014] Furthermore, the dog bite module circuit includes a first AND gate, a third OR gate, a second D flip-flop, a third D flip-flop and a first D flip-flop;

[0015] The Q8 terminal of the counter is connected to the CLK terminals of the second D flip-flop, the third D flip-flop, and the first D flip-flop; the Q12 of the counter is connected to the first input terminal of the first AND gate and the CLR terminal of the first D flip-flop; the Q13 of the counter is connected to the second input terminal of the first AND gate, the CLR terminals of the second D flip-flop, and the third D flip-flop;

[0016] The D-end inputs of the second D-type flip-flop and the first D-type flip-flop are both connected to the power supply VDD. The output of the terminal is a dog bite NMI signal, which serves as the interrupt input of the processor;

[0017] The Q output of the second D flip-flop is connected to the D input of the third D flip-flop, the Q output of the third D flip-flop is connected to the first input of the third OR gate, and the Q of the second D flip-flop is connected to the D input of the third D flip-flop. The output of the terminal is connected to the second input terminal of the third OR gate, the output terminal of the third OR gate is the second dog bite DRST# signal, which is connected to the second input terminal of the third AND gate of the reset module part;

[0018] The output end of the first AND gate is the third dog bite signal ONB, which is connected to the interface device that controls the power on of the other machine.

[0019] Further, the reset module includes a third inverter, a second AND gate, a third AND gate, a fifth resistor, a sixth resistor, a seventh resistor, a third capacitor, a fourth capacitor, and a second diode;

[0020] The command reset signal NRST# is connected to the negative terminal of the second diode, and the positive terminal of the second diode is connected to the first input terminal of the third AND gate via an RC filter network composed of a fifth resistor, a sixth resistor, and a third capacitor; VDD is connected to GND via a fourth capacitor and a seventh resistor, and the common terminal of the fourth capacitor and the seventh resistor is connected to the input terminal of the third inverter; the output terminal of the third inverter is a power-on reset signal, which is connected to the second input terminal of the third AND gate; the output terminal of the second AND gate is connected to the first input terminal of the third AND gate and also to the input terminal of the first inverter; the output terminal of the third AND gate is a system reset signal SYSRST#, which is connected to the reset input terminal of the processor.

[0021] Furthermore, the workflow is:

[0022] During the power-on process of the watchdog circuit, current flows through the seventh resistor and divides the voltage. After passing through the third inverter, the second AND gate, the first inverter, and the second OR gate, the counter CR terminal is high, and all the counting bits of the counter are cleared;

[0023] After power-on, when the watchdog circuit is working normally, the NDOG# signal remains high impedance and the first diode is in the cut-off state. Since the Q terminal of the fourth D flip-flop is initially low, after passing through the first and second OR gates, the high or low level of the CR terminal of the counter is determined only by the dog feeding signal P0.

[0024] When P0 is high, the CR terminal is low after passing through the second inverter, the first OR gate, and the second OR gate, and the counter works normally. The Q8, Q12, and Q13 of the counter change according to the timing, and the three pass through the dog bite module circuit to generate three dog bite signals;

[0025] When the processor performs the dog feeding operation, P0 is set to low, and after passing through the second inverter, the first OR gate, and the second OR gate, the CR terminal is high, the counter is cleared, and Q8, Q12, and Q13 cannot generate three dog bite signals according to the timing change;

[0026] When the NDOG# signal is connected to GND, the first diode is turned on. When the conduction stops, the first diode is cut off. The CLK terminal of the fourth D flip-flop generates a rising edge. Since the D terminal input of the fourth D flip-flop is high, the Q terminal output of the fourth D flip-flop is latched as a high level. After passing through the first OR gate and the second OR gate, the CR terminal remains at a high level. The counter is always cleared, and Q8, Q12 and Q13 of the counter cannot generate three dog bite signals according to the timing changes.

[0027] A software-hardware combined onboard computer fault recovery method:

[0028] The processor of the onboard computer adopts a dual-machine cold standby redundant design. Under normal working conditions, the main machine or the backup machine is powered on and running. When a fault occurs, the active machine turns on the other machine, and the other machine turns off the faulty machine after initialization is completed.

[0029] The onboard computer processor is also monitored by the watchdog circuit of the present invention. When the onboard computer processor operates abnormally and cannot output correctly within the watchdog time period, a dog bite event is triggered. The watchdog circuit can generate three dog bite signals. The fault recovery for three dog bite signals is as follows:

[0030] For the first dog bite, a local non-maskable interrupt is generated;

[0031] For the second dog bite, a reset signal is generated for the machine;

[0032] If the third dog bite generates a signal to turn on the other machine, this machine will not reset;

[0033] 1) At the same time, if the processor is reset continuously, the corresponding judgment will be made in the initialization program. When the master is reset continuously, it will switch to the backup machine. When the backup machine is reset continuously, it will switch to the minimum mode operation.

[0034] 2) The second dog bite generates a reset signal for the device;

[0035] 3) The third dog bite generates a signal to turn on the other machine, but this machine does not reset.

[0036] If continuous resets are caused by hardware failure, the software will make corresponding judgments, as follows: the master machine will switch to the backup machine after 6 consecutive resets, and the backup machine will switch to the minimum mode after 6 consecutive resets. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 is a structural diagram of the watchdog circuit of the present invention;

[0038] Figure 2 This is a timing diagram of three dog bites.

[0039] Figure 3This is a software fault recovery flowchart.

[0040] Among them, 1 is a timer; 2 is a fourth D flip-flop; 3 is a first OR gate; 4 is a second OR gate; 5 is a first inverter; 6 is a second inverter; 7 is a first AND gate; 8 is a third OR gate; 9 is a second D flip-flop; 10 is a third D flip-flop; 11 is a first D flip-flop; 12 is a third inverter; 13 is a second AND gate; 14 is a third AND gate. DETAILED DESCRIPTION

[0041] See also Figure 1 , Figure 1 This is a structural diagram of the watchdog circuit of the present invention. The watchdog circuit is mainly composed of discrete devices such as counters, inverters, AND gates, OR gates, and D flip-flops. It includes counter 1, fourth D flip-flop 2, first OR gate 3, second OR gate 4, first inverter 5, second inverter 6, first AND gate 7, third OR gate 8, second D flip-flop 9, third D flip-flop 10, first D flip-flop 11, third inverter 12, second AND gate 13, and third AND gate 14. All devices have a VDD of 3.3V. Specifically, the counter 1 circuit consists of counter 1 and resistors and capacitors configured with an initial frequency. The second end of the first capacitor C1 is connected to the CLKO terminal of counter 1, and the second end of the first resistor R1 is connected to the The first end of the first resistor R2 is connected to the CLKI terminal of the counter 1. The first capacitor C1, the first resistor R1, and the first end of the second resistor R2 are connected together. The capacitance of the first capacitor C1 is 4300pF, the resistance of the first resistor R1 is 47kΩ, and the resistance of the second resistor R2 is 200kΩ. The CR terminal of the counter 1 is connected to the output terminal of the first inverter 4 of the dog feeding module. The Q8, Q12, and Q13 terminals of the counter 1 are connected to the circuit components of the dog bite module, specifically as follows: the Q8 terminal is connected to the CLK terminal of the second D flip-flop 9, the third D flip-flop 10, and the first D flip-flop 11; Q12 is connected to the first input terminal of the first AND gate 7 and the CLR terminal of the first D flip-flop 11; Q13 is connected to the second input terminal of the first AND gate 7, the second D flip-flop 9, and the CLR terminal of the third D flip-flop.

[0042] The dog bite module circuit includes a first AND gate 7, a third OR gate 8, a second D flip-flop 9, a third D flip-flop 10, and a first D flip-flop 11, wherein the D-end inputs of the second D flip-flop 9 and the first D flip-flop 11 are both connected to the power supply VDD, and the D-end inputs of the first D flip-flop 11 are both connected to the power supply VDD. The output of the second D flip-flop 9 is a dog bite NMI signal, which is directly used as the interrupt input of the processor. The Q output of the second D flip-flop 9 is connected to the D input of the third D flip-flop 10, and the Q output of the third D flip-flop 10 is connected to the first input of the third OR gate 8. The output of the first AND gate 7 is connected to the second input of the third OR gate 8. The output of the third OR gate 8 is the second dog bite signal DRST#, which is connected to the second input of the third AND gate 14 in the reset module. The output of the first AND gate 7 is the third dog bite signal ONB, which is connected to the interface device that controls the power on of the other machine.

[0043] The dog feeding and dog disabling module circuit includes a fourth D flip-flop 2, a first OR gate 3, a second OR gate 4, a first inverter 5, a second inverter 6, third and fourth resistors R3 and R4, a second capacitor C2, and a first diode V1. The dog feeding signal P0 is connected to the processor's GPIO port, pulled up to VDD via the fourth resistor R4, and connected to the input of the second inverter 6. The output of the second inverter 6 is connected to the second input of the first OR gate 3, and the output of the first OR gate 3 is connected to the first input of the second OR gate 4. The dog disabling signal NDOG# is connected to the negative terminal of the first diode V1 by an external command. The positive terminal of the first diode V1 is connected to the second terminal of the third resistor R3 and the second capacitor C2, and the CLK terminal of the fourth D flip-flop 2. VDD is connected to the first terminal of the third resistor R3 and the second capacitor C2, and the D input of the fourth D flip-flop 2. The Q output of the fourth D flip-flop 2 is connected to the first input of the first OR gate 3. The reset signal is connected to the CLR terminal of the fourth D flip-flop 2 and the input of the first inverter 5. The output of the first inverter 5 is connected to the CR terminal of the counter 1. The resistance of the third resistor R3 is 3kΩ, and the capacitance of the second capacitor C2 is 0.1uF.

[0044] The reset module includes a third inverter 12, a second AND gate 13, a third AND gate 14, a fifth resistor R5, a sixth resistor R6, and a seventh resistor R7, a third capacitor C3 and a fourth capacitor C4, and a second diode V2. A command reset signal NRST# is connected to the negative terminal of the second diode V2. The positive terminal of the second diode V2 is connected to the first input of the third AND gate 14 via an RC filter network consisting of the fifth resistor R5, the sixth resistor R6, and the third capacitor C3. VDD is connected to GND via the fourth capacitor C4 and the seventh resistor R7. The common terminal of the fourth capacitor C4 and the seventh resistor R7 is connected to the input of the third inverter 12. The output of the third inverter 12 is a power-on reset signal, which is connected to the second input of the third AND gate 14. The output of the second AND gate 13 is connected to the first input of the third AND gate 14 and also to the input of the first inverter 5. The output of the third AND gate 14 is a system reset signal SYSRST#, which is connected to the reset input of the processor.

[0045] The specific device models are shown in Table 1.

[0046] Table 1 Main components of the watchdog circuit

[0047]

[0048] The main components used in the watchdog circuit are of CAST C quality grade, with high radiation resistance indicators, which can ensure correct operation in space environments.

[0049] The working process of the watchdog circuit of the present invention is:

[0050] During the power-on process of the watchdog circuit, current flows through the seventh resistor R7 and divides the voltage. After passing through the third inverter 12, the second AND gate 13, the first inverter 5, and the second OR gate 4, the CR terminal of the counter 1 is high, and all counting bits of the counter 1 are cleared.

[0051] After power-on, when the watchdog circuit operates normally, the NDOG# signal maintains high impedance and the first diode V1 is in the off state. Since the Q terminal of the fourth D flip-flop 2 is initially low and passes through the first OR gate 3 and the second OR gate 4, the high or low of the CR terminal of the counter 1 is determined only by the dog feeding signal P0. When P0 is high, the CR terminal is low after passing through the second inverter 6, the first OR gate 3, and the second OR gate 4, and the counter 1 operates normally. Q8, Q12, and Q13 change according to the timing, and the three pass through the dog bite module circuit to generate three dog bite signals. When the processor performs the dog feeding operation, P0 is set to low, and the CR terminal is high after passing through the second inverter 6, the first OR gate 3, and the second OR gate 4. The counter 1 is cleared, and Q8, Q12, and Q13 cannot generate three dog bite signals according to the timing change.

[0052] When the NDOG# signal and GND are connected, the first diode V1 is turned on. When it stops conducting, the first diode V1 is turned off. A rising edge occurs at the CLK terminal of the fourth D-type flip-flop 2. Since its D-terminal input is high, the Q-terminal output is latched high. After passing through the first and second OR gates 3 and 4, the CR terminal remains high, and counter 1 is always cleared. Q8, Q12, and Q13 cannot generate three dog bite signals according to the timing change.

[0053] The working principle of the watchdog circuit of the present invention is:

[0054] Configure a GPIO port output of the processor as a monitoring signal of the watchdog circuit. When the processor works abnormally, it cannot output correctly within the watchdog time period, thus triggering a dog bite event. The structure diagram of the watchdog circuit is shown in the figure below. Figure 1 As shown in the figure, the lower end of the D flip-flop is the CLR pin, and the upper end is the SET pin.

[0055] The core device of the watchdog circuit is the counter 1 model JC4060RFC, which supports 14-bit binary serial counting. Indicates that n is 0 to 13. Set the CLKO, Connecting a capacitor or resistor to the CLKI pin configures the counter input clock frequency. Each time the input clock transitions from high to low, the counter increments by 1. When the reset pin, CR, of counter 1 is input to 1, the counter is cleared and stops counting, with all output bits, Q, set to 0.

[0056] By configuring the counter input clock frequency and combining the output bits, three dog bite signals can be generated respectively. The following is a detailed analysis of the principles of each part of the watchdog circuit.

[0057] To ensure the normal operation of the watchdog circuit after power-on, it is necessary to set the initial state of the watchdog signal and the counter. Figure 1 The reset module in the present invention uses the GPIO port of the processor to generate a dog feeding signal, and uses an RC circuit and an inverter to generate a power-on reset signal. The system has three reset signals, namely power-on reset, instruction reset and dog bite reset, which are combined through two levels of AND gates as system reset signals. Since the reset signal is low-active, the processor will be reset when any one of them is 0. The power-on reset uses an RC circuit and an inverter. The output end of the inverter is 0 during power-on reset, and the output end of the inverter is 1 after power-on reset. After the power-on reset signal is combined with the AND gate, it passes through a first-level inverter and an OR gate and is used as the reset end input of the counter. At power-on reset, the reset end of the counter is 1, and the counter is cleared.

[0058] After the power-on reset is completed, the counter starts counting and the watchdog circuit starts working. The processor is required to feed the watchdog within the specified time, otherwise a dog bite event will occur. Figure 1 The dog feeding and dog disabling modules use the processor's GPIO0 output as the dog feeding signal, P0. When P0 is set to 0, dog feeding begins. At this point, after passing through a single inverter and a two-stage OR gate, P0's output is 1, which serves as the input to the counter reset terminal, CR, clearing the counter and stopping counting. When P0 is set to 1, dog feeding ends, and the counter restarts from 0. Because the GPIO needs to be initialized after a processor reset, P0 is pulled up. After power-on, the default state is to disable dog feeding. After initialization is complete, P0 is set to 0 to resume dog feeding.

[0059] Whenever the input clock changes from high to low, the counter increases by 1. If the input clock frequency is f, then the period of the n-th bit value Qn of the counter is Tn=2^(n+1) / f.

[0060] See Figure 1The dog bite module uses the first output bit Q8, the second output bit Q12, and the third output bit Q13 of the JC4060RFC counter as the inputs of the combinational logic. The three dog bite signals generated are: NMI, DRST#, and ONB. NMI is valid on the falling edge, DRST# is valid at a low level, and ONB is valid at a high level.

[0061] Taking the time when the counter restarts counting as zero and T8 as the basic time unit, the timing relationship of Q8, Q12 and Q13 is as follows: Figure 2 shown.

[0062] The NMI signal is generated by combining the first output bit Q8 and the second output bit Q12 of the JC4060RFC counter through the first D flip-flop D1. The first output bit Q8 of the JC4060RFC counter serves as the CLK input of the first D flip-flop D1, and the second output bit Q12 of the JC4060RFC counter serves as the CLR input of the first D flip-flop D1. The D input of the first D flip-flop D1 is set to normally high, and the Q# output of the first D flip-flop D1 serves as the NMI signal. NMI transitions from high to low at 8.5T_8.

[0063] The DRST# signal is generated by the first output bit Q8, the second output bit Q12, and the third output bit Q13 of the JC4060RFC counter. It is then generated by the second D flip-flop D2, the third D flip-flop D3, and an OR gate. The third output bit Q13 of the JC4060RFC counter serves as the CLR input of the second D flip-flop D2, while the first output bit Q8 of the JC4060RFC counter serves as the CLK input of the second D flip-flop D2. The D input of the second D flip-flop D2 is normally high. At 16.5T8, the Q terminal of the second D flip-flop D2 transitions from low to high, and the corresponding Q# terminal transitions from high to low. The Q output of the second D flip-flop D2 serves as the D input of the third D flip-flop D3, and the third output bit Q13 of the JC4060RFC counter serves as the CLK input of the third D flip-flop D3. At 17.5T8, the Q terminal of the third D flip-flop D3 goes from low to high. The Q terminal of the second D flip-flop D2 and the Q# terminal of the third D flip-flop D3 serve as the inputs of an OR gate, and the DRST# signal is the output of the OR gate. At 16.5T8, the DRST# signal generates a low pulse with a width of T8.

[0064] ONB signal is generated by the second output bit Q12 and the third output bit Q13 of the JC4060RFC counter as inputs of the AND gate. When both are high at the same time, ONB is high. At 24T8, ONB changes from low to high and remains high for 8T8 before changing to low.

[0065] Through the analysis of NMI, DRST# and ONB, the temporal relationship between the three is also plotted on Figure 2 middle.

[0066] See Figure 1 The watchdog function can be disabled by an external "disable" command, effectively preventing the generation of three "bite" signals. The "disable" command is a low-pulse signal. The "disable" function is implemented by a fourth D-type flip-flop D4. The "disable" signal NDOG# serves as its CLK input, while the combination of command reset and power-on reset serves as its CLR input. The Q output of D4 passes through a two-stage OR gate and then serves as the counter's CR input.

[0067] When the system is powered on or reset by an external command, the Q output of the fourth D flip-flop D4 is low. Consequently, the signal at the counter CR is low, and the watchdog circuit operates normally. When the rising edge of the low pulse of the disable command arrives, the high-level input of the fourth D flip-flop D4 is latched. The reset signal of the counter is high, and the counter remains in the zero-cleared state. At this point, the watchdog function is disabled until a reset command is issued or power is restored after a power outage.

[0068] The program of the onboard computer processor of the present invention is run in SRAM, and after each reset, the program will be reloaded and executed in the corresponding order. Each time it runs to a specified address in SRAM, the count at the specified location in the FLASH memory is increased by 1. If the processor is abnormally reset continuously, the corresponding address is continuously increased by 1. After the host program runs, the count value in FLASH is first judged. If it is 6, it means that it has been reset 6 times in a row. At this time, an instruction is issued to turn on the standby machine. After the standby machine is powered on and completes initialization and key data interaction, an instruction is issued to shut down the host. If the standby machine reset count value also reaches 6 times, the standby machine enters the minimum mode, only ensuring basic functions waiting for the arrival of ground instructions. The flowchart of software fault recovery is as follows Figure 3 shown.

[0069] The above content is only for explaining the technical idea of the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A watchdog circuit, characterized in that: Including dog feeding and dog prohibiting modules, counter circuit, dog bite module and reset module; The dog feeding and dog disabling module is used to receive the NDOG# signal when the watchdog is disabled. The NDOG# signal changes from low to high, and is output as a high level after passing through the Q end of the trigger. After passing through the two-stage OR gate, it is still high and is output as the reset signal CR of the counter. The counter will always be in a reset state and the watchdog circuit is disabled. When the dog is fed normally, it is used to receive the reset signal and the dog feeding signal P0. At this time, the dog feeding signal P0 is set to a low level, and is high after passing through the inverter and the two-stage OR gate. It is output as the reset signal CR of the counter, and the counter is reset to achieve normal dog feeding. The dog feeding and dog blocking module circuit comprises a fourth D trigger (2), a first OR gate (3), a second OR gate (4), a first inverter (5), a second inverter (6), a third resistor (R3), a fourth resistor (R4), a second capacitor (C2) and a first diode (V1); The dog feeding signal P0 is connected to the GPIO port of the processor, pulled up to VDD through the fourth resistor (R4) and connected to the input end of the second inverter (6), the output end of the second inverter (6) is connected to the second input end of the first OR gate (3), and the output end of the first OR gate (3) is connected to the first input end of the second OR gate (4); the dog disabling signal NDOG# is connected to the negative end of the first diode (V1), the positive end of the first diode (V1) is connected to the second end of the third resistor (R3) and the second capacitor (C2), and the CLK end of the fourth D flip-flop (2), VDD is connected to the first end of the third resistor (R3) and the second capacitor (C2), and the D end input of the fourth D flip-flop (2); the Q end output of the fourth D flip-flop (2) is connected to the first input end of the first OR gate (3), the reset signal is connected to the CLR end of the fourth D flip-flop (2) and the input end of the first inverter (5), and the output end of the first inverter (5) is connected to the CR end of the counter (1); The counter is used to receive the reset signal CR and the initial frequency signal CLKI, generate a certain frequency by configuring resistors and capacitors, and output a signal of 14-bit count value Q0~Q13. The count value is increased by 1 for each rising edge of the initial frequency signal. The dog bite module is used to receive signals as Q8, Q12 and Q13 bits of the counter, and generate a primary dog bite signal NMI, a secondary dog bite signal DRST# and a tertiary dog bite signal ONB through an internal combination circuit; The reset module is used to generate a reset signal.

2. The watchdog circuit according to claim 1, wherein: The counter (1) circuit is composed of a counter (1) and a resistor and a capacitor configured with an initial frequency, wherein the resistors include a first resistor (R1) and a second resistor (R2), and the capacitor is a first capacitor (C1); The first ends of the first capacitor (C1), the first resistor (R1) and the second resistor (R2) are connected together, the second end of the first capacitor (C1) is connected to the CLKO end of the counter (1), and the second end of the first resistor (R1) is connected to the CLKO end of the counter (1). The second end of the second resistor (R2) is connected to the CLKI end of the counter (1), the CR end of the counter (1) is connected to the output end of the dog feeding module, and the Q8, Q12 and Q13 ends of the counter (1) serve as the input of the dog biting module.

3. The watchdog circuit according to claim 2, wherein: The dog bite module circuit comprises a first AND gate (7), a third OR gate (8), a second D flip-flop (9), a third D flip-flop (10) and a first D flip-flop (11); The Q8 terminal of the counter (1) is connected to the CLK terminal of the second D flip-flop (9), the third D flip-flop (10), and the first D flip-flop (11); the Q12 of the counter (1) is connected to the first input terminal of the first AND gate (7) and the CLR terminal of the first D flip-flop (11); the Q13 of the counter (1) is connected to the second input terminal of the first AND gate (7), the second D flip-flop (9), and the CLR terminal of the third D flip-flop; The D-end inputs of the second D-type flip-flop (9) and the first D-type flip-flop (11) are both connected to the power supply VDD. The output of the terminal is a dog bite NMI signal, which serves as the interrupt input of the processor; The Q-end output of the second D flip-flop (9) is connected to the D-end input of the third D flip-flop (10), the Q-end output of the third D flip-flop (10) is connected to the first input of the third OR gate (8), and the Q-end output of the second D flip-flop (9) is connected to the D-end input of the third D flip-flop (10). The output of the terminal is connected to the second input terminal of the third OR gate (8), and the output terminal of the third OR gate (8) is the second dog bite DRST# signal, which is connected to the second input terminal of the third AND gate (14) of the reset module part; The output end of the first AND gate (7) is the third dog bite signal ONB, which is connected to the interface device for controlling the switching on of the other machine.

4. The watchdog circuit according to claim 3, wherein: The reset module comprises a third inverter (12), a second AND gate (13), a third AND gate (14), a fifth resistor (R5), a sixth resistor (R6), a seventh resistor (R7), a third capacitor (C3), a fourth capacitor (C4), and a second diode (V2); The command reset signal NRST# is connected to the negative end of the second diode (V2), and the positive end of the second diode (V2) is connected to the first input end of the third AND gate (14) via an RC filter network composed of a fifth resistor (R5), a sixth resistor (R6) and a third capacitor (C3); VDD is connected to GND through a fourth capacitor (C4) and a seventh resistor (R7), and the common end of the fourth capacitor (C4) and the seventh resistor (R7) is connected to the input end of the third inverter (12); the output end of the third inverter (12) is a power-on reset signal, which is connected to the second input end of the third AND gate (14); the output end of the second AND gate (13) is connected to the first input end of the third AND gate (14) and is also connected to the input end of the first inverter (5); the output end of the third AND gate (14) is a system reset signal SYSRST#, which is connected to the reset input end of the processor.

5. The watchdog circuit according to claim 4, wherein: The workflow is: During the power-on process of the watchdog circuit, current flows through the seventh resistor (R7) and a voltage is distributed. After passing through the third inverter (12), the second AND gate (13), the first inverter (5), and the second OR gate (4), the CR terminal of the counter (1) is at a high level, and all the counting bits of the counter (1) are cleared; After power-on, when the watchdog circuit is operating normally, the NDOG# signal maintains a high impedance and the first diode (V1) is in a cut-off state; since the Q terminal of the fourth D flip-flop (2) is initially at a low level, after passing through the first OR gate (3) and the second OR gate (4), the high or low level of the CR terminal of the counter (1) is determined only by the dog feeding signal P0; When P0 is high, after passing through the second inverter (6), the first OR gate (3), and the second OR gate (4), the CR terminal is at a low level, the counter (1) works normally, and Q8, Q12, and Q13 of the counter (1) change according to the timing sequence. The three generate three dog bite signals through the dog bite module circuit; When the processor performs the dog feeding operation, P0 is set to low, and after passing through the second inverter (6), the first OR gate (3), and the second OR gate (4), the CR terminal is high level, the counter (1) is cleared, and Q8, Q12, and Q13 cannot generate three dog bite signals according to the timing change; When the NDOG# signal is connected to GND, the first diode (V1) is turned on, and when the NDOG# signal is turned on, the first diode (V1) is turned off, and the CLK terminal of the fourth D flip-flop (2) generates a rising edge. Since the D terminal input of the fourth D flip-flop (2) is high level, the Q terminal output of the fourth D flip-flop (2) is latched to be high level, and the CR terminal after passing through the first OR gate (3) and the second OR gate (4) remains high level. The counter (1) is always cleared, and Q8, Q12 and Q13 of the counter (1) cannot generate three dog bite signals according to the timing change.

6. A software-hardware integrated onboard computer fault recovery method, characterized by: The processor of the onboard computer adopts a dual-machine cold standby redundant design. Under normal working conditions, the main machine or the backup machine is powered on and running. When a fault occurs, the active machine turns on the other machine, and the other machine turns off the faulty machine after initialization is completed. The onboard computer processor is simultaneously monitored by the watchdog circuit according to any one of claims 1 to 5, and the dog feeding and dog disabling module circuit comprises a fourth D flip-flop (2), a first OR gate (3), a second OR gate (4), a first inverter (5), a second inverter (6), a third resistor (R3), a fourth resistor (R4), a second capacitor (C2), and a first diode (V1); The dog feeding signal P0 is connected to the GPIO port of the processor, pulled up to VDD through the fourth resistor (R4) and connected to the input end of the second inverter (6), the output end of the second inverter (6) is connected to the second input end of the first OR gate (3), and the output end of the first OR gate (3) is connected to the first input end of the second OR gate (4); the dog disabling signal NDOG# is connected to the negative end of the first diode (V1), the positive end of the first diode (V1) is connected to the second end of the third resistor (R3) and the second capacitor (C2), and the CLK end of the fourth D flip-flop (2), VDD is connected to the first end of the third resistor (R3) and the second capacitor (C2), and the D end input of the fourth D flip-flop (2); the Q end output of the fourth D flip-flop (2) is connected to the first input end of the first OR gate (3), the reset signal is connected to the CLR end of the fourth D flip-flop (2) and the input end of the first inverter (5), and the output end of the first inverter (5) is connected to the CR end of the counter (1); When the onboard computer processor works abnormally and cannot output correctly within the watchdog time period, a dog bite event is triggered. The watchdog circuit can generate three dog bite signals. The fault recovery for three dog bite signals is as follows: For the first dog bite, a local non-maskable interrupt is generated; For the second dog bite, a reset signal is generated for the machine; If the third dog bite generates a signal to turn on the other machine, this machine will not reset; At the same time, if the processor is reset continuously, a corresponding judgment will be made in the initialization program. When the main machine is reset 6 times continuously, it will switch to the backup machine. When the backup machine is reset 6 times continuously, it will switch to the minimum mode.

7. The onboard computer failure recovery method combining software and hardware according to claim 6, characterized in that: The program of the onboard computer processor runs in the SRAM. After each reset, the program will be reloaded and executed in the corresponding order. Each time it runs to a specified address in the SRAM, the count at the specified location in the FLASH memory is increased by 1. If the onboard computer processor is abnormally reset continuously, the corresponding address will be continuously increased by 1; after the onboard computer processor program runs, it will first determine the count value in the FLASH. If it is 6 times, it will issue a command to turn on the standby machine; After the standby machine is powered on and completes initialization and key data interaction, it issues a command to shut down the host machine; If the standby machine reset count reaches 6 times, the standby machine enters the minimum mode.

Images