Secure watchdog circuit and watchdog detection method
By introducing a dual control module and a soft-start module into the railway signal safety watchdog circuit, comprehensive detection of the watchdog circuit is achieved, solving the problem of lack of monitoring in the intermediate circuit and improving the accuracy of fault location and circuit safety.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING HOLLYSYS
- Filing Date
- 2023-02-23
- Publication Date
- 2026-05-22
AI Technical Summary
In existing railway signal safety watchdog circuits, the intermediate circuits lack monitoring, making fault location difficult and inaccurate, and there are no other judgment methods, which affects maintenance efficiency.
Design a safety watchdog circuit, which includes two control modules and two watchdog command readback modules. Each module periodically compares the state of the watchdog pulse signal. A soft-start module and multiple detection mechanisms are used to ensure circuit safety.
It enables comprehensive detection of watchdog circuits, improves the accuracy of fault location and maintenance efficiency, and enhances circuit safety.
Smart Images
Figure CN116225763B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of railway signal safety technology, and more particularly to a safety watchdog circuit and a watchdog detection method. Background Technology
[0002] In railway signaling safety products, the core design principle is fail-safe, meaning that the system should be guided to the safety side when a failure occurs, ensuring train operation safety. The safety watchdog circuit in the system is crucial for guiding the system to the safety side. When a system failure occurs or there is no watchdog pulse, the watchdog circuit should automatically shut off the watchdog power, thereby cutting off external output and ensuring system safety.
[0003] Current railway signaling products typically use safety watchdog circuits designed as follows: Figure 1 The circuit shown has the following main problems: the path from the CPU feeding the watchdog to the actual watchdog output is long, and the entire circuit is not monitored, only the final watchdog output status is detected. The consequences are: the intermediate circuit is not monitored, the watchdog circuit cannot be accurately located when it fails, and maintenance is inconvenient; if the readback circuit itself fails, there are no other means of judgment. Summary of the Invention
[0004] This application provides a safe watchdog circuit and a watchdog detection method, which can detect the watchdog pulse command status, provide more comprehensive detection of the watchdog circuit, and improve the security of the watchdog circuit.
[0005] This application provides a security watchdog circuit, which includes two control modules and two watchdog command readback modules; each control module corresponds to one watchdog command readback module.
[0006] Each control module is configured to simultaneously send a watchdog pulse signal at preset intervals; periodically compare the first command readback status received from the corresponding watchdog command readback module with the first command readback status sent by another control module; when the two are inconsistent, each control module switches to the safety side; periodically compare the first command readback status received from its own corresponding watchdog command readback module with a first preset value; when the two are inconsistent, each control module switches to the safety side; and send the first command readback status received from the corresponding watchdog command readback module to another control module.
[0007] Each watchdog command readback module is configured to perform watchdog command readback processing based on the feeding pulse signal when it receives the watchdog pulse signal or during the idle interval between two adjacent watchdog pulse signals, and feed back the first command readback status as the readback processing result to the corresponding control module.
[0008] In one exemplary embodiment, each control module is further configured to issue a control signal during the idle interval between two adjacent watchdog pulse signals; periodically compare the received second command readback status fed back by the corresponding watchdog command readback module with the second command readback status sent by another control module; when the two are inconsistent, each control module directs to the safety side; periodically compare the second command readback status fed back by its own corresponding watchdog command readback module with a second preset value; when the two are inconsistent, each control module directs to the safety side; and send the received second command readback status fed back by the corresponding watchdog command readback module to another control module.
[0009] Each watchdog command readback module is configured to perform watchdog command readback processing based on the control signal, and feed back the second command readback status as the readback processing result to the corresponding control module.
[0010] In one exemplary embodiment, the security watchdog circuit further includes a soft-start module;
[0011] The slow-start module is configured to control each control module to generate a dog-feeding pulse signal within a preset slow-start time after the safety watchdog circuit is powered on.
[0012] In one exemplary embodiment, each control module is configured to read back the state of the slow-start module within a preset readback time after power-on, to ensure that the slow-start module only takes effect once.
[0013] In one exemplary embodiment, the two control modules include a first control module and a second control module;
[0014] The safety watchdog circuit also includes an AC signal generation module, a DC signal generation module, a watchdog voltage generation module, a first readback circuit, and a second readback circuit;
[0015] The AC signal generating module is configured to amplify the first dog-feeding pulse signal and generate an AC signal based on the amplified first dog-feeding pulse signal; wherein the first dog-feeding pulse signal is the dog-feeding pulse signal generated by the first control module.
[0016] The DC signal generation module is configured to amplify the second dog-feeding pulse signal and generate a DC signal based on the amplified second dog-feeding pulse signal; wherein the second dog-feeding pulse signal is the dog-feeding pulse signal generated by the second control module.
[0017] The watchdog voltage generation module is configured to construct a safety AND gate from the received AC signal and the DC signal, and generate a watchdog voltage based on the output of the safety AND gate.
[0018] The first readback circuit is configured to input the state of the watchdog voltage to the first control module;
[0019] The second readback circuit is configured to input the state of the watchdog voltage to the second control module;
[0020] The first control module and the second control module are also configured to send the status of the watchdog voltage they receive to another control module, and periodically compare the status of the received watchdog voltage. When the two are inconsistent, both the first control module and the second control module will switch to the safety side.
[0021] In one exemplary embodiment, the first watchdog command readback module includes a first comparator, and the second watchdog command readback module includes a second comparator;
[0022] The first watchdog command readback module is specifically configured to output a first reference voltage when the first control module sends a first watchdog pulse signal; a first comparator compares the first reference voltage with the output signal of the AC signal generation module, and sends the first comparison result as a first command readback status to the first control module for readback confirmation;
[0023] The first watchdog command readback module is further configured to output a first readback voltage after the first control module issues a first feed pulse signal and when the first control module issues a control signal; a first comparator compares a second reference voltage with the first readback voltage and sends the second comparison result as a second command readback status to the first control module for readback confirmation; wherein, the first readback voltage may have different comparison results with the second reference voltage when the first watchdog command readback module is in different states; the second reference voltage is the output of the AC signal generated according to the control signal;
[0024] The second watchdog command readback module is specifically configured to output a third reference voltage when the second control module sends a second watchdog pulse signal; the second comparator compares the third reference voltage with the output signal of the DC signal generation module, and sends the third comparison result to the second control module for readback confirmation;
[0025] The second watchdog command readback module is further configured to output a second readback voltage after the second control module issues a second feed pulse signal and when the second control module issues a control signal; the second comparator compares the fourth reference voltage with the second readback voltage and sends the fourth comparison result to the second control module for readback confirmation; wherein, the comparison result of the second readback voltage with the fourth reference voltage may be different when the second watchdog command readback module is in different states.
[0026] In one exemplary embodiment, the soft-start module is connected to the watchdog voltage generating module;
[0027] The soft-start module is further configured to control the watchdog voltage generating module to be in working state for a preset soft-start time, and to not control the watchdog voltage generating module after the preset soft-start time expires.
[0028] In one exemplary embodiment, the dog-feeding pulse signal comprises a first number of continuous pulse signals, each pulse signal having a duration of a preset duration.
[0029] In one exemplary embodiment, the first control module includes a first CPU and a first FPGA chip; the second control module includes a second CPU and a second FPGA chip.
[0030] The AC signal generation module includes a first drive circuit and a first transformer;
[0031] The DC signal generation module includes a second drive circuit and a second transformer;
[0032] The watchdog voltage generation module includes a magnetic amplifier, a 555 oscillator, a third transformer, an energy storage circuit, and an LDO circuit; the magnetic amplifier includes an AC coil, a control coil, and an output coil.
[0033] The first driving circuit is configured to amplify the first dog-feeding pulse signal; the first transformer is configured to generate an AC signal based on the first dog-feeding pulse signal and input the AC signal to the AC coil of the magnetic amplifier.
[0034] The second driving circuit is configured to amplify the second dog-feeding pulse signal; the second transformer is configured to generate a DC signal according to the second dog-feeding pulse signal and input the DC signal to the control coil of the magnetic amplifier.
[0035] The magnetic amplifier is configured to form a safe AND gate with the received AC signal and the DC signal, and output a third pulse signal through the output coil;
[0036] The 555 oscillator is configured to output a fourth signal under the control of the third pulse signal, and input the fourth signal to the input terminal of the third transformer.
[0037] The first output terminal of the third transformer is connected to the ground terminal of the 555 oscillator.
[0038] The second output terminal of the third transformer is connected to the energy storage circuit and the LDO circuit.
[0039] The energy storage circuit and LDO circuit are configured to be designed based on the output of the second output terminal of the third transformer; the energy storage circuit controls the LDO circuit to generate a watchdog voltage and outputs the watchdog voltage.
[0040] In one exemplary embodiment, the two watchdog command readback modules include a first watchdog command readback module and a second watchdog command readback module;
[0041] The first watchdog command readback module includes a first flip-flop and a first MOS gate circuit;
[0042] The second watchdog command readback module includes a second flip-flop and a second MOS gate circuit;
[0043] The first flip-flop is configured to be edge-triggered under the control of the first CPU, thereby controlling the on / off state of the first MOS gate circuit;
[0044] The first MOS gate circuit is configured to be turned on or off under the control of the first flip-flop, and the output signal is input to the non-inverting input terminal of the first comparator;
[0045] The first comparator is configured to compare the signal at the non-inverting input terminal and the signal at the inverting input terminal, and feed back the first comparison result or the second comparison result to the first FPGA; wherein, the signal at the inverting input terminal is the output signal of the first transformer;
[0046] The second flip-flop is configured to be edge-triggered under the control of the second CPU, thereby controlling the on / off state of the second MOS gate circuit;
[0047] The second MOS gate circuit is configured to be turned on or off under the control of the second flip-flop, and to input the output signal to the non-inverting input of the second comparator;
[0048] The second comparator is configured to compare the signal at the non-inverting input terminal and the signal at the inverting input terminal, and feed back the third comparison result or the fourth comparison result to the second FPGA; wherein the signal at the inverting input terminal is the output signal of the second transformer.
[0049] In one exemplary embodiment, the ground terminal of the 555 oscillator is jointly controlled by the output of the soft-start module and the first output terminal of the third transformer;
[0050] The trigger pin of the 555 oscillator is controlled by the output of the magnetic amplifier.
[0051] This application provides a watchdog detection method applied to the aforementioned safety watchdog circuit; comprising:
[0052] Each control module simultaneously sends a watchdog pulse signal at preset intervals; periodically compares the first command readback status received from the corresponding watchdog command readback module with the first command readback status sent by another control module. When the two are inconsistent, each control module switches to the safety side; periodically compares the first command readback status received from its own corresponding watchdog command readback module with a first preset value. When the two are inconsistent, each control module switches to the safety side; and sends the first command readback status received from the corresponding watchdog command readback module to another control module.
[0053] Each watchdog command readback module, upon receiving a watchdog feed pulse signal or during the idle interval between two adjacent watchdog feed pulse signals, performs watchdog command readback processing based on the feed pulse signal and feeds back the first command readback status as the readback processing result to the corresponding control module.
[0054] In one exemplary embodiment, each control module issues a control signal during the idle interval between two adjacent watchdog pulse signals; periodically compares the received second command readback status from the corresponding watchdog command readback module with the second command readback status sent by another control module; when the two are inconsistent, each control module switches to the safety side; periodically compares the second command readback status from its own corresponding watchdog command readback module with a second preset value; when the two are inconsistent, each control module switches to the safety side; and sends the received second command readback status from the corresponding watchdog command readback module to another control module.
[0055] Each watchdog command readback module performs watchdog command readback processing according to the control signal, and feeds back the second command readback status as the readback processing result to the corresponding control module.
[0056] This application has the following advantages:
[0057] At least one embodiment of this application adds a slow-start circuit and a status readback function for the slow-start circuit.
[0058] In one implementation of this application, the slow-start circuit controls the 555 oscillator in the watchdog circuit, and at the same time, the output coil of the third transformer after the 555 timer loops back to control the 555 oscillator, thereby achieving self-locking of the slow-start function.
[0059] At least one embodiment of this application adds a post-stage energy storage circuit to realize a non-continuous dog-feeding pulse with an interval controlled by the CPU, thereby solving the solidification problem.
[0060] At least one embodiment of this application implements soft-start circuit state readback, watchdog command circuit readback, watchdog command readback comparison circuit detection, and watchdog state readback.
[0061] Of course, any product implementing this application does not necessarily need to achieve all of the advantages described above at the same time.
[0062] Other features and advantages of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the application. Other advantages of this application can be realized and obtained by means of the solutions described in the description and the accompanying drawings. Attached Figure Description
[0063] The accompanying drawings are used to provide an understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.
[0064] Figure 1 This is a schematic diagram of a watchdog circuit and detection circuit in the prior art;
[0065] Figure 2 This is a schematic diagram of a watchdog circuit and detection circuit according to an embodiment of this application;
[0066] Figure 3 This is a schematic diagram of another watchdog circuit and detection circuit according to an embodiment of this application;
[0067] Figure 4 for Figure 3 The circuit shown is a schematic diagram of the CPU dog-feeding pulse timing. Detailed Implementation
[0068] Figure 2 This is a schematic diagram of a watchdog circuit and detection circuit according to an embodiment of this application, as shown below. Figure 2 As shown, a security watchdog circuit in this embodiment includes two control modules and two watchdog command readback modules; each control module corresponds to one watchdog command readback module;
[0069] Each control module is configured to simultaneously send a watchdog pulse signal at preset intervals; periodically compare the first command readback status received from the corresponding watchdog command readback module with the first command readback status sent by another control module; when the two are inconsistent, each control module switches to the safety side; periodically compare the first command readback status received from its own corresponding watchdog command readback module with a first preset value; when the two are inconsistent, each control module switches to the safety side; and send the first command readback status received from the corresponding watchdog command readback module to another control module.
[0070] Each watchdog command readback module is configured to perform watchdog command readback processing based on the feeding pulse signal when it receives the watchdog pulse signal or during the idle interval between two adjacent watchdog pulse signals, and feed back the first command readback status as the readback processing result to the corresponding control module.
[0071] Each control module sends a watchdog pulse signal and then performs two comparisons. The first comparison is between the command readback status and the expected value. If they do not match, the control module redirects to the safety side. The second comparison involves the two control modules exchanging command readback statuses and comparing whether the command readback statuses received by the two control modules from the watchdog command readback module are consistent. If they do not match, the control module redirects to the safety side.
[0072] In one exemplary embodiment, each control module is further configured to issue a control signal during the idle interval between two adjacent watchdog pulse signals; periodically compare the received second command readback status fed back by the corresponding watchdog command readback module with the second command readback status sent by another control module; when the two are inconsistent, each control module directs to the safety side; periodically compare the second command readback status fed back by its own corresponding watchdog command readback module with a second preset value; when the two are inconsistent, each control module directs to the safety side; and send the received second command readback status fed back by the corresponding watchdog command readback module to another control module.
[0073] Each watchdog command readback module is configured to perform watchdog command readback processing based on the control signal, and feed back the second command readback status as the readback processing result to the corresponding control module.
[0074] In one exemplary embodiment, the security watchdog circuit further includes a soft-start module;
[0075] The slow-start module is configured to generate a dog-feeding pulse signal within a preset slow-start time after the safety watchdog circuit is powered on.
[0076] In one exemplary embodiment, each control module is configured to read back the state of the slow-start module within a preset readback time after power-on, to ensure that the slow-start module only takes effect once.
[0077] The state of the soft-start module can be high during the soft-start time, after which the CPU can continue execution; and low after the soft-start time is exceeded, after which the CPU locks down.
[0078] In one exemplary embodiment, the two control modules include a first control module and a second control module;
[0079] The safety watchdog circuit also includes an AC signal generation module, a DC signal generation module, a watchdog voltage generation module, a first readback circuit, and a second readback circuit;
[0080] The AC signal generating module is configured to amplify the first dog-feeding pulse signal and generate an AC signal based on the amplified first dog-feeding pulse signal; wherein the first dog-feeding pulse signal is the dog-feeding pulse signal generated by the first control module.
[0081] The DC signal generation module is configured to amplify the second dog-feeding pulse signal and generate a DC signal based on the amplified second dog-feeding pulse signal; wherein the second dog-feeding pulse signal is the dog-feeding pulse signal generated by the second control module.
[0082] The watchdog voltage generation module is configured to construct a safety AND gate from the received AC signal and the DC signal, and generate a watchdog voltage based on the output of the safety AND gate.
[0083] The first readback circuit is configured to input the state of the watchdog voltage to the first control module;
[0084] The second readback circuit is configured to input the state of the watchdog voltage to the second control module;
[0085] The first control module and the second control module are also configured to send the status of the watchdog voltage they receive to another control module, and periodically compare the status of the received watchdog voltage. When the two are inconsistent, both the first control module and the second control module will switch to the safety side.
[0086] The watchdog voltage generated from the output of the safety AND gate can be generated by the safety AND gate output together with the subsequent 555 oscillator and the third transformer.
[0087] The reason for the periodic comparison is that the first and second control modules are executed in threads, and querying the status takes a certain amount of time. In order to allow the first and second control modules to compare at the same time, the period is about 20ms.
[0088] In one exemplary embodiment, the first watchdog command readback module includes a first comparator, and the second watchdog command readback module includes a second comparator;
[0089] The first watchdog command readback module is specifically configured to output a first reference voltage when the first control module sends a first watchdog pulse signal; a first comparator compares the first reference voltage with the output signal of the AC signal generation module, and sends the first comparison result as a first command readback status to the first control module for readback confirmation;
[0090] The first watchdog command readback module is further configured to output a first readback voltage after the first control module issues a first feed pulse signal and when the first control module issues a control signal; a first comparator compares a second reference voltage with the first readback voltage and sends the second comparison result as a second command readback status to the first control module for readback confirmation; wherein, the first readback voltage may have different comparison results with the second reference voltage when the first watchdog command readback module is in different states; the second reference voltage is the output of the AC signal generated according to the control signal;
[0091] The second watchdog command readback module is specifically configured to output a third reference voltage when the second control module sends a second watchdog pulse signal; the second comparator compares the third reference voltage with the output signal of the DC signal generation module, and sends the third comparison result to the second control module for readback confirmation;
[0092] The second watchdog command readback module is further configured to output a second readback voltage after the second control module issues a second feed pulse signal and when the second control module issues a control signal; the second comparator compares the fourth reference voltage with the second readback voltage and sends the fourth comparison result to the second control module for readback confirmation; wherein, the comparison result of the second readback voltage with the fourth reference voltage may be different when the second watchdog command readback module is in different states.
[0093] Specifically, the first comparison result and the third comparison result correspond to the first command readback state of each of the two watchdog command readback modules mentioned above. The second comparison result and the fourth comparison result correspond to the second command readback state of each of the two watchdog command readback modules mentioned above.
[0094] The first reference voltage enables the trigger to turn on the MOSFET after the watchdog timer pulse is emitted. The voltage divider circuit in the circuit generates the reference voltage, approximately 1.025V. When the MOSFET is off, the reference voltage generated by the voltage divider circuit is 1.385V. When there is no watchdog signal, the voltage generated by the watchdog data line is 1.19V. Comparing this voltage with the two voltages mentioned above, it falls within the aforementioned voltage range, resulting in comparators showing 1 and 0 respectively, indicating that the comparator circuit is functioning correctly.
[0095] The first comparison result can be obtained by turning the trigger on and off separately when the dog is not fed, so that the comparison circuit outputs 1 or 0 respectively within a narrow voltage range, which meets the expectation.
[0096] The second watchdog command readback module has the same function as the first watchdog command readback module, therefore, the voltage is also the same.
[0097] The third comparison result can be obtained by turning the trigger on and off separately when the watchdog is not fed, allowing the comparison circuit to output 1 or 0 respectively within a narrow voltage range, thus meeting the expectation. In an exemplary embodiment, the soft-start module is connected to the watchdog voltage generation module;
[0098] The soft-start module is further configured to control the watchdog voltage generating module to be in working state for a preset soft-start time, and to not control the watchdog voltage generating module after the preset soft-start time expires.
[0099] In one exemplary embodiment, the dog-feeding pulse signal comprises a first number of continuous pulse signals, each pulse signal having a duration of a preset duration.
[0100] The initial quantity can be 8. The preset duration can be 120us.
[0101] In one exemplary embodiment, the first control module includes a first CPU and a first FPGA chip; the second control module includes a second CPU and a second FPGA chip.
[0102] The AC signal generation module includes a first drive circuit and a first transformer;
[0103] The DC signal generation module includes a second drive circuit and a second transformer;
[0104] The watchdog voltage generation module includes a magnetic amplifier, a 555 oscillator, a third transformer, an energy storage circuit, and an LDO circuit; the magnetic amplifier includes an AC coil, a control coil, and an output coil.
[0105] The first driving circuit is configured to amplify the first dog-feeding pulse signal; the first transformer is configured to generate an AC signal based on the first dog-feeding pulse signal and input the AC signal to the AC coil of the magnetic amplifier.
[0106] The second driving circuit is configured to amplify the second dog-feeding pulse signal; the second transformer is configured to generate a DC signal according to the second dog-feeding pulse signal and input the DC signal to the control coil of the magnetic amplifier.
[0107] The magnetic amplifier is configured to form a safe AND gate with the received AC signal and the DC signal, and output a third pulse signal through the output coil;
[0108] The 555 oscillator is configured to output a fourth signal under the control of the third pulse signal, and input the fourth signal to the input terminal of the third transformer.
[0109] The first output terminal of the third transformer is connected to the ground terminal of the 555 oscillator.
[0110] The second output terminal of the third transformer is connected to the energy storage circuit and the LDO circuit.
[0111] The energy storage circuit and LDO circuit are configured to be designed based on the output of the second output terminal of the third transformer; the energy storage circuit controls the LDO circuit to generate a watchdog voltage and outputs the watchdog voltage.
[0112] The 555 oscillator generates oscillation pulses, which control the conduction of the subsequent MOSFET, thus producing a stable AC oscillation signal in the transformer coil. The input of the 555 oscillator is the output of a safety AND gate, and its output is the input of the third transformer, used to control the transformer's output voltage.
[0113] The input terminal of the third transformer can be the N1 coil of the third transformer. The first output terminal of the third transformer can be the N4 coil of the third transformer. The second output terminal of the third transformer can be the N5 coil of the third transformer.
[0114] LDO (Low Dropout Regulator) stands for Low Dropout Linear Regulator, which can be considered as a power supply module that generates regulated voltage.
[0115] In one exemplary embodiment, the two watchdog command readback modules include a first watchdog command readback module and a second watchdog command readback module;
[0116] The first watchdog command readback module includes a first flip-flop and a first MOS gate circuit;
[0117] The second watchdog command readback module includes a second flip-flop and a second MOS gate circuit;
[0118] The first flip-flop is configured to be edge-triggered under the control of the first CPU, thereby controlling the on / off state of the first MOS gate circuit;
[0119] The first MOS gate circuit is configured to be turned on or off under the control of the first flip-flop, and the output signal is input to the non-inverting input terminal of the first comparator;
[0120] The first comparator is configured to compare the signal at the non-inverting input terminal and the signal at the inverting input terminal, and feed back the first comparison result or the second comparison result to the first FPGA; wherein, the signal at the inverting input terminal is the output signal of the first transformer;
[0121] The second flip-flop is configured to be edge-triggered under the control of the second CPU, thereby controlling the on / off state of the second MOS gate circuit;
[0122] The second MOS gate circuit is configured to be turned on or off under the control of the second flip-flop, and to input the output signal to the non-inverting input of the second comparator;
[0123] The second comparator is configured to compare the signal at the non-inverting input terminal and the signal at the inverting input terminal, and feed back the third comparison result or the fourth comparison result to the second FPGA; wherein the signal at the inverting input terminal is the output signal of the second transformer.
[0124] The first CPU output can be an edge signal that transitions from low to high or from high to low. After the first flip-flop is triggered, it outputs a control voltage to control the MOS gate circuit to turn on or off. The output of the first MOS gate circuit can be used as the reference voltage for the comparator.
[0125] The first comparison result can refer to the comparison result with the reference voltage, where 1 is given if the voltage is higher than the reference voltage and 0 is given if the voltage is lower than the reference voltage.
[0126] The second CPU output can be an edge signal that transitions from low to high or from high to low. After the second flip-flop is triggered, it outputs a control voltage to control the MOS gate circuit to turn on or off. The output of the second MOS gate circuit can be used as the reference voltage for a comparator.
[0127] In one exemplary embodiment, the ground terminal of the 555 oscillator is jointly controlled by the output of the soft-start module and the first output terminal of the third transformer;
[0128] The trigger pin of the 555 oscillator is controlled by the output of the magnetic amplifier.
[0129] This application embodiment reads back to confirm whether the watchdog pulse is accurately output when the watchdog is being fed, and uses dynamic detection to confirm whether the comparison circuit is working properly when the watchdog is not being fed. This provides more comprehensive detection of the watchdog circuit and improves its security.
[0130] In one exemplary embodiment, the watchdog circuit adds a soft-start circuit and a soft-start circuit status readback function. The soft-start circuit controls the 555 oscillator in the watchdog circuit, and at the same time, the output coil of the third transformer after the 555 timer loops back to control the 555 oscillator, thereby realizing the self-locking of the soft-start function.
[0131] In one exemplary embodiment, a post-stage energy storage circuit is designed to implement a non-continuous dog-feeding pulse with intervals controlled by the CPU, thereby solving the solidification problem.
[0132] In one exemplary embodiment, the watchdog detection system includes four levels of detection: readback of the soft-start circuit status, readback of the watchdog command circuit, comparison circuit detection of the watchdog command readback, and multiple detections such as watchdog status readback.
[0133] This application also provides a watchdog detection method, applied to the security watchdog circuit described above;
[0134] Each control module simultaneously sends a watchdog pulse signal at preset intervals; periodically compares the first command readback status received from the corresponding watchdog command readback module with the first command readback status sent by another control module. When the two are inconsistent, each control module switches to the safety side; periodically compares the first command readback status received from its own corresponding watchdog command readback module with a first preset value. When the two are inconsistent, each control module switches to the safety side; and sends the first command readback status received from the corresponding watchdog command readback module to another control module.
[0135] Each watchdog command readback module, upon receiving a watchdog feed pulse signal or during the idle interval between two adjacent watchdog feed pulse signals, performs watchdog command readback processing based on the feed pulse signal, and feeds back the first command readback status as the readback processing result to the corresponding control module.
[0136] In one exemplary embodiment, each control module issues a control signal during the idle interval between two adjacent watchdog pulse signals; periodically compares the received second command readback status from the corresponding watchdog command readback module with the second command readback status sent by another control module; when the two are inconsistent, each control module switches to the safety side; periodically compares the second command readback status from its own corresponding watchdog command readback module with a second preset value; when the two are inconsistent, each control module switches to the safety side; and sends the received second command readback status from the corresponding watchdog command readback module to another control module.
[0137] Each watchdog command readback module performs watchdog command readback processing according to the control signal, and feeds back the second command readback status as the readback processing result to the corresponding control module.
[0138] In one exemplary embodiment, each control module reads back the status of the slow-start module within a preset readback time after power-on to ensure that the slow-start module only takes effect once.
[0139] Figure 3 A schematic diagram of another watchdog circuit and detection circuit according to an embodiment of this application is shown. Figure 3 It includes two control systems (corresponding to the control modules mentioned above), a watchdog control circuit and an output status readback circuit, a watchdog command readback circuit, and a watchdog slow-start circuit. The watchdog control circuit and output status readback circuit include: CPU1 and CPU2, FPGA1 and FPGA2, a first drive circuit and a second drive circuit, a first transformer and a second transformer, a magnetic amplifier, a 555 oscillator, a third transformer, an energy storage circuit and an LDO circuit, a first readback circuit and a second readback circuit.
[0140] Figure 3 middle:
[0141] 1 and 1' are readbacks of the soft start state;
[0142] 2 and 2' represent the watchdog command readback status;
[0143] 3 and 3' are the watchdog feed pulse signals generated by the CPU; see timing diagram below. Figure 4 ;
[0144] 4 and 4' are the inverting inputs of the comparator;
[0145] 5 and 5' are the non-inverting inputs of the comparator;
[0146] 6 is the AC input coil N2 of the magnetic amplifier;
[0147] 7 is the DC input coil N3 of the magnetic amplifier;
[0148] 8 is the output coil of the magnetic amplifier, N1 is the enable input pin of the 555 oscillator;
[0149] 9 is the GND of the 555 oscillator;
[0150] 10 is the output coil N4 of the third transformer;
[0151] 11 is the output coil N5 of the third transformer;
[0152] The watchdog command readback circuit includes: CPU1 and CPU2, FPGA1 and FPGA2, a first driving circuit and a second driving circuit, a first transformer and a second transformer, a first flip-flop circuit and a second flip-flop circuit, a first MOS gate circuit and a second MOS gate circuit, a first comparator and a second comparator.
[0153] The watchdog timer circuit includes: CPU1 and CPU2, the timer circuit, and a 555 oscillator.
[0154] The first control system consists of CPU1 and FPGA1, and the second control system consists of CPU2 and FPGA2.
[0155] The principle of the watchdog circuit and output status readback circuit is explained using the first control system as an example. CPU1 sends a watchdog pulse to trigger the first drive circuit. The first drive circuit inputs the amplified watchdog pulse signal to the first transformer and generates an oscillating AC signal. This AC signal serves as the input to the AC coil N2 of the magnetic amplifier. The second transformer circuit generates a DC signal as the input to the control coil N3 of the magnetic amplifier. The AC coil input N2 and the control coil input N3 of the magnetic amplifier form a safety AND gate, outputting a stable pulse signal on the output coil N1 side of the magnetic amplifier. This signal controls the operation of the subsequent 555 oscillator. The oscillator output is driven by the N1 coil of the third transformer. The N4 coil of the third transformer loops back to the GND terminal of the 555 oscillator. The N5 coil of the third transformer is the output coil. An energy storage circuit is designed on the N5 coil side to control the LDO power supply to generate a 5V watchdog output. Its status is read back by CPU1 and CPU2 respectively through the readback circuit. The first control system and the second control system periodically compare the output status readbacks. If they are inconsistent,
[0156] The principle of the watchdog command readback circuit is explained using the first control system as an example. CPU1 controls the first flip-flop to trigger on an edge via digital output, controlling the closing or opening of the first MOS gate circuit. The output of the first MOS circuit serves as the non-inverting input of the first comparator, while the output signal of the first transformer in the watchdog control circuit serves as the inverting input of the first comparator. After comparison by the first comparator, the FPGA1 reads back the command readback state, which is the command readback state. The watchdog readback circuit of the second control system operates on the same principle. The first and second control systems periodically compare the command readback states. When they are inconsistent, both the first and second control systems switch to the safety side.
[0157] The watchdog timer start circuit operates on the following principle: the start time can be controlled by adjusting the capacitor in the circuit, and is generally set within 5 seconds. Both CPU1 and CPU2 should generate a watchdog feed pulse signal within the start time. If either CPU fails to feed the watchdog on time, the watchdog circuit will not function. The watchdog timer start circuit has a readback function; both CPU1 and CPU2 read back the watchdog timer start status 1 and 1' 5 seconds after power-on, ensuring that the timer start circuit only takes effect once. During the timer start phase, the timer start circuit generates a negative voltage to control the GND terminal of the 555 oscillator, putting it in working condition. After the specified timer start expires, this negative voltage is no longer effective, and the 555 oscillator is no longer controllable by the timer start circuit.
[0158] The principles of other key circuits are as follows:
[0159] CPU1 and CPU2 generate watchdog pulse signals, sending a set of watchdog pulses every 30ms. The high level of the pulse is about 6~7us, and the low level is about 7~8us. A set of watchdog pulses consists of 8 consecutive pulse signals, lasting about 120us. Figure 3 As shown.
[0160] The first and second drive circuits amplify the dog-feed pulse signal generated by the CPU and use it as the input to the subsequent transformer.
[0161] The first and second transformers adjust the output voltage, which serves as the input to the subsequent magnetic amplifier. The first transformer generates an AC signal, which is used as the input to the AC coil N2 of the magnetic amplifier. The second transformer circuit generates a DC signal, which is used as the input to the control coil N3 of the magnetic amplifier. The magnetic amplifier output is only valid when both are active, thus forming a safety AND gate.
[0162] The 555 oscillator is controlled by three inputs: the output of the soft-start circuit, the output of the magnetic amplifier, and the N4 coil of the third transformer. The output of the soft-start circuit and the N4 coil of the third transformer jointly control the GND pin of the 555 oscillator, generating a negative voltage signal. The output of the magnetic amplifier controls the trigger pin of the 555 oscillator. During power-on startup, the GND pin of the 555 oscillator is driven by the negative voltage generated by the soft-start circuit. After the magnetic amplifier is triggered, it drives the N1 coil of the third transformer, simultaneously inducing a negative voltage in the N4 coil to supply power to the GND pin of the 555 oscillator, allowing the oscillator to continue operating even if the soft-start circuit fails. If the watchdog circuit malfunctions, causing the output of the preceding magnetic amplifier to shut down, the 555 oscillator will stop working, and the N4 coil of the third transformer will also stop outputting. In this case, manual intervention is required to re-power the circuit, allowing the soft-start circuit to trigger the watchdog circuit again, ensuring system safety.
[0163] The energy storage circuit and LDO circuit store energy by adding a capacitor to the output coil N5 of the third transformer and control the LDO DC-DC output to 5V. The generated 5V is the output of the watchdog timer.
[0164] The 5V output status of the watchdog timer is isolated and then collected by CPU1 and CPU2 through the first and second readback circuits to confirm the watchdog timer status.
[0165] The first flip-flop circuit is triggered by CPU1 and is used to control the on and off of the subsequent MOSFET during the watchdog command readback phase. The second flip-flop circuit operates on the same principle as the first.
[0166] The first MOS gate circuit is turned on and off by the trigger signal of the first flip-flop to perform watchdog command readback tests. The second MOS gate circuit operates on the same principle as the first MOS gate circuit.
[0167] Watchdog command circuit testing process: The testing of the watchdog command circuit includes two stages: detection when the watchdog pulse is issued and detection during the interval between watchdog pulses.
[0168] During the dog feed pulse phase, the dog feed pulse drives the first transformer to output a pulse signal. When the pulse is high, the inverting input of the first comparator is high. At this time, the non-inverting input is used as a reference voltage for comparison, and the comparison result is read back and confirmed by FPGA1.
[0169] During the watchdog timer pulse interval, the voltage at the inverting input of the first comparator is a fixed value, serving as a reference voltage. At this time, the CPU controls the first flip-flop to control the opening and closing of the first MOSFET, thereby controlling the voltage change at the non-inverting input of the aforementioned comparator, making it compare with the voltage at the inverting input. When the MOSFET is closed, the voltage at the inverting input is less than that at the non-inverting input; when the MOSFET is open, the voltage at the inverting input is greater than that at the non-inverting input. By dynamically controlling the closing of the MOSFET, the normal operation of the watchdog command circuit is confirmed.
[0170] The core function of a security watchdog is to ensure security. This application improves the security of the security watchdog through multiple means. Specifically:
[0171] This application detects the watchdog pulse command status, including detection during the issuance of the watchdog pulse and detection during the gap between watchdog pulses, as well as detection of the watchdog's output status. Specifically, the watchdog pulse detection checks whether the watchdog pulse is actually output; the detection during the gap between watchdog pulses uses a dynamic control method to detect whether the comparator circuit is working properly. This provides a more comprehensive detection of the watchdog circuit, allowing for accurate fault location and facilitating on-site maintenance and repair. Furthermore, by adding detection points, the safety of the watchdog circuit is improved.
[0172] A soft-start circuit and a soft-start circuit readback function have been added to the safety watchdog circuit. The soft-start circuit controls the time when the watchdog is fed after power-on and ensures that it is triggered only once each time power is on, thus improving its safety.
[0173] The watchdog feed pulse is a periodic pulse triggered by the CPU. It is a non-continuous pulse, which avoids the risk of the feed pulse becoming fixed and improves security.
[0174] This application describes several embodiments, but these descriptions are exemplary and not restrictive, and it will be apparent to those skilled in the art that many more embodiments and implementations are possible within the scope of the embodiments described herein. Although many possible combinations of features are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with, or may replace, any feature or element of any other embodiment.
[0175] Any feature shown and / or discussed in this application may be implemented individually or in any suitable combination.
[0176] Furthermore, in describing representative embodiments, the specification may have presented methods and / or processes as a specific sequence of steps. However, the method or process should not be limited to the specific order of steps described herein, to the extent that it does not depend on such a specific order. Other sequences of steps are possible, as will be understood by those skilled in the art.
[0177] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.
Claims
1. A safety watchdog circuit, characterized in that, The security watchdog circuit includes two control modules and two watchdog command readback modules; each control module corresponds to one watchdog command readback module. Each control module is configured to simultaneously send a watchdog pulse signal at preset intervals; periodically compare the first command readback status received from the corresponding watchdog command readback module with the first command readback status sent by another control module; when the two are inconsistent, each control module switches to the safety side; periodically compare the first command readback status received from its own corresponding watchdog command readback module with a first preset value; when the two are inconsistent, each control module switches to the safety side; and send the first command readback status received from the corresponding watchdog command readback module to another control module. Each watchdog command readback module is configured to perform watchdog command readback processing based on the feeding pulse signal when it receives the watchdog pulse signal or during the idle interval between two adjacent watchdog pulse signals, and feed back the first command readback status as the readback processing result to the corresponding control module. The two control modules include a first control module and a second control module; The security watchdog circuit also includes an AC signal generation module and a DC signal generation module; The AC signal generating module is configured to amplify the first dog-feeding pulse signal and generate an AC signal based on the amplified first dog-feeding pulse signal; wherein the first dog-feeding pulse signal is the dog-feeding pulse signal generated by the first control module. The DC signal generation module is configured to amplify the second dog-feeding pulse signal and generate a DC signal based on the amplified second dog-feeding pulse signal; wherein the second dog-feeding pulse signal is the dog-feeding pulse signal generated by the second control module. The two watchdog command readback modules include a first watchdog command readback module and a second watchdog command readback module; The first watchdog command readback module includes a first comparator, and the second watchdog command readback module includes a second comparator. The first watchdog command readback module is specifically configured to output a first reference voltage when the first control module sends a first watchdog pulse signal; a first comparator compares the first reference voltage with the output signal of the AC signal generation module, and sends the first comparison result as a first command readback status to the first control module for readback confirmation; The first watchdog command readback module is further configured to output a first readback voltage after the first control module issues a first feed pulse signal and when the first control module issues a control signal; a first comparator compares a second reference voltage with the first readback voltage and sends the second comparison result as a second command readback status to the first control module for readback confirmation; wherein, the first readback voltage may have different comparison results with the second reference voltage when the first watchdog command readback module is in different states; the second reference voltage is the output of the AC signal generated according to the control signal; The second watchdog command readback module is specifically configured to output a third reference voltage when the second control module sends a second watchdog pulse signal; the second comparator compares the third reference voltage with the output signal of the DC signal generation module, and sends the third comparison result to the second control module for readback confirmation; The second watchdog command readback module is further configured to output a second readback voltage after the second control module issues a second feed pulse signal and when the second control module issues a control signal; the second comparator compares the fourth reference voltage with the second readback voltage and sends the fourth comparison result to the second control module for readback confirmation; wherein, the comparison result of the second readback voltage with the fourth reference voltage may be different when the second watchdog command readback module is in different states.
2. The security watchdog circuit as described in claim 1, characterized in that, Each control module is also configured to issue a control signal during the idle interval between two adjacent watchdog pulse signals; periodically compare the second command readback status received from the corresponding watchdog command readback module with the second command readback status sent by another control module; when the two are inconsistent, each control module switches to the safety side; periodically compare the second command readback status received from its own corresponding watchdog command readback module with a second preset value; when the two are inconsistent, each control module switches to the safety side; and send the second command readback status received from the corresponding watchdog command readback module to another control module. Each watchdog command readback module is configured to perform watchdog command readback processing based on the control signal, and feed back the second command readback status as the readback processing result to the corresponding control module.
3. The security watchdog circuit as described in claim 2, characterized in that, The security watchdog circuit also includes a soft-start module; The slow-start module is configured to control each control module to generate a dog-feeding pulse signal within a preset slow-start time after the safety watchdog circuit is powered on.
4. The security watchdog circuit as described in claim 3, characterized in that, Each control module is configured to read back the status of the slow-start module within a preset readback time after power-on, to ensure that the slow-start module only takes effect once.
5. The security watchdog circuit as described in claim 4, characterized in that, The safety watchdog circuit also includes a watchdog voltage generation module, a first readback circuit, and a second readback circuit; The watchdog voltage generation module is configured to construct a safety AND gate from the received AC signal and the DC signal, and generate a watchdog voltage based on the output of the safety AND gate. The first readback circuit is configured to input the state of the watchdog voltage to the first control module; The second readback circuit is configured to input the state of the watchdog voltage to the second control module; The first control module and the second control module are also configured to send the status of the watchdog voltage they receive to another control module, and periodically compare the status of the received watchdog voltage. When the two are inconsistent, both the first control module and the second control module will switch to the safety side.
6. The security watchdog circuit as described in claim 5, characterized in that, The soft-start module is connected to the watchdog voltage generation module; The soft-start module is further configured to control the watchdog voltage generating module to be in working state for a preset soft-start time, and to not control the watchdog voltage generating module after the preset soft-start time expires.
7. The security watchdog circuit as described in claim 1, characterized in that, The dog-feeding pulse signal includes a first number of continuous pulse signals, and the duration of each pulse signal is a preset duration.
8. The security watchdog circuit as described in claim 6, characterized in that, The first control module includes a first CPU and a first FPGA chip; the second control module includes a second CPU and a second FPGA chip. The AC signal generation module includes a first drive circuit and a first transformer; The DC signal generation module includes a second drive circuit and a second transformer; The watchdog voltage generation module includes a magnetic amplifier, a 555 oscillator, a third transformer, an energy storage circuit, and an LDO circuit; the magnetic amplifier includes an AC coil, a control coil, and an output coil. The first driving circuit is configured to amplify the first dog-feeding pulse signal; the first transformer is configured to generate an AC signal based on the first dog-feeding pulse signal and input the AC signal to the AC coil of the magnetic amplifier. The second driving circuit is configured to amplify the second dog-feeding pulse signal; The second transformer is configured to generate a DC signal based on the second dog-feeding pulse signal and input the DC signal to the control coil of the magnetic amplifier; The magnetic amplifier is configured to form a safe AND gate with the received AC signal and the DC signal, and output a third pulse signal through the output coil; The 555 oscillator is configured to output a fourth signal under the control of the third pulse signal, and input the fourth signal to the input terminal of the third transformer. The first output terminal of the third transformer is connected to the ground terminal of the 555 oscillator. The second output terminal of the third transformer is connected to the energy storage circuit and the LDO circuit. The energy storage circuit and LDO circuit are configured to be designed based on the output of the second output terminal of the third transformer; the energy storage circuit controls the LDO circuit to generate a watchdog voltage and outputs the watchdog voltage.
9. The security watchdog circuit as described in claim 8, characterized in that, The two watchdog command readback modules include a first watchdog command readback module and a second watchdog command readback module; The first watchdog command readback module includes a first flip-flop and a first MOS gate circuit; The second watchdog command readback module includes a second flip-flop and a second MOS gate circuit; The first flip-flop is configured to be edge-triggered under the control of the first CPU, thereby controlling the on / off state of the first MOS gate circuit; The first MOS gate circuit is configured to be turned on or off under the control of the first flip-flop, and the output signal is input to the non-inverting input terminal of the first comparator; The first comparator is configured to compare the signal at the non-inverting input terminal and the signal at the inverting input terminal, and feed back the first comparison result or the second comparison result to the first FPGA; wherein, the signal at the inverting input terminal is the output signal of the first transformer; The second flip-flop is configured to be edge-triggered under the control of the second CPU, thereby controlling the on / off state of the second MOS gate circuit; The second MOS gate circuit is configured to be turned on or off under the control of the second flip-flop, and to input the output signal to the non-inverting input of the second comparator; The second comparator is configured to compare the signal at the non-inverting input terminal and the signal at the inverting input terminal, and feed back the third comparison result or the fourth comparison result to the second FPGA; wherein the signal at the inverting input terminal is the output signal of the second transformer.
10. The security watchdog circuit as described in claim 9, characterized in that, The grounding terminal of the 555 oscillator is jointly controlled by the output of the slow-start module and the first output terminal of the third transformer; The trigger pin of the 555 oscillator is controlled by the output of the magnetic amplifier.
11. A watchdog detection method, characterized in that, The security watchdog circuit applied to any one of claims 1-10 above; Each control module simultaneously sends a watchdog pulse signal at preset intervals; periodically compares the first command readback status received from the corresponding watchdog command readback module with the first command readback status sent by another control module. When the two are inconsistent, each control module switches to the safety side; periodically compares the first command readback status received from its own corresponding watchdog command readback module with a first preset value. When the two are inconsistent, each control module switches to the safety side; and sends the first command readback status received from the corresponding watchdog command readback module to another control module. Each watchdog command readback module, upon receiving a watchdog feed pulse signal or during the idle interval between two adjacent watchdog feed pulse signals, performs watchdog command readback processing based on the feed pulse signal, and feeds back the first command readback status as the readback processing result to the corresponding control module.
12. The watchdog detection method as described in claim 11, characterized in that, During the idle interval between two adjacent watchdog feed pulse signals, each control module sends a control signal; periodically compares the second command readback status received from the corresponding watchdog command readback module with the second command readback status sent by another control module; when the two are inconsistent, each control module switches to the safety side; periodically compares the second command readback status received from its own corresponding watchdog command readback module with a second preset value; when the two are inconsistent, each control module switches to the safety side; and sends the second command readback status received from the corresponding watchdog command readback module to another control module. Each watchdog command readback module performs watchdog command readback processing according to the control signal, and feeds back the second command readback status as the readback processing result to the corresponding control module.