Watchdog margin reset design method based on CPLD (Complex Programmable Logic Device)

Abstract

The invention belongs to the field of generator controller watchdog monitoring, and particularly relates to a watchdog margin reset design method based on a CPLD (Complex Programmable Logic Device), which comprises a watchdog chip, a digital signal processor and a programmable logic device, wherein the digital signal processor outputs a dog feeding signal to the watchdog chip in each period; when the watchdog chip does not detect a dog feeding signal in a timer period, a dog calling signal is sent to the digital signal processor and the programmable logic device; when the barking signal triggers NMI interruption in the digital signal processor, the digital signal processor requires to execute software reset through a preset code instruction; and when the barking signal does not trigger NMI interruption, the programmable logic device performs logic judgment and then forcibly resets the digital signal processor through the watchdog chip.

Description

Technical Field

[0001] The present invention relates to the field of generator controller watchdog monitoring, and in particular to a CPLD-based watchdog margin reset design method. Background Art

[0002] As the core component of the aviation power supply system, the aircraft generator controller is responsible for the power generation, voltage regulation, control, and protection of the power supply system during flight. Therefore, the safety and reliability of the generator controller itself are crucial to the flight safety of the aircraft. The main function of the watchdog is to prevent the generator controller from being stuck or having software errors during flight.

[0003] Taking the SM706T watchdog monitoring circuit as an example, when the CPU is working normally, a feeding signal (WDI signal) is output to SM706T to reset it at regular intervals. If the dog is not fed within the specified time, SM706T will output a barking signal (WD0 signal) to the CPU to reset the CPU, thereby resuming work and preventing the CPU from freezing.

[0004] On the JDSPF28335 platform, the commonly used watchdog reset implementation methods can be divided into the following two types:

[0005] Hard reset: Hard reset includes DSP built-in watchdog reset and external watchdog circuit reset. The reset method is to enable DSP RS reset pin to force reset DSP. The flowchart for implementing hard reset is as follows: Figure 1 As shown,

[0006] 1) The built-in watchdog of DSP is essentially a timer circuit, with the input as the dog feeding signal and the output connected to the RS reset pin inside the DSP. If the program runs away and the dog feeding signal stops, the watchdog will send a dog barking reset signal to the reset end of the DSP to force the DSP to reset. The disadvantage of the built-in watchdog of DSP is that it needs to be initialized. If the program runs away before the initialization and startup are completed or runs away after being disabled, the built-in watchdog of DSP will not be able to reset the system. In addition, the built-in watchdog of DSP adds a lot of uncertainty to the program, reducing reliability.

[0007] 2) Through the external watchdog circuit, if the program runs away and the feeding signal stops, the watchdog chip will send a barking signal. By associating the barking signal WDO pin with the RESET reset pin, the RESET pin of SM706T will eventually output a reset signal. The reset signal is directly connected to the RS reset pin of DSP, thereby forcing DSP to reset. The external watchdog circuit does not require initialization configuration and starts working when powered on, but watchdog chips such as SM706T cannot flexibly configure parameters.

[0008] Soft reset: The flowchart for implementing soft reset is as follows Figure 2 As shown in the figure, soft reset refers to the design method that the barking signal of the external watchdog chip enters the DSP NMI non-maskable interrupt, and the reset processing is performed inside the NMI interrupt. This method is currently commonly used in aviation electrical products. If the program runs away, the DSP will stop sending the dog feeding signal to the external watchdog chip. The watchdog chip sends a barking signal back to the DSP through the GPIO port to enter the NMI non-maskable interrupt set by the program, and the reset processing is performed in the NMI interrupt according to the code instruction requirements. The advantage of soft reset is that the NMI non-maskable interrupt can be flexibly reset according to the needs.

[0009] 3.2 Current shortcomings

[0010] Aviation electrical products have high reliability requirements, and the primary task is to ensure the necessary functions and performance of the products at all times during flight. Currently, on the DSP platform of aviation electrical products, a soft reset design method is often used in which the external watchdog chip barking signal enters the DSP NMI non-maskable interrupt, and the reset processing is performed in the NMI interrupt. However, there are exceptions where the soft reset does not work when the system crashes. For example, after the 28335 series chip is powered on, the CPU hangs due to occasional initialization errors in the XINTF module. The DSP stops feeding the dog and triggers the watchdog chip to bark. However, due to the CPU hang, it cannot correctly respond to the instructions in the NMI non-maskable interrupt to perform a DSP software reset. Therefore, the system cannot resume operation on its own. At this time, the system can only start normally after powering on again. The schematic diagram of this situation is shown in the figure Figure 3 For aircraft generator controllers, failure to reset will have serious adverse effects.

[0011] If only the hard reset processing method is used, the DSP built-in watchdog or external watchdog circuit is used to connect the RS reset pin of the DSP to force the DSP to reset. The difference from the soft reset through the NMI interrupt is that the hard reset will initialize the register. For the aircraft generator controller, initialization means the initialization and re-assignment of the state quantity such as the switch, which will cause the bus connection contactor to be disconnected and then attracted, which will cause a short power outage on the aircraft, which is undesirable during the flight. Summary of the invention

[0012] In order to solve the above problems, the present application provides a watchdog margin reset design method based on CPLD, comprising:

[0013] A watchdog chip, a digital signal processor and a programmable logic device; wherein the digital signal processor outputs a dog-feeding signal to the watchdog chip every cycle;

[0014] When the watchdog chip does not detect the dog feeding signal within a timer cycle, it sends a dog barking signal to the digital signal processor and programmable logic device;

[0015] When the dog barking signal triggers an NMI interrupt in the digital signal processor, the digital signal processor requires a software reset through a preset code instruction; when the dog barking signal does not trigger an NMI interrupt, the programmable logic device performs a logical judgment and then forces a reset on the digital signal processor through the watchdog chip.

[0016] Preferably, when the dog barking signal triggers an NMI interrupt in the digital signal processor, the digital signal processor also determines the soft reset count. When the soft reset count is less than 3, the digital signal processor requires a software reset to be performed through a preset code instruction, and the soft reset count is increased by 1. When the soft reset count is greater than or equal to 3, the software is locked according to the code instruction requirements and can only be unlocked through a manual GCS reset signal, and the soft reset count is cleared.

[0017] Preferably, when the dog barking signal does not trigger the NMI interrupt, the programmable logic device also determines the hard reset count. When the hard reset count is less than 3, the programmable logic device forces a reset on the digital signal processor through the watchdog chip. When the hard reset count is greater than or equal to 3, the programmable logic device locks the reset function and can only power on again to clear the hard reset count.

[0018] Preferably, the logic judgment specifically includes: when the programmable logic device receives the dog barking signal for a certain detection time, it is judged that the dog barking signal does not trigger the NMI interrupt.

[0019] Preferably, the specific process of the programmable logic device forcing a reset on the digital signal processor through the watchdog chip includes: when the dog barking signal continues for a certain detection time, the programmable logic device causes the RESET pin output of the watchdog chip to change from a high level to a low level and then to a high level through the MR pin of the watchdog chip; and the RS reset pin of the digital signal processor triggers a forced reset after receiving a high level-low level-high level level conversion.

[0020] Preferably, when the RESET pin outputs a low level, the watchdog timer flag is cleared, and at this time, the dog feeding signal and the dog barking signal are normally high.

[0021] The advantages of this application include: if the product is working normally and a software error occurs, the NMI interrupt is used for soft reset processing first; if the NMI interrupt fails to respond, the CPLD internal software logic determines the output of a hard reset signal to directly force the DSP to reset. This design method can avoid the situation where the NMI interrupt does not respond to the dog barking signal and the product never resets, thereby improving the reliability and stability of the product.

[0022] Although forced resetting of the DSP will cause a short power outage on the machine, in the case of a fault in which the NMI interrupt fails to respond to the dog barking signal, the power supply system itself is already in a power-off state, and the system will always remain in a power-off state if no measures are taken. If the watchdog margin reset design based on CPLD proposed by the present invention is added, the DSP can be forced to reset under such conditions and the system can generate power again.

[0023] Through this design, the occasional initialization error of the DSP XINTF module of a series of generator controllers on the 28335 platform has been successfully solved after power-on, causing the CPU to hang, unable to correctly respond to the instructions in the NMI non-maskable interrupt to reset the DSP software, and the system cannot automatically recover from the operation failure. At the same time, it avoids the CPU hanging and the NMI interrupt does not respond during the use of the 28335 platform, causing the product to not reset. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a hard reset flow chart;

[0025] Figure 2 It is a soft reset flow chart;

[0026] Figure 3 This is a schematic diagram of the invalid soft reset situation;

[0027] Figure 4 This is the hardware circuit diagram of the watchdog margin reset design based on CPLD;

[0028] Figure 5 This is a design flow chart of watchdog margin reset based on CPLD;

[0029] Figure 6 It is the reset function logic in CPLD. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical scheme and advantages of the implementation of this application clearer, the technical scheme in the implementation of this application will be described in more detail in combination with the drawings in the implementation of this application. In the drawings, the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The described implementation is a part of the implementation of this application, not all of the implementations. The implementation described below with reference to the drawings is exemplary and is intended to be used to explain this application, and cannot be understood as a limitation on this application. Based on the implementation in this application, all other implementations obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. The implementation of this application is described in detail below in combination with the drawings.

[0031] On the DSP28335 platform, a watchdog margin reset design method based on CPLD is proposed. Based on the common design method of keeping the dog barking signal entering the NMI interrupt for reset processing, a hard reset design method based on CPLD is added to realize dual margin design. The design method is as follows.

[0032] a) Circuit hardware design

[0033] The hardware circuit design of the watchdog margin reset based on CPLD in the generator controller is as follows Figure 4 As shown, it is mainly composed of a digital signal processor (JDSPF28335), namely DSP, a watchdog chip (SM706T) and a programmable logic device (HWD570MCQFP144), namely CPLD, etc.

[0034] The watchdog chip (SM706T) will always monitor the watchdog's feeding input WDI. If the program runs away, the feeding signal stops, and SM706T does not detect the feeding signal within the watchdog's timer period (typical value 1.6s), the barking signal WDO will be triggered to output a low level, which will remain until the next feeding signal WDI arrives.

[0035] Connect the barking signal WDO of SM706T to the acquisition pin of CPLD. If the internal logic of CPLD determines that the hard reset condition is met, CPLD outputs a low-level CPLD_RST signal to the MR pin of SM706T. When the MR pin is low, the RESET pin will output a low level; after a delay (300ms) controlled by the internal software of CPLD, CPLD outputs a high-level CPLD_RST signal to the MR pin of SM706T, and the RESET pin will output a high level after a reset pulse width delay (typical value 200ms). The RS reset pin of DSP triggers a forced reset of DSP after receiving a high-low-high level conversion.

[0036] b) Design of watchdog margin reset based on CPLD

[0037] The design flow chart of watchdog margin reset based on CPLD is shown in Figure 5 .

[0038] First, the software runs at a cycle of 8ms when it is working normally, and outputs a dog-feeding signal every 8ms. If the software runs away or the program is stuck, the software will stop sending the dog-feeding signal. At this time, the external watchdog chip starts timing. If the dog-feeding signal is received within the timer cycle (typical value 1.6s), the watchdog chip starts a new round of timing; if the dog-feeding signal is not received within the timer cycle, the dog-barking signal is issued.

[0039] Secondly, if the dog barking signal triggers the NMI interrupt, the program first determines whether the soft reset count n in the NMI interrupt is less than 3. If n is less than 3, the software reset is performed according to the code instruction requirements, and the number of soft resets n=n+1 is recorded. After the software reset, a new round of dog feeding signal detection begins. If n is greater than or equal to 3, the software is locked according to the code instruction requirements and can only be unlocked by a manual GCS reset signal to clear the soft reset count.

[0040] Finally, the CPLD collects the dog barking signal and performs logical judgment. If the dog barking signal does not trigger the NMI interrupt within a certain detection time (that is, the dog barking signal always remains at a low level), the CPLD logic first determines whether the hard reset count m is less than 3. If m is less than 3, the CPLD delays 3S to output a low-level signal to the MR pin of the watchdog chip, and then outputs a high level after 300ms. The rising edge of the MR pin triggers the RESET pin to output a reset signal. The RESET pin is directly connected to the RS reset pin of the DSP, thereby triggering a forced reset of the DSP and recording the number of hard resets m=m+1. If m is greater than or equal to 3, the CPLD locks the reset function and can only power on to clear the hard reset count. The purpose of the hard reset count is to prevent the product from continuously resetting and causing the external contactor to keep closing.

[0041] The relevant logic for watchdog reset in CPLD is as follows Figure 6 shown.

[0042] In the watchdog margin reset design based on CPLD, the hard reset function based on CPLD logic judgment is only used as a margin backup. Only when the NMI interrupt fails to respond to the dog barking signal, the hard reset signal is output to force the DSP to reset. Figure 4 The hardware circuit shown is measured and analyzed. After artificially shielding the soft reset function in the NMI interrupt:

[0043] 1. After the dog barking signal lasts for 3 seconds, the CPLD output signal changes from high level to low level;

[0044] 2. The CPLD output signal is connected to the MR pin of the watchdog chip. When the MR pin is low, the RESERT pin is low. When the RESERT pin is low, the watchdog timer flag is cleared. At this time, the dog feeding signal and the dog barking signal are always high.

[0045] 3. The CPLD output signal remains at a low level for 300ms and then turns to a high level. The RESET pin will be pulled high after a reset pulse width (typical value 200ms) expires.

[0046] 4. The rising edge of the RESET pin triggers a forced reset of the DSP.

[0047] The present invention proposes a watchdog margin reset design method based on CPLD. If a software runaway or other fault occurs under normal product operation, soft reset processing is preferentially performed through NMI interruption; if a fault occurs in which the NMI interruption cannot respond, a hard reset signal is output based on the internal software logic judgment of the CPLD to directly force a DSP reset. This design method can avoid the situation in which the NMI interruption does not respond to the dog barking signal and the product is never reset, thereby improving the reliability and stability of the product.

[0048] Although forced resetting of the DSP will cause a short power outage on the machine, in the case of a fault in which the NMI interrupt fails to respond to the dog barking signal, the power supply system itself is already in a power-off state, and the system will always remain in a power-off state if no measures are taken. If the watchdog margin reset design based on CPLD proposed by the present invention is added, the DSP can be forced to reset under such conditions and the system can generate power again.

[0049] Through this design, the occasional initialization error of the DSP XINTF module of a series of generator controllers on the 28335 platform has been successfully solved after power-on, causing the CPU to hang, unable to correctly respond to the instructions in the NMI non-maskable interrupt to reset the DSP software, and the system cannot automatically recover from the operation failure. At the same time, it avoids the CPU hanging and the NMI interrupt does not respond during the use of the 28335 platform, causing the product to not reset.

[0050] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A watchdog margin reset design method based on CPLD, characterized in that: include: The watchdog margin reset circuit includes: a watchdog chip, a digital signal processor and a programmable logic device; wherein the digital signal processor outputs a dog feeding signal to the watchdog chip every cycle; the design method includes: When the watchdog chip does not detect the dog feeding signal within a timer cycle, it sends a dog barking signal to the digital signal processor and programmable logic device; When the dog barking signal triggers an NMI interrupt in the digital signal processor, the digital signal processor requires a software reset through a preset code instruction; when the dog barking signal does not trigger an NMI interrupt, the programmable logic device performs a logical judgment and then forces a reset on the digital signal processor through the watchdog chip.

2. The watchdog margin reset design method based on CPLD as claimed in claim 1, characterized in that, When the dog barking signal triggers the NMI interrupt in the digital signal processor, the digital signal processor also determines the soft reset count. When the soft reset count is less than 3, the digital signal processor requires the execution of a software reset through a preset code instruction, and the soft reset count is increased by 1. When the soft reset count is greater than or equal to 3, the software is locked according to the code instruction requirements and can only be unlocked by a manual GCS reset signal, and the soft reset count is cleared.

3. The watchdog margin reset design method based on CPLD as claimed in claim 1, characterized in that, When the dog barking signal does not trigger the NMI interrupt, the programmable logic device also determines the hard reset count. When the hard reset count is less than 3, the programmable logic device forces a reset on the digital signal processor through the watchdog chip. When the hard reset count is greater than or equal to 3, the programmable logic device locks the reset function and can only power on again to clear the hard reset count.

4. The watchdog margin reset design method based on CPLD as claimed in claim 1, characterized in that, The logic judgment specifically includes: when the programmable logic device receives the dog barking signal for a certain detection time, it is judged that the dog barking signal does not trigger the NMI interrupt.

5. The watchdog margin reset design method based on CPLD as claimed in claim 4, characterized in that, The specific process of a programmable logic device forcing a reset on a digital signal processor through a watchdog chip includes: when the dog barking signal continues for a certain detection time, the programmable logic device causes the RESET pin output of the watchdog chip to change from a high level to a low level and then to a high level through the MR pin of the watchdog chip; the RS reset pin of the digital signal processor triggers a forced reset after receiving a high level-low level-high level conversion.

6. The watchdog margin reset design method based on CPLD as claimed in claim 5, characterized in that: When the RESET pin outputs a low level, the watchdog timer flag is cleared, and the dog feeding signal and the dog barking signal are normally high.

Images