Control method of watchdog device supporting multi-agent early warning and then resetting

Abstract

The invention relates to the technical field of electronics, and discloses a control method of a watchdog device supporting multi-agent early warning and then resetting, which comprises the following steps: in a CPU (Central Processing Unit) power-on starting stage, a hardware agent module sends a dog feeding signal to a watchdog chip according to overflow time of the watchdog chip; in the CPU protection stage, the hardware agent module sets the overflow time of the dog feeding signal of each process, in the CPU protection stage, the hardware agent module keeps the overflow time of the watchdog chip to send the dog feeding signal to the watchdog chip, and meanwhile, whether each process of the CPU sends the dog feeding signal to the hardware agent module within the respective overflow time is monitored; if any process does not send the dog feeding signal in the overflow time, the hardware agent module sends an interruption early warning signal to the CPU, and if the process does not send the dog feeding signal in the next overflow time, the hardware agent module stops sending the dog feeding signal to the watchdog chip. According to the method, the overflow time is configured for each path of process, and early warning and resetting are supported.

Description

Technical Field

[0001] The invention relates to the field of electronic technology, and in particular to a control method for a watchdog device supporting multi-party agents to first warn and then reset. Background Art

[0002] The watchdog mechanism is responsible for monitoring key tasks or processes in the system. If the monitored task does not respond within a certain period of time, it is considered to be hung and the system is restarted. The implementation of the watchdog can be divided into two solutions: hardware and software, each with its own advantages and disadvantages: 1. The independent watchdog chip in the hardware solution (such as CAT705 / CAT706, IMP706 and other chips) has a feeding pin (usually input by the CPU's GPIO signal) and a reset pin (output to the CPU to restore the entire system). This type of watchdog starts working as soon as the system is powered on and cannot be disabled; its overflow time is about 1.6s and cannot be changed. Advantages: no software configuration is required, it can be used immediately after power-on; continuous and effective protection, no protection time blind spot. Disadvantages: overflow time cannot be configured; cannot be disabled, low flexibility.

[0003] 2. In the hardware solution, most CPUs have built-in watchdog hardware, and the reset pin of the watchdog is fixedly connected inside the CPU. This solution requires a program to initialize when in use, and can be started and disabled at any time, and the watchdog is fed through internal system calls; its overflow time can be flexibly set. Advantages: can be disabled and started at any time; the overflow time can be changed at any time. Disadvantages: there is a protection blind spot, such as the dog is not initialized, the dog is not started, and the dog is disabled, after which the watchdog loses its function.

[0004] 3. The main technologies of the software solution are: 1) Heartbeat detection (local timed detection, or timed sending by the other end), which is equivalent to the dog feeding signal. 2) If there is no heartbeat detected within the predetermined period, the protection operation will be executed (equivalent to the dog barking). Advantages: The overflow time can be configured at will; the recovery operation after the dog barking can be set at will. Disadvantages: Using software to monitor software, the reliability cannot be guaranteed.

[0005] In general, current technologies have the following problems: 1. The solution of independent watchdog chip needs to ensure that there must be a watchdog feeding signal within 1.6s from power-on. However, the startup time of current network equipment is generally in the minute level (3 to 5 minutes), so how to feed the watchdog after the system is powered on and before the system software runs is a difficult problem.

[0006] 2. The overflow time of 1.6s brings theoretical and practical difficulties to the software. The cycle of computer execution instructions is nanoseconds, which is at least 7 orders of magnitude different from 1.6s. If too few or too many dog ​​feeding operations are inserted into the program, it will cause serious problems. The location of the dog feeding signal is relatively arbitrary due to the lack of theoretical guidance, which limits the use of the watchdog.

[0007] 3. Current software design generally adopts a multi-process distributed architecture. There is no good solution for the collaborative feeding of dogs between multiple processes. Because the execution of multiple processes will be coupled to feed the same dog, it brings inconvenience to code writing, debugging and maintenance. Summary of the invention

[0008] The purpose of the present invention is to improve the deficiencies in the prior art and provide a control method for a watchdog device that supports multiple agents to first warn and then reset.

[0009] In order to achieve the above-mentioned object of the invention, the embodiment of the present invention provides the following technical solutions: A control method for a watchdog device supporting multiple agents to first warn and then reset is characterized by comprising the following steps: Step 1, connecting the hardware proxy module between the CPU and the watchdog chip, and configuring the number of pin connections between the CPU and the hardware proxy module according to the number of CPU processes; the output end of the hardware proxy module is connected to the input end of the watchdog chip; Step 2: During the CPU power-on startup phase, the hardware proxy module sends a feeding signal to the watchdog chip according to the overflow time of the watchdog chip; Step 3, set the dog feeding signal overflow time of each process. In the CPU protection stage, the hardware agent module maintains the overflow time of the watchdog chip as the watchdog chip sends the dog feeding signal, and monitors whether each process of the CPU sends the dog feeding signal to the hardware agent module within its respective overflow time. If any process does not send the dog feeding signal within its overflow time, the hardware agent module sends an interrupt warning signal to the CPU. If the process still does not send the dog feeding signal at the next overflow time, the hardware agent module stops sending the dog feeding signal to the watchdog chip.

[0010] In the above scheme, during the CPU power-on startup phase, the hardware proxy module sends a dog feeding signal to the watchdog chip according to the overflow time of the watchdog chip, ensuring that the reset action of the watchdog chip will not be triggered during the power-on startup of the device. This device provides an independent N-way dog ​​feeding signal interface to the CPU, which can support N different processes to feed the dog separately, so that each process can exclusively feed the dog without interfering with each other.

[0011] Furthermore, in step 1: If the CPU needs to run N processes, the CPU is connected to the hardware proxy module through N GPIO ports; The hardware proxy module is connected to the CPU via 1 or N interrupt pins.

[0012] Furthermore, in step 1: when configuring the connection relationship between the CPU and the hardware proxy module, the GPIO port of the CPU is selected to connect to the hardware proxy module through the configuration interface such as I2C and SPI of the CPU.

[0013] Furthermore, the step 2 further comprises the following steps: A total power-on startup time counter is configured in the register of the hardware proxy module, and a maximum power-on startup time is set according to the normal power-on startup time of the CPU. If the register value of the CPU does not change from 0 to 1 within the maximum power-on startup time, the hardware proxy module stops sending the watchdog chip a feeding signal WDI. At this time, the watchdog chip sends a reset signal WDO to the CPU, causing the CPU to restart the system.

[0014] Furthermore, the dog feeding signal overflow time of each process is the same or different.

[0015] In the above scheme, the dog feeding signal overflow time threshold of different processes can be configured independently: if some processes take a long time to execute, this threshold can be set longer; if some processes are executed intensively, this threshold can be set shorter; setting thresholds according to the characteristics of the processes is convenient for software development and debugging and locating problems.

[0016] Furthermore, in step 3: the dog feeding signal overflow time of the process is 10ms~100s.

[0017] Furthermore, in step 3: if the hardware proxy module is connected to the CPU via an interrupt pin, then when any process does not send a dog-feeding signal during its overflow time, the hardware proxy module sends an interrupt warning signal to the CPU via the interrupt pin; the interrupt warning signal includes the process number of the process that did not send the dog-feeding signal, or the interrupt warning signal does not include the process signal of the process that did not send the dog-feeding signal.

[0018] Furthermore, in step 3, if the hardware proxy module is connected to the CPU through N interrupt pins, when any process does not send a dog feeding signal during its overflow time, the hardware proxy module sends an interrupt warning signal to the CPU through the interrupt pin corresponding to the process.

[0019] In the above scheme, the present invention supports "warning first, then reset", that is, when a process on a certain path does not send a dog-feeding signal and is determined to be dead, a signal is first sent to the interrupt of the path for warning, and then a new dog-feeding signal is waited for. If the dog-feeding signal is still not received, the reset operation is performed. Because a global reset will cause the entire system to power on again, it will take a long time to re-enter the system and resume services, so it is best to avoid it if it can be avoided; when only individual local processes are dead and the CPU can still respond to interrupts, sending an interrupt signal will prompt the CPU to restart the process and perform software recovery, reducing the global reset operation; for the sake of safety, when the CPU is completely dead and cannot handle interrupts at all, performing a system reset is still the last resort.

[0020] Compared with the prior art, the present invention has the following beneficial effects: the present invention can configure the "overflow time" for each process separately, or it can be a short-term millisecond-level monitoring, and it does not affect the overflow time of the watchdog chip, which is convenient for users to use. The present invention supports "early warning before reset", giving the CPU a chance to recover through interruption, so that the entire system does not need to be restarted every time "hanging protection" occurs, reducing the time of interrupting business; and the protection means of this solution is not weak, resetting the entire system is still the last protection means, and the protection strength of the entire system is not affected. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 This is a schematic diagram of the hardware structure of the watchdog device of the present invention; Figure 2 A schematic diagram of a dog feeding signal pulse when all four processes in an embodiment of the present invention maintain normal operation; Figure 3 is a flow chart of the method of the present invention; Figure 4 Schematic diagram of dog feeding signal pulses when process 1 does not send the dog feeding signal WDI1 in the 5th second in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

[0024] It should be noted that similar numbers and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance, or implying any such actual relationship or order between these entities or operations. In addition, the terms "connected", "connected", etc. can be directly connected between elements, or indirectly connected via other elements. Example 1

[0025] The present invention is achieved through the following technical solutions: Figure 3 As shown, the control method of the watchdog device supporting multiple agents to first warn and then reset includes the following steps: Step 1, connect the hardware proxy module between the CPU and the watchdog chip, and configure the number of pin connections between the CPU and the hardware proxy module according to the number of CPU processes; the output end of the hardware proxy module is connected to the input end of the watchdog chip.

[0026] This solution adds the hardware proxy module to the original hardware solution of the independent watchdog chip, which is used to feed the watchdog on behalf of the CPU. To facilitate the description of the connection relationship between the hardware proxy module, the CPU and the watchdog chip, assuming that the current CPU needs to run 4 processes, the 4 GOIP ports of the CPU are respectively connected to the hardware proxy module; the hardware proxy module is connected to 1 or 4 interrupt pins of the CPU. The output end of the hardware proxy module is disconnected from the input of the watchdog chip, and the output end of the watchdog chip is connected to the reset pin of the CPU.

[0027] Furthermore, when configuring the connection relationship between the CPU and the hardware proxy module, you can select which GPIO ports of the CPU are connected to the hardware proxy module through the CPU's I2C, SPI and other configuration interfaces. Therefore, when the number of CPU processes changes, there is no need to manually connect the CPU and the hardware proxy module, and you can directly configure it through the configuration interface.

[0028] Step 2: During the CPU power-on startup phase, the hardware proxy module sends a feeding signal to the watchdog chip according to the overflow time of the watchdog chip.

[0029] Before the CPU is powered on, the register value of the CPU defaults to 0. After the power-on is completed, the register value jumps to 1, so whether the CPU has completed the power-on can be distinguished according to the register value. When the register value is 0, the hardware proxy module sends a dog feeding signal WDI to the watchdog chip through its output terminal WDI_out, and the time interval for sending the dog feeding signal WDI is the overflow time of the watchdog chip.

[0030] Since the watchdog chip is an independent hardware, such as CAT705 / CAT706, IMP706 and other chips, its overflow time is fixed at the factory and cannot be changed. Generally speaking, the overflow time of the watchdog chip is 1.6s, so during the CPU power-on startup phase, the hardware proxy module will send a dog-feeding signal WDI to the watchdog chip every 1.6s to prevent the CPU from failing to send a dog-feeding signal to the watchdog chip during the power-on startup phase (such as 3 to 5 minutes), causing the watchdog chip to mistakenly believe that the CPU is hung, and send a reset signal WDO to the CPU to restart the CPU.

[0031] However, this step will not unconditionally wait for the CPU to complete power-on startup. It is very likely that the CPU has indeed hung during the power-on startup phase. Therefore, the "power-on startup total time counter" is configured in the register of the hardware proxy module. The user can set a maximum power-on startup time according to the normal power-on startup time of the CPU. If the CPU register value has not jumped to 1 within the maximum power-on startup time, that is, when the configured total power-on startup time counter has been reduced to 0, the CPU register value has not jumped to 1, then it is determined that the CPU has hung during the power-on startup phase, and then the hardware proxy module stops sending the watchdog chip to feed the dog signal WDI. At this time, the watchdog chip sends a reset signal WDO to the CPU to restart the CPU system.

[0032] Step 3, set the dog feeding signal overflow time of each process. In the CPU protection stage, the hardware agent module maintains the overflow time of the watchdog chip as the watchdog chip sends the dog feeding signal, and monitors whether each process of the CPU sends the dog feeding signal to the hardware agent module within its respective overflow time. If any process does not send the dog feeding signal within its overflow time, the hardware agent module sends an interrupt warning signal to the CPU. If the process still does not send the dog feeding signal at the next overflow time, the hardware agent module stops sending the dog feeding signal to the watchdog chip.

[0033] Let's take the example of a CPU with 4 processes. Figure 1As shown, it is assumed that the CPU is connected to the hardware proxy module through its GPIO1, GPIO2, GPIO3, and GPIO4 pins, which correspond to four processes respectively. Process 1 of the CPU sends the dog-feeding signal WDI1 to the hardware proxy module through GPIO1, and its overflow time is 1s; process 2 of the CPU sends the dog-feeding signal WDI2 to the hardware proxy module through GPIO2, and its overflow time is 2s; process 3 of the CPU sends the dog-feeding signal WDI3 to the hardware proxy module through GPIO3, and its overflow time is 10s; process 4 of the CPU sends the dog-feeding signal WDI4 to the hardware proxy module through GPIO4, and its overflow time is 40s. When all four processes maintain normal operation, their respective dog-feeding signal pulses can be seen in Figure 2 The hardware proxy module is responsible for sending the watchdog chip a feeding signal WDI according to the overflow time of the watchdog chip 1.6s, while WDI1, WDI2, WDI3, and WDI4 can be configured with the same or different overflow times according to the process conditions. It can be seen that when the four processes are running normally, WDI, WDI1, WDI2, WDI3, and WDI4 all send feeding signals according to their overflow times. The watchdog chip will not send a reset signal WDO to the CPU after receiving the feeding signal WDI.

[0034] When any process i does not send the dog-feeding signal WDIi to the hardware proxy module, the hardware proxy module will not stop sending the dog-feeding signal WDI immediately, but will first send an interrupt warning signal to the CPU through the interrupt pin, so that the CPU will first do an internal detection to restore the operation of the process inside the CPU. However, the CPU may not be able to restore the process inside it, so when the next overflow time arrives, the process i still does not send the dog-feeding signal WDIi to the hardware proxy module, then the hardware proxy module determines that the process is hung and stops sending the dog-feeding signal WDI to the watchdog chip, and then the watchdog chip WDI sends a reset signal WDO to the CPU, causing the CPU to restart the entire system.

[0035] As an example, Figure 4As shown in the figure, the overflow time of process 1 is 1s. Assuming that process 1 should have sent the dog feeding signal WDI1 to the hardware proxy module at the 5th second, but did not send it at the 5th second, according to the overflow time of the watchdog chip of 1.6s, the overflow time closest to the 5th second is 4*1.6s, then at the 6.4th second, the hardware proxy module still sends the dog feeding signal WDI to the watchdog chip; and the hardware proxy module sends an interrupt warning signal to the CPU through the interrupt pin after 5s and before 6s, informing the CPU that it should restart process 1 internally; however, if at the 6th second, process 1 still does not send the dog feeding signal WDI1 to the hardware proxy module, then at the 8th second (i.e., 5*1.6s), the hardware proxy module stops sending the dog feeding signal WDI to the watchdog chip, and then the watchdog chip WDI sends a reset signal WDO to the CPU, causing the CPU to restart the entire system.

[0036] As an implementable method, the hardware proxy module is connected to the CPU only through an interrupt pin. No matter which process among multiple processes does not send a dog-feeding signal to the hardware proxy module within the configured overflow time, the hardware proxy module sends an interrupt warning signal to the CPU through the interrupt pin. The interrupt warning signal may include the process number that did not send the dog-feeding signal, or may not include the process signal that did not send the dog-feeding signal. If the interrupt warning signal includes the process number that did not send the dog-feeding signal, the CPU directly restores the corresponding process according to the sequence number; if the interrupt warning signal does not include the process signal that did not send the dog-feeding signal, the CPU quickly traverses all processes, determines which process is hung, and restores the process.

[0037] As another feasible method, if there are 4 processes, the hardware proxy module is connected to the CPU through 4 interrupt pins. For example, if process 1 does not send the dog feeding signal WDI1 to the hardware proxy module within the configured overflow time, the interrupt pin corresponding to process 1 sends an interrupt warning signal INT1 to the CPU, and the CPU can immediately restore process 1.

[0038] As another example, if the overflow times of two processes are configured to be similar, for example, the overflow time of process 1 is 1s and the overflow time of process 2 is 2s, at the 2nd second, process 2 does not send the dog feeding signal WDI2 to the hardware agent module, and at the 3rd second, process 1 does not send the dog feeding signal to the hardware agent module, then the hardware agent module still sends the dog feeding signal WDI to the watchdog chip at 3.2s (i.e. 2*1.6s), and the hardware agent module sends the interrupt warning signal INT2 to the CPU after the 2nd second and before the 4th second; if process 2 still does not send the dog feeding signal WDI2 to the hardware agent module at the 4th second, then the hardware agent module stops sending the dog feeding signal WDI to the watchdog chip at 4.8s (i.e. 3*1.6s). Since the overflow time 1s of process 1 is shorter than the overflow time 2s of process 2, process 1 does not send the dog feeding signal WDI1 to the hardware proxy module in the 3rd second. The hardware proxy module still sends the dog feeding signal WDI to the watchdog chip in the closest 3.2s, and the hardware proxy module sends the interrupt warning signal INT1 to the CPU after the 3rd second and before the 4th second. If process 1 still does not send the dog feeding signal WDI1 to the hardware proxy module in the 4th second, the hardware proxy module stops sending the dog feeding signal WDI to the watchdog chip at 4.8s (i.e. 3*1.6s). That is to say, no matter how much overflow time is configured for each process, the hardware proxy module will not immediately stop sending the dog feeding signal WDI to the watchdog chip when it does not receive the dog feeding signal sent by any process, but will send an interrupt warning signal to the CPU before the process should send the next dog feeding signal, so that the CPU can restore the process internally. If the process still does not send the dog feeding signal to the hardware proxy module when the next overflow time is reached, the hardware proxy module will stop sending the dog feeding signal at the overflow time for sending the next dog feeding signal to the watchdog chip.

[0039] Therefore, in principle, no matter how long the overflow time of each process is, it will not affect the overflow time of the hardware agent module sending the dog feeding signal to the watchdog chip. This ensures that without changing the configuration of the original independent watchdog chip, the running status of each process can be monitored separately, and when a process fails, a warning signal will be issued first to give the process an internal recovery opportunity, instead of restarting the entire system immediately when a process fails.

[0040] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A control method for a watchdog device supporting multiple agents to first warn and then reset, characterized in that: The following steps are involved: Step 1, connecting the hardware proxy module between the CPU and the watchdog chip, and configuring the number of pin connections between the CPU and the hardware proxy module according to the number of CPU processes; the output end of the hardware proxy module is connected to the input end of the watchdog chip; Step 2: During the CPU power-on startup phase, the hardware proxy module sends a feeding signal to the watchdog chip according to the overflow time of the watchdog chip; Step 3, set the dog feeding signal overflow time of each process. In the CPU protection stage, the hardware agent module maintains the overflow time of the watchdog chip as the watchdog chip sends the dog feeding signal, and monitors whether each process of the CPU sends the dog feeding signal to the hardware agent module within its respective overflow time. If any process does not send the dog feeding signal within its overflow time, the hardware agent module sends an interrupt warning signal to the CPU. If the process still does not send the dog feeding signal at the next overflow time, the hardware agent module stops sending the dog feeding signal to the watchdog chip.

2. The control method of the watchdog device supporting multiple agents to warn first and then reset according to claim 1, characterized in that: In step 1: If the CPU needs to run N processes, the CPU is connected to the hardware proxy module through N GPIO ports; The hardware proxy module is connected to the CPU via 1 or N interrupt pins.

3. The control method of the watchdog device supporting multiple agents to warn first and then reset according to claim 1, characterized in that: In the step 1: when configuring the connection relationship between the CPU and the hardware proxy module, the GPIO port of the CPU is selected to connect to the hardware proxy module through the configuration interface such as I2C and SPI of the CPU.

4. The control method of the watchdog device supporting multiple agents to warn first and then reset according to claim 1, characterized in that: The step 2 further comprises the following steps: A total power-on startup time counter is configured in the register of the hardware proxy module, and a maximum power-on startup time is set according to the normal power-on startup time of the CPU. If the register value of the CPU does not change from 0 to 1 within the maximum power-on startup time, the hardware proxy module stops sending the watchdog chip a feeding signal WDI. At this time, the watchdog chip sends a reset signal WDO to the CPU, causing the CPU to restart the system.

5. The control method of the watchdog device supporting multiple agents to warn first and then reset according to claim 1, characterized in that: In step 3: the dog feeding signal overflow time of each process is the same or different.

6. The control method of the watchdog device supporting multiple agents to warn first and then reset according to claim 1, characterized in that: In step 3: the dog feeding signal overflow time of the process is 10ms~100s.

7. The control method of the watchdog device supporting multiple agents to warn first and then reset according to claim 2, characterized in that: In step 3: if the hardware proxy module is connected to the CPU via an interrupt pin, when any process fails to send a dog-feeding signal during its overflow time, the hardware proxy module sends an interrupt warning signal to the CPU via the interrupt pin; the interrupt warning signal includes the process number of the process that failed to send the dog-feeding signal, or the interrupt warning signal does not include the process signal of the process that failed to send the dog-feeding signal.

8. The control method of the watchdog device supporting multiple agents to warn first and then reset according to claim 2, characterized in that: In step 3, if the hardware proxy module is connected to the CPU through N interrupt pins, when any process does not send a dog feeding signal during its overflow time, the hardware proxy module sends an interrupt warning signal to the CPU through the interrupt pin corresponding to the process.

Images