Zero clearing method and device for watchdog timer

Abstract

The invention discloses a zero clearing method of a watchdog timer. The method comprises the following steps: S1, setting zero clearing logic at an entry point of an idle thread of an operating system; s2, setting the timing duration of an awakening timer and the timing duration of a watchdog timer of one hardware as T1 and T2 respectively, wherein T1 is smaller than T2; s3, the two timers start timing at the same time; and when the timing of the wake-up timer reaches T1, hardware timer interruption is generated. And S4, firstly executing the thread with the priority higher than that of the idle thread, and then executing the idle thread. And S5, if the zero clearing logic is successfully executed before T2, the two timers restart timing at the same time. And if the zero clearing logic is not successfully executed before the T2, triggering the preset event when the T2 is reached. The reset operation of the watchdog timer is implanted into the idle thread of the operating system, a special reset thread does not need to be created, and faults such as system crash, thread deadlock and thread hunger can be effectively detected.

Description

Technical Field

[0001] This invention relates to a method for resetting a watchdog timer. Background Technology

[0002] In fields with high reliability requirements, such as embedded systems, industrial control, and automotive electronics, watchdog timers are commonly used as a system fault recovery mechanism. A watchdog timer monitors whether the system is in a normal state; essentially, it is a monotonically increasing counter. When the counter reaches a preset threshold, it triggers a preset event—such as sending a signal to reset, restart, or shut down the system. During normal system operation, the watchdog timer needs to be periodically reset to zero before the preset threshold is reached, causing it to periodically restart counting; this is commonly referred to as "feeding the dog." If the watchdog timer is not reset in time, it indicates that the system has experienced an anomaly or malfunction such as a crash or deadlock, at which point a preset event will be triggered to restore the system to a normal state.

[0003] The existing methods for resetting watchdog timers—or, more commonly, for feeding the watchdog—can be divided into the following two types.

[0004] The first approach is a software method, using a dedicated reset thread to reset the watchdog timer. This reset thread is created as a separate, low-priority thread (or task) within the operating system. Its core responsibility is to monitor the system status and periodically reset the watchdog timer. This approach can effectively detect software faults such as system crashes, thread deadlocks, and thread starvation. Thread starvation occurs when high-priority threads occupy CPU resources for an extended period, preventing low-priority business threads from being scheduled. When this software fault occurs, the reset thread cannot be scheduled and therefore cannot execute, triggering the watchdog timer's preset event. The disadvantages of this approach are: the reset thread resides permanently in the operating system, leading to significant memory overhead (e.g., task usage) and runtime overhead (e.g., context switching, CPU usage). The reset thread needs to execute periodically, which may interrupt the execution of normal business threads, adversely affecting the system's real-time performance.

[0005] The second approach is hardware-based, using a separate hardware timer to reset the watchdog timer. This involves setting up an independent, periodic hardware timer, and resetting the watchdog timer within its interrupt callback function. This approach eliminates the need to create additional threads in the operating system, resulting in lower memory and runtime overhead and higher system resource utilization. However, this approach has the drawback of failing to detect software faults such as thread starvation. This is because the execution of the hardware timer interrupt is independent of the operating system's thread scheduling state. Regardless of whether a thread is running normally, deadlocked, or starved, the hardware timer will unconditionally trigger an interrupt and reset the watchdog timer upon expiration. Therefore, this approach cannot effectively reflect the health status of threads within the system.

[0006] The two existing methods for resetting watchdog timers each have their advantages and disadvantages, and neither can effectively detect software faults while minimizing system resource overhead. Summary of the Invention

[0007] The technical problem to be solved by this invention is: how to implement a watchdog timer clearing method that can effectively detect software faults and has low system resource overhead.

[0008] To solve the above technical problems, this invention proposes a method for clearing a watchdog timer, comprising the following steps: Step S1: Set clearing logic at the entry point of the idle thread in the operating system; the clearing logic refers to performing a clearing operation on the watchdog timer and the hardware wake-up timer, causing both to restart their timing. Step S2: After the operating system starts, set the timing duration of a hardware wake-up timer to T1 and the timing duration of the watchdog timer to T2, where T1 < T2; the wake-up timer does not have an interrupt callback function set; if the watchdog timer's timing reaches T2, a preset event will be triggered. Step S3: Start timing for both the wake-up timer and the watchdog timer simultaneously; when the wake-up timer's timing reaches T1, a hardware timer interrupt for the wake-up timer is generated, and the interrupt response process is entered; after the interrupt response process ends, the scheduler executes the scheduled thread. Step S4: Execute threads with higher priority than the idle thread first; after all threads with higher priority than the idle thread are blocked, execute the idle thread; when the idle thread is executed, it executes the clearing logic. Step S5: If the reset logic is successfully executed before the watchdog timer reaches T2, the watchdog timer and wake-up timer restart simultaneously, and then return to step S3. If the reset logic is not successfully executed before the watchdog timer reaches T2, a preset event is triggered when the watchdog timer reaches T2, and then return to step S2.

[0009] Furthermore, in step S1, the idle thread is the lowest priority thread in the operating system; when no other business threads need to be scheduled for execution, the idle thread will be scheduled for execution.

[0010] Furthermore, in step S3, when the wake-up timer generates a hardware timer interrupt, if the operating system was originally in a non-sleep state, it directly enters the interrupt response process due to the hardware timer interrupt; if the operating system was originally in a sleep state, it enters the interrupt response process after being woken up by the hardware timer interrupt.

[0011] Furthermore, in step S3, during the interrupt response process, if the hardware timer interrupt has an interrupt callback function registered, the interrupt callback function is called in the interrupt context; if the hardware timer interrupt has not registered an interrupt callback function, the step of executing the interrupt callback function is skipped; before the interrupt response process ends, the scheduler selects the next thread to be executed, and then the interrupt response process ends.

[0012] Furthermore, in step S4, when there are multiple scheduled threads, the scheduler first selects a thread in a ready state to execute; when the thread finishes execution or needs to block and wait, the thread blocks itself; then the operating system is triggered to execute the scheduler again, and the scheduler selects one of the remaining ready scheduled threads to execute; this process is repeated until all ready scheduled threads are blocked, at which point an idle thread is scheduled to execute.

[0013] Furthermore, in step S5, if the clearing logic is successfully executed within time T2, it means that the idle thread can be scheduled within time T2, and that all threads in the operating system can be scheduled within time T2.

[0014] Furthermore, in step S5, if the clearing logic is not successfully executed within time T2, it indicates that the operating system has experienced a software fault such as thread starvation, thread deadlock, or system crash, which causes the idle thread to fail to be scheduled within time T2.

[0015] This invention also proposes a watchdog timer clearing device, comprising an idle thread setting unit, a timer setting unit, an interrupt response handling unit, a thread scheduling execution unit, and a clearing unit. The idle thread setting unit is used to set clearing logic at the entry point of the operating system's idle thread; the clearing logic refers to performing a clearing operation on the watchdog timer and the hardware wake-up timer, causing both to restart their timing. The timer setting unit is used, after the operating system starts, to set the timing duration of a hardware wake-up timer to T1 and the timing duration of the watchdog timer to T2. If T1 < T2, the wake-up timer does not have an interrupt callback function set; if the watchdog timer's timing reaches T2, a preset event is triggered. The interrupt response handling unit is used to start the timing of the wake-up timer and the watchdog timer simultaneously; when the wake-up timer's timing reaches T1, a hardware timer interrupt is generated for the wake-up timer, and the interrupt response process begins; after the interrupt response process ends, the scheduler executes the scheduled thread. The thread scheduling execution unit is used to execute threads with higher priority than the idle thread first; after all threads with higher priority than the idle thread are blocked, the idle thread is executed; when the idle thread is executed, the idle thread executes the clearing logic. The clearing unit is used to restart the watchdog timer and wake-up timer simultaneously when the clearing logic is successfully executed before the watchdog timer reaches T2; it is also used to trigger a preset event when the watchdog timer reaches T2 if the clearing logic is not successfully executed before the watchdog timer reaches T2.

[0016] The technical advantages achieved by this invention are: by embedding the watchdog timer's clearing operation into an idle thread of the operating system, eliminating the need to create a dedicated clearing thread, it can effectively detect system crashes, thread deadlocks, and thread starvation, thereby accurately reflecting the system's health status. This invention solves the problem of balancing monitoring accuracy and system resource overhead between dedicated thread solutions and hardware timer interrupt solutions, avoiding additional runtime and memory overhead, and significantly reducing system resource consumption while ensuring high monitoring accuracy. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the watchdog timer clearing method proposed in this invention.

[0018] Figure 2 This is a schematic diagram of the watchdog timer clearing device proposed in this invention.

[0019] The attached diagrams are labeled as follows: Idle thread setting unit 1, Timer setting unit 2, Interrupt response handling unit 3, Thread scheduling execution unit 4, Clearing unit 5. Detailed Implementation

[0020] Please see Figure 1 The watchdog timer clearing method proposed in this invention includes the following steps.

[0021] Step S1: Set the clearing logic at the entry point of the operating system's idle thread. The clearing logic includes two operations: the first operation is to clear the watchdog timer so that it restarts its timing; the second operation is to clear the hardware wake-up timer so that it restarts its timing.

[0022] Idle threads are the lowest priority threads in the operating system. They are scheduled for execution when no other business threads require execution. The primary function of idle threads is to allow the operating system to enter a low-power state when appropriate. Whether an idle thread can be scheduled for execution quickly reflects the operating system's workload and its responsiveness to business events. If an idle thread remains unscheduled for an extended period, it indicates that the operating system is extremely busy, its responsiveness is poor, and it may even be experiencing thread starvation, deadlock, or a system crash, rendering it unable to provide normal service. This is precisely the kind of software fault that watchdog timers aim to detect.

[0023] Step S2: After the operating system starts, the duration of a hardware wake-up timer is set to T1, and the duration of a watchdog timer is set to T2, where T1 < T2. The wake-up timer does not have an interrupt callback function; it is only used as a means to wake up the operating system. If the watchdog timer reaches T2, a preset event will be triggered. This preset event may be, for example, sending a signal to reset, restart, or shut down the operating system.

[0024] Step S3: The operating system starts timing both the wake-up timer and the watchdog timer simultaneously. When the wake-up timer reaches T1, a hardware timer interrupt is generated, and the interrupt response process begins. There are two scenarios: First, if the operating system was not in a sleep state, the interrupt response process begins directly due to the hardware timer interrupt. Second, if the operating system was in a sleep state, it is woken up by the hardware timer interrupt and then enters the interrupt response process.

[0025] In a multithreaded operating system, as long as the operating system is not in a sleep state, the scheduler schedules execution among all threads according to certain rules. When no other business threads need to execute, an idle thread is scheduled to execute. The idle thread puts the operating system into a sleep state, waiting for an asynchronous event interrupt (such as a hardware timer interrupt). When an asynchronous event interrupt occurs, the operating system is awakened by the event interrupt and enters the interrupt response process. If the asynchronous event interrupt has registered an interrupt callback function, the interrupt callback function is called in the interrupt context. If the asynchronous event interrupt has not registered an interrupt callback function, the step of executing the interrupt callback function is skipped. Before the interrupt response process ends, the scheduler executes, selects the next thread to execute, and then ends the interrupt response process. After the interrupt response process ends, the scheduler executes the scheduled thread.

[0026] In either case, once the operating system enters the interrupt response process, because the wake-up timer has not set an interrupt callback function, the interrupt response process skips the step of executing the interrupt callback function. Before the interrupt response process ends, the scheduler selects the next thread to execute. After the interrupt response process ends, the scheduler executes the scheduled thread.

[0027] Step S4: When there are multiple threads to be scheduled, the scheduler selects a ready thread to execute according to a certain algorithm (such as priority, time slice rotation, etc.). When the thread finishes execution or needs to block and wait (such as waiting for an external event or the end of its time slice), the thread blocks itself (puts itself into a blocked state). Then the operating system is triggered again to execute the scheduler, which selects one of the remaining ready threads to execute. This process is repeated until all ready threads are blocked, at which point the idle thread is scheduled to execute. In other words, when all threads with a higher priority than the idle thread are blocked, the idle thread is executed. When the idle thread is executed, it performs the aforementioned zeroing logic.

[0028] Step S5: If the reset logic is successfully executed before the watchdog timer reaches T2, return to step S3, and the watchdog timer and wake-up timer restart simultaneously. This indicates that the operating system is running normally, and idle threads can be scheduled and execute the reset logic in a timely manner. If an idle thread can be scheduled within T2, it means that all threads in the operating system can be scheduled within T2.

[0029] If the reset logic is not successfully executed before the watchdog timer reaches T2, a preset event is triggered when the watchdog timer reaches T2—for example, a reset, restart, or shutdown signal is sent to the operating system, and then the process returns to step S2. This situation indicates that the operating system has experienced software failures such as thread starvation, thread deadlock, or even a system crash, and idle threads cannot be scheduled and execute the reset logic in a timely manner. For example, if there are multiple threads to be scheduled, and a thread with a higher priority than the idle thread is executing, causing the idle thread to remain unscheduled beyond T2, thread starvation occurs. In addition, thread deadlock, system crashes, and other failures can also cause idle threads to remain unscheduled beyond T2.

[0030] Please see Figure 2 The watchdog timer clearing device proposed in this invention includes an idle thread setting unit 1, a timer setting unit 2, an interrupt response processing unit 3, a thread scheduling execution unit 4, and a clearing unit 5. Figure 2 The device shown corresponds to Figure 1 The method shown.

[0031] The idle thread setting unit 1 is used to set clearing logic at the entry point of the idle thread in the operating system. The clearing logic includes two operations: the first operation is to clear the watchdog timer so that it restarts its timing; the second operation is to clear the hardware wake-up timer so that it restarts its timing.

[0032] The timer setting unit 2 is used to set the timing duration of a hardware wake-up timer to T1 and the timing duration of a watchdog timer to T2 after the operating system starts, where T1 < T2; and to start the wake-up timer and the watchdog timer simultaneously. The wake-up timer does not have an interrupt callback function. If the watchdog timer reaches T2, a preset event will be triggered.

[0033] The interrupt response processing unit 3 is used to start the wake-up timer and watchdog timer simultaneously. When the wake-up timer reaches T1, a hardware timer interrupt is generated for the wake-up timer, and the interrupt response process begins. After the interrupt response process is completed, the scheduler executes the scheduled thread.

[0034] The thread scheduling execution unit 4 is used to first execute threads with higher priority than the idle thread; after all threads with higher priority than the idle thread are blocked, the idle thread is executed. When the idle thread is executed, the idle thread executes the clearing logic.

[0035] The reset unit 5 is used to restart the watchdog timer and wake-up timer simultaneously when the reset logic is successfully executed before the watchdog timer reaches T2; it is also used to trigger a preset event when the watchdog timer reaches T2 if the reset logic is not successfully executed before the watchdog timer reaches T2.

[0036] The watchdog timer clearing method proposed in this invention combines existing software and hardware methods, and has the following beneficial effects.

[0037] First, this invention performs the watchdog timer clearing operation in an existing idle thread, eliminating the need to create a dedicated clearing thread. This avoids context switching between the clearing thread and other threads, as well as the resulting CPU scheduling overhead, and also avoids the memory and other system resource overhead caused by the clearing thread residing in the operating system.

[0038] Second, this invention can effectively detect software faults such as thread starvation and thread deadlock that cause abnormal system scheduling, thereby providing a more comprehensive reflection of the operating system's health status.

[0039] Third, existing software or hardware methods for clearing watchdog timers require interrupting the current task and switching tasks during the clearing process, involving significant memory and register operations. The clearing logic of this invention only involves clearing the watchdog timer and the wake-up timer, which can be achieved by writing to a register and a few memory variables. Furthermore, the clearing logic of this invention is executed by an idle thread, that is, when the operating system is idle, avoiding unnecessary task switching and resulting in lower overall overhead.

[0040] The above are merely preferred embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for clearing a watchdog timer, characterized in that, Includes the following steps; Step S1: Set the clearing logic at the entry point of the idle thread in the operating system; the clearing logic refers to performing a clearing operation on the watchdog timer and the hardware wake-up timer, so that both of them start counting again; Step S2: After the operating system starts, set the timing duration of a hardware wake-up timer to T1 and the timing duration of a watchdog timer to T2, where T1 < T2; no interrupt callback function is set for the wake-up timer; if the watchdog timer reaches T2, a preset event will be triggered. Step S3: Start timing the wake-up timer and the watchdog timer simultaneously; when the wake-up timer reaches T1, generate a hardware timer interrupt for the wake-up timer and enter the interrupt response process; after the interrupt response process is completed, the scheduler executes the scheduled thread; Step S4: First, execute threads with higher priority than the idle thread; after all threads with higher priority than the idle thread are blocked, execute the idle thread; when the idle thread is executed, the idle thread executes the aforementioned zeroing logic; Step S5: If the reset logic is successfully executed before the watchdog timer reaches T2, the watchdog timer and the wake-up timer restart their timing simultaneously, and then return to step S3; If the reset logic is not successfully executed before the watchdog timer reaches T2, a preset event is triggered when the watchdog timer reaches T2, and then the process returns to step S2.

2. The method for clearing the watchdog timer according to claim 1, characterized in that, In step S1, the idle thread is the lowest priority thread in the operating system; when no other business threads need to be scheduled for execution, the idle thread will be scheduled for execution.

3. The method for clearing the watchdog timer according to claim 1, characterized in that, In step S3, when the wake-up timer generates a hardware timer interrupt, if the operating system was not in a sleep state, it will directly enter the interrupt response process due to the hardware timer interrupt; if the operating system was in a sleep state, it will enter the interrupt response process after being woken up by the hardware timer interrupt.

4. The method for clearing the watchdog timer according to claim 1, characterized in that, In step S3, during the interrupt response process, if the hardware timer interrupt has an interrupt callback function registered, the interrupt callback function is called in the interrupt context; if the hardware timer interrupt has not registered an interrupt callback function, the step of executing the interrupt callback function is skipped. Before the interrupt response process ends, the scheduler selects the next thread to be executed, and then the interrupt response process ends.

5. The method for clearing the watchdog timer according to claim 1, characterized in that, In step S4, when there are multiple scheduled threads, the scheduler first selects a thread in a ready state to execute; when the thread finishes execution or needs to block and wait, the thread blocks itself; then the operating system is triggered to execute the scheduler again, and the scheduler selects one of the remaining ready scheduled threads to execute; this process is repeated until all ready scheduled threads are blocked, at which point an idle thread is scheduled to execute.

6. The method for clearing the watchdog timer according to claim 1, characterized in that, In step S5, if the clearing logic is successfully executed within time T2, it means that the idle thread can be scheduled within time T2, and that all threads in the operating system can be scheduled within time T2.

7. The method for clearing the watchdog timer according to claim 1, characterized in that, In step S5, if the clearing logic is not successfully executed within time T2, it indicates that the operating system has experienced a software fault such as thread starvation, thread deadlock, or system crash, which causes the idle thread to fail to be scheduled within time T2.

8. A watchdog timer resetting device, characterized in that, It includes an idle thread setting unit, a timer setting unit, an interrupt response handling unit, a thread scheduling and execution unit, and a clearing unit; The idle thread setting unit is used to set clearing logic at the entry point of the idle thread in the operating system; the clearing logic refers to performing a clearing operation on the watchdog timer and the hardware wake-up timer, so that both of them start counting again. The timer setting unit is used to set the timing duration of a hardware wake-up timer to T1 and the timing duration of a watchdog timer to T2 after the operating system starts. T1 < T2. The wake-up timer does not set an interrupt callback function. If the watchdog timer reaches T2, a preset event will be triggered. The interrupt response processing unit is used to start the wake-up timer and the watchdog timer simultaneously; when the wake-up timer reaches T1, a hardware timer interrupt is generated for the wake-up timer, and the interrupt response process is entered; after the interrupt response process is completed, the scheduler executes the scheduled thread. The thread scheduling execution unit is used to first execute threads with higher priority than the idle thread; after all threads with higher priority than the idle thread are blocked, the idle thread is executed; when the idle thread is executed, the idle thread executes the clearing logic. The reset unit is used to restart the watchdog timer and wake-up timer simultaneously when the reset logic is successfully executed before the watchdog timer reaches T2; it is also used to trigger a preset event when the watchdog timer reaches T2 if the reset logic is not successfully executed before the watchdog timer reaches T2.

Images