Dual Watchdog Timer Architecture for Microprocessor Fault Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Special purpose computer systems face challenges in monitoring microprocessors during the long operating system launch sequence and normal operation due to the limitations of commercial off-the-shelf (COTS) operating systems, which are often provided in a non-modifiable binary format and have long startup times, making it difficult to adequately monitor microprocessor faults.
Innovation Solution
The implementation of a dual-watchdog timer system, where an internal watchdog timer is initiated during the operating system startup and an external watchdog timer is enabled after the system is up and running, allowing for continuous monitoring and automatic reset of the microprocessor in case of faults, providing redundancy and increased reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single watchdog timer is used to monitor the microprocessor, then the device complexity is reduced, but the reliability of fault detection is insufficient because it cannot adequately monitor both the long OS startup sequence and normal operation
Solution Approach 1:
The system divides the watchdog timer functionality into two separate timers: an internal watchdog timer integrated into the microprocessor and an external watchdog timer separate from the microprocessor. This segmentation allows each timer to be optimized for specific monitoring scenarios - the internal timer for OS startup sequence monitoring and the external timer for normal operation monitoring - thereby improving overall fault detection reliability without requiring a single overly complex timer design
Solution Approach 2:
The internal watchdog timer acts as an intermediary during the OS startup sequence, monitoring the microprocessor when no other software is available. Once the OS is loaded, the external watchdog timer takes over as the primary monitoring mechanism. This intermediary approach ensures continuous monitoring across different system states without requiring both timers to operate simultaneously at full capacity
2Reliability
If the watchdog timer duration is set to cover the long COTS operating system startup sequence, then the startup monitoring is improved, but the timer duration becomes excessively long reducing its effectiveness for monitoring normal operation faults
Solution Approach 1:
The monitoring function is segmented into two phases with different timer durations: the internal watchdog timer uses a longer duration suitable for monitoring the extended COTS OS startup sequence, while the external watchdog timer uses a shorter duration optimized for detecting faults during normal operation. This segmentation resolves the contradiction by allowing each timer to have duration optimized for its specific operational phase
Solution Approach 2:
The system dynamically transitions between different watchdog timer configurations based on system state. During startup, the internal timer with longer duration is active; after OS loading, the system transitions to using the external timer with shorter duration for normal operation monitoring. This dynamic adaptation allows the watchdog mechanism to maintain optimal performance across varying operational requirements
3Reliability
If an external watchdog timer is added to monitor normal operation, then the monitoring coverage is improved, but the device complexity and cost increase
Solution Approach 1:
The system merges the internal and external watchdog timers into a unified monitoring architecture where both timers work together under coordinated control. The microprocessor manages both timers, switching between them based on operational phase. This merging allows the system to leverage the strengths of both timer types - the internal timer's immediate availability and the external timer's dedicated monitoring capability - while sharing control logic and reducing overall system complexity compared to having completely separate monitoring systems
4Reliability
If the internal watchdog timer is used during OS startup, then the startup monitoring is enabled, but the timer must have a long duration which reduces its responsiveness to faults during normal operation
Solution Approach 1:
The fault detection function is segmented into two specialized timers: the internal watchdog timer with longer duration optimized for startup monitoring, and the external watchdog timer with shorter duration optimized for rapid fault detection during normal operation. This segmentation eliminates the trade-off by allowing each timer to be independently optimized for its specific operational context without compromising the other
Solution Approach 2:
The internal watchdog timer performs preliminary monitoring during the critical OS startup phase when no other software is available. Once the OS is successfully loaded, the system prepares and transitions to the external watchdog timer for ongoing monitoring. This preliminary action ensures that monitoring is established before the OS is ready, then handoffs to the more responsive external timer for normal operation
Data Source
AI summary
Devices and methods for microprocessor supervision in a special purpose computer system are provided. One illustrative embodiment includes a first watchdog timer internal to the microprocessor and a second watchdog timer external to the microprocessor. In some cases, the internal watchdog timer may be initiated prior to or during the operating system startup and the external watchdog timer may be initiated after the operating system is up and running. The internal watchdog timer may have a relatively longer timer duration than the external watchdog timer, but is not required in all embodiments. In some embodiments, the internal watchdog timer may monitor the microprocessor's startup sequence and the internal watchdog timer and/or external watchdog timer may monitor the microprocessor when the operating system is up and running. If the microprocessor faults at any time during startup or while the operating system is up and running, the internal and/or external watchdog timer may trigger a microprocessor reset.