Dual Window Watchdog Timer Clock Failure Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional watchdog timers are unable to detect software or system errors when application software gets stuck in a loop or experiences clock failures, as they reset the watchdog timer, masking the issue and failing to detect clock deviations.
Innovation Solution
A Dual Window Watchdog Timer (DWWDT) system that operates in two clock domains, using a first counter in a faster clock domain and a second counter in a slower clock domain, generating interrupts and issuing system resets based on predetermined thresholds to detect and respond to clock failures and software errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional watchdog timer is used to detect system delays, then simple timeout detection is achieved, but the system cannot detect software stuck in loops or clock failures because the watchdog timer is reset within the loop
Solution Approach 1:
The watchdog timer is divided into two independent counters: a primary counter that generates the watchdog timeout interrupt, and a secondary counter that is restarted by the controller. This segmentation allows the system to detect when the controller fails to restart the secondary counter within the timeout period, even if the primary counter is repeatedly reset by software loops
Solution Approach 2:
The secondary counter acts as an intermediary mechanism between the primary counter and the system reset function. It translates the primary counter's timeout detection into a controlled system reset, preventing false resets from software loops while maintaining reliable error detection
2Reliability
If the watchdog timer counter is restarted continuously in a software loop, then the watchdog timeout is avoided, but the system cannot detect clock failures or deviations
Solution Approach 1:
The system dynamically monitors the relationship between the primary and secondary counter restarts. By detecting whether the secondary counter is properly restarted within the timeout period, the system can distinguish between legitimate software operation and clock failures, adapting its detection behavior based on system state
3Measurement precision
If a single counter watchdog timer is used, then the system is simple to implement, but it cannot distinguish between legitimate timeout and false timeout caused by software loops
Solution Approach 1:
The single counter is segmented into two distinct counters with different functions: the primary counter for timeout generation and the secondary counter for restart validation. This segmentation enables precise detection of legitimate timeouts while filtering out false timeouts caused by software loops that cannot restart both counters properly
Data Source
AI summary
Systems and methods for a Dual Window Watchdog Timer (DWWDT) are described. In some embodiments, a method may include running a first counter in a first clock domain and a second counter in a second clock domain; generating an interrupt to a controller during a window open period, wherein the window open period begins in response to the first counter having reached a predetermined threshold; and at least one of: restarting the first counter if the controller restarts the second counter in response to the interrupt before the window open period ends; or issuing a system reset if the controller does not restart the second counter in response to the interrupt before the window open period ends.