Dual Input Watchdog Timer

The present invention relates to watchdog timers for processors, such as microprocessors, and, more particularly, to a dual input watchdog timer which can monitor two different software modules in the processor so that a failure in any software module will be detected and result in reset or reinitialization of the processor.

The watchdog timing function in microprocessor applications, for example, is designed to monitor the microprocessor operation and to provide a reset or reinitialization signal to the microprocessor should a failure in the microprocessor occur. The watchdog timer in such a system usually receives periodic pulses from a software module in the microprocessor and is continuously reset by these periodic pulses. If a failure in the microprocessor should occur, the microprocessor no longer supplies these periodic pulses to the watchdog timer allowing the watchdog timer to supply an output pulse which is connected to the reset or reinitialization terminal of the microprocessor.

There is a failure mode which defeats this type of watchdog timing function. If the failure occurs such that the software module which generates the periodic pulses to the watchdog timer operates in a loop which excludes some or all of the other software modules, the watchdog timer assumes that the microprocessor is performing normally and will not generate the reset or reinitialization pulse. Copending patent application Ser. No. 308,703 discloses a system which monitors various points in the program memory to generate a serial data word to a cyclic redundancy checker. The cyclic redundancy checker is designed to require a periodic specific bit pattern which pattern is made up of bits selected from various locations in the program memory. In this way, a failure in a particular program memory location will not by itself defeat the watchdog timing function. However, the system shown in this copending application, while necessary in some applications, such as those where a failure can be hazardous, is overly complicated for other applications.

Therefore, the present invention is directed to a simple watchdog timer which monitors the correct operation of two software modules in order to provide the watchdog timing function. The system according to this invention includes a dual input circuit having first and second inputs and an output wherein the first and second inputs are connected to the processor such that the inputs receive signals from different software modules of the processor and wherein the output is responsive to the failure of at least one of the inputs to receive a signal for providing a reinitialization signal to the processor.

These and other features and advantages will become more apparent from a detailed consideration of the invention when taken in conjunction with the drawings in which:

FIG. 1 is a circuit schematic of the invention; and,

FIG. 2 shows the software used by the microprocessor of FIG. 1 and shows that the two inputs of the watchdog timer of FIG. 1 are supplied from different modules in the software.

In FIG. 1, the watchdog timing function is performed primarily by dual input device 11 which may be in the form of a D flip-flop. The data input terminal to the D flip-flop and the clock terminal to D flip-flop 11 are connected from corresponding outputs of input/output port 12 which communicates with microprocessor 13 over bus 14.

The Q output of flip-flop 11 is connected to the reset terminal of one counter 15 and the Q output of flip-flop 11 is connected to the reset terminal of another counter 16. The clock terminals of counters 15 and 16 are connected to clock source 17. The outputs of counters 15 and 16 are connected to inputs of OR gate 18 the output of which is connected to the reset or reinitialization terminal of microprocessor 13.

As an example of the types of circuits which can be used for the block shown in FIG. 1, the microprocessor may be an Intel 8086 processor, the input/output port 12 may be supplied under the standard industry part number 8255, flip-flop 11 may be supplied under the standard industry part number 74LS74, the counters may be supplied under the standard industry part number 74LS393, and OR gate 18 may be supplied under the standard industry part number 74LS32.

In order to insure that the watchdog timing function of the circuit arrangement shown in FIG. 1 is responsive to more than one software module utilized by microprocessor 13, the data input terminal of flip-flop 11 is supplied through input/output port 12 by one module as shown in FIG. 2 and the clock terminal of flip-flop 11 is supplied through input/output port 12 from a different module of the software as shown in FIG. 2.

In operation, microprocessor 13 supplies a 1 to the D terminal of flip-flop 11 from module 3 in the example shown in FIG. 2 and then clocks the 1 at terminal D to output Q of flip-flop 11 by generating a clock pulse from module 6 in the example shown. The 1 at the output Q of flip-flop 11 resets counter 15. Next, microprocessor 13 supplies a 0 to the D input of flip-flop 11 and clocks the 0 through to the Q output and a 1 to the Q output which resets counter 16. Next, a 1 is supplied to the D input of flip-flop 11 and is clocked through to the Q output and so on. In this manner, counters 15 and 16 are alternately reset so that the outputs from counters 15 and 16 are maintained low and a reinitialization pulse is not supplied to microprocessor 13. However, if a system failure prevents module 3 or module 6 from executing the operation described above, either by failing to generate a proper signal, the proper sequence of signals, or as outlined above, one of the counters 15 and 16 will count clock pulses from clock 17 until an output is provided through OR gate 18 to reinitialize or reset microprocessor 13.

As can be seen, the watchdog timing function of FIG. 1 provides greater reliability that error functions in microprocessor 13 will be detected by the watchdog timer. An error which excludes either module 3 or module 6 from properly functioning will be detected.