How to use a watchdog in a multi-interrupt setting

Log in or register to post comments
Go To Last Post
6 posts / 0 new
Author
Message
ossi
ossi's picture
Level: Raving Lunatic
Joined: Tue. Apr 25, 2006
Posts: 2332 View posts
Location: Germany
#1
Posted by ossi: Mon. Mar 3, 2014 - 03:50 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I want to make my software safer by using a watchdog
(a short interruption for restart is no problem).
In total it is a sort of digital software receiver running
functions in real time with different sample rates.

The problem is, that there are some independently
running functions and I think I want to make
sure that all functions operate properly.

The structure is as follows:

A fast timer1 interrupt running at about 10k interrupts per second.
Every 8 timer1-interrupt this routine fills one A-value into a FIFO.

The main-program is an infinite loop.
Always if A-values are ready in the FIFO, the main loop
triggers a function that fetches the A-values from the FIFO
and computes a new B-value using these values.

Then there is a timer2 interrupt that triggers a function
1000 times per second. This function takes the actual B-value
and computes a C-value and putputs bits on a port..

If I would reset the watchdog in the interrupt-routines
and one timer interrupt would be disabled due to a
malfunction, then the other interrupt would still
reset the watchdog and so the watchdog in this
simple way makes no sense.

The problem for me is: How can test that all the different
functions work properly.

In short: How to use a watchdog in a multi-interrupt setting?

Any suggestions welcome!

Tags:

AVR Microcontrollers, megaAVR and tinyAVR
Top
sparrow2
sparrow2's picture
Level: Raving Lunatic
Joined: Mon. Oct 7, 2002
Posts: 6331 View posts
Location: Denmark
Posted by sparrow2: Mon. Mar 3, 2014 - 04:11 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

First why do you have two timer interrupts, can't the timer2 ISR just be some code timer1 run every 1/10 time? (or is this a xmega?)

But never mind.
Try to define a sanity test for each program part (and set/clear a flag), and how they sync to each other, (like main should not take longer than x timer 1 ISR's etc.).
And if you meet all then kick the watchdog and clear flags, in the main program. (Perhaps in your setup the timer1 ISR are the main program! )

Top
clawson
clawson's picture
Level: Moderator
Joined: Mon. Jul 18, 2005
Posts: 95214 View posts
Location: (using avr-gcc in) Finchingfield, Essex, England
Posted by clawson: Mon. Mar 3, 2014 - 04:28 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

What you describe is effectively the perennial problem of where you put the watchdog kicker(s) in an OS environment. Do you put it at the core of the OS scheduling to simply ensure that the entire system does not lock up or do you rely on all the tasks sprinkling them liberally so no task can get "stuck". It's actually a very tricky design decision.

It might be best to try and gauge "what's most likely to lock up?" then save the protection for that alone.

Top
John_A_Brown
John_A_Brown's picture
Level: Raving Lunatic
Joined: Sat. Sep 20, 2003
Posts: 5990 View posts
Location: Surrey, England
Posted by John_A_Brown: Mon. Mar 3, 2014 - 04:41 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

I seem to remember that The Usch has a system he uses for this sort of thing. No doubt he'll be along soon and point you at it, but if not, I think he sets a flag in each ISR, and then clears the watchdog based on the AND of all such flags. I guess the flags are all cleared when the watchdog is reset.

Four legs good, two legs bad, three legs stable.

Top
ralphd
ralphd's picture
Level: Resident
Joined: Tue. Feb 11, 2014
Posts: 653 View posts
Posted by ralphd: Tue. Mar 4, 2014 - 04:39 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Here's what I'd suggest (sounds like it might be similar to John's suggestion):
Set up a watchdog interrupt to check run flags for each independent thread. For speed of checking, I'd use one of the GPIO registers. So bit0 could be for timer0, bit1 could be timer1, and bit3 could be your main loop. Each thread clear's its watchdog bit on each iteration. When the watchdog ISR runs, it checks the GIPIO register. If it is zero, it sets it to 7, and exits the ISR. If it is non-zero, one of the threads didn't reset it's watchdog bit, so the AVR should reset. To trigger the rest, clear WDIE, so the next time the watchdog times out the AVR will reset instead of running the watchdog ISR.

I have no special talents.  I am only passionately curious. - Albert Einstein

 

Top
theusch
theusch's picture
Level: 10k+ Postman
Joined: Mon. Feb 19, 2001
Posts: 39340 View posts
Location: Wisconsin USA
Posted by theusch: Tue. Mar 4, 2014 - 06:02 PM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Quote:

I seem to remember that The Usch has a system he uses for this sort of thing. No doubt he'll be along soon and point you at it, but if not, I think he sets a flag in each ISR, and then clears the watchdog based on the AND of all such flags. I guess the flags are all cleared when the watchdog is reset.


Exactly. One mention:
https://www.avrfreaks.net/index.p...

Be sure to read the whole thread for other views, especially danni's a few posts down.

Another interesting discussion I uncovered when searching for the above, but a hair different topic: "Watchdog--good or evil". ;)
https://www.avrfreaks.net/index.p...

You can put lipstick on a pig, but it is still a pig.

I've never met a pig I didn't like, as long as you have some salt and pepper.

Top