Hardware watchdog

Check watchdog timer alarm—often indicates hardware problem Operator turned controller off ... 

Industrial process sector PE logic solvers have internally configured diagnostics. They are referred to as internal watchdog timers (IWDT) in this annex. IWDTs include software, hardware, and communication diagnostic subsystems provided by the manufacturer, within the PE logic solver. 

Hardware-based non-intmsive module an additional non-intrasive hardware module is added to the architecture. This module implements watchdog and decoder characteristics in order to analyze the processor s control flow and decode instmctions sent from the inserted software instmctions. 

The last kind of detection is the control flow loop (4). In order to detect this type of error, a watchdog timer is implemented. The counter is reset eveiy time the execution flow enters a BB, with the reset XOR instraction. When the counter overflows, an error is flagged. By doing so, the hardware module can detect a control flow loop that causes the execution flow to be stuck at a single instraction. 

The watchdog characteristics allow the hardware module to detect incorrect jumps to unused memory addresses (3), by receiving irrformation of the memory area used by the application s program code (both program and data). When the processor tries to access an address that is out of range, an error is flagged. 

NOTE 1 The watchdog confirms that the software system is operating correctly by the regular resetting of an external device (for example, hardware electronic watchdog timer) by an output device controlled by the software. 

For SIL 1 and SIL 2 systems there should be basic hardware fault checks (i.e., watchdog and serial communication error detection). 

Justification for any diagnostic coverage claimed for each component (if over 60%). This may involve a separate textual section describing the hardware/software/ watchdog arrangements Section of this... 

The safety node (SCPU) has a Hardware Fault Tolerance of one (HFT = 1) based on two independent processors. Each processor controls one independent safety relay that can be de-activated (safe state) either directly commanded by safety protection or indirectly by diagnosis function. If the diagnosis detects a fatal error, it does not refresh the associated watchdog and this leads to a reset of the node. As a summary ... 

The hardware provides autonomous diagnosis (e.g., IEC-61508-2 Table A.9 Power Failure Monitor (PFM)) and diagnosis components to be commanded by software (e.g., IEC-61508-2 Table A.10 watchdog)... 

As is customary in non-accessible embedded systems, UPMSat-2 incorporates a WatchDog Timer (WDT) to achieve fault recovery. That is a hardware timer that must be periodically recharged by software, otherwise it provokes a hardware reset. Taking into account the stability property of fixed-priority scheduling, the task that restarts the WDT has been assigned the lowest priority. Therefore, in case of an infinite loop in any task or transient overload, the WDT task will overrun its deadline and the on-board computer will be restarted. The hardware timer is programmed for a 15 s time interval and the WDT task has a period of 10 s. As a result, the deadhne of this task is 5 s. 

Computer hardware power supply/watchdog card/rack/frame assemblies operator stations, peripherals... 

In the context of Figure 1.8, the watchdog is a hardware device, periodically refreshed (or reset) by the processor (for example, at the beginning of each application cycle), which has the ability to cut off output. Note that the watchdog can also be a software application. 

The field watchdog is an irreversible device for ensuring the maintenance of the system in a fallback position in case of a permanent failnre. These actions are to ensure that the system is not in a more permissive state than in the absence of failure. For this, the equipment power (all components) is cut off. This lack of power ensures the positioning of output in a restrictive state. This watchdog is periodically self-tested. This device detects, in the course of a program, a defect due to a temporary failure or random characteristic of the hardware or software equipment, and initiates the necessary actions. 

---