Watchdog und Brown-Out mit dem TC1232 am ATMEGA2560

Hallo Leute,

ich bin gerade beim "Feinschliff" meines BETA-Boards, jetzt stellt sich mir noch eine Frage!

Externe-Brown-Out und/oder externe Watchdog-Überwachung, denn ich bin bei verschiedenen ATMEGA-Boards (im Internet) auf externe Watchdog-ICs gestoßen, aber WARUM?!?! Gibt es dafür einen Grund?

Der Atmega2560 hat doch selbst eine BrownOut-Überwachung die ich aktivieren und nutzen kann.
(siehe BOD, BODLEVEL-Fuses)

Auch einen Watchdog-Timer gibt es! (WDT), bei dem ich einen Counter regelmäßg rücksetzen muss. ansonsten gibt es einen Reset!

Im Gegenteil, ich denke mal eine Externe-Beschaltung könnte unter umständen störend sein:
z.B. bei einen FlashVorgang der TC1232 würde dann bereits nach 200ms, 600ms oder 1200ms reagieren und die CPU unter umständen während des Flashvorgangs reseten! Wenn ich dabei nicht regelmäßig den Timer-Pin bediene.

Also warum machen das verschiedene Board-Entwickler? Bei einem 8051/8052 Kann ich das ja verstehen, aber warum bei einem ATMEGA 1280/2560. Oder habe ich da einen Denkfehler?

Bei der Gelegenheit, gibt es im AVRco eigentlich eine fertige Routine für den Watchdog um die Überwachung zu steuern (ein/aus-schalten, rückstellen usw.)?

Vieleicht kann mir einer von euch erfahrenen ATMEGA-Kennern den Grund sagen.
Funktionieren die Internen-Funktionen evtl. nicht richtig?
Oder haben die anderen Leute das evtl. nicht kapiert, das es da was FERTIGES von ATMEL gibt?

Gruß
Thorsten

Hi Merlin.



hmm, but i think, this can handle with a clean-software-function. I can check this every start on the Main-Loop, if the watchdog is off i can turn it on.

A electrical glitch an a misread instruction is not an normal operation! If the MCU make an misread instruction it can go in an illegal-instruction-Mode, this is the moment for an reset from the watchdog1 Or?

OK, with an externel, how it works if the MCU are in BOOT-Mode-ROM, the TC1232 must than switch OFF or the Trigger must keep alive in the BOOT-Mode.



OK, but i have up to 8s Time to keep alive the internal Watchdog, i thing this is a BIG-Timezone to work with my other functions.

And i think i don't must make a Jump to the interrupt. Or?

If i clear the Counter in the Watchdog on every 500-1000 cycles in my Main-Loop, it works. I think so! Or you mean other?

Regards
Thorsten

Hi Thorten.

The standards I am thinking of are safety critical. If your application is not safety critical you do not need an external watchdog. Mostly your statements are correct, but safety critical applictions like to be 'belt and braces'.

Strictly speaking, what this kind of standard calls for is really if the program gets into an unexpected state it is forced to return to a known good state. It need not be an external watchdog, but this is the simplest solution - i.e. if for any reason the processor goes into the weeds it is rebooted, which is a known good state. It can be much harder to demonstrate that this will happen if you use the internal watchdog, because, by definition, the program is not behaving as you expect.

Other alternatives exist. For example in multiprocessor systems this could involve each processor keeping an eye on its neighbours, but the mechanism is essentially the same. You are entitled to assume that two processors will not fail simultaneously.

On Dev boards it is a pain. The chip nearly always ends up getting (temporarily) disabled for a time, so if you do decide to fit an external watchdog, on a dev board I suggest a jumper to allw simple disconnection from the reset line ( and perhaps add an LED to the reset line to indicate a watchdog would have occurred.

Boot mode must allow for the watchdog too, as you say.



Sadly no. If your program has locked in a subroutine, the main loop may never get executed, unless you are using multitasking which raises a whole host of problems of its own (which has been discussed in another thread). Also you could be masking a problem.



You must not toggle the watchdog line in an interrupt.

Cheers

Merlin.

Hello Merlin,

there is always a problem with no absolute resolution. Each kind of Watchdog can be triggered by accident!
I always prefer the AVR mode because it needs a very special sequence to retrigger the Watchdog. Of course the underlying function can also be called by accident. But there is a little bit more security as by simply setting a port bit for the external Watchdog.

rolf