ASIL-D compliant watchdog application design

At present, while the development momentum of automobile automated driving is rising steadily, various painful quality accidents frequently occur. Demand promotes change, and demand promotes the rapid implementation of functional safety in automotive electronics. This article will take you to appreciate the watchdog in high-level safety design .

In electronic systems with increasingly higher requirements for automotive safety, in order to ensure that system programs run according to the expected process, the monitoring measures of the program by the watchdog have become an indispensable part of the functional safety requirements. For example, the monitoring of program running logic and program running time, etc., such watchdog application requirements cannot be met by general watchdogs. ZLG  recommends the use of FS45/65 power management chips for users. Its watchdog is implemented based on the "question/answer" principle, which can well support related functional safety designs.

1. Introduction to Watchdog

Figure 1 Challenger WD

The watchdog of FS45/65 is Challenger WD, and the watchdog refresh is implemented based on the "question/answer" principle: FS45/65 generates 8-bit pseudo-random numbers based on the linear shift register (LFSR). The MCU  can send a custom LFSR seed or use the default LFSR value (0xB2) of FS45/65 to perform predefined calculations and send the results to FS45/65 through SPI for verification. If the verification is correct, a new pseudo-random number will be generated; if the verification is wrong, the WD error counter will increase, the value of WD_LFSR will remain unchanged, and the WD error counter will reach a certain threshold according to the predetermined configuration, and control RSTB and FS0B, so that the system enters a safe state.

Any WD refresh will restart the window, which ensures  the synchronization between   MCU and FS65. At the same time , the external watchdog independent of the MCU  system can better ensure the stability of the system.

2. Watchdog Window

Figure 2 Watchdog window

The first watchdog refresh is in the INIT phase. After the first watchdog refresh, the device enters the normal WD refresh mode and the MCU must refresh the watchdog during the watchdog window opening. The watchdog window time can be configured from 1.0ms to 1024ms in the WD_WINDOW[3:0] bits. The watchdog can only be disabled in the INIT phase to allow "reprogramming".

• Whether it is a good or bad WD refresh or WD timeout, a new WD window will be restarted;

• The window time can be changed at any stage, and the changed window time will be reflected after the next WD refresh;

• The duty cycle of the window is 50%±10% and cannot be modified.

3. Watchdog Error Count

Figure 3 Watchdog error counter

FS45/65 implements watchdog error counter management. The device determines the actions of RSTB and FS0B by configuring the watchdog error count threshold in the INIT phase, ensuring that the system can quickly enter a safe state when a serious watchdog fault occurs.

In case of a watchdog fault, the WD error counter is incremented by 2; in case of a correct refresh, the WD error counter is decremented by 1. This principle ensures that the cyclic "OK/NOK" behavior converges on fault detection. To allow application flexibility, the maximum value of this counter can be configured using the WD_CNT_RFR[1:0] bits during the INIT phase.

The watchdog error counter value can be read by the microcontroller at the WD_ERR[2:0] bit to diagnose whether the watchdog is refreshed correctly.

4. Watchdog refresh counter

Figure 4 Watchdog refresh counter

The watchdog refresh counter is used to decrement the fault error counter. Every time the watchdog is refreshed correctly, the watchdog refresh counter will increase by 1, and every time the watchdog refresh counter reaches 6, if the next WD refresh is also good, the fault error counter is decremented by 1.

Regardless of the current value of the watchdog refresh counter, each time an error occurs while refreshing the watchdog, the watchdog refresh counter will be reset to 0
.

Figure 5   ZLG  resources

ZLG has prepared comprehensive device usage and functional safety resources for users, including device evaluation kits, basic function usage documentation, basic function codes, functional safety usage documentation, and functional safety SafetyLib.

VI. Conclusion

FS45/65 is far superior to traditional window watchdogs in terms of watchdog response strategy, fault count management function and diagnosis. It can effectively ensure the stable operation of the system and complies with the relevant technical requirements of the national standard GB/T 34590-5 program sequence monitoring, achieving a very high level of diagnostic coverage.