Watchdog timers and FPGA designs

[gahelton]

First, I'm sorry if this is a re-hash of any existing posts, many of which I have read. But I think that a watchdog timer would be useful for my design.

This one seems relevant.

https://www.edaboard.com/threads/watchdog-reset-for-fpga-designs.247625/

The way that a watchdog would have to work is different than with a microcontroller design. For microcontrollers, the logic is sequential while on the FPGA it is highly parallel.

The way that I would envision a watchdog to work for a FPGA would be to have each critical, clocked process write to a large watchdog register when it has completed. All the bits of register would be logically "ANDed" together, and the output from the AND would reset the watchdog timer. If any process failed or locked up, the watchdog timer would not be satisfied, and force an internal reset. Anytime the watchdog timer is reset (all processes have set their respective bits saying that "I'm ok", then the watchdog register would be cleared in addition to the timer). The watchdog timer would need to be setup to timeout for the longest possible process in the system. Some processes will run in a clock cycle or two, and some may not be satisfied with it's logic for dozens of clock cycles.

One person suggested that each process with a state machine could provide it's own state reset in the event of a hang-up. While that would be nice, I think that would require a lot more resources since I have a lot of processes.

What is the best practice for providing a watchdog for a FPGA design ?

Thanks.

 

[ThisIsNotSam]

It is not clear what your watchdog is watching. Having multiple FSM-like pieces of logic doing things in parallel is natural digital design, why do you expect them to hang?

 

[KlausST]

Hi,

On a quick thought it makes not much sense.

It´s not like software, where the program counter (code address) may get corrupt.
An FPGA is hardware processing in parallel.

So each "process" should have a predictable timing ... and should be properly constrained in first place.

Maybe we need more information on why you think this could be necessary.

Klaus

 

[FvM]

The above quoted previous thread discusses real scenarios where e.g. a state machine gets stuck in an illegal state due to inappropriate processing of asynchronous input signals. We get reliably rid of similar problems by using state-of-the art signal synchronization and have safe state-machine option as an additional precautional measure in critical designs, but never use a watchdog.

If we implement a watchdog in FPGA, it's monitoring health state of an accompanying processor.