GB2105877A - Watch-dog timer circuit - Google Patents

Abstract

A watch-dog timer monitor for the control system of a power plant including a pulse monitor which measures the length of time between successive control pulses from an output port of a computer. In the event that any control pulses exceeds the preselected time interval, the pulse monitor sends a disable signal through a latch to the buffers in the path of the control signals. The buffers instantaneously transition to a blocked condition preventing any subsequent control pulses from reaching the control system of the power plant. A reset button is toggled to reset an initializer which restarts the program in the computer. A start-up delay is also provided to insure that no spurious control pulses reach the control system of the power plant during a warm-up period when the digital logic circuits are settling out.

Description

SPECIFICATION Watch-dog timer circuit Technical Field This invention relates to computer systems and, more particularly, to a watch-dog circuit for use with a microcomputer control system for a fuel cell or the like, to insure a safe, reliable shutdown in the event of a failure in the microcomputer software or logic circuits.

Background Art There are numerous prior art techniques for monitoring a computer to insure its proper operation. One such system is described in U.S. Patent No. 3,795,800 issued March 5, 1974 to J. Nimmo et al for WATCH DOG RELOAD INITIALIZER. This system detects a malfunction in a communication link and after the malfunction has occurred a logic circuit in conjunction with a timing circuit initiates conditioning signals for the sequential operation of a remote processor and a data set in the remote processing system. A timing circuit within the watch-dog reload initializer times out a predetermined time delay. If a software instruction indicating proper operation is not monitored by the watch-dog reload initializer during the delay period, a malfunction condition is assumed.The timing circuit then provides a data set with a signal that effectively disconnects the data set. Following this, the watch-dog reload initializer provides a series of operations to normalize the remote processor and data set. These operations include clearing the remote processor in the remote processing unit of all previous information, disconnecting the remote processor system from the phone line for a predetermined time period, initializing the remote processing system such that it can receive a return message from the central processing unit, and setting up the remote processor in the remote processing system so that it can receive the message from the central processor. Once these operations have occurred the remote processing system is then loaded with the information it had prior to the condition which caused the malfunction.

Another prior art device is described in U.S.

Patent No. 4,072,852 issued to J. Hogan on February 7, 1978 for DIGITAL COMPUTER MONITORING AND RESTART CIRCUIT. This apparatus monitors the presence of periodic output signals from the digital computer with a missing pulse detector. When the detector senses a missing output signal from the computer, it indicates that the computer is not operating. A restart pulse is then generated and is applied to the computer to restart the computer and reset the monitoring circuit.

Disclosure of the Invention An object of the watch-dog timer circuit of the present invention is to provide an improved microcomputer monitoring circuit for shutting down a power plant, or the like, in the event of a microcomputer software or other logic failure.

Another object of the present invention is to provide a failure detection circuit for monitoring the output of a microcomputer controlled fuel cell to automatically bring the power plant to a safe shutdown in the event of a logic or software failure.

According to a particular feature of the watch-dog timer circuit of the present invention, a micro-computer for operating a power plant is monitored for a software failure. In the event that a malfunction occurs, the watch-dog circuitry transitions a series of buffers to their lock-out state which halts the microcomputer and brings the power plant to a controlled shutdown.

According to yet another feature of the present invention, accidental start-up of a power plant or the like, controlled by a microcomputer is prevented. Because digital circuits operate erratically during a start-up period when the voltage level applied by a power supply varies as it approaches its operating potential, the microcomputer could inadvertently generate pulses which could enable the switching elements of the power plant. The watch-dog timer circuit includes a reset switch which must be toggled afer start-up to connect the microcomputer to the switching elements.

The foregoing and other objects, features and advantages of the present invention will become more apparentfrnm the following description of preferred embodiments and accompanying drawings.

Brief Description of Drawings Figure 1 is a block diagram of one embodiment of the watch-dog timer circuit according to the present invention; and Figure 2 is a timing diagram of the watchdog timer circuit depicted in Fig. 1.

Best Mode for Carrying Out the Invention One of the significant features of the watchdog circuit according to the present invention is that it prevents both a faulty start-up of a microcomputer controlling a power plant and also brings the power plant to an automatic shutdown in the event of a software or other logic failure related to the calculations to be performed by the microcomputer. This feature is particularly important where the power plant is a fuel cell, coupled through an inverter, to a power grid, or similar a.c. energy consuming device. The microcomputer typically monitors numerous conditions associated with both the fuel cell, the inverter, and the pow#er grid.In the operation of a fuel cell, inputs to the microcomputer might include such parameters as reformer temperature, stack temperature, stack current, stack voltage, and the microcomputer follows a predetermined program to determine the fuel flow, coolant flow, etc., by changing the control signals applied to various valves, or the like.

Another example of the calculations typically made by a microcomputer relates to the turn on and turn off times for the switching elements of the inverter. Any hang up in the software or logic associated with the calculations performed by the microcomputer could cause serious malfunction resulting in significant damage to the fuel cell or inverter.

Accordingly, it is particularly important that the operation of the microcomputer be carefully monitored. Disabling of the microcomputer is performed by a disable pulse (described in greater detail hereinafter) applied to the reset terminal of the microcomputer which stops the program. At the same time, the disable signal is supplied to tristate buffers which are positioned in the control path to the switching elements of the fuel cell. This disable signal renders the tristate buffers nonresponsive to any stray pulses from the microcomputer.

Referring now to Fig. 1, there is seen one embodiment of a watch-dog timer circuit according to the present invention. A power plant (not shown) is controlled by a microcomputer 10 which typically monitors the numerous operating parameters of the plant and makes descisions by following the sequential stops of a predetermined software program.

The microcomputer 10 has a plurality of output ports 12 through which control pulses for many valves, switches, etc., pass to the respective elements. One or more tristate buffers 13 or similar blocking device may be positioned between the microcomputer 10 and the devices which are to receive the control pulse. As is known, tristate buffers 13 have one terminal, which, when presented with a pulse, cause the device to assume a blocked or high impedance state and no control pulse will be pased therethrough. The output ports 12 are the ports through which pulses pass to the controlled devices. One such port, the port 1 2a, is connected to a pulse monitor and is addressed at the end of the software routine by the microcomputer 10.This pulse monitor includes a one shot multivibrator 14 connected to the output port 1 2a and a timer 16 connected to the one shot multivibrator 14 which times out to transition the one shot back to its stable state after a predetermined length of time related to the program loop time. The output from the one shot multivibrator 14 is connected by a lead 18 to one input of a NAND 20.

The watch-dog timer circuit of the present invention also includes an initializer delay to prevent the pulse monitor circuit from operation when the microcomputer 10 is initializing all of the digital circuits during a start-up period, after a power loss, or other such time as the microcomputer 10 resets all of the logic circuits. The initializer loop includes a one shot multivibrator 22 having its output connected by a line 24 to one input of the NAND 20. A timer 26, such as a simple RC network, times out to transition the one shot multivibrator 22 back to its stable state after the software program has initialized all of the logic elements.

Yet another aspect of the watch-dog timer circuit of the present invention involves a start-up delay loop which allows all of the logic circuitry, including the microcomputer 10, sufficient time during a start-up period to reach a stable state prior to the microcomputer beginning the initializing program for all of the logic elements. The start-up delay includes a flip flop 28 whose output is connected by a line 30 to one input of an AND 32. A timer 34 connected to the flip flop 28 times out shortly after the digital circuits are initially energized and resets all of the digital elements at that point.

A reset button 36 is provided and must be toggled each time the circuit is latched out so that the microcomputer 10 starts the initializing program to load and set all of the digital logic circuitry. The reset button 36 is connected through a conventional debouncer 38 by a line 40 to one input of the AND 32 and by a line 42 to reset both the flip flop 28 and the one shot multivibrator 22.

Referring additionally to Fig. 2, the operation of the watch-dog timer circuit according to the present invention will now be described. As mentioned briefly herebefore, a start-up delay is provided to allow the microcomputer 10 and all of the digital circuits to settle out when the control system is first energized to prevent spurious control pulses that might inadvertently activate the power plant. Before time to, the microcomputer 10 and all of its logic circuits are unenergized, meaning that all circuits are in their low state.

At time to, the microcomputer 10 and the control system for the power plant is energized and the entire system begins to power up. By the time t1 the timer 34 presents a signal to the flip flop 28 indicating a sufficient time has passed to allow settling of the logic circuits. The output from the flip flop 28 is zero as is the output of the AND 32. The watch-dog timer is now in a stable hold condition and ready for the reset switch 36 to be toggled.

At time t2, the manual reset switch 36 is toggled and a pulse is presented to the startup flip flop 28 and also to the initializing one shot multivibrator 22, resetting them both simultaneously. This also presents a pulse via the line 40 to the AND 32. When the reset button is released at time t3, the pulses on the lines 40 and 42 are returned to their stable state and the timing circuit 26 is enabled. At this time t3, all three inputs to the AND 32 are in the high state and it is latched into the ON state causing the microcomputer 10 to begin its initializing program for the logic circuits. At the same time the tristate buffer 13 is enabled, allowing control signals to reach the main switching elements of the power plant.The initializing loop, through the NAND 20, prevents the pulse monitor from disabling the AND 32 prior to the time that the initializing program has been completed and control pulses are generated for the main switching elements. Finally, by time t5 the timer 26 times out and the AND 32 is now responsive to a disabled signal from the one shot multivibrator 14 of the pulse monitor.

As mentioned, the pulse monitor continually monitors control pulses in the output port 12a and the one shot multivibrator 14, in normal operation, is continually reset by each control pulse from the microcomputer prior to the timer 16 timing out. However, if a software failure or other logic failure occurs, the one shot multivibrator 14 would not be reset prior to the timer 16 timing out. Still referring to Fig. 2, if this failure occurs at time t6, the output from the one shot multivibrator 14 on the line 18 changes to its high state and simultaneously, through the NAND 20, disables the AND 32. At this time, a high signal is presented to the tristate buffer 13 which instantaneously renders it nonresponsive to control pulses from the microcomputer 10.

This "pulls the plug" on the power plant by instantaneously interrupting all of the control signals to the fuel cell and simultaneously brings the entire power plant to a complete shutdown.

In this latched out condition, the tristate buffers 13 prevent control signals from reaching the main switching elements and other components of the power plant so that the plant cannot be inadvertently restarted. To restart the entire system, the reset switch 36 is toggled (time t7) and the entire system again goes through initialising steps as described herebefore.

Although this invention has been shown and described with respect to a preferred embodiment, it will be understood by those skilled in this art that various changes in form and detail thereof may be made without departing from the spirit and scope of the claimed invention.

Claims (6)

1. A watch-dog timer monitor for use with a power plant that includes a computer which follows a pre-arranged program in presenting control signals through a plurality of output ports, comprising: a pulse monitor means connected to said output ports of said computer, and including a first timer means having a delay period related to the maximum length of a control pulse through the monitored output ports; blocking means connected downstream of said computer for blocking control pulses to said control system when presented with a disable signal; a reset means including an initializer means for restarting said prearranged program followed by said computer for initializing the logic elements in said control system; and whereby when a control pulse presented by said computer through said monitored output port exceeds a predetermined length, said pulse monitor means presents a disable signal to said buffer means inhibiting control pulses from reaching said control means for said power plant thereby shutting down said power plant.

2. A watch-dog timer circuit according to claim 1, further including a start-up delay means for presenting to said blocking means a disable signal during the power-up phase of said control system, thereby preventing a spurious signal pulse from inadvertently enabling said control means.

3. A watch-dog timer circuit according to claim 2, wherein said start-up delay means includes a flip flop and a timer means, and wherein said flip flop is connected to said latch means, and wherein said timer means transitions said flip flop back to its stable state after a predetermined length of time which corresponds to the warm-up delay.

4. Apparatus according to claim 1, further including a reset means connected to said intializer means and said start-up flip flop for resetting the same when said reset means is toggled.

5. A watch-dog timer circuit according to claim 1, wherein said initializer means includes a one shot multivibrator and a timer for transitioning said one shot multivibrator back to its stable state, said timer having a delay period which corresponds to the time required to initialize all of the logic circuitry in said computer.

6. A watch-dog timer circuit according to claim 1, wherein said pulse monitor means connected to the output port of said computer includes a timer having a delay of slightly longer than the maximum length of the control pulse passed through said output port, and wherein said pulse control means, unless reset, is transitioned to its stable state by said timer means creating a disable signal which transitions said blocking means to its blocked state.