Condition monitoring & predictive maintenance Diagnostic Technique/Measure
Watchdog with a separate time base without a time window
Watchdog with a separate time base and time window
Combination of temporal and logical monitoring of programme sequences
Figure 5. Checking the correct logic of the sequence through markers.
While watchdogs with a separate time base and time window offer higher diagnostic coverage compared with simple WDTs, they still cannot capture issues concerning whether the software’s subroutines have been executed in the correct sequence. This is what the next diagnostic technique addresses.
COMBINATION OF TEMPORAL AND LOGICAL MONITORING OF PROGRAMME SEQUENCES
Diagnostic techniques involving the combination of temporal and logical monitoring provide high diagnostic coverage of programme sequences according to IEC 61508-2. An example implementation of this technique involves a windowed watchdog and a capability to check whether the programme sequence has been executed in the correct order.
An example can be visualised when the circuit in Figure 2 is combined with the sequence in Figure 5, where each of the MCU’s programme routines employs a unique combination of characters and digits. Such unique combinations are then placed in an array each time a routine is executed. After the last routine, the MCU will only kick, or send a reset signal to, the watchdog if all words are correctly set in the array.
CHALLENGE/RESPONSE ARCHITECTURE In some systems, more diagnostic coverage may be required to capture failures of the MCU, which may mean that simply sending back a pulse within a time window is not enough. It may therefore be beneficial to require the MCU to perform a complex task, such as a calculation, to ensure that it is fully operational.
+ 1 that will shift all bits upwards towards the most significant bit (MSB) and insert the calculated bit as the new least significant bit (LSB). The MCU must compute the response in this manner and return it to the MAX42500’s register through I²C. Notably, this polynomial is identified as primitive and, at the same
This is where the MAX42500’s challenge/ response watchdog can come into play. In this watchdog mode, there is a key-value register in the IC that must be read as the starting point of the challenge message. The MCU must utilise this message to calculate the appropriate response to send back to the watchdog IC so the watchdog can be kicked within the valid window. This type of challenge/response watchdog operates similarly to a simple windowed one, except that the key register is updated rather than the watchdog being refreshed with a rising edge. This is shown in Figure 6. Notably, for the MAX42500’s watchdog timer, the watchdog input is implemented using I²C, while the watchdog output is the output reset pin. The MAX42500 contains a linear-feedback shift key (LFSK) register with a polynomial of x8 + x4
+ x6 + x5 Maximum DC Considered Achievable Low Medium High Table 1. According to IEC 61508-2 Annex A Table A.10 - Programme Sequence (Watchdog)
time, a maximal-length feedback polynomial for eight bits. This ensures that all bit-value combinations (1 to 255) are generated by the polynomial and the order of the numbers is pseudo-random. Such a challenge/response can offer more coverage than the combination of temporal and logical programme sequence monitoring, as it shows that the MCU can still perform actual calculations. This is as opposed to an MCU implementing only decision-making routines, such as checking whether the array of words is correct before issuing a signal to reset the watchdog.
DIAGNOSTIC COVERAGE CLAIMS The basic functional safety standard has maximum claimable diagnostic coverage for each diagnostic measure recommended per block in an SRS. Table 1 corresponds to programme sequence monitoring according to IEC 61508, which utilises watchdog timers. Furthermore, where different implementations may not be covered in the standard, claimed diagnostic coverage can only be validated through fault insertion testing.
CONCLUSION
This article outlines three types of diagnostic measures that use watchdog timers, as recommended by IEC 61508-2, to address failures in programme sequence. The first type of watchdog, which has a separate time base but no time window, can be implemented using a simple watchdog. This diagnostic measure can only claim low diagnostic coverage.
The second type of watchdog, which has both a separate time base and a time window, can be implemented using a windowed watchdog. This measure can claim medium diagnostic coverage. To improve diagnostic coverage to high, logical monitoring can be employed alongside the usual temporal monitoring using watchdogs. A challenge/response windowed watchdog architecture can further increase diagnostic coverage against programme sequence failures through its capability to check an MCU’s computational ability.
Figure 6. Challenge/response windowed watchdog. 62
Analog Devices
www.analog.com
October 2026 Instrumentation Monthly
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68 |
Page 69 |
Page 70 |
Page 71 |
Page 72
