Компьютерлік іркілуді қадағалау таймері

Electronic timer used to detect and recover from computer malfunctions

A watchdog timer (WDT, or simply a watchdog), sometimes called a computer operating properly timer (COP timer), In real time operating systems, a watchdog timer may be used to monitor a time critical task to ensure it completes within its maximum allotted time and, if it fails to do so, to terminate the task and report the failure.

The act of restarting a watchdog timer is commonly referred to as kicking the watchdog. Kicking is typically done by writing to a watchdog control port or by setting a particular bit in a register. Alternatively, some tightly coupled watchdog timers are kicked by executing a special machine language instruction. An example of this is the CLRWDT (clear watchdog timer) instruction found in the instruction set of some PIC microcontrollers. In computers that are running operating systems, watchdog restarts are usually invoked through a device driver. For example, in the Linux operating system, a user space program will kick the watchdog by interacting with the watchdog device driver, typically by writing a zero character to or by calling a KEEPALIVE ioctl. The device driver, which serves to abstract the watchdog hardware from user space programs, may also be used to configure the time out period and start and stop the timer. Some watchdog timers will only allow kicks during a specific time window. The window timing is usually relative to the previous kick or, if the watchdog has not yet been kicked, to the moment the watchdog was enabled. The window begins after a delay following the previous kick, and ends after a further delay. If the computer attempts to kick the watchdog before or after the window, the watchdog will not be restarted, and in some implementations this will be treated as a fault and trigger corrective action.

A watchdog timer is said to be enabled when operating and disabled when idle. Upon power up, a watchdog may be unconditionally enabled or it may be initially disabled and require an external signal to enable it. In the latter case, the enabling signal may be automatically generated by hardware or it may be generated under software control. When automatically generated, the enabling signal is typically derived from the computer reset signal. In some systems the reset signal is directly used to enable the watchdog. In others, the reset signal is delayed so that the watchdog will become enabled at some later time following the reset. This delay allows time for the computer to boot before the watchdog is enabled. Without this delay, the watchdog would timeout and invoke a subsequent reset before the computer can run its application software — the software which kicks the watchdog — and the system would become stuck in an endless cycle of incomplete reboots.

Watchdog timers come in many configurations, and many allow their configurations to be altered. For example, the watchdog and CPU may share a common clock signal as shown in the block diagram below, or they may have independent clock signals. A basic watchdog timer has a single timer stage which, upon timeout, typically will reset the CPU:

Two or more timers are sometimes cascaded to form a multistage watchdog timer, where each timer is referred to as a timer stage, or simply a stage. For example, the block diagram below shows a three stage watchdog. In a multistage watchdog, only the first stage is kicked by the processor. Upon first stage timeout, a corrective action is initiated and the next stage in the cascade is started. As each subsequent stage times out, it triggers a corrective action and starts the next stage. Upon final stage timeout, a corrective action is initiated, but no other stage is started because the end of the cascade has been reached. Typically, single stage watchdog timers are used to simply restart the computer, whereas multistage watchdog timers will sequentially trigger a series of corrective actions, with the final stage triggering a computer restart. can be configured to perform tests that cover resource availability (e. g., sufficient memory and file handles, reasonable CPU time), evidence of expected process activity (e. g., system daemons running, specific files being present or updated), overheating, and network activity, and system specific test scripts or programs can also be run. Upon discovery of a failed test, the computer may attempt to perform a sequence of corrective actions under software control, culminating with a software initiated reboot. If the software fails to invoke a reboot, the watchdog timer will timeout and invoke a hardware reset. In effect, this is a multistage watchdog timer in which the software comprises the first and intermediate timer stages and the hardware reset the final stage. In a Linux system, for example, the watchdog daemon could attempt to perform a software initiated restart, which can be preferable to a hardware reset as the file systems will be safely unmounted and fault information will be logged. It is essential, however, to have the insurance provided by a hardware timer, since a software restart can fail under a number of fault conditions.