Tutorials to .com

Tutorials to .com » Mechine » Embed » AT91 RM9200 used to build highly reliable embedded systems

AT91 RM9200 used to build highly reliable embedded systems

Print View , by: iSee ,Total views: 26 ,Word Count: 3457 ,Date: Sat, 22 Aug 2009 Time: 10:02 AM

Abstract A AT91RM9200 processor-based dual-plane high-temperature preparation of reliable solutions. The use of EPlC6, MAX6374 external design of the two redundant processors Watchdog monitoring system status, use of the Watchdog as AT91RM9200 own internal monitoring mechanism to monitor processor's own fault; designed and given to AT91RM9200 monitoring mechanism at the core of the concrete realization, including the heartbeat signal to send and interrupt service routine design.

In this paper, a design to AT91RM9200 processor as the core high-reliability embedded systems. System has two units, when a unit after the failure of the other work units to take over and continue running. System to provide external and internal Watchdog (watchdog) monitoring mechanisms constitute a redundancy, monitoring levels of reliability design. Watchdog outside of which were used MAX6374 and EPlC6 FPGA to build a monitoring circuit, and the internal Watchdog while the Watchdog using AT91RM9200 own module. In this paper, hardware and software from two perspectives on the system.

1 System design of the overall structure

1.1 AT91RM9200 processor

AT91RM9200 is produced by a Atrnel Industrial ARM9 processor, embedded ARM920T ARM Thumb processor core, when the 180 MHz frequency for performance up to 200 MIPS, and built-in 16 KB SRAM and 128 KB ROM. External bus interface (EBI), such as support for SDRAM memory, with seven external towel off the source of a fast interrupt sources and four 32-bit PIO controller, supports up to 122 programmable I / O port. At the same time, the chip also embedded Ethemet MAClO/100M interface, and provides USB 2.0 full speed host port interface and equipment, as well as other commonly used external interface.

1.2 System architecture Design

In order to improve the reliability, the system prepared based on the temperature of the system-level reliability design. Temperature in the preparation of hot and cold prepared based on the development of a Fault-tolerant technology, which means the two units at the same time power, but only in the work of the host state, prepared by machine in a "warm state" (idling waiting to take over the work of the host state). When the host failure, by preparing to take over the host machine to continue its work. Machine repair failure after the preparation of a new machine. Compared with the hot, warm preparation program with a simple, stable performance, etc.; options in relation to cold, temperature in the preparation of the program prepared in the host machine can quickly reboot the system after the failure, thus minimizing system failures caused by short-term loss.

System with two processor modules, each processor module are calculated AT9lRM9200 core, referred to as "units." Each unit can be an independent subsystem to complete the tasks. System also has an arbitration board for arbitration, and control data signals double the work. System block diagram shown in Figure l.

AT91 RM9200 used to build highly reliable embedded systems

AT91RM9200 own use of a variety of peripheral interfaces, each unit in addition to the processor module, but also with an Ethernet interface, USB interface (USB interface for connecting a wireless network adapter) and RS232 serial interface. The unique use of network communications work, each unit on the wired network interface to connect to a hub, USB access several wireless card works in managed mode, so do not need to focus on the network interface of the arbitration signal input / output, the system only arbitration board provides serial input / output signal arbitration. In this way for two-machine synchronization information between the transmission of an effective way: Two-machine running on an application can use the wired network or wireless network synchronization information transmission, when the system breakdown, the preparation of the user machine can be synchronization point from the beginning of the recent work, in order to minimize the losses caused by host failures.

Arbitration control logic board through two units of the control signal interface unit to obtain the current status of work in order to determine the mode of the current system, and accordingly the control unit and external devices. Control logic is also responsible for the provision of two units to the working conditions of the current system in order to run in the units in the decision-making applications.

1.3 System Reliability Design

In order to improve overall system reliability, to be prepared in accordance with the characteristics of temperature control mechanism design. The system for each unit are equipped with Watchdog circuit for monitoring operation of generating units. Once a fat cow unit failure, after a certain period of time, the fault plane corresponding to the Watchdog detects the emergence of fault, and through the fault reset signal generating unit failure nReset send units to another unit at the same time sent to take over the IRQ signal to inform the work of . Host control logic to maintain the connection with external devices, once the system breakdown, the control logic to change the working conditions, access to a new host and external devices.

In the system, using internal and external levels, monitoring strategies. Internal control program using AT91RM9200 processor module internal Watchdog; external monitoring programs in the use of arbitration boards and special EPlC6 FPGA chip MAX6374 to achieve Watchdog. Which, MAX6374 chip to achieve the main function of the external monitor. When the MAX6374 damage, is used at internal EP1C6 the realization of the use of hardware description language of the Watchdog to take over the work of the external monitor in order to constitute an external monitoring mechanism redundant. Internal control mechanism than the priority of the external monitoring mechanism for the arbitration board's priority. If the arbitration board of two Watchdog failure occurred, therefore, unable to restart the CPU boards, AT9lRM9200 internal Watchdog role is going to happen to restart the CPU. This is by controlling the Watchdog counter both internal and external to the length of time to achieve. MAX6374 timing will be set-up time for the 3s, EPlC6 the regular time is set to 4s, and AT9lRM9200 internal Watchdog timer time is set to 5 s. AT91RM9200 Internal Watchdog therefore software and hardware Watchdog arbitration board constituted a two-tier system of monitoring, a redundant control mechanisms. Reliability of the system design diagram as shown in Figure 2.

AT91 RM9200 used to build highly reliable embedded systems

2 Based on AT91RM9200 multi-level monitoring mechanisms to achieve

2.1 Design the use of external monitors MAX6374

The use of the arbitration board of the MAX6374 chip Watchdog dedicated circuit. Maxim's MAX6374 foot a low-power chip Watchdog, power Miriam 5μA, package 8-pin SOT23. Through its regular cycle of the pin SET2, SETl and SETO program, which was a different time from time to time. Cycle, such as MAX6374 timing listed in Table 1, the circuit schematic diagram shown in figure 3.

AT91 RM9200 used to build highly reliable embedded systems

AT91 RM9200 used to build highly reliable embedded systems

WDI input of the MAX6374 with the AT91RM9200 port directly connected to the PIO, but with WD0 output nReset pin connected to the AT91RM9200. In actual use, the SETO, SETl and SET2, respectively, is set to l, 0 and O. AT91RM9200 in 3 s, if not issued within the heartbeat signal, the MAX6374 will be sent in a low-end WDO pulse to reset on AT91RM9200. In addition, the FPGA can also be on port 3 SET programming to meet the needs of different timing intervals.

2.2 Design the use of external monitors EPlC6

In addition to using dedicated Watchdog Circuit MAX6374, the FPGA can also be used to design a monitoring module as a redundant circuit MAX6374. Using Altera's another external EPlC6 FPGA design Watchdog. AT91RM9200 heartbeat signal sent through the control unit into EPlC6 signal interface, the custom of the EPlC6 Internal Watchdog hardware reset for the cyclical; In addition, EPlC6 two units is also responsible for arbitration of their respective serial signals. With Watchdog Function and arbitration functions of FPAG module known as the "arbiter." Figure 4 is the arbiter of the structure and function of Fig.

Figure 4 in the key signal as follows:

AT91 RM9200 used to build highly reliable embedded systems

(1) module symbols

cpu0 and cpul Fault-tolerant system for two units of symbols; ARBITER Arbitration for arbitration device module, the judge marks the completion of the host; DBOUT for data communication arbiter module, the data signals to arbitration to communicate with the outside world; WDT0 and WDT1 for the Watchdog module, respectively, to monitor the work of the unit.

(2) input / output signal

wdil for the CPU and wdiO sent to the cyclical nature of the Watchdog heartbeat signal, for the CPU is working properly marked; IRQ0 and IRQ1 interrupt request signal for requesting the corresponding CPU units start to take over the unit failure; nRESET0 and nRESETl reset signal for the CPU; ARBITER module clk for synchronous signal.

Watchdog outside the main structure of Verilog code is as follows:

AT91 RM9200 used to build highly reliable embedded systems

As can be seen, the module counts the time determined by the clock signal clk. The system uses a 40 MHz crystal clock, so if you need a length of 4 s of the regular time set for the counter value should be of 40 000 0004 = 160 000 000. After 4 s, if the processor Watthdog sent did not receive the heartbeat signal, the port will be through the FPGA to send AT9lRM9200 low reset pin of the reset signal.

wdi1 of wdi0 and arbiter is asynchronous input signal. This allows easy transmission of signals in the FPGA, the time required can not be accurately estimated, when the two signals simultaneously hopping the moment, we have had a "competition and adventure." After simulation in the timing of the waveform will often have some incorrect signal peak burr. In addition, as a result of FPGA and CPLD devices other internal distributed capacitance and inductance of the circuit does not filter the basic role of Burr, these burrs signal will be "reservations" and delivered to the following level, so that a more prominent problem burr. To this end an increase in the design in Figure 4 as the overall signal clk clock synchronization signal. It is also the FPGA's clock signal, and its role is to enable the signals from the Watchdog "in parallel" to enter into arbitration device, so that the signal can be eliminated burr.

wd0 and clk synchronization code wdl as follows:

AT91 RM9200 used to build highly reliable embedded systems

2.3 Internal Watchdog module designed to use the internal monitor

Watchdog module embedded AT9lRM9200 for a deadlock in the software to prevent system lock. Its structure based on a 16-bit down counter, counter value of the register from the AT91RM9200 loaded ST_WDMR, as shown in Figure 5.

AT91 RM9200 used to build highly reliable embedded systems

When the Watchdog reset, ST_WDMR the value of 0x00020000, the maximum corresponds to the counter; when Wathdog overflow, the pin will be in NWDOCF a width of eight slow clock cycles Watchdog overflow of low-level signals. In a typical clock frequency of 32.768kHz slow, the use of slow clock frequency of 128 times the signal to determine the maximum Watchdog period of 256 s. Under normal operation, Watchdog timer overflow before, you can set up ST_CR (Control Register) bit WDRST the regular heavy duty Watchdog.

If there is overflow, Watchdog timer will be: ① set interrupt generated ST_SR (Status Register) bit of WDOVF; ② If ST_WD-MR in the EXTEN bit position, then Watchdog overflow signal in a slower clock cycle 8, low power ping pulse; ③ RSTEN if ST_WDMR in position, and will generate an internal interrupt reset; ④ overloaded and restart down counter.

ST_WDMR not write down counter heavy load or restart, only when writing to ST_CR after, Watchdog counter immediately loaded by ST_WDMR value and restart. Watchdog in the use of internal AT91RM9200 need work Watchdog set to AT91RM9200 processor internal reset. Specific settings as follows:

Watchdog in order to prevent overflow. Members need to periodically register Purchase ST_CR, in order to complete the value of the Watchdog reset.

AT91RM9200 in Atmel configured for ARM Linux operating system, has provided the use of AT91RM9200 Internal Watchdog interface. In the internal Watchdog configured the ARM Linux operating system will create / dev / misc / Watchdog device file, all internal Watchdog for operation AT9lRM9200 can file by visiting the device to complete. Specific methods of operation are as follows:

(1) Open Internal Watchdog

The use of the method, Watchdog will be activated and begin to count. Watchdog If time does not count the Watchdog reset, then the system will restart.

(2) reset the internal Watchdog

Watchdog will always run after the restart. If the deadlock due to procedural or other reasons leading to the collapse of the processor, then the Watchdog will not be able to successfully reset, the Watchdog will restart counting after the AT91RM9200, allowing the system to re-run. This approach to enhance the reliability of the system software to prevent deadlock, or strong electromagnetic interference caused by processor failures to provide an effective means of protection.

2.4 AT91RM9200 heartbeat signals sent

System to monitor the two external circuits are required to provide periodic AT9l RM9200 heartbeat signal, in order to monitor the status of the system; At the same time have access to an external monitor AT91RM9200 send the interrupt signal circuit, and then change the system operation unit. More than functional units need to directly operate the AT91RM9200. Can be through the AT91RM9200 cyclical PIO port level Set / reset to achieve the heart rate signal to send.

AT91RM9200 controller total of 4 PIO (ie PIOA, PI-OB, PIOC and PIOD), respectively, each PIO Controller PIO control port 32. PIO ports each have multiple functions, such as the common output, synchronous data output, general input, interrupt sources, such as peripheral options. The heartbeat signal sent PIO port settings need to be output as an ordinary function, the PIO, mainly through the control of the GPIO controller AT9lRM9200 completed. In this design, will NCST/PCI3 port as heartbeat signals sent AT91RM9200 port, output port for NCS7 settings are as follows:

PIOC_OER | = 0xD; / * enable output NCS7 function * /

PIOC_PER | = 0xD; / * set up client NCS7 controller 13 for PIO * / if NCS7 port set to high, then the use of the following methods:

PIOC_SODR | = 0xD; / * set the port for the high NCS7 * / NCS7 If you want to port is set to low, then the use of the following methods:

PIOC_CODR | = OXD; / * set low NCS7 port * / one, PIOC_OER, PIOC_PER, PIOC_SODR and PIOC_CO-DR were PIOC controller output enable register, PIO Enable Register, Chi-bit output data register and Clear output data register. AT91RM9200 heartbeat signals sent by the system software is responsible for a separate control process.

2.5 AT91RM9200 Design interrupt service routine

When the unit normal working hours, the system board to the arbitral process of external control module to send heartbeat signal that signal WDI. External control module through the heart of the two units send signals to determine the current state of Fault-tolerant systems. If after a specified time, the arbitration board has not received the Watchdog module unit to send a heartbeat signal will be sent to another unit interrupt signal, to inform them to take appropriate action. If another unit for the preparation of machine, the machine on the system prepared by the procedure will start the user program immediately; if another unit for the host, the host will not carry out any operation, when the user program has been running on the host. The failure of the unit will be reset by re-attempt to repair faults. Units running in the interrupt service routine is responsible for receiving the external interrupt signal sent Watchdog. For external interrupt handling AT91RM9200 there are two programs.

(1) the use of an external interrupt source AT91RM9200

AT91RM9200 own as a result of seven common external interrupt source and a fast interrupt source, it can be arbitrary AT91RM9200 external interrupt pin and the system of external Watchdog interrupt signal connected to the output.

For example, if you want to use the AT91RM9200-pin IRQ0 interrupt source as required in the AT91RM9200 driver method used to set up as follows:

request_irq function is disrupted in the Linux operating system, application function. The function of the application to the interruption of the operating system interrupt AT91C_ID_IRQO number and notify the operating system interrupt handling of the interruption function at91_interrupt_IRQ0. Subsequently, the definition of at91_interrupt_IRQ0 function:

In this way, once the AT91RM9200 port IRQO the level of occurrence of high to low transition will lead to the implementation of at9l_interrupt_IRQO function.

(2) the use of the PIO port AT9lRM9200 as interrupt source

In addition to the AT91RM9200 own external interrupt source, it also can be used to provide AT9lRM9200 rich as the interruption of the PIO input port. This system, the use of the GPIOC7 pin AT9lRM9200 as interrupt source, at this time of need AT91RM9200 driver settings using the following methods:

request_irq (AT91C_ID_PIOC, at91_interrupt_PIOC, O, "at91Rm9200 interrupt PIOC", NULL);

The function applied to the operating system interrupt AT91C_ID_IPIOC number of interruption, and notification of the suspension of the operating system interrupt handling function at91_interrupt_PIOC. PIOC controller in order to enable the interrupt function, but also need to set the corresponding interrupt control register: PIOC_IER | = 0x7;

Interrupt handling function can add the code to start the user program, so that once receiver AT9lRM9200 issued by the Watchdog interrupt signal after the interruption of the process will be called in order to start the user's application.


In this paper, AT91RM9200 processor built with the temperature system Fault-tolerant features. The system-level redundancy, high reliability levels, the design of monitoring programs, with simple and low cost, key areas to meet the general needs of embedded systems. Proven, the system can occur in response to board-level and processor-level fault, the extension of the system's mean time between failures, the application better.

Embedded Systems Articles

Can't Find What You're Looking For?

Rating: Not yet rated


No comments posted.