Hello Spehro,
It's the F2013. The other interrupts are never supposed to happen, and definitely no overflow.
But if it just dumps back upon a "non-authorized" interrupt an error condition would go unnoticed. In this case that would most likely be a HW fault on the chip, provided that the remainder of the code is clean and doesn't step on the CCR registers.
It sure looked ugly to me but as you wrote, I guess I'd have to consider it customary :-)
Hello Frank,
In med you have to do a hazard analysis, kind of a "what if" list. The WDT would have to go off, followed by an orderly reaction and often this reaction will be driven by other parts of the circuitry because you may not be able to trust the uC after such an event.
"You might as well service them silently, ..." usually isn't an option if these interrupts come from sources that aren't supposed to ever generate an interrupt. "Or have them set a flag, ..." is almost correct but you'd have to drop the word "Or" :-)
Sorry but I can't at this time. This app wouldn't be too critical if it freezes the uC but I'd still like things to be squeaky clean. Basically I treat every application as if it were a critical medical one.
"Joerg" schreef in bericht news:tXtWg.11090$ snipped-for-privacy@newssvr29.news.prodigy.net...
The set flag idea can be seen as an almost free sanity check, but it is not more than that. You can sprinkle your code with thousands of sanity checks. But they're just sanity checks and nothing else. So you have to decide how many sanity checks you provide, 999 or 1000. In theory you don't need sanity checks, so I see them mainly as an aid during development. And leave them in afterwards.
WDT's are bandages and only cover a very very very small part of (all) potential problems. Allowing a uC/uP to go bananas because of missing stubs is plain stupid and a WDT is certainly not the way to catch those. Static discharges - yes, that should not occur - can alter bits in configuration registers, and all of a sudden you will have your unexpected interrupt. Not providing a stub or harmless vector for it, invites the watchdog, but a system rebooting from a watchdog may already have caused damage or at least aggrevation. Imagine a production line with half finished products. In medical systems, it could be worse than that.
You seriously lack some understanding and should be kept far away from any uC/uP stuff other than toys perhaps ;)
Hello Frank,
Something needs to happen upon a set flag. A flag alone usually won't protect enough.
A WDT is like an airbag. Shouldn't go off but if it does and if the recovery after reset is handled properly it can save the situation as much as an airbag does. IOW your glasses might be busted and the car is totaled but you didn't break your neck. Think of it as crash-worthiness. For most critical applications such as aircraft there are strict rules as to what should happen after something broke. That's why they have three or more independent computer systems for many functions. Two magnetos. Several generators plus an extra one that gets flicked into the air stream (when that comes out, tighten the lap belt really good and re-read the evacuation sheet ...). After a glitch it is absolutely not permitted that any of them quietly return to a state as if nothing had happened. While the array of computers still functions via majority decisions etc. a warning has to be issued.
Then don't develop a complicated coronary crisis anywhere near a large city, including you country. Chances are that a system containing one of my designs will be used on you and it does contain a uC. Of course, while I did the architecture the code was written by experts and was then vetted by numerous other experts in design reviews. And it has undergone rather rigorous agency testing. They look in every nook and cranny. Plus they expect some HW interlocks.
Since the Therac-25 accidents agencies are particularly careful when auditing code. It is a classic example of what can happen when people assume that when the code keeps running it'll be fine:
"Joerg" schreef in bericht news:DGwWg.14432$ snipped-for-privacy@newssvr27.news.prodigy.net...
That's why I wrote: "Or have them set a flag, and turn on a sirene - if you must - but let the system continue as healthy as possible instead of letting it go bananas first and wait for the WDT.".
A 'flag' can be anything, upto and including an email to the VP.
A WDT is for anything you couldn't possibly anticipate in your design. Missing vectors does not fall into that group. Full recovery after a reset is (or can be) very difficult, all data in ram should be treated as possibly corrupt because you have no idea (yet) why the WDT triggered and what has happened in the milliseconds before it kicked in. You would be totally insane not initializing vectors to stubs even for sources that are not supposed to generate any interrupts in the first place.
Interrupts are (in most cases) not the result from processing data, but from external events like timers, counters, hardware inputs etc. Don't let a WDT take care of unexpected or impossible events from those sources. Make a note of it (a flag, a sirene, an email to the VP) if you want, but keep your system up and running. Or do a jmp reset yourself if you really don't have a clue how to handle it.
Never let your system run crazy for milliseconds and possibly corrupting all your vulnerable data, before a WDT kicks in, if you can avoid it. Be good and put vectors in, for all your interrupts, including the so-called impossible ones.
Can't complain about code written by experts.
On Mon, 09 Oct 2006 14:34:54 GMT, "Michael A. Terrell" Gave us:
On Sat, 07 Oct 2006 19:55:41 -0500, John Fields Gave us:
You want crass? Download and look at this list!
It sucks 'cause it is ALL DVD releases, instead of just films.
I think the guy should have made separate tables.
I add a "Do I Own It" column at the "B" position, as well as freezing the top pane so that the column titles are always visible. Other than that, it is a very comprehensive list. Perhaps more so even than the database at IMDB.
We saw "The Departed" last night in a theater...
A nice convoluted almost Hitchcockian adventure ;-)
...Jim Thompson
Hello Frank,
Only thing is that it seems that the presented code doesn't contain a mechanism to generate any flags. That was what puzzled me.
It can detect missing vectors (if set up to do it). Also, some uC have special registers that lets the system know whether a reset was caused by a WDT time-out or by something else like the BOR.
Good to know that you seem to trust my code architecture then ;-)
"Joerg" schreef in bericht news:sEOWg.13179$ snipped-for-privacy@newssvr25.news.prodigy.net...
It is still very much better than nothing. Otherwise that unexpected interrupt may mess up a lot, before your WDT kicks in.
Yes, *some*. You would have to upgrade your precious 8051 designs ;)
I trust them to make a few changes too ;)
On Mon, 09 Oct 2006 19:06:12 -0700, JoeBloe Gave us:
Hey, John! Did you DL this list?
It really is quite comprehensive.
Have something to add? Share your thoughts — no account required.
Ask the community — no account required