Introduction

This chip integrates four watchdog timers: one independent watchdog timer (IWDG) and three system watchdog timers (WDG).

  • IWDG: a shared watchdog for KR4 and KM4

  • WDG0: a watchdog timer for KR4

  • WDG1: a secure watchdog timer for KM4

  • WDG2: a non-secure watchdog timer for KM4

../../../rst_um/peripherals/8_wdog/figures/watchdog_architecture.svg

Watchdog architecture

All four watchdog timers can trigger the reset of the corresponding CPU or the whole system. The reset logic is illustrated in the following sections.

Independent Watchdog Timer

The independent watchdog timer (IWDG) is powered by always-on power and always-on clock source, which means that it can stay active even when the main power or crystal fails. Also, IWDG can be configured to start by hardware at the very beginning of reset.

Features

  • Powered by always-on power and always-on clock source

  • Once enabled, cannot be disabled

  • Can wake up the system from sleep mode with an early interrupt

  • Can reset the whole system even in sleep mode

  • Optional early interrupt can be generated at a programmable time prior to watchdog timeout

  • Gated automatically when the KR4 or KM4 processor is in debug mode

  • Can be configured to run or gate in sleep mode

  • A separate wake reason for each watchdog timer

Clock and Power

The IWDG is powered by always-on power and clocked by an always-on 100kHz. The processer cannot shut off the power and clock after the system boots up, so there is no way to disable the IWDG after enabled.

The always-on 100kHz clock is a no-calibration clock, so it may have a margin of error of 50%. When feeding the watchdog, software should take the margin into consideration. Moreover, we do not suggest enabling the window function of IWDG.

The IWDG will be reset in deep-sleep mode, so the IWDG should be enabled again by software or hardware after wakeup again. IWDG can be configured to retain or keep counting in sleep mode by setting the LPEN bit in the control register. The watchdog timeout event in sleep mode can reset the whole system, and the early interrupt in sleep mode can wake up the system.

The early interrupt of IWDG is connected to both KM4 and KR4, however only the CPU working as KR4 is suggested to handle the interrupt.

OTP can auto-load an AON register to trigger IWDG enable. The register can only be set from 0 to 1, meaning that once the IWDG is enabled by hardware, it will automatically run no matter the initial boot or waking from deep-sleep.

The IWDG keeps counting when one of the CPUs is active (both clock and function enabled) and non-CPU is in debug mode.

../../../rst_um/peripherals/8_wdog/figures/iwdg_clock_and_function_enable_diagram.svg

IWDG clock and function enable diagram

Note

LPEN bit shall be 1 by default to let the IWDG keeps counting in HW PMC stage if IWDG is enabled by HW, And CPU need to clear LPEN bit when IWDG be configured to retain in sleep mode.

Reset Architecture

The IWDG has the highest privilege. The IWDG timeout will trigger GLB_RST, and this reset signal will reset the whole system, including all the processors and almost all the peripherals. Only very few peripherals won’t be reset by GLB_RST, e.g. RTC, AON PAD.

../../../rst_um/peripherals/8_wdog/figures/iwdg_reset_control.svg

IWDG reset control

System Watchdog Timer

The power and clock of system watchdog timers (WDG 0/1/2) are protected by itself. Once the watchdog is enabled, the processor cannot shut off the watchdog’s power and clock again.

The WDG1 is a secure watchdog timer, which can only be accessed from secure word.

Features

  • Optional early interrupt can be generated at a programmable time prior to watchdog timeout

  • Gate automatically when the processor is in debug mode

  • Gate and maintains settings in sleep mode.

  • Window protection function and timeout cannot be changed anymore once WDG is enabled.

  • A separate boot reason for each watchdog timer

  • After watchdog is enabled, the reload register can only be decreased, not increased.

Clock and Power

The system watchdog timers are powered by SYSON and clocked by SDM32K.

The secure watchdog timer (WDG1) is guaranteed by itself and can only be accessed from secure word. It will be gated automatically when the CPU enters debug mode or the CPU is gated.

../../../rst_um/peripherals/8_wdog/figures/swdg_clock_and_function_enable_diagram.svg

SWDG clock and function enable diagram

Functional Description

Workflow

The workflow of system watchdog timer is illustrated in the following figure.

../../../rst_um/peripherals/8_wdog/figures/watchdog_workflow.svg

Initialization

Watchdog initialization

Step

What to do

How to do

Comment

1

Check HW IWDG enable

IWDG can start counting when hw_wdg_fen is asserted.

  • For the IWDG prescaler, using default value 0x63

  • For the WDG1~WDG0 prescaler, using default value 0x1F

For the reload counter, using default value 0xFFFF

IWDG can be enabled by HW and SW, but WDG1~WDG0 can only be enabled by SW.

2

Enable register access

Write “0x6969” into the WDG_MKEYR register

Enable register access to the WDG_CR/

WDG_RLR/WDG_WINR registers

3

Program Reload register

Configure the RELOAD and PRER bits of the WDG_RLR register

4

Program Control register if needed

Configure the EICNT bit of the WDG_CR register

5

Program Window register if needed

Configure the WDG_WINR register

Enable the window protection

6

Enable SW WDG

Write “0x3C3C” into the WDG_MKEYR register

WDG is enabled by SW.

7

Enable reload command if needed

Write “0x5A5A” into the WDG_MKEYR register

Reload value for WDG counter

Operation Flow

Hardware Enable

In the OTP area, one bit is used to control the IWDG automatically to enable the function. There is no difference between hardware WDG (enabled by hardware) and software WDG (enabled by software). When the HW WDG is enabled, the prescaler will use default value 0x63 and the reload counter will use default value 0xFFFF.

An application can adjust the barking interval of the watchdog. Once the IWDG is enabled, it cannot be disabled anymore. No matter which way is used to enable the watchdog timer, the software is responsible for feeding the dog to prevent barking.

The system watchdog timers can only be enabled by software.

Low-power Mode

For IWDG, whether the IWDG can keep running or gating in sleep mode depends on the LPEN bit.

  • If LPEN is cleared, the clock for IWDG will be gated internally, and IWDG will be frozen with all status maintained.

  • If LPEN is enabled, IWDG will keep counting down, wake up the system if the early interrupt event fires, and reset system if the dog barks.

For system watchdog timers, each of them can maintain its registers but keep freezing in sleep mode. Counting down will resume after leaving from sleep.

However, IWDG will be disabled by HW and the system watchdog timers will be powered off in deep-sleep mode.

Register Protection

After the watchdog timer is enabled, WDG_MKEYR is the only register that can be accessed at any time. Other registers can be accessed only when WDG_MKEYR equals 0x6969.

Early Interrupt

The watchdog timer can trigger an interrupt to wake up the system or inform the system that a watchdog reset is coming. This interrupt can be enabled by setting a proper value to EARLY_INT_CNT and EIE. When the down-counter (WDGCNT) reaches the value of (EARLY_INT_CNT -1), the interrupt fires.

It is possible to change the early interrupt threshold after EIE is enabled, by performing the following sequences:

  1. Enable register access by writing 0x6969 into the WDG_MKEYR register

  2. Disable the EIE bit of the WDG_CR register

  3. Wait for EVU = ‘0’, EVU is also located in the WDG_CR register

  4. Program the early interrupt threshold and enable the early interrupt in the WDG_CR register

  5. Wait for EVU = ‘0’

  6. Refresh the counter with RL[15:0], and write-protect registers by writing 0x5A5A into the WDG_MKEYR register

Window Protection

The watchdog timer can also work as a window watchdog by setting the KM4propriate window in the WDG_WIN. If the reload operation is performed while the counter is greater than WDG_WIN[15:0], a reset is generated. The default value of the WDG_WIN is 0x0000FFFF, if not updated, the window option is disabled.

In order to prevent malicious attacks from changing the value of window, the window value can only be set before watchdog enable. Once the watchdog is enabled, the value cannot be changed. Due to the inaccurate of the source clock, we do no suggest enabling the window protection function of IWDG.

Prescaler

The watchdog timer itself works in a low clock (IWDG works at 100kHz and system watchdog timers work at 32kHz), while the access to the registers works in KM4B domain whose frequency is much higher than the clock of watchdog timer. If the prescaler dynamic change is involved, the cross-clock synchronization must be considered. In order to simplify the programming and design flow, prescaler dynamic change is not allowed. The prescaler can only be configured before watchdog enable.

Update Indication

Because the watchdog and its registers work in different clock domains, and frequencies are varied, cross-clock synchronization must be considered. In order to prevent the subsequent write operation from affecting the previous operation, two status flags are introduced in the following table.

Status flags

Bit

Flag

Description

EVU

Watchdog early interrupt function update

This bit is set by hardware to indicate that an update of the interrupt threshold (EICNT[15:0]) is ongoing or an update of the EIE is ongoing. It is reset by hardware when the update operation is completed. The EICNT[15:0] and EIE fields can be updated only when the EVU bit is reset.

RVU

Watchdog counter value update

This bit is set by hardware to indicate that the reload operation is ongoing. It is reset by hardware when the counter update operation is completed. The reload value can be updated only when the RVU bit is reset.

Before writing to the watchdog register, software needs to check these flags to ensure no conflict and disorder issues.

Registers

IWDG Registers

Name

Address offset

Access

Description

REG_WDG_MKEYR

000h

R/W

REG_WDG_CR

004h

R/W

REG_WDG_RLR

008h

R/W

REG_WDG_WINR

00Ch

R/W

REG_IWDG_DUMMY

010h

R/W

REG_WDG_MKEYR

  • Name : WDG Magic Key register

  • Size : 32

  • Address offset : 000h

  • Read/write access : R/W

31:16 RSVD 15:0 MKEY

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

MKEY

R/W

0h

  • 0x6969: enable access to register WDG_CR/WDG_RLR/WDG_WINR

  • 0x5A5A: reload WDG counter

  • 0x3C3C: enable WDG function

REG_WDG_CR

  • Name : WDG Control regsietr

  • Size : 32

  • Address offset : 004h

  • Read/write access : R/W

31 RVU 30 EVU 29:25 RSVD 24 LPEN 23:18 RSVD 17 EIC 16 EIE 15:0 EICNT

Bit

Symbol

Access

Reset

Description

31

RVU

R

0h

Watchdog counter update by reload command

30

EVU

R

0h

Watchdog early interrupt function update

29:25

RSVD

R

-

Reserved

24

LPEN

R/W

1h

Low power enable

  • 0: WDG will gating when system goes into sleep mode

  • 1: WDG keep running when system goes into sleep mode

23:18

RSVD

R

-

Reserved

17

EIC

R/W

0h

Write ‘1’ clear the early interrupt

16

EIE

R/W

0h

Watchdog early interrupt enable

15:0

EICNT

R/W

0h

Early interrupt trigger threshold

REG_WDG_RLR

  • Name : WDG Relaod register

  • Size : 32

  • Address offset : 008h

  • Read/write access : R/W

31:24 RSVD 23:16 PRER 15:0 RELOAD

Bit

Symbol

Access

Reset

Description

31:24

RSVD

R

-

Reserved

23:16

PRER

R/W

63h

Prescaler counter, configuration only allowed before wdg ena ble

WDG: 0x63

System wdg: 0x1F

15:0

RELOAD

R/W

FFFFh

Reload value for watchdog counter

Default : 64s (x100k)

REG_WDG_WINR

  • Name : WDG Window Register

  • Size : 32

  • Address offset : 00Ch

  • Read/write access : R/W

31:16 RSVD 15:0 WINDOW

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

WINDOW

R/W

FFFFh

Watchdog feed protect window register

REG_IWDG_DUMMY

  • Name : Wdg Dummy Register

  • Size : 32

  • Address offset : 010h

  • Read/write access : R/W

31:16 RSVD 15:0 DUMMY

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

DUMMY

R/W

0xFF

Rsvd for hw

SWDG Registers

Name

Address offset

Access

Description

REG_SWDG_MKEYR

000h

R/W

REG_SWDG_CR

004h

R/W

REG_SWDG_RLR

008h

R/W

REG_SWDG_WINR

00Ch

R/W

REG_SWDG_DUMMY

010h

R/W

REG_SWDG_MKEYR

  • Name : System WDG Magic Key register

  • Size : 32

  • Address offset : 000h

  • Read/write access : R/W

31:16 RSVD 15:0 MKEY

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

MKEY

R/W

0h

  • 0x6969: enable access to register WDG_CR/WDG_RLR/WDG_WINR

  • 0x5A5A: reload WDG counter

  • 0x3C3C: enable WDG function

REG_SWDG_CR

  • Name : System WDG Control regsietr

  • Size : 32

  • Address offset : 004h

  • Read/write access : R/W

31 RVU 30 EVU 29:18 RSVD 17 EIC 16 EIE 15:0 EICNT

Bit

Symbol

Access

Reset

Description

31

RVU

R

0h

Watchdog counter update by reload command

30

EVU

R

0h

Watchdog early interrupt function update

29:18

RSVD

R

-

Reserved

17

EIC

R/W

0h

Write ‘1’ clear the early interrupt

16

EIE

R/W

0h

Watchdog early interrupt enable

15:0

EICNT

R/W

0h

Early interrupt trigger threshold

REG_SWDG_RLR

  • Name : System WDG Relaod register

  • Size : 32

  • Address offset : 008h

  • Read/write access : R/W

31:24 RSVD 23:16 PRER 15:0 RELOAD

Bit

Symbol

Access

Reset

Description

31:24

RSVD

R

-

Reserved

23:16

PRER

R/W

1Fh

Prescaler counter, configuration only allowed before wdg ena bleg

Iwdg: 0x63

System wdg: 0x1F

15:0

RELOAD

R/W

FFFh

Reload value for watchdog counter

REG_SWDG_WINR

  • Name : System WDG Window Register

  • Size : 32

  • Address offset : 00Ch

  • Read/write access : R/W

31:16 RSVD 15:0 WINDOW

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

WINDOW

R/W

FFFFh

Watchdog feed protect window register, configuration only al lowed before wdg enable

REG_SWDG_DUMMY

  • Name : Wdg Dummy Register

  • Size : 32

  • Address offset : 010h

  • Read/write access : R/W

31:16 RSVD 15:0 DUMMY

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

DUMMY

R/W

0xFF

Rsvd for hw