Watchdog Timer

The watchdog timer is a hardware-level safety monitoring module used to detect and recover from software faults (such as infinite loops, code runaway, bus hangs). When system software fails to perform the watchdog feeding operation (refreshing the counter) within the specified time, the WDG will time out and trigger a reset signal, forcing the corresponding CPU or the entire system to reboot, ensuring reliability and recoverability under abnormal conditions.

In the Ameba series SoC, the watchdog is divided into two categories: independent watchdog (IWDG) and system watchdog (SWDG):

• Independent watchdog: Operates with an independent clock source, does not rely on the system main clock, and is not affected by low-power modes or main clock configurations. It can serve as a global fault monitor shared by dual cores, and can trigger a system-level reset upon timeout.

• System watchdog: Bound to the CPU. In a multi-core system, each CPU is configured with a dedicated system watchdog. For CPUs that support TrustZone, independent secure watchdog (Secure WDG) and non-secure watchdog (Non-secure WDG) are also provided, used for fault monitoring of secure domain and non-secure domain firmware respectively, enabling hierarchical fault isolation and handling.

All watchdogs support dual paths of timeout interrupt and reset. An interrupt can first notify the software for fault diagnosis and remediation. If the fault is not handled, a reset signal will be output upon timeout, implementing a multi-level recovery strategy ranging from single-core reset to system-wide global reset.

RTL8721DxRTL8720ERTL8710ERTL8726ERTL8713ERTL8730ERTL8721F

RTL8721Dx:

• IWDG: Independent watchdog timer for the system

• WDG0: Watchdog timer for KM0

• WDG1: Secure watchdog timer for KM4

• WDG2: Non-secure watchdog timer for KM4

The watchdog architecture is shown in the following figure.

Independent Watchdog Timer

Introduction

The independent watchdog (IWDG) is a system-level safety monitoring module driven by an always-on power domain and a 100 kHz uncalibrated internal clock. The power domain and clock cannot be disabled after system startup, so once the IWDG is enabled, software cannot disable it.

The IWDG’s 100 kHz clock is an uncalibrated internal oscillator with a frequency tolerance of ±50%. When configuring the timeout period and feeding strategy, software must reserve sufficient margin to avoid unexpected resets. To prevent mistriggers caused by feeding timing deviations, enabling the IWDG window function is not recommended.

The IWDG behavior in sleep mode can be configured via the LPEN bit in the control register: when set, the IWDG continues counting in sleep mode, and a timeout will trigger a system-level reset; the configured early interrupt can wake up the system. When LPEN is cleared, the IWDG stops counting in sleep mode and holds its current state, resuming counting after wakeup. The IWDG is reset upon entering deep sleep.

OTP can be configured to auto-load an AON register, enabling the IWDG automatically by hardware. This register only supports writing from 0 to 1 (a one-time operation). Once configured, the IWDG will automatically run after initial boot or deep sleep wakeup, and software cannot intervene or disable it.

Features

• Once enabled, it cannot be disabled

• Optional early interrupt that can generate an interrupt at a programmable time before watchdog timeout

• Independent wakeup source

• Powered and clocked by the AON (always-on) power domain

• Automatically pauses counting when the CPU is in debug mode

• Configurable operation in sleep mode

Debug Pause

The IWDG keeps counting when one of the CPUs is active (both clock and function are enabled) and no CPU is in debug mode. The IWDG clock and function enable diagram is illustrated in the following figure.

RTL8721DxRTL8720ERTL8726ERTL8713ERTL8730ERTL8721F

RTL8721Dx:

Reset

The IWDG has the highest privilege. An IWDG timeout will trigger GLB_RST, and this reset signal resets the entire system, including all processors and almost all peripherals. Only a very few peripherals are not reset by GLB_RST, such as RTC and AON PAD.

The IWDG reset control is illustrated below.

System Watchdog Timer

Introduction

The system watchdog (SWDG) is a dedicated safety monitoring module for the CPU core, sharing the power domain with the corresponding CPU core. It is driven by an internal 32 kHz OSC clock, providing fault detection and recovery capabilities for the CPU operating state.

The system watchdog supports a windowed watchdog function, which can be configured to allow watchdog feeding only within a specified window range of the counter. If the feeding timing is too early or too late, a system reset identical to that triggered by a timeout event will occur, thereby enabling strict monitoring of software execution timing.

In sleep mode, the system watchdog stops counting and maintains its current state. Counting resumes after the system wakes up. When entering deep sleep mode, the system watchdog is reset. Therefore, after waking up from deep sleep, the module must be reconfigured and enabled by software.

Features

• Once enabled, cannot be disabled

• Optional early interrupt that can generate an interrupt at a programmable time before watchdog timeout

• Independent wakeup source

• Powered by SYSON domain and SDM32K clock source

• Automatically pauses counting when the CPU is in debug mode

Debug Pause

When the corresponding CPU enters debug mode or is shut down, the SWDG automatically pauses counting, but its state is maintained.

The SWDG clock and function enable diagram is illustrated below.

Reset

WDG timeout or feeding outside the window will trigger GLB_RST by default. This reset signal will reset the entire system, including all processors and almost all peripherals. Only very few peripherals will not be reset by GLB_RST, such as RTC and AON PAD. Some SoC system watchdogs support configuration to reset only the corresponding CPU under specific conditions.

Functional Description

Low-power Mode

For IWDG, whether the IWDG can keep running or gating in sleep mode depends on the LPEN bit.

• If LPEN is cleared, the hardware will gate the clock for IWDG internally, and IWDG will be frozen with all status maintained.

• If LPEN is enabled, IWDG will keep counting down, wake up the system if the early interrupt event fires, and reset the system if the watchdog triggers.

Each system watchdog timer can maintain its registers but keep freezing in sleep mode. Counting down will resume after leaving sleep.

However, in deep-sleep mode, the hardware will disable IWDG, and the system watchdog timers will be powered off.

Register Protection

After the watchdog timer is enabled, WDG_MKEYR is the only register that can be accessed at any time. Other registers can be accessed only when WDG_MKEYR equals 0x6969.

Early Interrupt

The watchdog timer can trigger an interrupt to wake up the system or inform the system that a watchdog reset is coming. This interrupt can be enabled by setting appropriate values to EARLY_INT_CNT and EIE. When the down-counter (WDGCNT) reaches the value of (EARLY_INT_CNT -1), the interrupt fires.

It is possible to change the early interrupt threshold after EIE is enabled, by performing the following sequences:

1. Enable register access by writing 0x6969 into the WDG_MKEYR register

2. Disable the EIE bit of the WDG_CR register

3. Wait for EVU = 0, EVU is also located in the WDG_CR register

4. Program the early interrupt threshold and enable the early interrupt in the WDG_CR register

5. Wait for EVU = 0

6. Refresh the counter with WDG_RLR [15:0], and write-protect registers by writing 0x5A5A into the WDG_MKEYR register

Window Protection

The watchdog timer can also work as a window watchdog by setting the appropriate window in WDG_WIN. If the reload operation is performed while the counter is greater than WDG_WIN [15:0], a reset is generated. The default value of WDG_WIN is 0x0000FFFF, if not updated, the window option is disabled.

To prevent malicious attacks from changing the window value, the window value can only be set before watchdog enable. Once the watchdog is enabled, the value cannot be changed. Due to the inaccuracy of the source clock, we do not suggest enabling the window protection function of IWDG.

The watchdog window function watchdog feeding timing diagram is illustrated below.

Timeout Configuration

The watchdog timeout period is determined by WDG_RLR [15:0] RELOAD and WDG_RLR [23:16] Prescaler. The calculation formula is RELOAD × Prescaler / WDG_CLK.

To configure the timeout period, perform the following sequences:

1. Enable register access by writing 0x6969 into the WDG_MKEYR register

2. Wait for EVU = 0, EVU is also located in the WDG_CR register

3. Program the WDG_RLR register

4. Wait for EVU = 0

5. Write-protect registers by writing 0x5A5A into the WDG_MKEYR register

Watchdog Refresh

Refresh the counter with WDG_RLR [15:0], and write-protect registers by writing 0x5A5A into the WDG_MKEYR register.

Update Indication

Because the watchdog and its registers work in different clock domains, and frequencies are varied, cross-clock synchronization must be considered. In order to prevent the subsequent write operation from affecting the previous operation, two status flags are introduced in the following table.

Bit	Flag	Description
EVU	Watchdog early interrupt function update	This bit is set by hardware to indicate that an update of the interrupt threshold (EICNT[15:0]) is ongoing or an update of the EIE is ongoing. It is reset by hardware when the update operation is completed. The EICNT[15:0] and EIE fields can be updated only when the EVU bit is reset.
RVU	Watchdog counter value update	This bit is set by hardware to indicate that the reload operation is ongoing. It is reset by hardware when the counter update operation is completed. The reload value can be updated only when the RVU bit is reset.

Before writing to the watchdog register, software needs to check these flags to ensure no conflict and disorder issues.

Registers

WDG Registers

RTL8721DxRTL8720ERTL8710ERTL8726ERTL8713ERTL8730ERTL8721F

RTL8721Dx:

Base Address:

• IWDG_REG : 0x41008C00

• WDG0_REG : 0x41008D00

• WDG2_REG : 0x41008D80

• WDG1_REG_S : 0x51008D40

Name	Address offset	Access	Description
REG_WDG_MKEYR	000h	R/W
REG_WDG_CR	004h	R/W
REG_WDG_RLR	008h	R/W
REG_WDG_WINR	00Ch	R/W
REG_IWDG_DUMMY	010h	R/W

REG_WDG_MKEYR

• Name: WDG Magic Key register

• Size: 32

• Address offset: 000h

• Read/write access: R/W

Bit	Symbol	Access	INI	Description
31:16	RSVD	R	-	Reserved
15:0	MKEY	R/W	0h	0x6969: enable access to register WDG_CR/WDG_RLR/WDG_WINR 0x5A5A: reload WDG counter 0x3C3C: enable WDG function

REG_WDG_CR

• Name: WDG Control regsietr

• Size: 32

• Address offset: 004h

• Read/write access: R/W

Bit	Symbol	Access	INI	Description
31	RVU	R	0h	Watchdog counter update by reload command
30	EVU	R	0h	Watchdog early interrupt function update
29:25	RSVD	R	-	Reserved
24	LPEN	R/W	1h	Low power enable 0: WDG will gating when system goes into sleep mode 1: WDG keep running when system goes into sleep mode
23:18	RSVD	R	-	Reserved
17	EIC	R/W	0h	Write ‘1’ clear the early interrupt
16	EIE	R/W	0h	Watchdog early interrupt enable
15:0	EICNT	R/W	0h	Early interrupt trigger threshold

REG_WDG_RLR

• Name: WDG Relaod register

• Size: 32

• Address offset: 008h

• Read/write access: R/W

Bit	Symbol	Access	INI	Description
31:24	RSVD	R	-	Reserved
23:16	PRER	R/W	63h	Prescaler counter, configuration only allowed before WDG enable IWDG: 0x63 System WDG: 0x1F
15:0	RELOAD	R/W	FFFh	Reload value for watchdog counter

REG_WDG_WINR

• Name: WDG Window Register

• Size: 32

• Address offset: 00Ch

• Read/write access: R/W

Bit	Symbol	Access	INI	Description
31:16	RSVD	R	-	Reserved
15:0	WINDOW	R/W	FFFFh	Watchdog feed protect window register

REG_IWDG_DUMMY

• Name: WDG Dummy Register

• Size: 32

• Address offset: 010h

• Read/write access: R/W

Bit	Symbol	Access	INI	Description
31:16	RSVD	R	-	Reserved
15:0	DUMMY	R/W	0xFF	Reserved for HW