Watchdog Timer

Introduction

This chip integrates four watchdog timers: one independent watchdog timer (IWDG) and three system watchdog timers (WDG).

  • IWDG: a shared watchdog for KM0 and KM4.

  • WDG0: a watchdog timer for KM0

  • WDG1: a secure watchdog timer for KM4

  • WDG2: a non-secure watchdog timer for KM4

The Watchdog architecture is illustrated in the following figure.

../../_images/wdg_arch_dplus.svg

All watchdog timers can trigger the reset of the corresponding CPU or the whole system. The reset logic is illustrated in the following sections.

Independent Watchdog Timer

The independent watchdog timer (IWDG) is powered by always-on power and always-on clock source, which means that it can stay active even when the main power or crystal fails. Also, IWDG can be configured to start by hardware at the very beginning of reset.

Features

  • Once enabled, cannot be disabled

  • An optional early interrupt feature can generate an interrupt at a programmable time before the watchdog timeout

  • A separate wake reason for each watchdog timer

  • Powered by AON(always-on) area power and clock source

  • Can be configured to determine whether it operates in sleep mode

  • Can wake up the system from sleep mode with an early interrupt

  • Gated automatically when the KM4 or KM0 is in debug mode

  • After the watchdog is enabled, the timeout duration can only be decreased, not increased

Clock and Power

The IWDG is powered by always-on power and clocked by an always-on 100kHz. The processer cannot shut off the power and clock after the system boots up, so there is no way to disable the IWDG after enabled.

The always-on 100kHz clock is a no-calibration clock, so it may have a margin of error of 50%. When feeding the watchdog, software should take the margin into consideration. Moreover, we do not suggest enabling the window function of IWDG.

The IWDG will be reset in deep-sleep mode, so the IWDG should be enabled again by software or hardware after wakeup again. IWDG can be configured to retain or keep counting in sleep mode by setting the LPEN bit in the control register. The watchdog timeout event in sleep mode can reset the whole system, and the early interrupt in sleep mode can wake up the system.

The early interrupt of IWDG is connected to both KM4 and KM0, however only the CPU working as KM0 is suggested to handle the interrupt.

OTP can auto-load an AON register to trigger IWDG enable. The register can only be set from 0 to 1, meaning that once the IWDG is enabled by hardware, it will automatically run no matter the initial boot or waking from deep-sleep.

The IWDG keeps counting when one of the CPUs is active (both clock and function enabled) and non-CPU is in debug mode. The IWDG clock and function enable diagram is illustrated in the following figure.

Note

LPEN bit shall be 1 by default to let the IWDG keeps counting in HW PMC stage if IWDG is enabled by HW, And CPU need to clear LPEN bit when IWDG be configured to retain in sleep mode.

Reset Architecture

The IWDG has the highest privilege. The IWDG timeout will trigger GLB_RST, and this reset signal will reset the whole system, including all the processors and almost all the peripherals. Only very few peripherals won’t be reset by GLB_RST, e.g. RTC, AON PAD.

The IWDG reset control is illustrated below.

../../_images/iwdg_reset_control.svg

System Watchdog Timer

The power and clock of system watchdog timers ({{IC_PARAM_SWDG_TIMER}}) are protected by itself. Once the watchdog is enabled, the processor cannot shut off the watchdog’s power and clock again.

The {{IC_PARAM_SECURE_SWDG_TIMER}} is a secure watchdog timer, which can only be accessed from secure word.

Features

  • Once enabled, cannot be disabled

  • An optional early interrupt feature can generate an interrupt at a programmable time before the watchdog timeout

  • A separate wake reason for each watchdog timer

  • When KM0 is in debug mode, WDG0 is gated; when KM4 is in debug mode, WDG1 and WDG2 are gated

  • Gate and maintains settings in sleep mode

  • Window protection function and timeout cannot be changed anymore once WDG is enabled

Clock and Power

The system watchdog timers are powered by SYSON and clocked by SDM32K.

The secure watchdog timer ({{IC_PARAM_SECURE_SWDG_TIMER}}) is guaranteed by itself and can only be accessed from secure word. It will be gated automatically when the CPU enters debug mode or the CPU is gated.

The SWDG clock and function enable diagram is illustrated below.

../../_images/swdg_clock_and_function_enable_diagram.svg

Functional Description

Workflow

The workflow of watchdog timer is illustrated in the following figure.

Initialization

The initialization steps of watchdog are illustrated below.

Step

What to do

How to do

Comment

1

Check HW IWDG enable

IWDG can start counting when hw_wdg_fen is asserted.

  • For the IWDG prescaler, using default value 0x63

  • For the system WDG prescaler, using default value 0x1F

For the reload counter, using default value {{IC_PARAM_RELOAD_VALUE}}

IWDG can be enabled by HW and SW, but system WDG can only be enabled by SW.

2

Enable register access

Write “0x6969” into the WDG_MKEYR register

Enable register access to the WDG_CR/

WDG_RLR/WDG_WINR registers

3

Program Reload register

Configure the RELOAD and PRER bits of the WDG_RLR register

4

Program Control register if needed

Configure the EICNT bit of the WDG_CR register

5

Program Window register if needed

Configure the WDG_WINR register

Enable the window protection

6

Enable SW WDG

Write “0x3C3C” into the WDG_MKEYR register

WDG is enabled by SW.

7

Enable reload command if needed

Write “0x5A5A” into the WDG_MKEYR register

Reload value for WDG counter

Operation Flow

Hardware Enable

In the OTP area, one bit is used to control the IWDG automatically to enable the function. There is no difference between hardware WDG (enabled by hardware) and software WDG (enabled by software). When the HW WDG is enabled, the prescaler will use default value 0x63 and the reload counter will use default value {{IC_PARAM_RELOAD_VALUE}}.

An application can adjust the barking interval of the watchdog. Once the IWDG is enabled, it cannot be disabled anymore. No matter which way is used to enable the watchdog timer, the software is responsible for feeding the dog to prevent barking.

The system watchdog timers can only be enabled by software. Once enabled, the WDG also cannot be disabled anymore.

Low-power Mode

For IWDG, whether the IWDG can keep running or gating in sleep mode depends on the LPEN bit.

  • If LPEN is cleared, the clock for IWDG will be gated internally, and IWDG will be frozen with all status maintained.

  • If LPEN is enabled, IWDG will keep counting down, wake up the system if the early interrupt event fires, and reset system if the dog barks.

Each system watchdog timer can maintain its registers but keep freezing in sleep mode. Counting down will resume after leaving from sleep.

However, IWDG will be disabled by HW and the system watchdog timers will be powered off in deep-sleep mode.

Register Protection

After the watchdog timer is enabled, WDG_MKEYR is the only register that can be accessed at any time. Other registers can be accessed only when WDG_MKEYR equals 0x6969.

Early Interrupt

The watchdog timer can trigger an interrupt to wake up the system or inform the system that a watchdog reset is coming. This interrupt can be enabled by setting a proper value to EARLY_INT_CNT and EIE. When the down-counter (WDGCNT) reaches the value of (EARLY_INT_CNT -1), the interrupt fires.

It is possible to change the early interrupt threshold after EIE is enabled, by performing the following sequences:

  1. Enable register access by writing 0x6969 into the WDG_MKEYR register

  2. Disable the EIE bit of the WDG_CR register

  3. Wait for EVU = ‘0’, EVU is also located in the WDG_CR register

  4. Program the early interrupt threshold and enable the early interrupt in the WDG_CR register

  5. Wait for EVU = ‘0’

  6. Refresh the counter with RL [15:0], and write-protect registers by writing 0x5A5A into the WDG_MKEYR register

Window Protection

The watchdog timer can also work as a window watchdog by setting the apropriate window in the WDG_WIN. If the reload operation is performed while the counter is greater than WDG_WIN [15:0], a reset is generated. The default value of the WDG_WIN is 0x0000FFFF, if not updated, the window option is disabled.

In order to prevent malicious attacks from changing the value of window, the window value can only be set before watchdog enable. Once the watchdog is enabled, the value cannot be changed. Due to the inaccurate of the source clock, we do no suggest enabling the window protection function of IWDG.

Prescaler

The watchdog timer itself works in a low clock (IWDG works at 100kHz and system watchdog timers work at 32kHz), while the access to the registers works in APB domain whose frequency is much higher than the clock of watchdog timer. If the prescaler dynamic change is involved, the cross-clock synchronization must be considered. In order to simplify the programming and design flow, prescaler dynamic change is not allowed. The prescaler can only be configured before watchdog enable.

Update Indication

Because the watchdog and its registers work in different clock domains, and frequencies are varied, cross-clock synchronization must be considered. In order to prevent the subsequent write operation from affecting the previous operation, {{IC_PARAM_SWDG_TIMER_STATUS_FLAG_NUM}} status flags are introduced in the following table.

Bit

Flag

Description

EVU

Watchdog early interrupt function update

This bit is set by hardware to indicate that an update of the interrupt threshold (EICNT[15:0]) is ongoing or an update of the EIE is ongoing. It is reset by hardware when the update operation is completed. The EICNT[15:0] and EIE fields can be updated only when the EVU bit is reset.

RVU

Watchdog counter value update

This bit is set by hardware to indicate that the reload operation is ongoing. It is reset by hardware when the counter update operation is completed. The reload value can be updated only when the RVU bit is reset.

Before writing to the watchdog register, software needs to check these flags to ensure no conflict and disorder issues.

Registers

WDG Registers

Base Address:

  • IWDG_REG : 0x41008C00

  • WDG0_REG : 0x41008D00

  • WDG1_REG_S : 0x51008D40

  • WDG2_REG : 0x41008D80

Name

Address offset

Access

Description

REG_WDG_MKEYR

000h

R/W

REG_WDG_CR

004h

R/W

REG_WDG_RLR

008h

R/W

REG_WDG_WINR

00Ch

R/W

REG_IWDG_DUMMY

010h

R/W

REG_WDG_MKEYR

  • Name : WDG Magic Key register

  • Size : 32

  • Address offset : 000h

  • Read/write access : R/W

31:16 RSVD 15:0 MKEY

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

MKEY

R/W

0h

  • 0x6969: enable access to register WDG_CR/WDG_RLR/WDG_WINR

  • 0x5A5A: reload WDG counter

  • 0x3C3C: enable WDG function

REG_WDG_CR

  • Name : WDG Control regsietr

  • Size : 32

  • Address offset : 004h

  • Read/write access : R/W

31 RVU 30 EVU 29:25 RSVD 24 LPEN 23:18 RSVD 17 EIC 16 EIE 15:0 EICNT

Bit

Symbol

Access

Reset

Description

31

RVU

R

0h

Watchdog counter update by reload command

30

EVU

R

0h

Watchdog early interrupt function update

29:25

RSVD

R

-

Reserved

24

LPEN

R/W

1h

Low power enable

  • 0: WDG will gating when system goes into sleep mode

  • 1: WDG keep running when system goes into sleep mode

23:18

RSVD

R

-

Reserved

17

EIC

R/W

0h

Write ‘1’ clear the early interrupt

16

EIE

R/W

0h

Watchdog early interrupt enable

15:0

EICNT

R/W

0h

Early interrupt trigger threshold

REG_WDG_RLR

  • Name : WDG Relaod register

  • Size : 32

  • Address offset : 008h

  • Read/write access : R/W

31:24 RSVD 23:16 PRER 15:0 RELOAD

Bit

Symbol

Access

Reset

Description

31:24

RSVD

R

-

Reserved

23:16

PRER

R/W

63h

Prescaler counter, configuration only allowed before WDG ena ble

IWDG: 0x63

System WDG: 0x1F

15:0

RELOAD

R/W

FFFh

Reload value for watchdog counter

REG_WDG_WINR

  • Name : WDG Window Register

  • Size : 32

  • Address offset : 00Ch

  • Read/write access : R/W

31:16 RSVD 15:0 WINDOW

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

WINDOW

R/W

FFFFh

Watchdog feed protect window register

REG_IWDG_DUMMY

  • Name : WDG Dummy Register

  • Size : 32

  • Address offset : 010h

  • Read/write access : R/W

31:16 RSVD 15:0 DUMMY

Bit

Symbol

Access

Reset

Description

31:16

RSVD

R

-

Reserved

15:0

DUMMY

R/W

0xFF

Reserved for HW