15.4 Functional Description

The WDT is used to prevent system lockup if the software becomes trapped in a deadlock. It is supplied with VDDCORE. It restarts with initial values on processor reset.

The WDT is built around a 12-bit down counter loaded with the value defined in field PERIOD of the Window Level Register (WDT_WLR). WDT uses slow clock divided by 128 to establish the maximum watchdog period to 16 seconds (with a typical slow clock of 32.768 kHz).

The following parameters can be configured:

• Watchdog event period: a watchdog event occurs when the 12-bit down counter reaches 0, and leads to either an interrupt (if bit PERINT in the Interrupt Mask register (WDT_IMR) is high) or a reset (if bit PERIODRST in the Mode register (WDT_MR) is high).
• Minimum restart period: if the restart command is performed before this period, WDT creates a repeat violation. A repeat violation leads to either an interrupt (if WDT_IMR.RPTHINT = 1) or a reset (if WDT_MR.RPTHRST = 1).
• Maximum period before single interrupt event: if WDT_IMR.LVLINT = 1, a single interrupt is generated (no reset). The WDT_ILR.LVLTH value must be lower than WDT_WLR.PERIOD.

After a processor reset, the value of PERIOD is 0xFFF, corresponding to the maximum value of the counter with the external reset generation enabled (bit PERIODRST at 1 after a backup reset). This means that the WDT is running at reset, i.e., at powerup. The user can either disable the WDT by setting bit WDT_MR.WDDIS to ‘1’ or reprogram the WDT to meet the maximum WDT period the application requires.

If the WDT is restarted by writing into the corresponding Control register (WDT_CR), the corresponding WDT_MR must not be programmed during a period of time of three slow clock periods following the WDT_CR write access. In any case, programming a new value in WDT_MR automatically initiates a restart instruction.

WDT_MR, WDT_WLR and WDT_ILR (Interrupt Level register) can be written until a WDT_CR.LOCKMR command is issued in the corresponding WDT_CR. Only a peripheral reset can configure the bit LOCKMR to 0.

When the bit WDT_CR.LOCKMR = 0, writing WDT_WLR reloads the corresponding WDT with the newly programmed mode parameters.

In normal operation, the user reloads the WDT at regular intervals before the timer underflow occurs, by setting bit WDT_CR.WDRSTT. The WDT counter is then immediately reloaded from PERIOD and restarted, and the slow clock 128 divider is reset and restarted.

Writing WDR_CR without the correct hard-coded key has no effect (see Watchdog Timer Control Register).

A repeat threshold can be defined for each watchdog in order to protect against dead-locks that would repeatedly restart the watchdog. WDT_WLR.RPTH defines the minimum number of cycles to wait after a watchdog restart before the WDT can be started again. If a watchdog restart occurs before this limit is reached, a repeat threshold failure is asserted and the RPTHINT bit in the Interrupt Status register (WDT_ISR) is set to one.

If WDT_IMR.RPTHINT is high and a repeat threshold violation occurs in the WDT, an interrupt is generated.

If WDT_MR.RPTHRST is high and a repeat threshold violation occurs in the WDT, a watchdog reset is generated.

WDT reload must occur while the WDT counter is within a window between 0 and (PERIOD–RPTH). PERIOD and RPTH are defined in WDT_WLR.

Note that this feature can be disabled by programming a null RPTH value. In such configuration, restarting the WDT is permitted in the whole range [0 up to PERIOD] and does not generate an error. This is the default configuration on reset (RPTH is null).

If a reset is generated or if WDT_SR is read, the status bits are reset and the interrupt is cleared.

Writing WDT_MR reloads and restarts the down counter.

While the processor is in debug state or in Sleep mode, the counter may be stopped depending on the value programmed for the bits WDIDLEHLT and WDDBGHLT in WDT_MR.