22.4 Functional Description

The WDT is used to prevent system lock-up if the software becomes trapped in a deadlock. It is supplied with VDDCORE. It restarts with initial values on processor reset.

The watchdog is built around a 12-bit down counter, which is loaded with the value defined in the field WDV of the Mode register (WDT_MR). The WDT uses the slow clock divided by 128 to establish the maximum watchdog period to be 16 seconds (with a typical slow clock of 32.768 kHz).

After a processor reset, the value of WDV is 0xFFF, corresponding to the maximum value of the counter with the external reset generation enabled (field WDRSTEN at 1 after a backup reset). This means that a default watchdog is running at reset, i.e., at power-up. The user can either disable the WDT by setting WDT_MR.WDDIS or by reprogramming the WDT to meet the maximum watchdog period the application requires.

When setting WDDIS to ‘1’, and while it is set to ‘1’, the fields WDV and WDD must not be modified.

The watchdog is restarted by writing a '1' to WDT_CR.WDRSTT. Any write access to WDT_MR automatically restarts the watchdog. If WDT_CR or WDT_MR are written, write access to these registers is prohibited during a period of time of three slow clock periods.

WDT_MR can be written until a LOCKMR command is issued in WDT_CR. Only a processor reset resets it. If a LOCKMR command has never been issued, writing WDT_MR reloads the timer with the newly programmed mode parameters. If a LOCKMR command has been issued at least once, writing WDT_MR restarts the Watchdog counter.

In normal operation, the user reloads the watchdog at regular intervals before the timer underflow occurs, by setting WDT_CR.WDRSTT. The watchdog counter is then immediately reloaded from WDT_MR and restarted, and the slow clock 128 divider is reset and restarted. WDT_CR is write-protected. As a result, writing WDT_CR without the correct hard-coded key has no effect. If an underflow does occur, the “wdt_fault” signal to the Reset Controller is asserted if WDT_MR.WDRSTEN is set. Moreover, WDUNF is set in the Status register (WDT_SR).

The reload of the watchdog must occur while the watchdog counter is within a window between 0 and WDD. WDD is defined in WDT_MR.

Any attempt to restart the watchdog while the watchdog counter is between WDV and WDD results in a watchdog error, even if the watchdog is disabled. WDT_SR.WDERR is updated and the “wdt_fault” signal to the Reset Controller is asserted.

Note that this feature can be disabled by programming a WDD value greater than or equal to the WDV value. In such a configuration, restarting the Watchdog Timer is permitted in the whole range [0; WDV] and does not generate an error. This is the default configuration on reset (the WDD and WDV values are equal).

The status bits WDUNF (Watchdog Underflow) and WDERR (Watchdog Error) trigger an interrupt, provided WDT_MR.WDFIEN is set. The signal “wdt_fault” to the Reset Controller causes a watchdog reset if WDRSTEN is set as already explained in the section “Reset Controller (RSTC)”. In this case, the processor and the Watchdog Timer are reset, and the WDERR and WDUNF flags are reset.

If a reset is generated or if WDT_SR is read, the status bits are reset, the interrupt is cleared, and the “wdt_fault” signal to the reset controller is deasserted.

Writing WDT_MR reloads and restarts the down counter.

While the processor is in debug state or in Sleep mode, the counter may be stopped depending on the value programmed in WDT_MR.WDIDLEHLT and WDT_MR.WDDBGHLT.