5.12.2 WATCHDOG REGISTERS AND FEATURES

The built-in watchdog is activated by default and starts after powering on the device. The watchdog can be reconfigured or disabled only after power-on AND the first trigger.

The watchdog supports two operating modes:

• Window mode

  In Window mode, a watchdog trigger event within the watchdog trigger window resets the Watchdog Timer.

  The Window mode is only available in Normal mode.

• Time-out mode

  In Time-out mode, the watchdog can be triggered any time within the trigger range by a watchdog trigger.

In order to avoid unwanted configuration of the watchdog, the ATA6847 only allows configuration of the watchdog (write access to WDCR1 and WDCR2 registers) when the device is in Standby mode.

Every write access to the WDCR1 and WDCR2 registers via SPI will reset the Watchdog Timer and immediately apply the changes.

If Window mode is selected (WDC = 100), the watchdog will remain in (or switch to) Time-out mode until the device enters Normal mode (Window mode is only supported when the device is in Normal mode).

Any attempt to configure the watchdog (write access to WDCR1 register and WDCR2 register) while the device is not in Standby mode will trigger a reset of the microcontroller, and the device will set the ILLCON bit in the Watchdog Status register, WDSR (illegal watchdog configuration).

The ATA6847 watchdog supports eight watchdog periods. The watchdog period is programmable via the Watchdog Period bits (WWDP) in the Watchdog Control Register 2 (WDCR2). The selected period is valid for both Window and Time-out modes. The default watchdog period value is 128 ms.

A watchdog trigger event (an SPI write access to the WDTRIG register with the pattern (01010101) resets the Watchdog Timer. The Watchdog Reset pulse width is configured via the WRPL bits in the WDCR2 register.

The watchdog is an important safety mechanism that must be configured correctly. Two mechanisms are provided to prevent watchdog parameters from being changed by mistake.

• All configuration bitfields in the registers WDC, WWDP and WRPL have a Hamming distance of at least two for valid states.
• Reconfiguration protection: The configuration is only possible in Standby mode.

Having a Hamming distance of at least two for all valid states for the control bitfields, WDC, WWDP and WRPL, ensures that a single bit error cannot cause the watchdog to be configured incorrectly (at least two bits must be flipped to reconfigure WDC, WWDP or WRPL). If an attempt is made to write an invalid code to the WDCR1 register or WDCR2 register, the SPI write to the WDCRx register is ignored and the CACC bit in the Watchdog Status register is set.

Writing ‘1’ to the corresponding bit of the Watchdog Status register will reset the bit.

A microcontroller reset is triggered immediately in response to an illegal watchdog configuration (configuration of the watchdog in Normal or Sleep mode), an incorrect watchdog trigger event in Window mode (watchdog overflow or triggered too early) or when the watchdog overflows in Time-out mode. If a reset is triggered by the window watchdog the Window Watchdog Reset Event register will be set. The device will enter the μC Reset mode and enter Standby mode after the reset is finished.

If a reset is triggered by the watchdog, the respective reset event register will be set. The device will enter the MCU Reset mode, followed by Standby mode, after the reset takes place.

If there is a corrupted write access to the watchdog configuration registers and/or an illegal configuration of watchdog control register occurred when the watchdog is in OFF mode, the corresponding status register bit will be set.

If the fault register bits (CACC, ILLCON, OF, OFSLP and ETRIG bits – see WDSR) are not reset to zero before enabling the window watchdog, an MCU Reset will be triggered immediately after enabling the watchdog.