RM0046 Functional Safety
Doc ID 16912 Rev 5 753/936
loaded into an internal 32-bit down counter when the SWT is enabled and a valid service
sequence is written. The SWT_CR[CSL] bit selects which clock (system or oscillator) drives
the down counter.
The configuration of the SWT can be locked through use of either a soft lock or a hard lock.
In either case, when locked the SWT_CR, SWT_TO and SWT_WN registers are read only.
The hard lock is enabled by setting the SWT_CR[HLK] bit, which can only be cleared by a
reset. The soft lock is enabled by setting the SWT_CR[SLK] bit and is cleared by writing the
unlock sequence to the service register. The unlock sequence is a write of 0xC520 followed
by a write of 0xD928 to the SWT_SR[WSC] field. There is no timing requirement between
the two writes. The unlock sequence logic ignores service sequence writes and recognizes
the 0xC520, 0xD928 sequence regardless of previous writes. The unlock sequence can be
written at any time and does not require the SWT_CR.WEN bit to be set.
When enabled, the SWT requires periodic execution of the watchdog servicing sequence.
The service sequence is a write of 0xA602 followed by a write of 0xB480 to the
SWT_SR[WSC] field. Writing the service sequence loads the internal down counter with the
time-out period. There is no timing requirement between the two writes. The service
sequence logic ignores unlock sequence writes and recognizes the 0xA602, 0xB480
sequence regardless of previous writes. Accesses to SWT registers occur with no
peripheral bus wait states. (The peripheral bus bridge may add one or more system wait
states.) However, due to synchronization logic in the SWT design, recognition of the service
sequence or configuration changes may require as many as 3 system plus 7 counter clock
cycles.
If window mode is enabled (SWT_CR[WND] bit is set), the service sequence must be
performed in the last part of the time-out period defined by the window register. The window
is open when the down counter is less than the value in the SWT_WN register. Outside of
this window, service sequence writes are invalid accesses and generate a bus error or reset
depending on the value of the SWT_CR[RIA] bit. For example, if the SWT_TO register is set
to 5000 and SWT_WN register is set to 1000 then the service sequence must be performed
in the last 20% of the time-out period. There is a short lag in the time it takes for the window
to open due to synchronization logic in the watchdog design. This delay could be as many
as 3 system plus 4 counter clock cycles.
The SWT_CR[ITR] interrupt then reset bit controls the action taken when a time-out occurs.
If the SWT_CR[ITR] bit is not set, a reset is generated immediately on a time-out. If the
SWT_CR[ITR] bit is set, an initial time-out causes the SWT to generate an interrupt and
load the down counter with the time-out period. If the service sequence is not written before
the second consecutive time-out, the SWT generates a system reset. The interrupt is
indicated by the time-out interrupt flag (SWT_IR[TIF]). The interrupt request is cleared by
writing a one to the SWT_IR[TIF] bit.
The SWT_CO register shows the value of the down counter when the watchdog is disabled.
When the watchdog is enabled this register is cleared. The value shown in this register can
lag behind the value in the internal counter for as many as 6 system plus 8 counter clock
cycles.
The SWT_CO can be used during a software self test of the SWT. For example, the SWT
can be enabled and not serviced for a fixed period of time less than the time-out value. Then
the SWT can be disabled (SWT_CR[WEN] cleared) and the value of the SWT_CO read to
determine if the internal down counter is working properly.
To Next Page
Loading...
