Philips Semiconductors Product data
XA-G30
XA 16-bit microcontroller family
512 B RAM, watchdog, 2 UARTs
2002 Mar 25
13
WATCHDOG TIMER
The watchdog timer subsystem protects the system from incorrect
code execution by causing a system reset when the watchdog timer
underflows as a result of a failure of software to feed the timer prior
to the timer reaching its terminal count. It is important to note that
the watchdog timer is running after any type of reset and must be
turned off by user software if the application does not use the
watchdog function.
Watchdog Function
The watchdog consists of a programmable prescaler and the main
timer. The prescaler derives its clock from the TCLK source that also
drives timers 0, 1, and 2. The watchdog timer subsystem consists of
a programmable 13-bit prescaler, and an 8-bit main timer. The main
timer is clocked (decremented) by a tap taken from one of the top
8-bits of the prescaler as shown in Figure 10. The clock source for
the prescaler is the same as TCLK (same as the clock source for
the timers). Thus the main counter can be clocked as often as once
every 32 TCLKs (see Table 2). The watchdog generates an
underflow signal (and is autoloaded from WDL) when the watchdog
is at count 0 and the clock to decrement the watchdog occurs. The
watchdog is 8 bits wide and the autoload value can range from 0 to
FFH. (The autoload value of 0 is permissible since the prescaler is
cleared upon autoload).
This leads to the following user design equations. Definitions: t
OSC
is the oscillator period, N is the selected prescaler tap value, W is
the main counter autoload value, P is the prescaler value from
Table 2, t
MIN
is the minimum watchdog time-out value (when the
autoload value is 0), t
MAX
is the maximum time-out value (when the
autoload value is FFH), t
D
is the design time-out value.
t
MIN
= t
OSC
× 4 × 32 (W = 0, N = 4)
t
MAX
= t
OSC
× 64 × 4096 × 256 (W = 255, N = 64)
t
D
= t
OSC
× N × P × (W + 1)
The watchdog timer is not directly loadable by the user. Instead, the
value to be loaded into the main timer is held in an autoload register.
In order to cause the main timer to be loaded with the appropriate
value, a special sequence of software action must take place. This
operation is referred to as feeding the watchdog timer.
To feed the watchdog, two instructions must be sequentially
executed successfully. No intervening SFR accesses are allowed,
so interrupts should be disabled before feeding the watchdog. The
instructions should move A5H to the WFEED1 register and then
5AH to the WFEED2 register. If WFEED1 is correctly loaded and
WFEED2 is not correctly loaded, then an immediate watchdog reset
will occur. The program sequence to feed the watchdog timer or
cause new WDCON settings to take effect is as follows:
clr ea ; disable global interrupts.
mov.b wfeed1,#A5h ; do watchdog feed part 1
mov.b wfeed2,#5Ah ; do watchdog feed part 2
setb ea ; re-enable global interrupts.
This sequence assumes that the XA interrupt system is enabled and
there is a possibility of an interrupt request occurring during the feed
sequence. If an interrupt was allowed to be serviced and the service
routine contained any SFR access, it would trigger a watchdog
reset. If it is known that no interrupt could occur during the feed
sequence, the instructions to disable and re-enable interrupts may
be removed.
The software must be written so that a feed operation takes place
every t
D
seconds from the last feed operation. Some tradeoffs may
need to be made. It is not advisable to include feed operations in
minor loops or in subroutines unless the feed operation is a specific
subroutine.
To turn the watchdog timer completely off, the following code
sequence should be used:
mov.b wdcon,#0 ; set WD control register to clear WDRUN.
mov.b wfeed1,#A5h ; do watchdog feed part 1
mov.b wfeed2,#5Ah ; do watchdog feed part 2
This sequence assumes that the watchdog timer is being turned off
at the beginning of initialization code and that the XA interrupt
system has not yet been enabled. If the watchdog timer is to be
turned off at a point when interrupts may be enabled, instructions to
disable and re-enable interrupts should be added to this sequence.
Watchdog Control Register (WDCON)
The reset values of the WDCON and WDL registers will be such that
the watchdog timer has a timeout period of 4 × 4096 × t
OSC
and the
watchdog is running. WDCON can be written by software but the
changes only take effect after executing a valid watchdog feed
sequence.
Table 2. Prescaler Select Values in WDCON
PRE2 PRE1 PRE0 DIVISOR
0 0 0 32
0 0 1 64
0 1 0 128
0 1 1 256
1 0 0 512
1 0 1 1024
1 1 0 2048
1 1 1 4096
Watchdog Detailed Operation
When external RESET is applied, the following takes place:
• Watchdog run control bit set to ON (1).
• Autoload register WDL set to 00 (min. count).
• Watchdog time-out flag cleared.
• Prescaler is cleared.
• Prescaler tap set to the highest divide.
• Autoload takes place.
When coming out of a hardware reset, the software should load the
autoload register and then feed the watchdog (cause an autoload).
If the watchdog is running and happens to underflow at the time the
external RESET is applied, the watchdog time-out flag will be
cleared.
