Atmel ARM-Based Evaluation Kit for SAM4S16C, 32-Bit ARM® Cortex® Microcontroller ATSAM4S-WPIR-RD ATSAM4S-WPIR-RD Data Sheet

SAM4S Series [DATASHEET]

Atmel-11100G-ATARM-SAM4S-Datasheet_27-May-14

318

The Watchdog Timer can be used to prevent system lock-up if the software becomes trapped in a deadlock. It is 

supplied with VDDCORE. It restarts with initial values on processor reset.
The Watchdog is built around a 12-bit down counter, which is loaded with the value defined in the field WDV of the 

Mode Register (WDT_MR). The Watchdog Timer uses the Slow Clock divided by 128 to establish the maximum 

Watchdog period to be 16 seconds (with a typical Slow Clock of 32.768 kHz).
After a Processor Reset, the value of WDV is 0xFFF, corresponding to the maximum value of the counter with the 

external reset generation enabled (field WDRSTEN at 1 after a Backup Reset). This means that a default 

Watchdog is running at reset, i.e., at power-up. The user must either disable it (by setting the WDDIS bit in 

WDT_MR) if he does not expect to use it or must reprogram it to meet the maximum Watchdog period the 

application requires.
If the watchdog is restarted by writing into the WDT_CR register, the WDT_MR register must not be programmed 

during a period of time of 3 slow clock periods following the WDT_CR write access. In any case, programming a 

new value in the WDT_MR register automatically initiates a restart instruction.
The Watchdog Mode Register (WDT_MR) can be written only once . Only a processor reset resets it. Writing the 

WDT_MR register reloads the timer with the newly programmed mode parameters.
In normal operation, the user reloads the Watchdog at regular intervals before the timer underflow occurs, by 

writing the Control Register (WDT_CR) with the bit WDRSTT to 1. The Watchdog counter is then immediately 

reloaded from WDT_MR and restarted, and the Slow Clock 128 divider is reset and restarted. The WDT_CR 

register is write-protected. As a result, writing WDT_CR without the correct hard-coded key has no effect. If an 

underflow does occur, the “wdt_fault” signal to the Reset Controller is asserted if the bit WDRSTEN is set in the 

Mode Register (WDT_MR). Moreover, the bit WDUNF is set in the Watchdog Status Register (WDT_SR). 
To prevent a software deadlock that continuously triggers the Watchdog, the reload of the Watchdog must occur 

while the Watchdog counter is within a window between 0 and WDD, WDD is defined in the WatchDog Mode 

Register WDT_MR.
Any attempt to restart the Watchdog while the Watchdog counter is between WDV and WDD results in a 

Watchdog error, even if the Watchdog is disabled. The bit WDERR is updated in the WDT_SR and the “wdt_fault” 

signal to the Reset Controller is asserted. 
Note that this feature can be disabled by programming a WDD value greater than or equal to the WDV value. In 

such a configuration, restarting the Watchdog Timer is permitted in the whole range [0; WDV] and does not 

generate an error. This is the default configuration on reset (the WDD and WDV values are equal).
The status bits WDUNF (Watchdog Underflow) and WDERR (Watchdog Error) trigger an interrupt, provided the bit 

WDFIEN is set in the mode register. The signal “wdt_fault” to the reset controller causes a Watchdog reset if the 

WDRSTEN bit is set as already explained in the reset controller programmer Datasheet. In that case, the 

processor and the Watchdog Timer are reset, and the WDERR and WDUNF flags are reset.
If a reset is generated or if WDT_SR is read, the status bits are reset, the interrupt is cleared, and the “wdt_fault” 

signal to the reset controller is deasserted.
Writing the WDT_MR reloads and restarts the down counter. 
While the processor is in debug state or in idle mode, the counter may be stopped depending on the value 

programmed for the bits WDIDLEHLT and WDDBGHLT in the WDT_MR.