Atmel Xplained Pro Evaluation Kit ATSAM4E-XPRO ATSAM4E-XPRO Data Sheet
Product codes
ATSAM4E-XPRO
SAM4E [DATASHEET]
Atmel-11157D-ATARM-SAM4E16-SAM4E8-Datasheet_12-Jun-14
364
18.4
Functional Description
The Reinforced Safety Watchdog Timer (RSWDT) can be used to prevent system lock-up if the software becomes
trapped in a deadlock. It is supplied with VDDCORE. The RSWDT is initialized with default values on processor
reset, or power-on sequence and is disabled (its default mode) under such conditions.
trapped in a deadlock. It is supplied with VDDCORE. The RSWDT is initialized with default values on processor
reset, or power-on sequence and is disabled (its default mode) under such conditions.
The RSWDT works in a distinct and fully independent mode from the Watchdog Timer (WDT). Its clock source is
automatically selected from either slow RC oscillator clock or main RC oscillator divided clock to get an equivalent
slow RC oscillator clock. If the WDT clock source (for example the 32 kHz crystal oscillator) fails, the system lock-
up is no longer monitored by the WDT, but the second watchdog timer, the RSWDT, will perform the monitoring.
Therefore, continuous safety is ensured regardless of the external operating conditions.
automatically selected from either slow RC oscillator clock or main RC oscillator divided clock to get an equivalent
slow RC oscillator clock. If the WDT clock source (for example the 32 kHz crystal oscillator) fails, the system lock-
up is no longer monitored by the WDT, but the second watchdog timer, the RSWDT, will perform the monitoring.
Therefore, continuous safety is ensured regardless of the external operating conditions.
The selection of the RSWDT clock source consists of a combination of the state of the main RC oscillator (field
MOSCRCEN in CKGR_MOR), Watchdog Timer (field WDDIS in WDT_MR) and slow clock selection (field
XTALSEL in SUPC_MR). The RSWDT is driven by the slow RC oscillator if the main RC oscillator is not already in
use, and either the selected slow clock is the 32 kHz crystal oscillator, or the WDT is disabled. Accordingly, slow or
main RC oscillators are automatically enabled.
MOSCRCEN in CKGR_MOR), Watchdog Timer (field WDDIS in WDT_MR) and slow clock selection (field
XTALSEL in SUPC_MR). The RSWDT is driven by the slow RC oscillator if the main RC oscillator is not already in
use, and either the selected slow clock is the 32 kHz crystal oscillator, or the WDT is disabled. Accordingly, slow or
main RC oscillators are automatically enabled.
The RSWDT is built around a 12-bit down counter, which is loaded with a slow clock value other than that of the
slow clock in the Watchdog Timer, defined in the WDV (Watchdog Counter Value) field of the Mode Register
(RSWDT_MR). The RSWDT uses the slow clock divided by 128 to establish the maximum watchdog period to be
16 seconds (with a typical slow clock of 32.768 kHz).
slow clock in the Watchdog Timer, defined in the WDV (Watchdog Counter Value) field of the Mode Register
(RSWDT_MR). The RSWDT uses the slow clock divided by 128 to establish the maximum watchdog period to be
16 seconds (with a typical slow clock of 32.768 kHz).
After a processor reset, the value of WDV is 0xFFF, corresponding to the maximum value of the counter with the
external reset generation enabled (RSWDT_MR.WDRSTEN = 1 after a backup reset). This means that a default
watchdog is running at reset, i.e., at power-up.
external reset generation enabled (RSWDT_MR.WDRSTEN = 1 after a backup reset). This means that a default
watchdog is running at reset, i.e., at power-up.
If the watchdog is restarted by writing into the Control Register (RSWDT_CR), the RSWDT_MR must not be
programmed during a period of time of three slow clock periods following the RSWDT_CR write access. In any
case, programming a new value in the RSWDT_MR automatically initiates a restart instruction.
programmed during a period of time of three slow clock periods following the RSWDT_CR write access. In any
case, programming a new value in the RSWDT_MR automatically initiates a restart instruction.
The RSWDT_MR can be written only once. Only a processor reset resets it. Writing the RSWDT_MR reloads the
timer with the newly programmed mode parameters.
timer with the newly programmed mode parameters.
In normal operation, the user reloads the watchdog at regular intervals before the timer underflow occurs, by
setting bit RSWDT_CR.WDRSTT. The watchdog counter is then immediately reloaded from the RSWDT_MR and
restarted, and the slow clock 128 divider is reset and restarted. The RSWDT_CR is write-protected. As a result,
writing RSWDT_CR without the correct hard-coded key has no effect. If an underflow does occur, the “wdt_fault”
signal to the reset controller is asserted if the bit RSWDT_MR.WDRSTEN is set. Moreover, the bit WDUNF
(Watchdog Underflow) is set in the Status Register (RSWDT_SR).
setting bit RSWDT_CR.WDRSTT. The watchdog counter is then immediately reloaded from the RSWDT_MR and
restarted, and the slow clock 128 divider is reset and restarted. The RSWDT_CR is write-protected. As a result,
writing RSWDT_CR without the correct hard-coded key has no effect. If an underflow does occur, the “wdt_fault”
signal to the reset controller is asserted if the bit RSWDT_MR.WDRSTEN is set. Moreover, the bit WDUNF
(Watchdog Underflow) is set in the Status Register (RSWDT_SR).
To prevent a software deadlock that continuously triggers the RSWDT, the reload of the RSWDT must occur while
the watchdog counter is within a window between 0 and the Watchdog Delta Value (WDD). WDD is defined in the
RSWDT_MR.
the watchdog counter is within a window between 0 and the Watchdog Delta Value (WDD). WDD is defined in the
RSWDT_MR.
Any attempt to restart the watchdog while the watchdog counter is between the two values WDV and WDD results
in a watchdog error, even if the RSWDT is disabled. The WDERR (Watchdog Error) bit is updated in the
RSWDT_SR and the “wdt_fault” signal to the reset controller is asserted.
in a watchdog error, even if the RSWDT is disabled. The WDERR (Watchdog Error) bit is updated in the
RSWDT_SR and the “wdt_fault” signal to the reset controller is asserted.
Note that the Windowed Watchdog feature can be disabled by programming a WDD value greater than or equal to
the WDV value. In such a configuration, restarting the RSWDT is permitted in the whole range 0 to WDV and does
not generate an error. This is the default configuration on reset (the WDD and WDV values are equal).
the WDV value. In such a configuration, restarting the RSWDT is permitted in the whole range 0 to WDV and does
not generate an error. This is the default configuration on reset (the WDD and WDV values are equal).
The status bits WDUNF and WDERR trigger an interrupt, provided the WDFIEN bit is set in the RSWDT_MR. The
signal “wdt_fault” to the reset controller causes a Watchdog reset if the WDRSTEN bit is set as explained in the
“Reset Controller (RSTC)” section of the product datasheet. In that case, the processor and the watchdog timer
are reset, and the WDUNF and WDERR flags are reset.
signal “wdt_fault” to the reset controller causes a Watchdog reset if the WDRSTEN bit is set as explained in the
“Reset Controller (RSTC)” section of the product datasheet. In that case, the processor and the watchdog timer
are reset, and the WDUNF and WDERR flags are reset.
If a reset is generated, or if RSWDT_SR is read, the status bits are reset, the interrupt is cleared, and the
“wdt_fault” signal to the reset controller is deasserted.
“wdt_fault” signal to the reset controller is deasserted.