ht8 mcu watchdog timer (wdt) application – crash prevention · 2016. 12. 30. · we4~we0 bits in...

HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention

AN0426E V1.00 1/12 April 12, 2016


D/N: AN0426E

Introduction Holtek Flash MCUs provide a Watch Dog Timer function, namely WDT, which is used to

prevent system breakdowns such as program malfunctions or sequences from jumping to

endless loops or unknown locations, due to certain uncontrollable events such as

electrical noise.

Functional Description

Holtek’s latest MCUs use the single “CLR WDT” instruction to clear the Watchdog Timer

instead of using two instructions, as described below.

“CLR WDT”Instruction

11-stage Divider

7-stage Divider

WE4~WE0 bitsWDTC Register Reset MCU

fSUB

8-to-1 MUX

CLR

WS2~WS0

WDT Time-out(2n/fSUB ~ 2m/fSUB)

“HALT”Instruction

LIRC MUX

Low Speed Oscillator Configuration option

LXT

Watchdog Timer

Note: The WDT structures in different MCUs will differ in their choice of clock source, which can be at

least one of four choices, fLXT, fLIRC, fSYS and fSYS/4. The WDT overflow time depends on the

clock source frequency and also the value of n and m which depends upon which MCU is

used. Refer to the required MCU datasheet for precise details.


AN0426E V1.00 2/12 April 12, 2016

The above figure shows one of the general HT8 MCU WDT structures where the clock

source, fSUB, is supplied by the internal LIRC oscillator or the external LXT oscillator. The

WS2~WS0 bits in the WDTC register control the WDT counting frequency. The

WE4~WE0 bits in the WDTC register will enable the WDT when set to 01010B or 10101B

and will reset the MCU when set to any other value. The Watchdog Timer operates by

providing a system reset when its timer overflows. If the program malfunctions for an

uncontrollable reason, the clear instruction will not be executed at the designated point in

the program, in which case the Watchdog Timer will overflow and reset the system to the

program start location. The WDT time-out period is chosen according to the application

requirements. Shorter time-out periods will result in faster recovery speeds after a system

breakdown. However, in such cases, the increased frequency of the “CLR WDT”

instruction execution will result in reduced MCU efficiency. On the contrary, using a larger

time-out period will reduce the “CLR WDT” instruction execution frequency but will also

result in longer system recovery times. Note that the WDT clock source, which comes

from the LIRC oscillator, can vary with VDD and temperature.

Operating Principles The WDT operation status, overflow or being cleared, will influence the TO and PDF bits

in the STATUS register, as shown below.

STATUS Register

Bit 7 6 5 4 3 2 1 0 Name – – TO PDF OV Z AC C R/W – – R R R/W R/W R/W R/W POR – – 0 0 x x x x

“x”: unknown Bit 7~6 Unimplemented, read as “0”

Bit 5 TO: Watchdog Time-out flag 0: After power up or executing the “CLR WDT” or “HALT” instruction 1: A watchdog time-out occurred

Bit 4 PDF: Power down flag 0: After power up or executing the “CLR WDT” instruction 1: By executing the “HALT” instruction

Bit 3 OV: Overflow flag 0: No overflow 1: An operation results in a carry into the highest-order bit but not a carry out of the highest-order bit or vice versa

Bit 2 Z: Zero flag 0: The result of an arithmetic or logical operation is not zero 1: The result of an arithmetic or logical operation is zero

Bit 1 AC: Auxiliary flag 0: No auxiliary carry 1: An operation results in a carry out of the low nibbles in addition, or no borrow from the high nibble into the low nibble in subtraction


AN0426E V1.00 3/12 April 12, 2016

Bit 0 C: Carry flag 0: No carry-out 1: An operation results in a carry during an addition operation or if a borrow does not take place during a subtraction operation The C flag is also affected by a rotate through carry instruction.

If the WDT counter overflows, the MCU will be automatically reset to its initial status and

the program will run from the start location with the TO bit set high. Under normal program

operation, a Watchdog Timer time-out will initialise a chip reset and all the special

purpose registers will return to their initial status. However, if the system is in the SLEEP

or IDLE Mode, when a Watchdog Timer time-out occurs, only the Program Counter and

Stack Pointer will be reset to “0h”, which is called warm reset.

Watchdog Timer Control Register

The WDTC register controls the WDT enable/disable operation as well as the required

time-out period. The WDTC register and the related configuration option together control

the overall WDT operation. The Watchdog Timer control register, WDTC, is described as

below.

WDTC Register

Bit 7 6 5 4 3 2 1 0 Name WE4 WE3 WE2 WE1 WE0 WS2 WS1 WS0 R/W R/W R/W R/W R/W R/W R/W R/W R/W POR 0 1 0 1 0 0 1 1

Bit 7~3 WE4~WE0: WDT function control 01010/10101: WDT enable Other values: Reset MCU When these bits are changed to any other values by the environmental noise to reset the microcontroller, the reset operation will be activated after 2~3 LIRC clock cycles and the WRF bit will be set to 1 to indicate the reset source.

Bit 2~0 WS2~WS0: WDT time-out period selection 000: 28/fLIRC 001: 29/fLIRC 010: 210/fLIRC 011: 211/fLIRC (default) 100: 212/fLIRC 101: 213/fLIRC 110: 214/fLIRC 111: 215/fLIRC These three bits determine the division ratio of the Watchdog Timer source clock, which in turn determines the time-out period.

Note: As the structure of the Watchdog Timer varies with different MCU types, therefore the

content of the WDTC register may also differ. The MCU datasheet should be consulted for full

details.


AN0426E V1.00 4/12 April 12, 2016

Watchdog Timer Operation

The Watchdog Timer operates by providing a device reset when its timer overflows. This

means that in the application program and during normal operation the user has to

strategically clear the Watchdog Timer before it overflows to prevent the Watchdog Timer

from executing a reset. This is done using the clear watchdog timer instruction. If the

program malfunctions for whatever reason and jumps to an unknown location or enters

an endless loop, the strategically placed “CLR WDT” instructions will not be executed in

the correct manner, in which case the Watchdog Timer will overflow and reset the device.

The WDT enable control and time-out period are set using corresponding configuration

options. The WE4~WE0 bits in the WDTC register are used for the Watchdog Timer

enable and the MCU reset. After power on these bits will have a value of 01010B, in

which condition the Watchdog Timer will have the best anti-interference capacity.

Under normal program operation, a Watchdog Timer time-out will initialise a device reset

and set the status bit TO. However, if the system is in the SLEEP or IDLE Mode, when a

Watchdog Timer time-out occurs, the TO bit in the status register will be set high and only

the Program Counter and Stack Pointer will be reset. Three methods can be adopted to

clear the contents of the Watchdog Timer. The first is an external reset, which means a

low level on the external reset pin, the second is using the Watchdog Timer software clear

instruction and the third is via a HALT instruction.

There is only one method of using software instruction to clear the Watchdog Timer. That

is to use the single “CLR WDT” instruction to clear the WDT.

The maximum time-out period is when the 215 division ratio is selected. As an example,

with a 32.768kHz LXT oscillator as its source clock, this will give a maximum watchdog

period of around 1 second for the 215 division ratio, and a minimum timeout of 7.8ms for

the 28 division ration. If the fSYS/4 clock is used as the Watchdog Timer clock source, it

should be noted that when the system enters the SLEEP or IDLE0 Mode, then the

instruction clock is stopped and the Watchdog Timer may lose its protecting purpose. For

systems that operate in noisy environments, using the fSUB clock source is strongly

recommended.

Watchdog Timer Typical Application

Preventing the MCU from being locking up is one of the WDT typical applications. Usually,

there is a main program loop where different subroutines can be called to implement

different tasks. The WDT is reset once during each main loop cycle. If the program

malfunctions for whatever reason, the Watchdog Timer will overflow and reset the

system.


AN0426E V1.00 5/12 April 12, 2016

Systems with a WDT function are well suited for error code detection. Interrupt events

include memory malfunctions or EMI discharging to the memory or interfaces, may result

in microcontroller input/out data polarity reversal. When error codes are introduced into

the program, the microcontroller will execute these error codes. One of possible cases is

that the microcontroller starts by executing operands instead of opcodes, which will cause

incorrect program operation without clearing the Watchdog Timer thus resetting the

microcontroller.

It should be noted that the WDT cannot detect a transient system failure. The WDT

function only resets the microcontroller when the WDT timer reaches the preset period. It

is for this reason that a time-out period as short as possible is required, to ensure that the

system can recover to normal operation via the WDT before it is out of control.

If the system is in the SLEEP Mode, a WDT time-out will set the TO bit high and wake-up

the system to normal status.

If the Watchdog Timer needs a higher precision clock for counting, an external clock

source can be applied to the Watchdog Timer.

Hardware Description

Take the HT45F3520 application circuit as an example. Regarding the WDT function, if it

overflows, the system will be reset. The externally connected LEDs are used to indicate

whether a Watchdog Timer time-out has occurred. The key is used to determine whether

the system correctly clears the Watchdog Timer.


AN0426E V1.00 6/12 April 12, 2016

Software Description

S/W Flowchart - Example 1

Start

Turn off A/D; Select GPIO pin function

Enable WDT; Set time-out period to 1s;

Set PA1 and PA3 as outputs

Clear WDT;Set PA.1 = High

Key pressed?

Set PA.1 = Low，PA.3 = High

Loop

N

Y

Program Description - Example 1

This WDT program example uses the “CLR WDT” instruction to clear the Watchdog Timer

before it overflows to prevent the Watchdog Timer from executing a reset.

Main program flowchart description:

Firstly, clear the data register to be used and clear the ENADC bit to disable the A/D

function. Then set the required PA pins to output low level and set WS2~WS0 bits to

111B to select the 215 division ratio for 1s time-out period. If the key is not pressed, the

system can operate normally as the program includes a clear Watchdog Timer instruction.

If the key is pressed, the program will enter an endless loop where there is no clear

Watchdog Timer instruction, in which case a Watchdog Timer time-out will reset the

program. If a clear Watchdog Timer instruction is added into the endless loop, the

Watchdog Timer will be cleared and the program will keep running in the loop without

being reset.


AN0426E V1.00 7/12 April 12, 2016

Program Example - Example 1

Example 1 uses the HT45F3520 MCUan and uses the wdt_asm.zip file.

Actual output waveform and description:

Note: This figure shows the Watchdog Timer time-out period specified using the WDTC

register.


Start


Enable WDT; Set time-out period to 62.5ms; Set PA1 and PA3 as outputs

Enable Timer interrupt,time interval = 60ms

CLR WDT, set PA.3 = High Set PA.1 = High

STM interrupt handling

Return Loop

N

Y


AN0426E V1.00 8/12 April 12, 2016






function. Then set the required PA pins to output a low level and set the WS2~WS0 bits to

011B to select the 211 division ratio to achieve a 62.5ms time-out period. Configure

STMC0[6:4] to 010B to select the STM timer clock as fH/16, set STMC0[3] to 1 to enable

the STM timer and set STMC1[7:6] to 11B to select the Timer mode. In this program, if the

Watchdog Timer reset time is larger than the STM time interval, the program will run

normally, otherwise the program will reset due to the Watchdog Timer time-out.


Example 2 uses the HT45F3520 MCU and uses the wdt_asm.zip file.


Note: The above figure shows the STM time interval.


AN0426E V1.00 9/12 April 12, 2016

Note: This figure shows the Watchdog Timer time-out period. Since the STM time interval

is shorter than the Watchdog Timer time-out period, adding a clear Watchdog

Timer instruction into the timer interrupt subroutine can prevent the Watchdog

Timer from executing a reset.


Start


Enable WDT; Set time-out period to 125ms;Set PA1 and PA3 as outputs

Set PA.1 = High

Key pressed?

CLR WDT;set PA.3 = High

N

Y

Return


AN0426E V1.00 10/12 April 12, 2016






function. Then set the required PA pins to output a low level.

This example uses a function, in which the "CLR WDT" instruction is used to clear the

Watchdog Timer. Only when the function is called will the Watchdog Timer be cleared,

otherwise when a Watchdog Timer time-out occurs, the program will be reset.


The example 3 uses the HT45F3520 MCU and uses the wdt_asm.zip file.


Note: This figure shows the Watchdog Timer time-out period specified using the WDTC

register.


AN0426E V1.00 11/12 April 12, 2016

Conclusion This application note has introduced the WDT usage using several WDT application

examples which were also provided. Users can set the WDTC register according their

actual requirements to select a proper MCU reset time and clear the WDTC register in the

program to prevent an MCU reset.

Program Examples C Language Code

HT45F3520_C.zip

ASM Language Code

HT45F3520_ASM.zip

Reference File Reference file: HT45F3520 DataSheet.

For more information, refer to the Holtek official website www.holtek.com.

Versions and Revision

Date Author Issue and Revision Note

2015.12.22 霍运军 First Version

http://www.holtek.com/


AN0426E V1.00 12/12 April 12, 2016

Disclaimer All information, trademarks, logos, graphics, videos, audio clips, links and other items

appearing on this website ('Information') are for reference only and is subject to change at

any time without prior notice and at the discretion of Holtek Semiconductor Inc.

(hereinafter 'Holtek', 'the company', 'us', 'we' or 'our'). Whilst Holtek endeavors to ensure

the accuracy of the Information on this website, no express or implied warranty is given

by Holtek to the accuracy of the Information. Holtek shall bear no responsibility for any

incorrectness or leakage.

Holtek shall not be liable for any damages (including but not limited to computer virus,

system problems or data loss) whatsoever arising in using or in connection with the use of

this website by any party. There may be links in this area, which allow you to visit the

websites of other companies. These websites are not controlled by Holtek. Holtek will

bear no responsibility and no guarantee to whatsoever Information displayed at such sites.

Hyperlinks to other websites are at your own risk.

Limitation of Liability In any case, the Company has no need to take responsibility for any loss or damage

caused when anyone visits the website directly or indirectly and uses the contents,

information or service on the website.

Governing Law This disclaimer is subjected to the laws of the Republic of China and under the jurisdiction

of the Court of the Republic of China.

Update of Disclaimer Holtek reserves the right to update the Disclaimer at any time with or without prior notice,

all changes are effective immediately upon posting to the website.

ht8 mcu watchdog timer (wdt) application – crash prevention · 2016. 12. 30. · we4~we0 bits in...

Documents