
How to use the
Watchdog Timer of the TriCore
3 of 17
AP3219 Rel.02
1
The TriCore Watchdog Timer provides a recovery mechanism from software or hardware
failure. The Watchdog Timer can either be used in an application, with its highly reliable
and secure Watchdog function, or it can be disabled.
If the software fails to service this timer correctly, the TriCore is reset.
When the software is configured to always service the Watchdog Timer before it overflows,
the Watchdog Timer will Time-out if the program does not progress properly. The
Watchdog Timer also times out if the software error was due to hardware-related failures.
This operation prevents the controller from malfunctioning for longer than a user-specified
time.
Service of the Watchdog Timer is a critical system function, because unintentional service
due to an error condition could disable the Watchdog function. Thus, the TriCore’s
Watchdog service requires a special instruction sequence with a password mechanism in
order to become effective. Incorrect sequences also lead to a reset of the chip.
In order for software to determine the cause of a Watchdog failure, first the Watchdog
Timer generates a NMI trap, then the reset occurs after a certain Time-out Period. In the
NMI trap routine, critical system state such as the PC value, the stack pointer, and context
pointers can be stored to data memory for examination after the reset has occurred. The
Watchdog Timer also has flags that indicate the type of Watchdog failure.
In addition to the Watchdog function, a Watchdog Timer control register contains the
WDTCON0.ENDINIT bit, which controls access to system critical registers. The state of
the ENDINIT bit can be modified; however, this must be performed using the sophisticated
password scheme of the Watchdog Timer. The Watchdog Timer monitors modifications of
the ENDINIT bit such that after clearing ENDINIT, the Watchdog Timer enters a defined
Time-out Mode; ENDINIT must be set again before the Time-out expires.
In systems where the Watchdog function is not applicable, the Watchdog Timer can be
disabled. However, this operation is also protected via the password scheme. The
Watchdog Time-out Function invoked on modifications of the ENDINIT bit is independent
of the disable or enable status of the Watchdog Timer.
Overview