Upload
others
View
2
Download
0
Embed Size (px)
Citation preview
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 1/12 April 12, 2016
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
D/N: AN0426E
Introduction Holtek Flash MCUs provide a Watch Dog Timer function, namely WDT, which is used to
prevent system breakdowns such as program malfunctions or sequences from jumping to
endless loops or unknown locations, due to certain uncontrollable events such as
electrical noise.
Functional Description
Holtek’s latest MCUs use the single “CLR WDT” instruction to clear the Watchdog Timer
instead of using two instructions, as described below.
“CLR WDT”Instruction
11-stage Divider
7-stage Divider
WE4~WE0 bitsWDTC Register Reset MCU
fSUB
8-to-1 MUX
CLR
WS2~WS0
WDT Time-out(2n/fSUB ~ 2m/fSUB)
“HALT”Instruction
LIRC MUX
Low Speed Oscillator Configuration option
LXT
Watchdog Timer
Note: The WDT structures in different MCUs will differ in their choice of clock source, which can be at
least one of four choices, fLXT, fLIRC, fSYS and fSYS/4. The WDT overflow time depends on the
clock source frequency and also the value of n and m which depends upon which MCU is
used. Refer to the required MCU datasheet for precise details.
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 2/12 April 12, 2016
The above figure shows one of the general HT8 MCU WDT structures where the clock
source, fSUB, is supplied by the internal LIRC oscillator or the external LXT oscillator. The
WS2~WS0 bits in the WDTC register control the WDT counting frequency. The
WE4~WE0 bits in the WDTC register will enable the WDT when set to 01010B or 10101B
and will reset the MCU when set to any other value. The Watchdog Timer operates by
providing a system reset when its timer overflows. If the program malfunctions for an
uncontrollable reason, the clear instruction will not be executed at the designated point in
the program, in which case the Watchdog Timer will overflow and reset the system to the
program start location. The WDT time-out period is chosen according to the application
requirements. Shorter time-out periods will result in faster recovery speeds after a system
breakdown. However, in such cases, the increased frequency of the “CLR WDT”
instruction execution will result in reduced MCU efficiency. On the contrary, using a larger
time-out period will reduce the “CLR WDT” instruction execution frequency but will also
result in longer system recovery times. Note that the WDT clock source, which comes
from the LIRC oscillator, can vary with VDD and temperature.
Operating Principles The WDT operation status, overflow or being cleared, will influence the TO and PDF bits
in the STATUS register, as shown below.
STATUS Register
Bit 7 6 5 4 3 2 1 0 Name – – TO PDF OV Z AC C R/W – – R R R/W R/W R/W R/W POR – – 0 0 x x x x
“x”: unknown Bit 7~6 Unimplemented, read as “0”
Bit 5 TO: Watchdog Time-out flag 0: After power up or executing the “CLR WDT” or “HALT” instruction 1: A watchdog time-out occurred
Bit 4 PDF: Power down flag 0: After power up or executing the “CLR WDT” instruction 1: By executing the “HALT” instruction
Bit 3 OV: Overflow flag 0: No overflow 1: An operation results in a carry into the highest-order bit but not a carry out of the highest-order bit or vice versa
Bit 2 Z: Zero flag 0: The result of an arithmetic or logical operation is not zero 1: The result of an arithmetic or logical operation is zero
Bit 1 AC: Auxiliary flag 0: No auxiliary carry 1: An operation results in a carry out of the low nibbles in addition, or no borrow from the high nibble into the low nibble in subtraction
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 3/12 April 12, 2016
Bit 0 C: Carry flag 0: No carry-out 1: An operation results in a carry during an addition operation or if a borrow does not take place during a subtraction operation The C flag is also affected by a rotate through carry instruction.
If the WDT counter overflows, the MCU will be automatically reset to its initial status and
the program will run from the start location with the TO bit set high. Under normal program
operation, a Watchdog Timer time-out will initialise a chip reset and all the special
purpose registers will return to their initial status. However, if the system is in the SLEEP
or IDLE Mode, when a Watchdog Timer time-out occurs, only the Program Counter and
Stack Pointer will be reset to “0h”, which is called warm reset.
Watchdog Timer Control Register
The WDTC register controls the WDT enable/disable operation as well as the required
time-out period. The WDTC register and the related configuration option together control
the overall WDT operation. The Watchdog Timer control register, WDTC, is described as
below.
WDTC Register
Bit 7 6 5 4 3 2 1 0 Name WE4 WE3 WE2 WE1 WE0 WS2 WS1 WS0 R/W R/W R/W R/W R/W R/W R/W R/W R/W POR 0 1 0 1 0 0 1 1
Bit 7~3 WE4~WE0: WDT function control 01010/10101: WDT enable Other values: Reset MCU When these bits are changed to any other values by the environmental noise to reset the microcontroller, the reset operation will be activated after 2~3 LIRC clock cycles and the WRF bit will be set to 1 to indicate the reset source.
Bit 2~0 WS2~WS0: WDT time-out period selection 000: 28/fLIRC 001: 29/fLIRC 010: 210/fLIRC 011: 211/fLIRC (default) 100: 212/fLIRC 101: 213/fLIRC 110: 214/fLIRC 111: 215/fLIRC These three bits determine the division ratio of the Watchdog Timer source clock, which in turn determines the time-out period.
Note: As the structure of the Watchdog Timer varies with different MCU types, therefore the
content of the WDTC register may also differ. The MCU datasheet should be consulted for full
details.
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 4/12 April 12, 2016
Watchdog Timer Operation
The Watchdog Timer operates by providing a device reset when its timer overflows. This
means that in the application program and during normal operation the user has to
strategically clear the Watchdog Timer before it overflows to prevent the Watchdog Timer
from executing a reset. This is done using the clear watchdog timer instruction. If the
program malfunctions for whatever reason and jumps to an unknown location or enters
an endless loop, the strategically placed “CLR WDT” instructions will not be executed in
the correct manner, in which case the Watchdog Timer will overflow and reset the device.
The WDT enable control and time-out period are set using corresponding configuration
options. The WE4~WE0 bits in the WDTC register are used for the Watchdog Timer
enable and the MCU reset. After power on these bits will have a value of 01010B, in
which condition the Watchdog Timer will have the best anti-interference capacity.
Under normal program operation, a Watchdog Timer time-out will initialise a device reset
and set the status bit TO. However, if the system is in the SLEEP or IDLE Mode, when a
Watchdog Timer time-out occurs, the TO bit in the status register will be set high and only
the Program Counter and Stack Pointer will be reset. Three methods can be adopted to
clear the contents of the Watchdog Timer. The first is an external reset, which means a
low level on the external reset pin, the second is using the Watchdog Timer software clear
instruction and the third is via a HALT instruction.
There is only one method of using software instruction to clear the Watchdog Timer. That
is to use the single “CLR WDT” instruction to clear the WDT.
The maximum time-out period is when the 215 division ratio is selected. As an example,
with a 32.768kHz LXT oscillator as its source clock, this will give a maximum watchdog
period of around 1 second for the 215 division ratio, and a minimum timeout of 7.8ms for
the 28 division ration. If the fSYS/4 clock is used as the Watchdog Timer clock source, it
should be noted that when the system enters the SLEEP or IDLE0 Mode, then the
instruction clock is stopped and the Watchdog Timer may lose its protecting purpose. For
systems that operate in noisy environments, using the fSUB clock source is strongly
recommended.
Watchdog Timer Typical Application
Preventing the MCU from being locking up is one of the WDT typical applications. Usually,
there is a main program loop where different subroutines can be called to implement
different tasks. The WDT is reset once during each main loop cycle. If the program
malfunctions for whatever reason, the Watchdog Timer will overflow and reset the
system.
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 5/12 April 12, 2016
Systems with a WDT function are well suited for error code detection. Interrupt events
include memory malfunctions or EMI discharging to the memory or interfaces, may result
in microcontroller input/out data polarity reversal. When error codes are introduced into
the program, the microcontroller will execute these error codes. One of possible cases is
that the microcontroller starts by executing operands instead of opcodes, which will cause
incorrect program operation without clearing the Watchdog Timer thus resetting the
microcontroller.
It should be noted that the WDT cannot detect a transient system failure. The WDT
function only resets the microcontroller when the WDT timer reaches the preset period. It
is for this reason that a time-out period as short as possible is required, to ensure that the
system can recover to normal operation via the WDT before it is out of control.
If the system is in the SLEEP Mode, a WDT time-out will set the TO bit high and wake-up
the system to normal status.
If the Watchdog Timer needs a higher precision clock for counting, an external clock
source can be applied to the Watchdog Timer.
Hardware Description
Take the HT45F3520 application circuit as an example. Regarding the WDT function, if it
overflows, the system will be reset. The externally connected LEDs are used to indicate
whether a Watchdog Timer time-out has occurred. The key is used to determine whether
the system correctly clears the Watchdog Timer.
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 6/12 April 12, 2016
Software Description
S/W Flowchart - Example 1
Start
Turn off A/D; Select GPIO pin function
Enable WDT; Set time-out period to 1s;
Set PA1 and PA3 as outputs
Clear WDT;Set PA.1 = High
Key pressed?
Set PA.1 = Low,PA.3 = High
Loop
N
Y
Program Description - Example 1
This WDT program example uses the “CLR WDT” instruction to clear the Watchdog Timer
before it overflows to prevent the Watchdog Timer from executing a reset.
Main program flowchart description:
Firstly, clear the data register to be used and clear the ENADC bit to disable the A/D
function. Then set the required PA pins to output low level and set WS2~WS0 bits to
111B to select the 215 division ratio for 1s time-out period. If the key is not pressed, the
system can operate normally as the program includes a clear Watchdog Timer instruction.
If the key is pressed, the program will enter an endless loop where there is no clear
Watchdog Timer instruction, in which case a Watchdog Timer time-out will reset the
program. If a clear Watchdog Timer instruction is added into the endless loop, the
Watchdog Timer will be cleared and the program will keep running in the loop without
being reset.
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 7/12 April 12, 2016
Program Example - Example 1
Example 1 uses the HT45F3520 MCUan and uses the wdt_asm.zip file.
Actual output waveform and description:
Note: This figure shows the Watchdog Timer time-out period specified using the WDTC
register.
S/W Flowchart - Example 2
Start
Turn off A/D; Select GPIO pin function
Enable WDT; Set time-out period to 62.5ms; Set PA1 and PA3 as outputs
Enable Timer interrupt,time interval = 60ms
CLR WDT, set PA.3 = High Set PA.1 = High
STM interrupt handling
Return Loop
N
Y
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 8/12 April 12, 2016
Program Description - Example 2
This WDT program example uses the “CLR WDT” instruction to clear the Watchdog Timer
before it overflows to prevent the Watchdog Timer from executing a reset.
Main program flowchart description:
Firstly, clear the data register to be used and clear the ENADC bit to disable the A/D
function. Then set the required PA pins to output a low level and set the WS2~WS0 bits to
011B to select the 211 division ratio to achieve a 62.5ms time-out period. Configure
STMC0[6:4] to 010B to select the STM timer clock as fH/16, set STMC0[3] to 1 to enable
the STM timer and set STMC1[7:6] to 11B to select the Timer mode. In this program, if the
Watchdog Timer reset time is larger than the STM time interval, the program will run
normally, otherwise the program will reset due to the Watchdog Timer time-out.
Program Example - Example 2
Example 2 uses the HT45F3520 MCU and uses the wdt_asm.zip file.
Actual output waveform and description:
Note: The above figure shows the STM time interval.
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 9/12 April 12, 2016
Note: This figure shows the Watchdog Timer time-out period. Since the STM time interval
is shorter than the Watchdog Timer time-out period, adding a clear Watchdog
Timer instruction into the timer interrupt subroutine can prevent the Watchdog
Timer from executing a reset.
S/W Flowchart - Example 3
Start
Turn off A/D; Select GPIO pin function
Enable WDT; Set time-out period to 125ms;Set PA1 and PA3 as outputs
Set PA.1 = High
Key pressed?
CLR WDT;set PA.3 = High
N
Y
Return
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 10/12 April 12, 2016
Program Description - Example 3
This WDT program example uses the “CLR WDT” instruction to clear the Watchdog Timer
before it overflows to prevent the Watchdog Timer from executing a reset.
Main program flowchart description:
Firstly, clear the data register to be used and clear the ENADC bit to disable the A/D
function. Then set the required PA pins to output a low level.
This example uses a function, in which the "CLR WDT" instruction is used to clear the
Watchdog Timer. Only when the function is called will the Watchdog Timer be cleared,
otherwise when a Watchdog Timer time-out occurs, the program will be reset.
Program Example - Example 3
The example 3 uses the HT45F3520 MCU and uses the wdt_asm.zip file.
Actual output waveform and description:
Note: This figure shows the Watchdog Timer time-out period specified using the WDTC
register.
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 11/12 April 12, 2016
Conclusion This application note has introduced the WDT usage using several WDT application
examples which were also provided. Users can set the WDTC register according their
actual requirements to select a proper MCU reset time and clear the WDTC register in the
program to prevent an MCU reset.
Program Examples C Language Code
HT45F3520_C.zip
ASM Language Code
HT45F3520_ASM.zip
Reference File Reference file: HT45F3520 DataSheet.
For more information, refer to the Holtek official website www.holtek.com.
Versions and Revision
Date Author Issue and Revision Note
2015.12.22 霍运军 First Version
HT8 MCU Watchdog Timer (WDT) Application – Crash Prevention
AN0426E V1.00 12/12 April 12, 2016
Disclaimer All information, trademarks, logos, graphics, videos, audio clips, links and other items
appearing on this website ('Information') are for reference only and is subject to change at
any time without prior notice and at the discretion of Holtek Semiconductor Inc.
(hereinafter 'Holtek', 'the company', 'us', 'we' or 'our'). Whilst Holtek endeavors to ensure
the accuracy of the Information on this website, no express or implied warranty is given
by Holtek to the accuracy of the Information. Holtek shall bear no responsibility for any
incorrectness or leakage.
Holtek shall not be liable for any damages (including but not limited to computer virus,
system problems or data loss) whatsoever arising in using or in connection with the use of
this website by any party. There may be links in this area, which allow you to visit the
websites of other companies. These websites are not controlled by Holtek. Holtek will
bear no responsibility and no guarantee to whatsoever Information displayed at such sites.
Hyperlinks to other websites are at your own risk.
Limitation of Liability In any case, the Company has no need to take responsibility for any loss or damage
caused when anyone visits the website directly or indirectly and uses the contents,
information or service on the website.
Governing Law This disclaimer is subjected to the laws of the Republic of China and under the jurisdiction
of the Court of the Republic of China.
Update of Disclaimer Holtek reserves the right to update the Disclaimer at any time with or without prior notice,
all changes are effective immediately upon posting to the website.