61. Independent watchdog (IWDG)

61.1 IWDG introduction

The independent watchdog (IWDG) peripheral offers a high safety level, thanks to its capability to detect malfunctions due to software or hardware failures.

The IWDG is clocked by an independent clock, and stays active even if the main clock fails.

In addition, the watchdog function is performed in the \( V_{DD} \) voltage domain, allowing the IWDG to remain functional even in low power modes. Refer to Section 61.3 to check the capability of the IWDG in this product.

The IWDG is best suited for applications that require the watchdog to run as a totally independent process outside the main application, making it very reliable to detect any unexpected behavior.

61.2 IWDG main features

• • 12-bit down-counter
• • Dual voltage domain, thus enabling operation in low power modes
• • Independent clock
• • Early wake-up interrupt generation
• • Reset generation
  • – In case of timeout
  • – In case of refresh outside the expected window

61.3 IWDG implementation

Table 622. STM32U5 series IWDG features ⁽¹⁾

1. 'X' = supported, '-' = not supported.

2. Refer to the RCC section for additional information.

1. 3. Wake-up from Stop with interrupt is supported only in Stop 0, Stop 1, and Stop 2 modes for STM32U575/585, and in Stop 0, Stop 1, Stop 2, and Stop 3 modes for STM32U535/545/59x/5Ax/5Fx/5Gx.
2. 4. Controlled via DBG_IWDG_STOP in DBG section.
3. 5. Controlled via the option byte IWDG_STOP in FLASH section.
4. 6. Controlled via the option byte IWDG_STDBY in FLASH section.
5. 7. Controlled via the option byte IWDG_SW in FLASH section.

61.4 IWDG functional description

61.4.1 IWDG block diagram

Figure 766 shows the functional blocks of the independent watchdog module.

Figure 766. Independent watchdog block diagram

The register and IRQ interfaces are located into the \( V_{CORE} \) voltage domain. The watchdog function itself is located into the \( V_{DD} \) voltage domain to remain functional in low power modes. See Section 61.3 for IWDG capabilities.

The register and IRQ interfaces are mainly clocked by the APB clock (iwdg_pclk), while the watchdog function is clocked by a dedicated kernel clock (iwdg_ker_ck). A synchronization mechanism makes the data exchange between the two domains possible. Note that most of the registers located in the register interface are shadowed into the \( V_{DD} \) voltage domain.

The IWDG down-counter (IWDcnt) is clocked by the prescaled clock (presc_ck). The prescaled clock is generated from the kernel clock iwdg_ker_ck divided by the prescaler, according to PR[3:0] bitfield.

The table below gives the timing delays according to the actions performed on the IWDG: changing the prescaler, the timeout, the window or the early wake-up comparator values or doing a refresh.

1. T _k represents a period of the kernel clock input, T _p represents a period of presc_ck.

61.4.2 IWDG internal signals

The list of IWDG internal signals is detailed in Table 624 .

Table 624. IWDG internal input/output signals

61.4.3 Software and hardware watchdog modes

The watchdog modes allow the application to select the way the IWDG is enabled, either by software commands (Software watchdog mode), or automatically (Hardware watchdog mode). All other functions work similarly for both Software and Hardware modes.

The software watchdog mode is the default working mode. The independent watchdog is started by writing the value 0x0000 CCCC into the IWDG key register (IWDG_KR) , and the IWDCNT starts counting down from the reset value (0xFFFF).

In the hardware watchdog mode the independent watchdog is generally started automatically at power-on, or every time it is reset (via iwdg_in_rst). The IWDCNT down-counter starts counting down from the reset value 0xFFF. The hardware watchdog mode feature is enabled through the device option bits, see Section 61.3 for details.

When the IWDCNT reaches 0x000, a reset signal is generated (iwdg_out_rst asserted).

Whenever the key value 0x0000 AAAA is written in the IWDG key register (IWDG_KR) , the IWDG_RLR value is reloaded into the IWDCNT, and the watchdog reset is prevented.

Due to re-synchronization delays, the IWDG must be refreshed before the IWDCNT down-counter reaches 1.

Once started, the IWDG can be stopped only when it is reset (iwdg_in_rst asserted).

As shown in Figure 767 , when the refresh command is executed, one period of presc_ck later, the IWDCNT is reloaded with the content of RL[11:0].

Figure 767. Reset timing due to timeout

1. If window option activated.

If the IWDG is not refreshed before the IWDCNT reaches 1, the IWDG generates a reset (iwdg_out_rst is asserted). In return, the RCC resets the IWDG (assertion of iwdg_in_rst) to clear the reset source.

Note: The iwdg_out_rst signal typically triggers a system reset, however, this behavior may vary across products. For more details, refer to Chapter 61.3.

61.4.4 Window option

The IWDG can also work as a window watchdog, by setting the appropriate window in the IWDG window register (IWDG_WINR) .

If the reload operation is performed while the counter is greater than WIN[11:0] + 1, a reset is generated. WIN[11:0] is located in the IWDG window register (IWDG_WINR) . As shown in Figure 768, the reset is generated one period of presc_ck after the unexpected refresh command.

The default value of the IWDG window register (IWDG_WINR) is 0x0000 0FFF, so, if not updated, the window option is disabled.

As soon as the window value changes, the down-counter (IWDCNT) is reloaded with the RL[11:0] value, to ease the estimation for where the next refresh must take place.

Figure 768. Reset timing due to refresh in the not allowed area

MS49975V3

Configuring the IWDG when the window option is enabled

1. 1. Enable the IWDG by writing 0x0000 CCCC in the IWDG key register (IWDG_KR) .
2. 2. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
3. 3. Write the IWDG prescaler by programming IWDG prescaler register (IWDG_PR) .
4. 4. Write the IWDG reload register (IWDG_RLR) .
5. 5. If needed, enable the early wake-up interrupt, and program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
6. 6. Write to the IWDG window register (IWDG_WINR) . This automatically reloads the IWDGCNT down-counter with the RL[11:0] value.
7. 7. Wait for the registers to be updated (IWDG_SR = 0x0000 0000).
8. 8. Write 0x0000 0000 into IWDG key register (IWDG_KR) to write-protect registers.

Note: Step 7 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Configuring the IWDG when the window option is disabled

When the window option is not used, the IWDG can be configured as follows:

1. 1. Enable the IWDG by writing 0x0000 CCCC in the IWDG key register (IWDG_KR) .
2. 2. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
3. 3. Write the prescaler by programming the IWDG prescaler register (IWDG_PR) .
4. 4. Write the IWDG reload register (IWDG_RLR) .
5. 5. If needed, enable the early wake-up interrupt, and program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
6. 6. Wait for the registers to be updated ( IWDG_SR = 0x0000 0000).
7. 7. Refresh the counter with RL[11:0] value, and write-protect registers by writing 0x0000 AAAA into IWDG key register (IWDG_KR) .

The figure below shows a sequence example changing the prescaler, the reload value, and then performing a refresh.

Figure 769. Changing PR, RL, and performing a refresh ⁽¹⁾

1. 1. Refer to Table 623: IWDG delays versus actions for details on timing values.

Note: When the new prescaler value is accepted by the IWDG (falling edge of PVU), the new division ratio is effective when the current division sequence is completed ( N-k in the drawing).

Note: The timeout delay between the refresh (write 0xAA into IWDG_KR) and the watchdog reset is increased by TD _Refresh .

If a refresh command is sent while the previous refresh command is not yet completed, this last refresh command is ignored.

Updating the window comparator

It is possible to update the window comparator when the IWDG is already running. The IWDCNT is reloaded as well. The following sequence can be performed to update the window comparator:

1. 1. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR).
2. 2. Write to the IWDG window register (IWDG_WINR). This automatically reloads the IWDCNT down-counter with RL[11:0] value.
3. 3. Wait for WVU = 0
4. 4. Lock registers by writing IWDG_KR to 0x0000 0000

Step 3 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

61.4.5 Debug

When the processor enters into Debug mode (core halted), the IWDCNT down-counter either continues to work normally or stops, depending on debug capability of the product. Refer to Section 61.3 for details on the capabilities of this product.

61.4.6 Register access protection

Write accesses to IWDG prescaler register (IWDG_PR) , IWDG reload register (IWDG_RLR) , IWDG early wake-up interrupt register (IWDG_EWCR) and IWDG window register (IWDG_WINR) are protected. To modify them, first write 0x0000 5555 in the IWDG key register (IWDG_KR) . A write access to this register with a different value breaks the sequence and register access is protected again. This is the case of the reload operation (writing 0x0000 AAAA).

A status register is available to indicate that an update of the prescaler or the down-counter reload value or the window value is ongoing.

61.5 IWDG low power modes

Depending on option bytes configuration, the IWDG can continue counting or not during the low power modes. Refer to Section 61.3 for details.

Table 625. Effect of low power modes on IWDG

61.6 IWDG interrupts

The IWDG offers the possibility to generate an early interrupt depending on the value of the down-counter. The early interrupt is enabled by setting the EWIE bit of the IWDG early wake-up interrupt register (IWDG_EWCR) to 1.

A comparator value (EWIT[11:0]) allows the application to define the position where the early interrupt must be generated.

When the IWDGCNT down-counter reaches the value of EWIT[11:0] - 1, the iwdg_wkup is activated, making it possible for the system to exit from low power modes, if needed.

When the APB clock is available, the iwdg_it is activated as well.

In addition, the flag EWIF of the IWDG status register (IWDG_SR) is set to 1.

The EWI interrupt is acknowledged by writing 1 to the EWIC bit in the IWDG early wake-up interrupt register (IWDG_EWCR) .

Writing into the IWDG_EWCR register also triggers a refresh of the down-counter (IWDGCNT) with the reload value RL[11:0].

Figure 770. Independent watchdog interrupt timing diagram

The early wake-up interrupt (EWI) can be used if specific safety operations or data logging must be performed before the watchdog reset is generated.

Changing the early wake-up comparator value

It is possible to change the early wake-up comparator value or to enable/disable the interrupt generation at any time, by performing the following sequence:

1. 1. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .

1. 2. Enable or disable the early wake-up interrupt, and/or program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
2. 3. Wait for EWU = 0, EWU is located into the IWDG status register (IWDG_SR) .
3. 4. Write-protect registers by writing 0x0000 0000 to IWDG key register (IWDG_KR) .

Step 3 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Table 626 summarizes the IWDG interrupt request.

Table 626. IWDG interrupt request

1. Generated when a clock is present on iwdg_pclk input.

2. Generated when a clock is present on iwdg_ker_ck input.

61.7 IWDG registers

Refer to Section 1.2 on page 127 for a list of abbreviations used in register descriptions.

The peripheral registers can be accessed by half-words (16-bit) or words (32-bit).

Most of the registers located into the register interface are shadowed into the V _DD voltage domain. When the iwdg_in_rst is asserted, the watchdog logic and the shadow registers located into the V _DD voltage domain are reset.

When the application reads back a watchdog register, the hardware transfers the value of the corresponding shadow register to the register interface.

When the application writes a watchdog register, the hardware updates the corresponding shadow register.

61.7.1 IWDG key register (IWDG_KR)

Address offset: 0x00

Reset value: 0x0000 0000

Bits 31:16 Reserved, must be kept at reset value.

Bits 15:0 KEY[15:0] : Key value (write only, read 0x0000)

These bits can be used for several functions, depending upon the value written by the application:

• - 0xAAAA: reloads the RL[11:0] value into the IWDGCNT down-counter (watchdog refresh), and write-protects registers. This value must be written by software at regular intervals, otherwise the watchdog generates a reset when the counter reaches 0.
• - 0x5555: enables write-accesses to the registers.
• - 0xCCCC: enables the watchdog (except if the hardware watchdog option is selected) and write-protects registers.
• - values different from 0x5555: write-protects registers.

Note that only IWDG_PR, IWDG_RLR, IWDG_EWCR and IWDG_WINR registers have a write-protection mechanism.

61.7.2 IWDG prescaler register (IWDG_PR)

Address offset: 0x04

Reset value: 0x0000 0000

Bits 31:4 Reserved, must be kept at reset value.

Bits 3:0 PR[3:0] : Prescaler divider

These bits are write access protected, see Section 61.4.6 . They are written by software to select the prescaler divider feeding the counter clock. PVU bit of the IWDG status register (IWDG_SR) must be reset to be able to change the prescaler divider.

• 0000: divider / 4
• 0001: divider / 8
• 0010: divider / 16
• 0011: divider / 32
• 0100: divider / 64
• 0101: divider / 128
• 0110: divider / 256
• 0111: divider / 512
• Others: divider / 1024

Note: Reading this register returns the prescaler value from the V _DD voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing. For this reason the value read from this register is valid only when the PVU bit in the IWDG status register (IWDG_SR) is reset.

61.7.3 IWDG reload register (IWDG_RLR)

Address offset: 0x08

Reset value: 0x0000 0FFF

Bits 31:12 Reserved, must be kept at reset value.

Bits 11:0 RL[11:0] : Watchdog counter reload value

These bits are write access protected, see Section 61.4.6 . They are written by software to define the value to be loaded in the watchdog counter each time the value 0xAAAA is written in the IWDG key register (IWDG_KR) . The watchdog counter counts down from this value.

The timeout period is a function of this value and the prescaler.clock. It is not recommended to set RL[11:0] to a value lower than 2.

The RVU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the reload value from the V _DD voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing, hence the value read from this register is valid only when the RVU bit in the IWDG status register (IWDG_SR) is reset.

61.7.4 IWDG status register (IWDG_SR)

Address offset: 0x0C

Reset value: 0x0000 0000

Bits 31:15 Reserved, must be kept at reset value.

Bit 14 EWIF : Watchdog early interrupt flag

This bit is set to '1' by hardware in order to indicate that an early interrupt is pending. This bit must be cleared by the software by writing the bit EWIC of IWDG_EWCR register to '1'.

Bits 13:4 Reserved, must be kept at reset value.

Bit 3 EWU : Watchdog interrupt comparator value update

This bit is set by hardware to indicate that an update of the interrupt comparator value (EWIT[11:0]) or an update of the EWIE is ongoing. It is reset by hardware when the update operation is completed in the V _DD voltage domain. Refer to Table 623: IWDG delays versus actions for delay values.

The EWIT[11:0] and EWIE fields can be updated only when EWU bit is reset.

Bit 2 WVU : Watchdog counter window value update

This bit is set by hardware to indicate that an update of the window value is ongoing. It is reset by hardware when the reload value update operation is completed in the \( V_{DD} \) voltage domain. Refer to Table 623: IWDG delays versus actions for delay values.

The window value can be updated only when WVU bit is reset.

This bit is generated only if generic “window” = 1.

Bit 1 RVU : Watchdog counter reload value update

This bit is set by hardware to indicate that an update of the reload value is ongoing. It is reset by hardware when the reload value update operation is completed in the \( V_{DD} \) voltage domain. Refer to Table 623: IWDG delays versus actions for delay values.

The reload value can be updated only when RVU bit is reset.

Bit 0 PVU : Watchdog prescaler value update

This bit is set by hardware to indicate that an update of the prescaler value is ongoing. It is reset by hardware when the prescaler update operation is completed in the \( V_{DD} \) voltage domain. Refer to Table 623: IWDG delays versus actions for delay values.

The prescaler value can be updated only when PVU bit is reset.

Note: If several reload, prescaler, early interrupt position or window values are used by the application, it is mandatory to wait until RVU bit is reset before changing the reload value, to wait until PVU bit is reset before changing the prescaler value, to wait until WVU bit is reset before changing the window value, and to wait until EWU bit is reset before changing the early interrupt position value. After updating the prescaler and/or the reload/window/early interrupt value, it is not necessary to wait until RVU or PVU or WVU or EWU is reset before continuing code execution, except in case of low power mode entry.

61.7.5 IWDG window register (IWDG_WINR)

Address offset: 0x10

Reset value: 0x0000 0FFF

Bits 31:12 Reserved, must be kept at reset value.

Bits 11:0 WIN[11:0] : Watchdog counter window value

These bits are write access protected, see Section 61.4.6 . They contain the high limit of the window value to be compared with the downcounter.

To prevent a reset, the IWDGCNT downcounter must be reloaded when its value is lower than WIN[11:0] + 1 and greater than 1.

The WVU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the reload value from the \( V_{DD} \) voltage domain. This value may not be valid if a write operation to this register is ongoing. For this reason the value read from this register is valid only when the WVU bit in the IWDG status register (IWDG_SR) is reset.

61.7.6 IWDG early wake-up interrupt register (IWDG_EWCR)

Address offset: 0x14

Reset value: 0x0000 0000

Bits 31:16 Reserved, must be kept at reset value.

Bit 15 EWIE : Watchdog early interrupt enable

Set and reset by software.

0: The early interrupt interface is disabled.

1: The early interrupt interface is enabled.

The EWU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the value of this bit.

Bit 14 EWIC : Watchdog early interrupt acknowledge

The software must write a 1 into this bit in order to acknowledge the early wake-up interrupt and to clear the EWIF flag. Writing 0 has no effect, reading this flag returns a 0.

Bits 13:12 Reserved, must be kept at reset value.

Bits 11:0 EWIT[11:0] : Watchdog counter early wake-up interrupt value

These bits are write access protected (see Section 61.4.6 ). They are written by software to define at which position of the IWDGCNT down-counter the early wake-up interrupt must be generated. The early interrupt is generated when the IWDGCNT is lower or equal to EWIT[11:0] - 1.

EWIT[11:0] must be bigger than 1.

An interrupt is generated only if EWIE = 1.

The EWU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the Early wake-up comparator value and the Interrupt enable bit from the V _DD voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing, hence the value read from this register is valid only when the EWU bit in the IWDG status register (IWDG_SR) is reset.

61.7.7 IWDG register map

Table 627. IWDG register map and reset values

Refer to Section 2.3: Memory organization for the register boundary addresses.