34. Independent watchdog (IWDG)

34.1 Introduction

The independent watchdog (IWDG) peripheral offers a high safety level, thanks to its capability to detect malfunctions due to software or hardware failures.

The IWDG is clocked by an independent clock, and stays active even if the main clock fails.

In addition, the watchdog function is performed in the \( V_{DD} \) voltage domain, allowing the IWDG to remain functional even in low power modes. Refer to Section 34.3 to check the capability of the IWDG in this product.

The IWDG is best suited for applications that require the watchdog to run as a totally independent process outside the main application, making it very reliable to detect any unexpected behavior.

34.2 IWDG main features

• • 12-bit down-counter
• • Dual voltage domain, thus enabling operation in low power modes
• • Independent clock
• • Early wake-up interrupt generation
• • Reset generation
  • – In case of timeout
  • – In case of refresh outside the expected window

34.3 IWDG implementation

Table 322. IWDG features ⁽¹⁾

1. 'X' = supported, '-' = not supported.

2. Refer to the RCC section for additional information.

3. Controlled via DBG_IWDG_STOP in DBG section.

1. 4. Controlled via the option byte IWDG_STOP in FLASH section.
2. 5. Controlled via the option byte IWDG_STDBY in FLASH section.
3. 6. Controlled via the option byte IWDG_SW in FLASH section.

34.4 IWDG functional description

34.4.1 IWDG block diagram

Figure 373 shows the functional blocks of the independent watchdog module.

The register and IRQ interfaces are located into the \( V_{CORE} \) voltage domain. The watchdog function itself is located into the \( V_{DD} \) voltage domain to remain functional in low power modes. See Section 34.3 for IWDG capabilities.

The register and IRQ interfaces are mainly clocked by the APB clock (iwdg_pclk), while the watchdog function is clocked by a dedicated kernel clock (iwdg_ker_ck). A synchronization mechanism makes the data exchange between the two domains possible. Note that most of the registers located in the register interface are shadowed into the \( V_{DD} \) voltage domain.

The IWDG down-counter (IWDCNT) is clocked by the prescaled clock (presc_ck). The prescaled clock is generated from the kernel clock iwdg_ker_ck divided by the prescaler, according to PR[3:0] bitfield.

The table below gives the timing delays according to the actions performed on the IWDG: changing the prescaler, the timeout, the window or the early wake-up comparator values or doing a refresh.

Table 323. IWDG delays versus actions ⁽¹⁾

1. 1. \( T_k \) represents a period of the kernel clock input, \( T_p \) represents a period of presc_ck .

34.4.2 IWDG internal signals

The list of IWDG internal signals is detailed in Table 324 .

Table 324. IWDG internal input/output signals

34.4.3 Software and hardware watchdog modes

The watchdog modes allow the application to select the way the IWDG is enabled, either by software commands (Software watchdog mode), or automatically (Hardware watchdog mode). All other functions work similarly for both Software and Hardware modes.

The Software watchdog mode is the default working mode. The independent watchdog is started by writing the value 0x0000 CCCC into the IWDG key register (IWDG_KR) , and the IWDCNT starts counting down from the reset value (0xFFFF).

In the hardware watchdog mode the independent watchdog is started automatically at power-on, or every time it is reset (via iwdg_in_rst ). The IWDCNT down-counter starts counting down from the reset value 0xFFFF. The hardware watchdog mode feature is enabled through the device option bits, see Section 34.3 for details.

When the IWDG is enabled the ONF flag is set to 1.

When the IWDCNT reaches 0x0000, a reset signal is generated ( iwdg_out_rst asserted).

Whenever the key value 0x0000 AAAA is written in the IWDG key register (IWDG_KR) , the IWDG_RLR value is reloaded into the IWDCNT, and the watchdog reset is prevented.

Due to re-synchronization delays, the IWDG must be refreshed before the IWDCNT down-counter reaches 1.

Once started, the IWDG can be stopped only when it is reset ( iwdg_in_rst asserted).

As shown in Figure 374 , when the refresh command is executed, one period of presc_ck later, the IWDCNT is reloaded with the content of RL[11:0].

Figure 374. Reset timing due to timeout

1. If window option activated.

If the IWDG is not refreshed before the IWDCNT reaches 1, the IWDG generates a reset (iwdg_out_rst is asserted). In return, the RCC resets the IWDG (assertion of iwdg_in_rst) to clear the reset source.

34.4.4 Window option

The IWDG can also work as a window watchdog, by setting the appropriate window in the IWDG window register (IWDG_WINR) .

If the reload operation is performed while the counter is greater than WIN[11:0] + 1, a reset is generated. WIN[11:0] is located in the IWDG window register (IWDG_WINR) . As shown in Figure 375, the reset is generated one period of presc_ck after the unexpected refresh command.

The default value of the IWDG window register (IWDG_WINR) is 0x0000 0FFF, so, if not updated, the window option is disabled.

As soon as the window value changes, the down-counter (IWDCNT) is reloaded with the RL[11:0] value, to ease the estimation for where the next refresh must take place.

Figure 375. Reset timing due to refresh in the not allowed area

Configuring the IWDG when the window option is enabled

1. 1. Enable the IWDG by writing 0x0000 CCCC in the IWDG key register (IWDG_KR) .
2. 2. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
3. 3. Write the IWDG prescaler by programming IWDG prescaler register (IWDG_PR) .
4. 4. Write the IWDG reload register (IWDG_RLR) .
5. 5. If needed, enable the early wake-up interrupt, and program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
6. 6. Write to the IWDG window register (IWDG_WINR) . This automatically reloads the IWDGCNT down-counter with the RL[11:0] value.
7. 7. Wait for the registers to be updated (IWDG_SR = 0x0000 0000).
8. 8. Write 0x0000 0000 into IWDG key register (IWDG_KR) to write-protect registers.

Note: Step 7 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Configuring the IWDG when the window option is disabled

When the window option is not used, the IWDG can be configured as follows:

1. 1. Enable the IWDG by writing 0x0000 CCCC in the IWDG key register (IWDG_KR) .
2. 2. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
3. 3. Write the prescaler by programming the IWDG prescaler register (IWDG_PR) .
4. 4. Write the IWDG reload register (IWDG_RLR) .
5. 5. If needed, enable the early wake-up interrupt, and program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
6. 6. Wait for the registers to be updated ( IWDG_SR = 0x0000 0000).
7. 7. Refresh the counter with RL[11:0] value, and write-protect registers by writing 0x0000 AAAA into IWDG key register (IWDG_KR) .

The figure below shows a sequence example changing the prescaler, the reload value, and then performing a refresh.

Figure 376. Changing PR, RL, and performing a refresh ⁽¹⁾

1. 1. Refer to Table 323: IWDG delays versus actions for details on timing values.

Note: When the new prescaler value is accepted by the IWDG (falling edge of PVU), the new division ratio is effective when the current division sequence is completed ( N-k in the drawing).

Note: The timeout delay between the refresh (write 0xAAAA into IWDG_KR) and the watchdog reset is increased by TD_Refresh .

If a refresh command is sent while the previous refresh command is not yet completed, this last refresh command is ignored.

Updating the window comparator

It is possible to update the window comparator when the IWDG is already running. The IWDCNT is reloaded as well. The following sequence can be performed to update the window comparator:

1. 1. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR).
2. 2. Write to the IWDG window register (IWDG_WINR). This automatically reloads the IWDCNT down-counter with RL[11:0] value.
3. 3. Wait for WVU = 0
4. 4. Lock registers by writing IWDG_KR to 0x0000 0000

Step 3 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Figure 377 shows this sequence. As soon as the IWDG_WINR register is written, the WVU flag goes high for TD _WVU . After a window comparator update, a refresh is automatically performed. The refresh is effective in the worst case, on the next prescaler clock active edge after the falling edge of WVU (TD _RefAuto )

Figure 377. Window comparator update ⁽¹⁾

1. 1. Refer to Table 323: IWDG delays versus actions for details on timing values.

34.4.5 Debug

When the processor enters into Debug mode (core halted), the IWDCNT down-counter either continues to work normally or stops, depending on debug capability of the product. Refer to Section 34.3 for details on the capabilities of this product.

34.4.6 Register access protection

Write accesses to IWDG prescaler register (IWDG_PR) , IWDG reload register (IWDG_RLR) , IWDG early wake-up interrupt register (IWDG_EWCR) and IWDG window register (IWDG_WINR) are protected. To modify them, first write 0x0000 5555 in the IWDG key register (IWDG_KR) . A write access to this register with a different value breaks the

sequence and register access is protected again. This is the case of the reload operation (writing 0x0000 AAAA).

A status register is available to indicate that an update of the prescaler or the down-counter reload value or the window value is ongoing.

34.5 IWDG low power modes

Depending on option bytes configuration, the IWDG can continue counting or not during the low power modes. Refer to Section 34.3 for details.

Table 325. Effect of low power modes on IWDG

34.6 IWDG interrupts

The IWDG offers the possibility to generate an early interrupt depending on the value of the down-counter. The early interrupt is enabled by setting the EWIE bit of the IWDG early wake-up interrupt register (IWDG_EWCR) to 1.

A comparator value (EWIT[11:0]) allows the application to define the position where the early interrupt must be generated.

When the IWDGCNT down-counter reaches the value of EWIT[11:0] - 1, the iwdg_wkup is activated, making it possible for the system to exit from low power modes, if needed.

When the APB clock is available, the iwdg_it is activated as well.

In addition, the flag EWIF of the IWDG status register (IWDG_SR) is set to 1.

The EWI interrupt is acknowledged by writing 1 to the EWIC bit in the IWDG early wake-up interrupt register (IWDG_EWCR) .

Writing into the IWDG_EWCR register also triggers a refresh of the down-counter (IWDGCNT) with the reload value RL[11:0].

Figure 378. Independent watchdog interrupt timing diagram

The early wake-up interrupt (EWI) can be used if specific safety operations or data logging must be performed before the watchdog reset is generated.

Changing the early wake-up comparator value

It is possible to change the early wake-up comparator value or to enable/disable the interrupt generation at any time, by performing the following sequence:

1. 1. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
2. 2. Enable or disable the early wake-up interrupt, and/or program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
3. 3. Wait for EWU = 0, EWU is located into the IWDG status register (IWDG_SR) .
4. 4. Write-protect registers by writing 0x0000 0000 to IWDG key register (IWDG_KR) .

Step 3 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Figure 378 shows this sequence. During the early wake-up comparator update operation the flag EWU remains to 1 for TDewu. A refresh is automatically performed. The refresh is effective on the worst case, on the next prescaler clock active edge after the falling edge of EWU (TDRefAuto).

1. Refer to Table 323: IWDG delays versus actions for details on timing values.

Table 326 summarizes the IWDG interrupt request.

Table 326. IWDG interrupt request

1. 1. Generated when a clock is present on iwdg_pclk input.
2. 2. Generated when a clock is present on iwdg_ker_ck input.

34.7 IWDG registers

Refer to Section 1.2 on page 70 for a list of abbreviations used in register descriptions.

The peripheral registers can be accessed by half-words (16-bit) or words (32-bit).

Most of the registers located into the register interface are shadowed into the \( V_{DD} \) voltage domain. When the iwdg_in_rst is asserted, the watchdog logic and the shadow registers located into the \( V_{DD} \) voltage domain are reset.

When the application reads back a watchdog register, the hardware transfers the value of the corresponding shadow register to the register interface.

When the application writes a watchdog register, the hardware updates the corresponding shadow register.

34.7.1 IWDG key register (IWDG_KR)

Address offset: 0x00

Reset value: 0x0000 0000

Bits 31:16 Reserved, must be kept at reset value.

Bits 15:0 KEY[15:0] : Key value (write only, read 0x0000)

These bits can be used for several functions, depending upon the value written by the application:

• - 0xAAAA: reloads the RL[11:0] value into the IWDGCNT down-counter (watchdog refresh), and write-protects registers. This value must be written by software at regular intervals, otherwise the watchdog generates a reset when the counter reaches 0.
• - 0x5555: enables write-accesses to the registers.
• - 0xCCCC: enables the watchdog (except if the hardware watchdog option is selected) and write-protects registers.
• - values different from 0x5555: write-protects registers.

Note that only IWDG_PR, IWDG_RLR, IWDG_EWCR and IWDG_WINR registers have a write-protection mechanism.

34.7.2 IWDG prescaler register (IWDG_PR)

Address offset: 0x04

Reset value: 0x0000 0000

Bits 31:4 Reserved, must be kept at reset value.

Bits 3:0 PR[3:0] : Prescaler divider

These bits are write access protected, see Section 34.4.6 . They are written by software to select the prescaler divider feeding the counter clock. PVU bit of the IWDG status register (IWDG_SR) must be reset to be able to change the prescaler divider.

0000: divider / 4

0001: divider / 8

0010: divider / 16

0011: divider / 32

0100: divider / 64

0101: divider / 128

0110: divider / 256

0111: divider / 512

Others: divider / 1024

Note: Reading this register returns the prescaler value from the \( V_{DD} \) voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing. For this reason the value read from this register is valid only when the PVU bit in the IWDG status register (IWDG_SR) is reset.

34.7.3 IWDG reload register (IWDG_RLR)

Address offset: 0x08

Reset value: 0x0000 0FFF

Bits 31:12 Reserved, must be kept at reset value.

Bits 11:0 RL[11:0] : Watchdog counter reload value

These bits are write access protected, see Section 34.4.6 . They are written by software to define the value to be loaded in the watchdog counter each time the value 0xAAAA is written in the IWDG key register (IWDG_KR) . The watchdog counter counts down from this value. The timeout period is a function of this value and the prescaler/clock. It is not recommended to set RL[11:0] to a value lower than 2.

The RVU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the reload value from the \( V_{DD} \) voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing, hence the value read from this register is valid only when the RVU bit in the IWDG status register (IWDG_SR) is reset.

34.7.4 IWDG status register (IWDG_SR)

Address offset: 0x0C

Reset value: 0x0000 0000 (0xFFFF FEFF)

This register contains various status flags. Note that the mask value between parenthesis means that the reset value of ONF bit is not defined. When the IWDG is configured in

software mode, the reset value of ONF bit is 0, when the IWDG is configured in hardware mode, the reset value of ONF bit is 1.

Bits 31:15 Reserved, must be kept at reset value.

Bit 14 EWIF : Watchdog early interrupt flag

This bit is set to '1' by hardware in order to indicate that an early interrupt is pending. This bit must be cleared by the software by writing the bit EWIC of IWDG_EWCR register to '1'.

Bits 13:9 Reserved, must be kept at reset value.

Bit 8 ONF : Watchdog enable status bit

Set to '1' by hardware as soon as the IWDG is started. In software mode, it remains to '1' until the IWDG is reset. In hardware mode, this bit is always set to '1'.

0: The IWDG is not activated

1: The IWDG is activated and needs to be refreshed regularly by the application

Bits 7:4 Reserved, must be kept at reset value.

Bit 3 EWU : Watchdog interrupt comparator value update

This bit is set by hardware to indicate that an update of the interrupt comparator value (EWIT[11:0]) or an update of the EWIE is ongoing. It is reset by hardware when the update operation is completed in the V _DD voltage domain. Refer to Table 323: IWDG delays versus actions for delay values.

The EWIT[11:0] and EWIE fields can be updated only when EWU bit is reset.

Bit 2 WVU : Watchdog counter window value update

This bit is set by hardware to indicate that an update of the window value is ongoing. It is reset by hardware when the reload value update operation is completed in the V _DD voltage domain. Refer to Table 323: IWDG delays versus actions for delay values.

The window value can be updated only when WVU bit is reset.

This bit is generated only if generic "window" = 1.

Bit 1 RVU : Watchdog counter reload value update

This bit is set by hardware to indicate that an update of the reload value is ongoing. It is reset by hardware when the reload value update operation is completed in the V _DD voltage domain. Refer to Table 323: IWDG delays versus actions for delay values.

The reload value can be updated only when RVU bit is reset.

Bit 0 PVU : Watchdog prescaler value update

This bit is set by hardware to indicate that an update of the prescaler value is ongoing. It is reset by hardware when the prescaler update operation is completed in the V _DD voltage domain. Refer to Table 323: IWDG delays versus actions for delay values.

The prescaler value can be updated only when PVU bit is reset.

Note: If several reload, prescaler, early interrupt position or window values are used by the application, it is mandatory to wait until RVU bit is reset before changing the reload value, to wait until PVU bit is reset before changing the prescaler value, to wait until WVU bit is reset before changing the window value, and to wait until EWU bit is reset before changing the

early interrupt position value. After updating the prescaler and/or the reload/window/early interrupt value, it is not necessary to wait until RVU or PVU or WVU or EWU is reset before continuing code execution, except in case of low power mode entry.

34.7.5 IWDG window register (IWDG_WINR)

Address offset: 0x10

Reset value: 0x0000 0FFF

Bits 31:12 Reserved, must be kept at reset value.

Bits 11:0 WIN[11:0] : Watchdog counter window value

These bits are write access protected, see Section 34.4.6 . They contain the high limit of the window value to be compared with the downcounter.

To prevent a reset, the IWDGCNT downcounter must be reloaded when its value is lower than WIN[11:0] + 1 and greater than 1.

The WVU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the reload value from the V _DD voltage domain. This value may not be valid if a write operation to this register is ongoing. For this reason the value read from this register is valid only when the WVU bit in the IWDG status register (IWDG_SR) is reset.

34.7.6 IWDG early wake-up interrupt register (IWDG_EWCR)

Address offset: 0x14

Reset value: 0x0000 0000

Bits 31:16 Reserved, must be kept at reset value.

Bit 15 EWIE : Watchdog early interrupt enable

Set and reset by software.

0: The early interrupt interface is disabled.

1: The early interrupt interface is enabled.

The EWU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the value of this bit.

Bit 14 EWIC : Watchdog early interrupt acknowledge

The software must write a 1 into this bit in order to acknowledge the early wake-up interrupt and to clear the EWIF flag. Writing 0 has no effect, reading this flag returns a 0.

Bits 13:12 Reserved, must be kept at reset value.

Bits 11:0 EWIT[11:0] : Watchdog counter window value

These bits are write access protected (see Section 34.4.6 ). They are written by software to define at which position of the IWDGCNT down-counter the early wake-up interrupt must be generated. The early interrupt is generated when the IWDGCNT is lower or equal to EWIT[11:0] - 1.

EWIT[11:0] must be bigger than 1.

An interrupt is generated only if EWIE = 1.

The EWU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the Early wake-up comparator value and the Interrupt enable bit from the \( V_{DD} \) voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing, hence the value read from this register is valid only when the EWU bit in the IWDG status register (IWDG_SR) is reset.

34.7.7 IWDG register map

Table 327. IWDG register map and reset values