35. Independent watchdog (IWDG)

35.1 IWDG introduction

The independent watchdog (IWDG) peripheral offers a high safety level, thanks to its capability to detect malfunctions due to software or hardware failures.

The IWDG is clocked by an independent clock, and stays active even if the main clock fails.

In addition, the watchdog function is performed in the \( V_{DD} \) voltage domain, allowing the IWDG to remain functional even in low power modes. Refer to Section 35.3 to check the capability of the IWDG in this product.

The IWDG is best suited for applications that require the watchdog to run as a totally independent process outside the main application, making it very reliable to detect any unexpected behavior.

35.2 IWDG main features

35.3 IWDG implementation

Table 336. IWDG features (1)

IWDG modes/featuresIWDG
LSI used as IWDG kernel clock (iwdg_ker_ck)X
Window functionX
Early wake-up interrupt generationX
System reset generation (2)X
Capability to work in system StopX
Capability to work in system StandbyX
Capability to generate an interrupt in system StopX
Capability to generate an interrupt in system StandbyX
Capability to be frozen when the microcontroller enters in Debug mode (3)X
Option bytes to control the activity in Stop mode (4)X
Option bytes to control the activity in Standby mode (5)X
Option bytes to control the Hardware mode (6)X

1. 'X' = supported, '-' = not supported.

2. Refer to the RCC section for additional information.

3. Controlled via DBG_IWDG_STOP in DBG section.

  1. 4. Controlled via the option byte IWDG_STOP in FLASH section.
  2. 5. Controlled via the option byte IWDG_STDBY in FLASH section.
  3. 6. Controlled via the option byte IWDG_SW in FLASH section.

35.4 IWDG functional description

35.4.1 IWDG block diagram

Figure 378 shows the functional blocks of the independent watchdog module.

Figure 378. Independent watchdog block diagram. The diagram shows the IWDG module split into two voltage domains: V_CORE and V_DD. In the V_CORE domain, there is a Register interface connected to an APB bus (iwdg_pclk) and an IRQ interface (iwdg_it). In the V_DD domain, there is a Prescaler (inputs: iwdg_ker_ck, iwdg_in_rst), a 12-bit reload value register, an IWDcnt (12 bits) counter, and Comparator logic (outputs: iwdg_wkup, iwdg_out_rst). A 'sync' block and 'Shadow registers and Control' block facilitate data exchange between the two domains. The IWDcnt counter is clocked by the prescaled clock (presc_ck) from the Prescaler.

Figure 378. Independent watchdog block diagram

Figure 378. Independent watchdog block diagram. The diagram shows the IWDG module split into two voltage domains: V_CORE and V_DD. In the V_CORE domain, there is a Register interface connected to an APB bus (iwdg_pclk) and an IRQ interface (iwdg_it). In the V_DD domain, there is a Prescaler (inputs: iwdg_ker_ck, iwdg_in_rst), a 12-bit reload value register, an IWDcnt (12 bits) counter, and Comparator logic (outputs: iwdg_wkup, iwdg_out_rst). A 'sync' block and 'Shadow registers and Control' block facilitate data exchange between the two domains. The IWDcnt counter is clocked by the prescaled clock (presc_ck) from the Prescaler.

The register and IRQ interfaces are located into the \( V_{CORE} \) voltage domain. The watchdog function itself is located into the \( V_{DD} \) voltage domain to remain functional in low power modes. See Section 35.3 for IWDG capabilities.

The register and IRQ interfaces are mainly clocked by the APB clock (iwdg_pclk), while the watchdog function is clocked by a dedicated kernel clock (iwdg_ker_ck). A synchronization mechanism makes the data exchange between the two domains possible. Note that most of the registers located in the register interface are shadowed into the \( V_{DD} \) voltage domain.

The IWDG down-counter (IWDcnt) is clocked by the prescaled clock (presc_ck). The prescaled clock is generated from the kernel clock iwdg_ker_ck divided by the prescaler, according to PR[3:0] bitfield.

The table below gives the timing delays according to the actions performed on the IWDG: changing the prescaler, the timeout, the window or the early wake-up comparator values or doing a refresh.

Table 337. IWDG delays versus actions (1)

TD RVU , TD PVUTD WVUTD EWUTD RefreshTD RefAuto
MinMaxMinMaxMinMaxMinMaxMinMax
5 T k6 T k-6 T k-6 T k2 T k2 T k + T p-T p
  1. 1. Tk represents a period of the kernel clock input, Tp represents a period of presc_ck.

35.4.2 IWDG internal signals

The list of IWDG internal signals is detailed in Table 338 .

Table 338. IWDG internal input/output signals

Signal nameSignal typeDescription
iwdg_ker_ckInputIWDG kernel clock
iwdg_ker_reqInputIWDG kernel clock request
iwdg_pclkInputIWDG APB clock
iwdg_out_rstOutputIWDG reset output
iwdg_in_rstInputIWDG reset input
iwdg_wkupOutputIWDG wake-up event
iwdg_itOutputIWDG early wake-up interrupt

35.4.3 Software and hardware watchdog modes

The watchdog modes allow the application to select the way the IWDG is enabled, either by software commands (Software watchdog mode), or automatically (Hardware watchdog mode). All other functions work similarly for both Software and Hardware modes.

The software watchdog mode is the default working mode. The independent watchdog is started by writing the value 0x0000 CCCC into the IWDG key register (IWDG_KR) , and the IWDCNT starts counting down from the reset value (0xFFF).

In the hardware watchdog mode the independent watchdog is started automatically at power-on, or every time it is reset (via iwdg_in_rst). The IWDCNT down-counter starts counting down from the reset value 0xFFF. The hardware watchdog mode feature is enabled through the device option bits, see Section 35.3 for details.

When the IWDG is enabled the ONF flag is set to 1.

When the IWDCNT reaches 0x000, a reset signal is generated (iwdg_out_rst asserted).

Whenever the key value 0x0000 AAAA is written in the IWDG key register (IWDG_KR) , the IWDG_RLR value is reloaded into the IWDCNT, and the watchdog reset is prevented.

Due to re-synchronization delays, the IWDG must be refreshed before the IWDCNT down-counter reaches 1.

Once started, the IWDG can be stopped only when it is reset (iwdg_in_rst asserted).

As shown in Figure 379 , when the refresh command is executed, one period of presc_ck later, the IWDCNT is reloaded with the content of RL[11:0].

Figure 379. Reset timing due to timeout

Timing diagram for IWDG reset due to timeout. The top graph shows the IWDCNT value decreasing linearly from RL[11:0] towards 0. A window threshold WIN[11:0] is shown. The counter is divided into two regions: 'Refresh not allowed' (from RL[11:0] down to WIN[11:0]+1) and 'Refresh allowed' (from WIN[11:0]+1 down to 0). A reset is generated when the counter reaches 0. Below the graph, signals for 'Writing 0xAAAA into IWDG_KR', 'iwdg_out_rst', and 'iwdg_in_rst' are shown. An inset shows a detail of the prescaler clock (T_presc_ck) and counter states (0, 1, 2).

The figure is a timing diagram illustrating the reset timing due to a timeout in the Independent Watchdog (IWDG). The top part shows the IWDCNT value decreasing linearly over time. The counter starts at RL[11:0] and decreases towards 0. A window threshold WIN[11:0] is indicated. The counter is divided into two regions: 'Refresh not allowed' (from RL[11:0] down to WIN[11:0]+1) and 'Refresh allowed' (from WIN[11:0]+1 down to 0). A reset is generated when the counter reaches 0. Below the graph, signals for 'Writing 0xAAAA into IWDG_KR', 'iwdg_out_rst', and 'iwdg_in_rst' are shown. An inset shows a detail of the prescaler clock (T_presc_ck) and counter states (0, 1, 2).

Timing diagram for IWDG reset due to timeout. The top graph shows the IWDCNT value decreasing linearly from RL[11:0] towards 0. A window threshold WIN[11:0] is shown. The counter is divided into two regions: 'Refresh not allowed' (from RL[11:0] down to WIN[11:0]+1) and 'Refresh allowed' (from WIN[11:0]+1 down to 0). A reset is generated when the counter reaches 0. Below the graph, signals for 'Writing 0xAAAA into IWDG_KR', 'iwdg_out_rst', and 'iwdg_in_rst' are shown. An inset shows a detail of the prescaler clock (T_presc_ck) and counter states (0, 1, 2).

1. If window option activated.

If the IWDG is not refreshed before the IWDCNT reaches 1, the IWDG generates a reset (iwdg_out_rst is asserted). In return, the RCC resets the IWDG (assertion of iwdg_in_rst) to clear the reset source.

35.4.4 Window option

The IWDG can also work as a window watchdog, by setting the appropriate window in the IWDG window register (IWDG_WINR) .

If the reload operation is performed while the counter is greater than WIN[11:0] + 1, a reset is generated. WIN[11:0] is located in the IWDG window register (IWDG_WINR) . As shown in Figure 380, the reset is generated one period of presc_ck after the unexpected refresh command.

The default value of the IWDG window register (IWDG_WINR) is 0x0000 0FFF, so, if not updated, the window option is disabled.

As soon as the window value changes, the down-counter (IWDCNT) is reloaded with the RL[11:0] value, to ease the estimation for where the next refresh must take place.

Figure 380. Reset timing due to refresh in the not allowed area

Timing diagram for IWDG reset due to refresh in the not allowed area. The diagram shows the IWDGCNT value, RL[11:0], WIN[11:0] + 1, Writing 0xAAAA into IWDG_KR, iwdg_out_rst, and iwdg_in_rst signals over time. The IWDGCNT value starts at 0xFFF and decreases. The RL[11:0] value is shown as a step function. The WIN[11:0] + 1 value is shown as a step function. The Writing 0xAAAA into IWDG_KR signal is shown as a pulse. The iwdg_out_rst signal is shown as a pulse. The iwdg_in_rst signal is shown as a pulse. The 'Refresh not allowed' period is indicated by a shaded region. The T_presc_ck period is indicated by a double-headed arrow.

The diagram illustrates the timing of an IWDG reset when a refresh is attempted outside the allowed window. The top graph shows the IWDGCNT value decreasing from 0xFFF. The RL[11:0] and WIN[11:0] + 1 values are shown as step functions. The 'Refresh not allowed' period is shaded. The bottom part shows the timing of writing 0xAAAA into IWDG_KR, iwdg_out_rst, and iwdg_in_rst signals. The T_presc_ck period is indicated.

Timing diagram for IWDG reset due to refresh in the not allowed area. The diagram shows the IWDGCNT value, RL[11:0], WIN[11:0] + 1, Writing 0xAAAA into IWDG_KR, iwdg_out_rst, and iwdg_in_rst signals over time. The IWDGCNT value starts at 0xFFF and decreases. The RL[11:0] value is shown as a step function. The WIN[11:0] + 1 value is shown as a step function. The Writing 0xAAAA into IWDG_KR signal is shown as a pulse. The iwdg_out_rst signal is shown as a pulse. The iwdg_in_rst signal is shown as a pulse. The 'Refresh not allowed' period is indicated by a shaded region. The T_presc_ck period is indicated by a double-headed arrow.

MS49975V3

Configuring the IWDG when the window option is enabled

  1. 1. Enable the IWDG by writing 0x0000 CCCC in the IWDG key register (IWDG_KR) .
  2. 2. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
  3. 3. Write the IWDG prescaler by programming IWDG prescaler register (IWDG_PR) .
  4. 4. Write the IWDG reload register (IWDG_RLR) .
  5. 5. If needed, enable the early wake-up interrupt, and program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
  6. 6. Write to the IWDG window register (IWDG_WINR) . This automatically reloads the IWDGCNT down-counter with the RL[11:0] value.
  7. 7. Wait for the registers to be updated (IWDG_SR = 0x0000 0000).
  8. 8. Write 0x0000 0000 into IWDG key register (IWDG_KR) to write-protect registers.

Note: Step 7 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Configuring the IWDG when the window option is disabled

When the window option it is not used, the IWDG can be configured as follows:

  1. 1. Enable the IWDG by writing 0x0000 CCCC in the IWDG key register (IWDG_KR) .
  2. 2. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
  3. 3. Write the prescaler by programming the IWDG prescaler register (IWDG_PR) .
  4. 4. Write the IWDG reload register (IWDG_RLR) .
  5. 5. If needed, enable the early wake-up interrupt, and program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
  6. 6. Wait for the registers to be updated ( IWDG_SR = 0x0000 0000).
  7. 7. Refresh the counter with RL[11:0] value, and write-protect registers by writing 0x0000 AAAA into IWDG key register (IWDG_KR) .

The figure below shows a sequence example changing the prescaler, the reload value, and then performing a refresh.

Figure 381. Changing PR, RL, and performing a refresh (1)

Timing diagram showing the sequence for changing IWDG prescaler, reload value, and performing a refresh. The diagram includes signals for iwdg_ker_ck, WDGcnt counter, PVU, RVU, Prescaler, RL[11:0], and CPU activity. It illustrates the timing for writing to IWDG_PR, IWDG_KR, and RL[11:0] registers, and the resulting counter values and timeout delays (TD_PVU, TD_RVU, TD_Refresh).

The diagram illustrates the timing sequence for configuring the IWDG. The top signal is iwdg_ker_ck , a high-frequency clock. Below it is the WDGcnt counter , which counts down from N to 0. The counter's division ratio is determined by the Prescaler register. The Prescaler register is initially set to ÷ 4 . The RL[11:0] register is initially set to P . The CPU activity line shows the sequence of writes: first, 'Write 1 into IWDG_PR' and 'Write 0x5555 into IWDG_KR' (Registers unlock). This is followed by a change in the Prescaler to ÷ 8 . Then, 'Write into M into RL[11:0]' occurs. Finally, 'Write 0xAAAA into IWDG_KR' (Refresh + Registers lock) occurs. The diagram shows the counter counting down from N to N-k (with ÷ 4 division), then from N-k-1 to N-k-t (with ÷ 8 division), and finally reaching M . The timeout delay TD_PVU is the time for the counter to reach N-k with ÷ 4 division. TD_RVU is the time for the counter to reach N-k-t with ÷ 8 division. TD_Refresh is the time between the final write and the counter reaching M . A 'Refresh ignored region' is indicated for the counter values between N-k-t and M .

Timing diagram showing the sequence for changing IWDG prescaler, reload value, and performing a refresh. The diagram includes signals for iwdg_ker_ck, WDGcnt counter, PVU, RVU, Prescaler, RL[11:0], and CPU activity. It illustrates the timing for writing to IWDG_PR, IWDG_KR, and RL[11:0] registers, and the resulting counter values and timeout delays (TD_PVU, TD_RVU, TD_Refresh).
  1. 1. Refer to Table 337: IWDG delays versus actions for details on timing values.

Note: When the new prescaler value is accepted by the IWDG (falling edge of PVU), the new division ratio is effective when the current division sequence is completed ( N-k in the drawing).

Note: The timeout delay between the refresh (write 0xAAAA into IWDG_KR) and the watchdog reset is increased by TD_Refresh .

If a refresh command is sent while the previous refresh command is not yet completed, this last refresh command is ignored.

Updating the window comparator

It is possible to update the window comparator when the IWDG is already running. The IWDCNT is reloaded as well. The following sequence can be performed to update the window comparator:

  1. 1. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR).
  2. 2. Write to the IWDG window register (IWDG_WINR). This automatically reloads the IWDCNT down-counter with RL[11:0] value.
  3. 3. Wait for WVU = 0
  4. 4. Lock registers by writing IWDG_KR to 0x0000 0000

Step 3 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Figure 382 shows this sequence. As soon as the IWDG_WINR register is written, the WVU flag goes high for TD wvu . After a window comparator update, a refresh is automatically performed. The refresh is effective in the worst case, on the next prescaler clock active edge after the falling edge of WVU (TD RefAuto )

Figure 382. Window comparator update (1)

Timing diagram for window comparator update. The diagram shows five horizontal timelines: iwdg_ker_ck (clock), WDGCNT counter (values N, ..., N-k, M, M-1, M-2, ...), WVU (flag), WIN[11:0] (values 500, 800), and CPU activity. CPU activity shows three writes: 'Write 0x5555 into IWDG_KR' (Registers unlock), 'Write 800 into IWDG_WINR', and 'Write 0x0000 into IWDG_KR' (Registers lock). The WVU flag goes high when WIN[11:0] is updated to 800 and goes low when it returns to 500. The WDGCNT counter is reloaded to M when WIN[11:0] is updated. A 'Refresh ignored region' is highlighted in yellow between N-k and M. Timing intervals TD_wvu and TD_RefAuto are indicated.

The diagram illustrates the timing sequence for updating the window comparator. The top line shows the IWDG kernel clock (iwdg_ker_ck). Below it, the WDGCNT counter is shown with values N, ..., N-k, M, M-1, M-2, ... . A yellow shaded area between N-k and M is labeled 'Refresh ignored region'. The WVU flag is shown going high when the WIN[11:0] register is updated from 500 to 800 and going low when it returns to 500. The WIN[11:0] register is shown with values 500 and 800. The RL[11:0] register is shown with the value M. CPU activity is shown at the bottom with three write actions: 'Write 0x5555 into IWDG_KR' (Registers unlock), 'Write 800 into IWDG_WINR', and 'Write 0x0000 into IWDG_KR' (Registers lock). The first write to IWDG_KR unlocks the registers, the write to IWDG_WINR updates the window comparator and reloads the counter, and the second write to IWDG_KR locks the registers. Timing intervals TD wvu and TD RefAuto are indicated.

MSv75427V1

Timing diagram for window comparator update. The diagram shows five horizontal timelines: iwdg_ker_ck (clock), WDGCNT counter (values N, ..., N-k, M, M-1, M-2, ...), WVU (flag), WIN[11:0] (values 500, 800), and CPU activity. CPU activity shows three writes: 'Write 0x5555 into IWDG_KR' (Registers unlock), 'Write 800 into IWDG_WINR', and 'Write 0x0000 into IWDG_KR' (Registers lock). The WVU flag goes high when WIN[11:0] is updated to 800 and goes low when it returns to 500. The WDGCNT counter is reloaded to M when WIN[11:0] is updated. A 'Refresh ignored region' is highlighted in yellow between N-k and M. Timing intervals TD_wvu and TD_RefAuto are indicated.
  1. 1. Refer to Table 337: IWDG delays versus actions for details on timing values.

35.4.5 Debug

When the processor enters into Debug mode (core halted), the IWDGCNT down-counter either continues to work normally or stops, depending on debug capability of the product. Refer to Section 35.3 for details on the capabilities of this product.

35.4.6 Register access protection

Write accesses to IWDG prescaler register (IWDG_PR) , IWDG reload register (IWDG_RLR) , IWDG early wake-up interrupt register (IWDG_EWCR) and IWDG window register (IWDG_WINR) are protected. To modify them, first write 0x0000 5555 in the IWDG key register (IWDG_KR) . A write access to this register with a different value breaks the

sequence and register access is protected again. This is the case of the reload operation (writing 0x0000 AAAA).

A status register is available to indicate that an update of the prescaler or the down-counter reload value or the window value is ongoing.

35.5 IWDG low power modes

Depending on option bytes configuration, the IWDG can continue counting or not during the low power modes. Refer to Section 35.3 for details.

Table 339. Effect of low power modes on IWDG

ModeDescription
SleepNo effect. IWDG interrupts cause the device to exit from the mode.
StopThe IWDG remains active or not, depending on option bytes configuration. Refer to Section 35.3 for details.
IWDG interrupts cause the device exit the Stop mode.
StandbyThe IWDG remains active or not, depending on option bytes configuration. Refer to Section 35.3 for details.
IWDG interrupts cause the device to exit from Standby mode.

35.6 IWDG interrupts

The IWDG offers the possibility to generate an early interrupt depending on the value of the down-counter. The early interrupt is enabled by setting the EWIE bit of the IWDG early wake-up interrupt register (IWDG_EWCR) to 1.

A comparator value (EWIT[11:0]) allows the application to define the position where the early interrupt must be generated.

When the IWDGCNT down-counter reaches the value of EWIT[11:0] - 1, the iwdg_wkup is activated, making it possible for the system to exit from low power modes, if needed.

When the APB clock is available, the iwdg_it is activated as well.

In addition, the flag EWIF of the IWDG status register (IWDG_SR) is set to 1.

The EWI interrupt is acknowledged by writing 1 to the EWIC bit in the IWDG early wake-up interrupt register (IWDG_EWCR) .

Writing into the IWDG_EWCR register also triggers a refresh of the down-counter (IWDGCNT) with the reload value RL[11:0].

Figure 383. Independent watchdog interrupt timing diagram

Figure 383. Independent watchdog interrupt timing diagram. The diagram shows the relationship between the IWDGCNT value, APB write accesses, iwdg_wkup_it, pclk, and iwdg_it signals over time. The IWDGCNT value starts at EWIT[11:0] and decreases linearly. A vertical dashed line marks the point where IWDGCNT = EWIT - 1. At this point, the iwdg_wkup_it signal goes high. A write access to the EWIC register is shown, setting EWIC to '1'. The pclk signal is shown as a series of pulses, with a shaded region indicating it is active. The iwdg_it signal goes high when the pclk is active and the iwdg_wkup_it signal is high.

The figure is a timing diagram for the Independent Watchdog (IWDG) interrupt. The top graph shows the IWDGCNT value decreasing linearly over time. A horizontal line represents the EWIT[11:0] value. A vertical dashed line indicates the point where IWDGCNT = EWIT - 1. Below the graph, four signal lines are shown: APB write accesses, iwdg_wkup_it, pclk, and iwdg_it. The APB write accesses line shows a write to the EWIC register, setting it to '1'. The iwdg_wkup_it signal goes high at the point where IWDGCNT = EWIT - 1. The pclk signal is shown as a series of pulses, with a shaded region indicating it is active. The iwdg_it signal goes high when the pclk is active and the iwdg_wkup_it signal is high. The diagram is labeled MS49976V1.

Figure 383. Independent watchdog interrupt timing diagram. The diagram shows the relationship between the IWDGCNT value, APB write accesses, iwdg_wkup_it, pclk, and iwdg_it signals over time. The IWDGCNT value starts at EWIT[11:0] and decreases linearly. A vertical dashed line marks the point where IWDGCNT = EWIT - 1. At this point, the iwdg_wkup_it signal goes high. A write access to the EWIC register is shown, setting EWIC to '1'. The pclk signal is shown as a series of pulses, with a shaded region indicating it is active. The iwdg_it signal goes high when the pclk is active and the iwdg_wkup_it signal is high.

The early wake-up interrupt (EWI) can be used if specific safety operations or data logging must be performed before the watchdog reset is generated.

Changing the early wake-up comparator value

It is possible to change the early wake-up comparator value or to enable/disable the interrupt generation at any time, by performing the following sequence:

  1. 1. Enable register access by writing 0x0000 5555 in the IWDG key register (IWDG_KR) .
  2. 2. Enable or disable the early wake-up interrupt, and/or program the early wake-up comparator, by writing the proper values into the IWDG early wake-up interrupt register (IWDG_EWCR) .
  3. 3. Wait for EWU = 0, EWU is located into the IWDG status register (IWDG_SR) .
  4. 4. Write-protect registers by writing 0x0000 0000 to IWDG key register (IWDG_KR) .

Step 3 can be skipped if the application does not intend to disable the APB clock after the completion of this sequence.

Figure 384 shows this sequence. During the early wake-up comparator update operation the flag EWU remains to 1 for TDewu. A refresh is automatically performed. The refresh is effective on the worst case, on the next prescaler clock active edge after the falling edge of EWU (TDRefAuto).

Figure 384. Early wake-up comparator update (1) Timing diagram for early wake-up comparator update. It shows the relationship between iwdg_ker_ck clock, WDGCNT counter, EWU, EWIT[11:0], RL[11:0], and CPU activity. The counter counts down from N to M, where M is the refresh ignored region. The EWU is active when the counter is between N-k and M. The EWIT[11:0] register is updated from 500 to 300. The RL[11:0] register is updated to M. CPU activity is shown as pulses. Timing parameters TD_EWU and TD_RefAuto are indicated. Actions include writing 300 into EWIT[11:0], writing 0x5555 into IWDG_KR to unlock registers, and writing 0x0000 into IWDG_KR to lock registers.

The diagram illustrates the timing for an early wake-up comparator update. The top signal is iwdg_ker_ck , a periodic clock. Below it is the WDGCNT counter , which counts down from N through N-k to M (highlighted in a yellow 'Refresh ignored region'), then to M-1 , M-2 , and so on. The EWU (Early Wake-Up) signal is active (high) when the counter is between N-k and M . The EWIT[11:0] register is initially set to 500 and is updated to 300 when the counter reaches N-k . The RL[11:0] register is updated to M when the counter reaches M . CPU activity is shown as pulses. Timing parameters TD_EWU and TD_RefAuto are indicated. Actions include writing 300 into EWIT[11:0] , writing 0x5555 into IWDG_KR to unlock registers, and writing 0x0000 into IWDG_KR to lock registers. The diagram is labeled MSv75425V1.

Timing diagram for early wake-up comparator update. It shows the relationship between iwdg_ker_ck clock, WDGCNT counter, EWU, EWIT[11:0], RL[11:0], and CPU activity. The counter counts down from N to M, where M is the refresh ignored region. The EWU is active when the counter is between N-k and M. The EWIT[11:0] register is updated from 500 to 300. The RL[11:0] register is updated to M. CPU activity is shown as pulses. Timing parameters TD_EWU and TD_RefAuto are indicated. Actions include writing 300 into EWIT[11:0], writing 0x5555 into IWDG_KR to unlock registers, and writing 0x0000 into IWDG_KR to lock registers.

1. Refer to Table 337: IWDG delays versus actions for details on timing values.

Table 340 summarizes the IWDG interrupt request.

Table 340. IWDG interrupt request

Interrupt eventEvent flagInterrupt clear methodInterrupt enable control bitActivated interrupt
iwdg_itiwdg_wkup_it
IWDGCNT reaches EWIT valueEWIFWriting EWIC to 1EWIEγ (1)γ (2)
  1. Generated when a clock is present on iwdg_pclk input.
  2. Generated when a clock is present on iwdg_ker_ck input.

35.7 IWDG registers

Refer to Section 1.2 on page 78 for a list of abbreviations used in register descriptions.

The peripheral registers can be accessed by half-words (16-bit) or words (32-bit).

Most of the registers located into the register interface are shadowed into the \( V_{DD} \) voltage domain. When the iwdg_in_rst is asserted, the watchdog logic and the shadow registers located into the \( V_{DD} \) voltage domain are reset.

When the application reads back a watchdog register, the hardware transfers the value of the corresponding shadow register to the register interface.

When the application writes a watchdog register, the hardware updates the corresponding shadow register.

35.7.1 IWDG key register (IWDG_KR)

Address offset: 0x00

Reset value: 0x0000 0000

31302928272625242322212019181716
Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.
1514131211109876543210
KEY[15:0]
wwwwwwwwwwwwwwww

Bits 31:16 Reserved, must be kept at reset value.

Bits 15:0 KEY[15:0] : Key value (write only, read 0x0000)

These bits can be used for several functions, depending upon the value written by the application:

Note that only IWDG_PR, IWDG_RLR, IWDG_EWCR and IWDG_WINR registers have a write-protection mechanism.

35.7.2 IWDG prescaler register (IWDG_PR)

Address offset: 0x04

Reset value: 0x0000 0000

31302928272625242322212019181716
Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.
1514131211109876543210
Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.PR[3:0]
rwrwrwrw

Bits 31:4 Reserved, must be kept at reset value.

Bits 3:0 PR[3:0] : Prescaler divider

These bits are write access protected, see Section 35.4.6 . They are written by software to select the prescaler divider feeding the counter clock. PVU bit of the IWDG status register (IWDG_SR) must be reset to be able to change the prescaler divider.

0000: divider / 4

0001: divider / 8

0010: divider / 16

0011: divider / 32

0100: divider / 64

0101: divider / 128

0110: divider / 256

0111: divider / 512

Others: divider / 1024

Note: Reading this register returns the prescaler value from the \( V_{DD} \) voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing. For this reason the value read from this register is valid only when the PVU bit in the IWDG status register (IWDG_SR) is reset.

35.7.3 IWDG reload register (IWDG_RLR)

Address offset: 0x08

Reset value: 0x0000 0FFF

31302928272625242322212019181716
Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.
1514131211109876543210
Res.Res.Res.Res.RL[11:0]
rwrwrwrwrwrwrwrwrwrwrwrw

Bits 31:12 Reserved, must be kept at reset value.

Bits 11:0 RL[11:0] : Watchdog counter reload value

These bits are write access protected, see Section 35.4.6 . They are written by software to define the value to be loaded in the watchdog counter each time the value 0xAAAA is written in the IWDG key register (IWDG_KR) . The watchdog counter counts down from this value. The timeout period is a function of this value and the prescaler clock. It is not recommended to set RL[11:0] to a value lower than 2.

The RVU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the reload value from the \( V_{DD} \) voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing, hence the value read from this register is valid only when the RVU bit in the IWDG status register (IWDG_SR) is reset.

35.7.4 IWDG status register (IWDG_SR)

Address offset: 0x0C

Reset value: 0x0000 0000 (0xFFFF FEFF)

This register contains various status flags. Note that the mask value between parenthesis means that the reset value of ONF bit is not defined. When the IWDG is configured in

software mode, the reset value of ONF bit is 0, when the IWDG is configured in hardware mode, the reset value of ONF bit is 1.

31302928272625242322212019181716
Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.
1514131211109876543210
Res.EWIFRes.Res.Res.Res.Res.ONFRes.Res.Res.Res.EWUWVURVUPVU
rrrrrr

Bits 31:15 Reserved, must be kept at reset value.

Bit 14 EWIF : Watchdog early interrupt flag

This bit is set to '1' by hardware in order to indicate that an early interrupt is pending. This bit must be cleared by the software by writing the bit EWIC of IWDG_EWCR register to '1'.

Bits 13:9 Reserved, must be kept at reset value.

Bit 8 ONF : Watchdog enable status bit

Set to '1' by hardware as soon as the IWDG is started. In software mode, it remains to '1' until the IWDG is reset. In hardware mode, this bit is always set to '1'.

0: The IWDG is not activated

1: The IWDG is activated and needs to be refreshed regularly by the application

Bits 7:4 Reserved, must be kept at reset value.

Bit 3 EWU : Watchdog interrupt comparator value update

This bit is set by hardware to indicate that an update of the interrupt comparator value (EWIT[11:0]) or an update of the EWIE is ongoing. It is reset by hardware when the update operation is completed in the \( V_{DD} \) voltage domain. Refer to Table 337: IWDG delays versus actions for delay values.

The EWIT[11:0] and EWIE fields can be updated only when EWU bit is reset.

Bit 2 WVU : Watchdog counter window value update

This bit is set by hardware to indicate that an update of the window value is ongoing. It is reset by hardware when the reload value update operation is completed in the \( V_{DD} \) voltage domain. Refer to Table 337: IWDG delays versus actions for delay values.

The window value can be updated only when WVU bit is reset.

This bit is generated only if generic "window" = 1.

Bit 1 RVU : Watchdog counter reload value update

This bit is set by hardware to indicate that an update of the reload value is ongoing. It is reset by hardware when the reload value update operation is completed in the \( V_{DD} \) voltage domain. Refer to Table 337: IWDG delays versus actions for delay values.

The reload value can be updated only when RVU bit is reset.

Bit 0 PVU : Watchdog prescaler value update

This bit is set by hardware to indicate that an update of the prescaler value is ongoing. It is reset by hardware when the prescaler update operation is completed in the \( V_{DD} \) voltage domain. Refer to Table 337: IWDG delays versus actions for delay values.

The prescaler value can be updated only when PVU bit is reset.

Note: If several reload, prescaler, early interrupt position or window values are used by the application, it is mandatory to wait until RVU bit is reset before changing the reload value, to wait until PVU bit is reset before changing the prescaler value, to wait until WVU bit is reset before changing the window value, and to wait until EWU bit is reset before changing the

early interrupt position value. After updating the prescaler and/or the reload/window/early interrupt value, it is not necessary to wait until RVU or PVU or WVU or EWU is reset before continuing code execution, except in case of low power mode entry.

35.7.5 IWDG window register (IWDG_WINR)

Address offset: 0x10

Reset value: 0x0000 0FFF

31302928272625242322212019181716
Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.
1514131211109876543210
Res.Res.Res.Res.WIN[11:0]rwrwrwrwrwrwrwrw

Bits 31:12 Reserved, must be kept at reset value.

Bits 11:0 WIN[11:0] : Watchdog counter window value

These bits are write access protected, see Section 35.4.6 . They contain the high limit of the window value to be compared with the downcounter.

To prevent a reset, the IWDGCNT downcounter must be reloaded when its value is lower than WIN[11:0] + 1 and greater than 1.

The WVU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the reload value from the V DD voltage domain. This value may not be valid if a write operation to this register is ongoing. For this reason the value read from this register is valid only when the WVU bit in the IWDG status register (IWDG_SR) is reset.

35.7.6 IWDG early wake-up interrupt register (IWDG_EWCR)

Address offset: 0x14

Reset value: 0x0000 0000

31302928272625242322212019181716
Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.
1514131211109876543210
EWIEEWICRes.Res.EWIT[11:0]rwrwrwrwrwrwrwrw

Bits 31:16 Reserved, must be kept at reset value.

Bit 15 EWIE : Watchdog early interrupt enable

Set and reset by software.

0: The early interrupt interface is disabled.

1: The early interrupt interface is enabled.

The EWU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the value of this bit.

Bit 14 EWIC : Watchdog early interrupt acknowledge

The software must write a 1 into this bit in order to acknowledge the early wake-up interrupt and to clear the EWIF flag. Writing 0 has no effect, reading this flag returns a 0.

Bits 13:12 Reserved, must be kept at reset value.

Bits 11:0 EWIT[11:0] : Watchdog counter early wake-up interrupt value

These bits are write access protected (see Section 35.4.6 ). They are written by software to define at which position of the IWDGCNT down-counter the early wake-up interrupt must be generated. The early interrupt is generated when the IWDGCNT is lower or equal to EWIT[11:0] - 1.

EWIT[11:0] must be bigger than 1.

An interrupt is generated only if EWIE = 1.

The EWU bit in the IWDG status register (IWDG_SR) must be reset to be able to change the reload value.

Note: Reading this register returns the Early wake-up comparator value and the Interrupt enable bit from the \( V_{DD} \) voltage domain. This value may not be up to date/valid if a write operation to this register is ongoing, hence the value read from this register is valid only when the EWU bit in the IWDG status register (IWDG_SR) is reset.

35.7.7 IWDG register map

Table 341. IWDG register map and reset values

OffsetRegister name313029282726252423222120191817161514131211109876543210
0x00IWDG_KRRes.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.KEY[15:0]
Reset value0000000000000000
0x04IWDG_PRRes.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.PR[3:0]
Reset value000
0x08IWDG_RLRRes.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.RL[11:0]
Reset value11111111111
0x0CIWDG_SRRes.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.EMIFRes.Res.Res.Res.Res.ONFRes.Res.Res.Res.EWUWUJRJUPVU
Reset value0x0000
0x10IWDG_WINRRes.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.WIN[11:0]
Reset value11111111111
0x14IWDG_EWCRRes.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.Res.EWIEEWICRes.Res.EWIT[11:0]
Reset value0000000000000

Refer to Section 2.3: Memory organization for the register boundary addresses.