WDT_E101 - Restrictions on Watchdog Timer Refresh Interval

by <a href="http://community.silabs.com/t5/Welcome-and-Announcements/Community-Ranking-System-and-Recognition-Program/m-p/140490#U140490"><font color="#000000"><font size="2">Hero Employee</font></font> </a> Tabitha on ‎11-28-2016 02:38 PM - edited on ‎02-20-2017 02:54 AM by Administrator Siliconlabs

See the Errata sheet for your device to see the complete description of this errata and affected products:

 

www.silabs.com/support/resources

 

Affected Devices

 

The following table shows devices that might exhibit the failure mode. 

 

Device Family Device Revision Fixed Date Code
C8051F85x/86x All
EFM8BB1 All
EFM8BB2 All
EFM8BB3 All
EFM8UB1 All
EFM8LB1 All

 

Failure Mode

 

If the Watchdog Timer (WDT) is enabled, firmware will periodically write an 0xA5 value to the WDTCN register to refresh the timer and prevent the watchdog reset from occurring. However, if firmware writes to WDTCN more than once during the same LFOSC0 clock period, the refresh signal may be canceled, resulting in an unintended watchdog reset when the timer expires.

 

Fix/Workaround

 

Systems using the Watchdog Timer (WDT) should ensure that the WDT is refreshed no more than once per LFOSC0 clock period.

 

Firmware Workaround

 

Firmware can work around this issue by using timers to count LFOSC0 clock periods. There are three methods to accomplish this:

 

  1. If Timer 3 is not already in use, set it up to capture on the LFOSC0 clock. In this mode, the value of the Timer 3 reload registers does not matter. Instead, the WDT refresh function should check for the 16-bit timer flag (TF3H) to be set in the reset watchdog function, which indicates that a capture event occurred. If the device has another timer that can capture on the LFOSC0 clock, then that timer may be used instead of Timer 3.
    void refresh_wdt()
    {
       // Only refresh if TF3H is set
       if (TMR3CN0 & (0x80))
       {
           WDTCN = 0xA5;
           TMR3CN0 &= ~(0x80);
       }
    }
  2. If any timer is already in use, is clocked from the LFOSC0, and the low overflow flag is not already in use, firmware can check the low byte overflow flag (TFnL) to ensure at least one clock period has passed. For example, using Timer 3:
    void init_wdt()
    {
    // whatever code needed to initialized watchdog

    // intentionally set the TF3L flag (assuming SFRPAGE is correct)
    TMR3CN0 |= 0x40;
    }

    void refresh_wdt()
    {
    static uint8_t last_tmr3l = 0;

    if ( (TMR3CN0 & 0x40) || (last_tmr3l != TMR3L) )
    {
    WDTCN = 0xA5;
    TMR3CN0 &= ~0x40;
    last_tmr3l = TMR3L;
    }
    }
  3. If the application already has an accurate and reliable time base, use that timer to establish a minimum WDT refresh interval that is longer than one LFOSC0 clock period in duration, similar to method (2) above as appropriate.

Note: The LFOSC0 does not halt while debugging. This can cause the timer overflow flag to be set more quickly than expected when debugging the watchdog refresh function.

 

The attached zip files include updated WDT examples demonstrating method (1) for each of the affected devices. To import a project into Simplicity Studio, use the File > Import... > General > Existing Projects into Workspace option, click Next, and select the zip file under Select archive file.