 Hello and welcome to this presentation of the STM32 independent watchdog. It covers the main features of this peripheral, which can be used either as a watchdog to reset the device when a problem occurs, or as a free running timer for application timeout management. The independent watchdog is used to detect and resolve malfunctions due to hardware or software failures. It generates a reset sequence when it is not refreshed within the expected time window. An early interrupt can be generated as well. Since its clock is an independent 32 kHz low-speed internal RC oscillator, or LSI, it remains active even if the main clock fails. One of the main benefits for applications is its ability to run independently from the main clock. The independent watchdog offers a wide range of timeout values, from 187 microseconds to 131 seconds. It is clocked by a 32 kHz RC oscillator, which cannot be disabled when the independent watchdog is enabled. It generates a reset when the programmed timeout value elapses, or when a watchdog refresh occurs outside a programmed time window. The IWDG also generates an early interrupt at a programmable position before the reset happens. It is possible to enable automatically the independent watchdog after a system reset. In this case, the default timeout value is set to 131 seconds. It is possible to define the behavior of the independent watchdog in debug, stop, or standby mode. The independent watchdog registers are located in the core voltage domain, while its functions are in the VDD voltage domain. In this way, the independent watchdog continues counting down even if the core voltage is switched off. Two clocks are needed. The APB clock is required in order to access registers. The LSI clock is required for the functional part of the watchdog. This architecture allows the independent watchdog to work even in stop and standby modes. A programmable 8-bit prescaler is used to divide the LSI oscillator frequency. The 12-bit down counter defines the timeout value. The comparator logic is used for the window function and for the interrupt generation. The STM32MP1 includes two independent watchdogs, or IWDG, dedicated to the Cortex-A7 core. Both are using the low-speed internal oscillator as a watchdog clock. When an independent watchdog is enabled, it forces the activation of the low-speed internal oscillator. IWDG1 is Trust Zone Aware and is connected to the secure APB5 bus. The enabling of the APB clock is controlled by the RCC block. The APB clock is needed to refresh and to configure the watchdog. The wake-up signals are connected to the EXTI block, allowing the system to exit from stop mode when an early interrupt is generated. The interrupt signals are connected to the Global Interrupt Controller, or GIC, of the Cortex-A7 core. Finally, the reset signals generated by the watchdogs are connected to the RCC block and can perform a system reset. The application can control the behavior of both watchdogs in stop, standby, or in debug mode. In addition, it is possible to automatically enable the watchdogs after a system reset, hardware mode. For each independent watchdog, it is possible to select the hardware or software mode via option bytes. For each independent watchdog, it is possible to define if it is frozen or not when the Cortex-A7 goes to C stop, or when the system goes to standby. The IWDG1 has some specific options linked to secure mode. When the secure debug is disabled, the IWDG1 can be frozen when both Cortex-A7 cores are in debug mode. When the secure debug is enabled, the behavior of the IWDG1 freeze depends on the WDF's ZCTL bit. Either the IWDG1 is frozen when at least one Cortex-A7 core is in debug mode, or the IWDG1 is frozen when both cores are in debug mode. The IWDG2 can also be frozen when one of the Cortex-A7 cores is in debug mode. Finally, when the bootrom is executed, both IWDG are frozen, preventing the bootrom from modifying the watchdog settings. This diagram illustrates how the independent watchdog operates. When the downcounter reaches zero, the watchdog reset is activated. This happens when the application software did not refresh the window watchdog on time. If the software refreshes the watchdog while the downcounter is greater than the value stored in the window register, then a reset is generated as well. To prevent a watchdog reset, the refresh must occur when the downcounter value is higher than zero and lower than the time window value. As shown in the figure, the application can program at which position the interrupt shall be generated. When the downcounter, IWDCNT, reaches the programmed threshold, the wake-up signal is activated in order to wake up the system from stop in case the system was in stop mode. The interrupt signal is activated as soon as the APB clock is available, allowing the CA7 to serve this interrupt. At the end of the interrupt service routine, the application must clear the interrupt by writing the EWIC bit to 1. The independent watchdog hardware is enabled by the device's option bytes. If the hardware mode is enabled, after every system reset, the watchdog automatically loads the downcount with 0xFFF and starts to count down. To prevent any reset, the key register must be refreshed at regular intervals before the counter reaches zero and within the window, if this option has been selected. The IWDG software start is configured in a few steps. The first step is to write the key register with value 0x0000CCCC, which starts the watchdog. Then remove IWDG register protection by writing 0x000055555 to unlock the key. Set the IWDG prescaler in the IWDGPR register by selecting the prescaler divider feeding the counter clock. Write the reload register IWDGRLR to define the value to be loaded in the watchdog counter. After accessing the previous registers, it is necessary to wait for the IWDG SR bits to be reset in order to confirm that the registers have been updated. Two options are now available. Enable or disable the IWDG window option. To enable the window option, write the window value in the IWDGWINR register. Otherwise, refresh the counter by writing 0x0000AAAA in the key register to disable the window option. The IWDG timebase is pre-scaled from the LSI clock at 32 kHz. The IWDGPR prescaler register can divide the LSI clock frequency by up to 4. The watchdog counter reload value is a 12-bit value written in the IWDGRLR register. The independent watchdog time is based on the LSI period and its prescaler as well as the selected watchdog counter reload value. It offers a wide range of timeout values. Note that the reset and clock controller, or RCC of the product, provides registers giving the source of the reset. In that way, the application can check if a reset is caused by an independent watchdog. The IWDG can be active in all modes. The IWDG can be active in all modes.