A6130
the watchdog timer resets and is defined by TCW = TWD
-
conventional watchdogs by monitoring both software cy-
OWP(TWD).The open window starts after the closed time cle time and execution. Should software clear the watch-
window finishes and lasts till TWD + OWP(TWD). The open dog too quickly (incorrect cycle time) or too slowly
window time is defined by TOW = 2 x OWP(TWD).
For example if TWD = 100 ms (actual value) and OWP =
(incorrect execution) it will cause the system to be reset. If
software is stuck in a loop which includes the routine to
20ꢀ this means the closed window lasts during first the clear the watchdog then a conventional watchdog would
80 ms (TCW = 80 ms = 100 ms - 0.2 (100 ms)) and the not make a system reset even though software is mal-
open window the next 40 ms (TOW = 2 x 0.2 (100 ms) = 40 functioning; the A6130 would make a system reset be-
ms). The watchdog can be serviced between 80 ms and cause the watchdog would be cleared too quickly.
120 ms after the timer reset. However as the time base is If no TCL signal is applied before the closed and open
10ꢀ accurate, software must use the following calcula- windows expire, RES will start to generate square waves
tion for servicing signal TCL during the open window:
of period (TCW + TOW + TWDR). The watchdog will remain in
Related to curves (Fig. 10 to Fig. 20), especially Fig. 19 this state until the next TCL falling edge appears during
and Fig. 20, the relation between TWD and REXT could eas- an open window, or until a fresh power-up sequence. The
ily be defined. Let us take an example describing the vari- system enable output, EN, can be used to prevent critical
ations due to production and temperature:
1. Choice, TWD = 26 ms.
2. Related to Fig. 20, the coefficient (TWD to REXT) is 1.125
where REXT is in kW and TWD in ms.
3. REXT (typ.) = 26 x 1.125 = 29.3 kW.
4.
control functions being activated in the event of the sys-
tem going into this failure mode (see section “Enable - EN
Output"). The RES output must be pulled up to VOUTPUT
even if the output is not used by the system (see Fig. 8).
Combined Voltage and Timer Action
The combination of voltage and timer actions is illus-
trated by the sequence of events shown in Fig. 6. On
power-up, when the voltage at VIN reaches VREF, the
power-on-reset, POR, delay is initialized and holds RES
active for the time of the POR delay. A TCL pulse will have
no effect until this power-on-reset delay is completed.
When the risk exists that TCL temporarily floats, e.g. dur-
ing TPOR, a pull-up to VDD is required on that pin. After the
POR delay has elapsed, RES goes inactive and the
watchdog timer starts acting. If no TCL pulse occurs, RES
goes active low for a short time TWDR after each closed
and open window period. A TCL pulse coming during the
open window clears the watchdog timer. When the TCL
pulse occurs too early (during the closed window), RES
goes active and a new timeout sequence starts. A voltage
drop below the VREF level for longer than typically 5 µs
overrides the timer and immediately forces RES active
and EN inactive. Any further TCL pulse has no effect until
the next power-up sequence has completed.
The ratio between TWD = 26 ms and the (TCL period)
= 25.4 ms is 0.975.
Then the relation over the production and the full
temperature range is TCL period = 0.975 x TWD or
0.975 x REXT
, as typical value.
TCL period =
1.125
a) While PRODUCTION value unknown for the
customer when REXT ¹ 118 kW.
b) While operating TEMPERATURE range -40°C £ TJ
£ +85°C.
Enable - EN Output
The system enable output, EN, is inactive always when
RES is active and remains inactive after a RES pulse until
the watchdog is serviced correctly 3 consecutive times
(ie. the TCL pulse must come in the open window). After
three consecutive services of the watchdog with TCL dur-
ing the open window, the EN goes active low. A malfunc-
tioning system would be repeatedly reset by the
watchdog. In a conventional system critical motor con-
trols could be energized each time reset goes inactive
(time allowed for the system to restart) and in this way the
electrical motors driven by the system could function out
of control. The A6130 prevents the above failure mode by
using the EN output to disable the motor controls until
software has successfully cleared the watchdog three
times (ie. the system has correctly restarted after a reset
condition).
5. If you fixed a TCL period = 26 ms
26 x 1.125
0.975
= 30 kW.
Þ REXT
=
If during your production the TWD time can be mea-
sured at TJ = +25°C and the µC can adjust the TCL pe-
riod, then the TCL period range will be much larger for
the full operating temperature.
Timer Clearing and RES Action
The watchdog circuit monitors the activity of the proces-
sor. If the user’s software does not send a pulse to the
TCL input within the programmed open window timeout
period a short watchdog RES pulse is generated which is
equal to TWD / 40 = 2.5 ms typically (see Fig. 5).
With the open window constraint new security is added to
7