Datasheet

71M6521DE/DH/FE Data Sheet
Page: 46 of 107 Rev 3
Hardware Watchdog Timer
In addition to the basic watchdog timer included in the 80515 MPU, an
independent, robust, fixed-duration, watchdog timer (WDT) is included in the
device. It uses the RTC crystal oscillator as its time base and must be refreshed
by the MPU firmware at least every 1.5 seconds. When not refreshed on time the
WDT overflows, and the part is reset as if the RESET pin were pulled high, except
that the I/O RAM bits will be in the same state as after a wake-up from SLEEP or
LCD modes (see the I/O RAM description for a list of I/O RAM bit states after
RESET and wake-up). 4100 oscillator cycles (or 125ms) after the WDT overflow,
the MPU will be launched from program address 0x0000.
A status bit, WD_OVF, is set when WDT overflow occurs. This bit is powered by
the non-volatile supply and can be read by the MPU to determine if the part is
initializing after a WDT overflow event or after a power-up. After it is read, MPU
firmware must clear WD_OVF. The WD_OVF bit is cleared by the RESET pin
There is no internal digital state that deactivates the WDT. For debug purposes,
however, the WDT can be disabled by tying the V1 pin to V3P3 (see Figure 39).
Of course, this also deactivates V1 power fault detection. Since there is no
method in firmware to disable the crystal oscillator or the WDT, it is guaranteed
that whatever state the part might find itself in, upon WDT overflow, the part will
be reset to a known state.
Asserting ICE_E will also deactivate the WDT. This is the only method that will
disable the WDT in BROWNOUT mode.
In normal operation, the WDT is reset by periodically writing a one to the
WDT_RST bit. The watchdog timer is also reset when the internal signal WAKE=0 (see section on Wake Up Behavior).
Figure 14: Functions defined by V1
Program Security
When enabled, the security feature limits the ICE to global flash erase operations only. All other ICE operations are
blocked. This guarantees the security of the user’s MPU and CE program code. Security is enabled by MPU code
that is executed in a 32 cycle preboot interval before the primary boot sequence begins. Once security is enabled, the
only way to disable it is to perform a global erase of the flash, followed by a chip reset.
The first 32 cycles of the MPU boot code are called the preboot phase because during this phase the ICE is inhibited.
A read-only status bit, PREBOOT, identifies these cycles to the MPU. Upon completion of preboot, the ICE can be
enabled and is permitted to take control of the MPU.
SECURE, the security enable bit, is reset whenever the chip is reset. Hardware associated with the bit permits only
ones to be written to it. Thus, preboot code may set SECURE to enable the security feature but may not reset it. Once
SECURE is set, the preboot code is protected and no external read of program code is possible
Specifically, when SECURE is set:
• The ICE is limited to bulk flash erase only.
• Page zero of flash memory, the preferred location for the user’s preboot code, may not be page-erased by
either MPU or ICE. Page zero may only be erased with global flash erase.
• Writes to page zero, whether by MPU or ICE are inhibited.
The SECURE bit is to be used with caution! Inadvertently setting this bit will inhibit access to the part via
the ICE interface, if no mechanism for actively resetting the part between reset and erase operations is
provided (see ICE Interface description).
V3P3
V3P3 -
400mV
V3P3 - 10mV
VBIAS
0V
Battery
modes
Normal
operation,
WDT
enabled
WDT dis-
abled
V1