NXP Semiconductors 39
33907/33908
6.5.2 Watchdog operation
A windowed watchdog is implemented in the 33907/33908 and is based on “question/answer” principle (Challenger). The watchdog must
be continuously triggered by the MCU in the open watchdog window, otherwise an error is generated. The error handling and watchdog
operations are managed by the Fail-safe state machine. For debugging purpose, this functionality can be inhibited by setting the right
voltage on the DEBUG pin at start-up.
The watchdog window duration is selectable through the SPI during the INIT FS phase or in Normal mode. The following values are
available: 1.0 ms, 2.0 ms, 3.0 ms, 4.0 ms, 6.0 ms, 8.0 ms, 12 ms, 16.0 ms, 24 ms, 32 ms, 64 ms, 128 ms, 256 ms, 512 ms, and 1024 ms.
The watchdog can also be inhibited through the SPI register to allow “reprogramming” (ie.at vehicle level through CAN).
An 8-bit pseudo-random word is generated, due to a Linear Feedback Shift Register implemented in the 33907/33908. The MCU can send
the seed of the LFSR or use the LFSR generated by the 33907/33908 during the INIT phase and performs a pre-defined calculation. The
result is sent through the SPI during the “open” watchdog window and verified by the 33907/33908. When the result is right, a new LFSR
is generated and the watchdog window is restarted. When the result is wrong, the WD error counter is incremented, the watchdog window
is restarted, an INTB is generated, and the LFSR value is not changed. Any access to the WD register during the “closed” watchdog
window is considered a wrong WD refresh.
6.5.2.1 Normal operation (first watchdog refresh)
At power up, when the RSTB is released as high (after around 16 ms), the INIT phase starts for a maximum duration of 256 ms and this
is considered as a fully open watchdog window. During this initialization phase the MCU sends the seed for the LFSR, or uses the default
LFSR value generated by the 33907/33908 (0xB2), available in the WD_LFSR register (Table 75). Using this LFSR, the MCU performs
a simple calculation based on this formula. As an example, the result of this calculation based on LFSR default value (0xB2) is 0x4D.
Figure 15. Watchdog answer calculation
The MCU sends the results in the WD answer register (Table 77). When the watchdog is properly refreshed during the open window, the
256 ms open window is stopped and the initialization phase is finished. A new LFSR is generated and available in the WD LFSR register,
Table 74. If the watchdog refresh is wrong or if the watchdog is not refreshed during this 256 ms open window (INIT FS phase), the device
asserts the reset low and the RSTB error counter is incremented by “1”.
After a good watchdog refresh, the device enters the Normal WD refresh mode, where open and closed windows are defined either by
the configuration made during initialization phase in the watchdog window register (Table 73), or by the default value already present in
this register (3.0 ms).
6.5.2.2 Normal watchdog refresh
The watchdog must be refreshed during every open window of the window period configured in the register Table 73. Any WD refresh
restarts the window. This ensures the synchronization between MCU and 33907/33908.
The duration of the “window” is selectable through the SPI with no access restriction, means the window duration can be changed in the
INIT phase or Normal mode. Doing the change in normal operation allow the system integrator to configure the watchdog window duration
on the fly:
• The new WD window duration (except after disable) will be taken into account when a write in the WD_answer register occurs (good
or bad WD answer) or when the previous WD window is finished without any writing (WD timeout)
• The new WD window duration after disable will be taken into account when SPI command is validated
The duty cycle of the window is set to 50% and is not modifiable.
Figure 16. Windowed watchdog
LFSR_OUT[7:0] x
4
+
6
-
4
NOT /
4
WD_answer[7:0]
Window Period
CLOSED CLOSEDOPEN OPEN
Refresh
Slot
Refresh
Slot