ST9 datasheet(74/146 Pages) STMICROELECTRONICS

74 / 146 page

74/146

ST9 USER GUIDE

output pin at the next end of count. By alternating between two time values, a duty cycle other

than 50% can be obtained (PWM). When the interrupt occurs, the output has already changed

its state, so that the waveform can be very precise since it depends only on the timer hardware

and not on the software. All that the interrupt service routine has to do is to load the timer latch

with the value to be used when the end of count is reached. Thus, the constraint is that the re-

load interrupt must be guaranteed a latency time less that the shortest time between two

output transitions. This may or may not be difficult to realize according to the intended timing

and the presence of portions of the program where the interrupts are disabled. It is thus rec-

ommended to properly manage the interrupts and thoroughly use the priorities to achieve this

requirement.

The WDT does not have an interrupt cause and a vector of its own. It must borrow them either

from the Top Level Interrupt or the INTA0 input. We have chosen to use INTA0 here, and to

give it a priority of 6 which is high, but not the highest (which is 0).

4.3.4 Watchdog Application 2: Using the Watchdog

A watchdog timer is a safety measure to prevent a program going adrift. It relies on a hardware

timer that must be periodically reset by the program. Failing to do this will reset the whole pro-

gram (at the End Of Count). You will find it in the Companion software in the WDT/appli2 di-

rectory.

The efficiency of this approach varies with the type of program and depends on the following

conditions:

The hardware action to perform in order to reset the timer must be so complex that if the pro-

cessor goes adrift, it cannot accidentally reset the watchdog. In the ST9, you need to write

0AAh and 055h successively to the WDTLR.

The chosen time-out value must be greater than the interval at which the program resets the

watchdog. It must also be as close as possible to that interval for maximum safety. Since the

watchdog time-out value is set once at the beginning of the program, this condition is best ful-

filled if the resetting action is performed at constant intervals.

A special software arrangement must be designed to reduce the chance that the part of the

program that resets the watchdog can continue undisturbed when other parts of the program

are faulty. This may include an interlock mechanism that requires that several program

branches be executed to enable the resetting of the Watchdog count.

As you can see, achieving a very secure program malfunction detection by the sole means of

a watchdog is a very difficult thing to realize. However, the watchdog can still play a key role

in the safety of some systems, an example of which is an induction motor controller.

ST9 Folha de dados(PDF) 74 Page - STMicroelectronics