71M6521BE Datasheet, PDF (45/97 Pages) Teridian Semiconductor Corporation – Energy Meter IC

71M6521BE
Energy Meter IC
DATA SHEET
JANUARY 2008
Hardware Watchdog Timer
V3P3
V3P3 - 10mV
V3P3 -
400mV
VBIAS
V1
WDT dis-
abled
Normal
operation,
WDT
enabled
Battery
modes
In addition to the basic watchdog timer included in the 80515 MPU, an independent,
robust, fixed-duration, watchdog timer (WDT) is included in the device. It uses the crystal
oscillator as its time base and must be refreshed by the MPU firmware at least every 1.5
seconds. When not refreshed on time the WDT overflows, and the part is reset as if the
RESET pin were pulled high, except that the I/O RAM bits will be in the same state as after
a wake-up from SLEEP or LCD modes (see the I/O RAM description for a list of I/O RAM
bit states after RESET and wake-up). 4100 oscillator cycles (or 125ms) after the WDT
overflow, the MPU will be launched from program address 0x0000.
A status bit, WD_OVF, is set when WDT overflow occurs. This bit is powered by the
nonvolatile supply and can be read by the MPU when WAKE rises to determine if the part
is initializing after a WD overflow event or after a power-up. After it is read, MPU firmware
must clear WD_OVF. The WD_OVF bit is cleared by the RESET pin
There is no internal digital state that deactivates the WDT. For debug purposes, however,
the WDT can be disabled by tying the V1 pin to V3P3 (see Figure 35). Of course, this also
deactivates V1 power fault detection. Since there is no firmware way to disable the crystal
oscillator or the WDT, it is guaranteed that whatever state the part might find itself in, upon
watchdog overflow, the part will be reset to a known state.
Asserting ICE_E will also deactivate the WDT. This is the only method that will work in
BROWNOUT mode.
In normal operation, the WDT is reset by periodically writing a one to the WDT_RST bit. The
0V
watchdog timer is also reset when the internal signal WAKE=0 (see section on Wake Up
Behavior).
Figure 14: Functions defined by V1.
Program Security
When enabled, the security feature limits the ICE to global flash erase operations only. All other ICE operations are blocked.
This guarantees the security of the user’s MPU and CE program code. Security is enabled by MPU code that is executed in a
32 cycle preboot interval before the primary boot sequence begins. Once security is enabled, the only way to disable it is to
perform a global erase of the flash, followed by a chip reset.
The first 32 cycles of the MPU boot code are called the preboot phase because during this phase the ICE is inhibited. A read-
only status bit, PREBOOT, identifies these cycles to the MPU. Upon completion of preboot, the ICE can be enabled and is
permitted to take control of the MPU.
SECURE, the security enable bit, is reset whenever the chip is reset. Hardware associated with the bit permits only ones to be
written to it. Thus, preboot code may set SECURE to enable the security feature but may not reset it. Once SECURE is set, the
preboot code is protected and no external read of program code is possible
Specifically, when SECURE is set:
• The ICE is limited to bulk flash erase only.
• Page zero of flash memory, the preferred location for the user’s preboot code, may not be page-erased by either
MPU or ICE. Page zero may only be erased with global flash erase.
• Writes to page zero, whether by MPU or ICE are inhibited.
The SECURE bit is to be used with caution! Inadvertently setting this bit will inhibit access to the part via the ICE
interface, if no mechanism for actively resetting the part between reset and erase operations is provided (see ICE
Interface description).
V1.0
© 2005-2008 TERIDIAN Semiconductor Corporation
Page: 45 of 97