This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

MSP430F1232: Watchdog Timer Operation

Part Number: MSP430F1232

Question regarding the Watchdog Timer on the device. See the excerpt from BS EN50271 standards below, which requires the following for fire safety systems:

Monitoring equipment with its own time base (e.g. watchdog) shall work independently and separately from the parts of the digital unit which perform the data processing. Triggering of the monitoring equipment (e.g. watchdog) shall be based on the program execution and shall not be only time-related (e.g. based on a periodic timer interrupt);

Independent operation is considered to be fulfilled if:

  1. The operation of the monitoring equipment (watchdog) cannot be controlled by the digital unit which performs the data processing (CPU)
  2. The voltage supply is separately connected to the power supply of the digital unit.
  3. Negative effects (e.g. ESD, EMC) on the operation of the data processing unit (CPU) are not likely to influence the operation of the monitoring equipment (watchdog)
  4. malfunction of the data processing unit (CPU) caused by thermal or electrical overload will not influence the operation of the monitoring equipment

---------------------------------------------

The question is this: the watchdog in the F1232 is a separate hardware module that runs on ACLK (according to the datasheet). Is the watchdog's operation considered "independent" from the CPU per any of the guidelines above?

  • Hi Ali,
    I am not familiar with these standards. However, I would be concerned about #1 because the WDT is configured by the CPU - so I'd be concerned this isn't really meeting the spirit of what they are requiring here - but it is hard to say without knowing if we are correctly interpreting the standard. I'm also unsure about #2 if it's saying that they need separate power, but watchdog would be powered off the same Vcc pins as the CPU, but again I'm not 100% sure of the correct interpretation of this standard. So I hesitate to give a recommendation one way or the other.

    This standard seems more like a case where you may need an external watchdog in my opinion. But you may want to try to find someone more familiar with the standard (perhaps your customer has had other designs that had to meet this standard already, or a test house that they work with that may know the true meaning of the requirement better).

    Regards,
    Katie
  • Wondering if you found a solution to this. We are experiencing the same problem with EN50271.
  • Hi Steven,

    To preface: I am by no means an expert on the EN50721 standard, so please also do your own due diligence. However, we had some more discussions with some experts after this and we determined that an external WDT, not the internal WDT inside the MSP430 should be used in order to meet the EN50721 standard. There are a few reasons, the obvious one being that there's a requirement that the WDT would have to function even if the main micro (MSP430) was not powered and must be on a separate supply from the micro - obviously this cannot be done within the same device because the internal WDT is powered only when the rest of the device is powered. So for the earlier customer we recommended using an external WDT circuitry. I hope this helps give some guidance.

    Regards,
    Katie
  • AFAIK, the intent of the standard is that the 'dog be a separate device.

    Side note: Never a good idea to strobe a wdog directly from within an ISR. If your main loop / tasking locks up, the interrupt might not, so the dog would never actually bark.

    Set a flag in the ISR and let the bottom/default task or equivalent do the tickle when and if the flag says  " w-dog needs to be tickled".

    Second side note: MAXIM 6369

  • Thanks Jeff - yes this was also our interpretation (that it should be separate). Glad to see you found the same!

    Also good watchdog tip. :-)
    -Katie
  • Thanks, that's good information! I guess where we are getting stuck is that if there is an external watchdog and the MSP fails, then to whom does the watchdog bark? If there is complete micro failure, then what purpose does a watchdog serve, even if it is external?
  • Hi Steven,

    Usually the purpose of the watchdog is to do a hard reset on the device. So with an external one typically it will have a connection to the reset pin of the part. Speaking generally, hard resets can clear a lot of problems in a system (albeit not necessarily all of them) but it can often get you out of an unexpected code state etc. In that case it's not really alerting anyone so much as taking action to try to get the part running again if possible, by pulling the reset line.

    Regards,
    Katie

**Attention** This is a public forum