2004 Mar 22
13
Philips Semiconductors
Objective specification
Low speed CAN/LIN system basis chip
UJA1061
6.2.7
F
LASH MODE
Flash mode can be entered only from Start-up mode if a
certain fail-safe mode control sequence has been applied
to the UJA1061 within Normal mode. This control
sequence comprises three consecutive write accesses to
themoderegisterwithinthelegalwindowsofthewatchdog
using the mode codes ‘111’, ‘001’ and ‘111’ respectively.
As a result of this sequence, the UJA1061 enters Start-up
mode providing a system reset and the related reset
source information.
Within Start-up mode, the application software has the
256 ms start-up time available to enter Flash mode, using
the init Flash code ‘011’ within the mode register thus
feeding back a successfully received hardware reset
(handshake between UJA1061 and microcontroller). This
transition towards Flash mode is possible only once after
the above fail-safe entry sequence.
The application can also decide not to enter Flash mode
butswitchovertoNormalmodeagainusingtheinitNormal
mode code ‘101’ for handshaking. This again clears the
prepared Fail-safe Flash mode entry. So if the Flash mode
should be entered again, the fail-safe sequence has to be
applied again.
The watchdog behaviour within Flash mode is similar to its
time-out behaviour within Standby mode, however the
mode code ‘111’ has to be used for serving the watchdog.
If this code is not used or the watchdog overflows, the
UJA1061 immediately forces a reset and enters Start-up
mode again. This allows leaving Flash mode very quickly
with a defined reset and without waiting for a watchdog
overflow.
6.3
On-chip oscillator
The on-chip oscillator provides the clock signal for all
digital functions and is the time reference for the on-chip
watchdog and the internal timers.
Iftheon-chiposcillatorfrequencyistoolowortheoscillator
is not running there is an immediate transition to Fail-safe
mode. The UJA1061 will stay within Fail-safe mode until
the oscillator has recovered to its normal frequency and
the system receives a wake-up event. There is no
possibility to have a system running without watchdog
supervision or with erroneous watchdog supervision.
6.4
Watchdog
The watchdog fulfils the following basic tasks:
Verifies proper microcontroller start-up
Continuously monitors the microcontroller and performs
a reset whenever the microcontroller fails to trigger the
watchdog in time (according to the selected mode)
Applies a cyclic wake-up to the sleeping microcontroller.
The watchdog is clocked directly by an independent
on-chip oscillator.
In order to guarantee fail-safe control of the watchdog via
the SPI, all watchdog accesses are coded with redundant
bits. Therefore only certain codes are allowed for a proper
watchdog service.
The following corrupted watchdog accesses are detected
and result in an immediate system reset:
Illegal watchdog period coding; only ten different codes
are valid
Illegal operating mode coding; only six different codes
are valid
A mode other than init Normal mode or init Flash mode
is selected during the watchdog initialization phase.
Furthermore, any SPI access is monitored with respect to
the number of clock (SCK) cycles. If enabled, an interrupt
is forced whenever the clock count differs from 16 clock
periods. Within Start-up and Restart mode a system reset
instead of an interrupt is forced immediately in the event of
an incorrect number of clock counts.
Any microcontroller-driven mode change is synchronized
with a watchdog access by reading the mode information
and the watchdog period information within the same
register. This allows an easy software flow control with
defined watchdog behaviour when switching between
different software modules.
The watchdog, as an independent observation medium of
the microcontroller, provides the following timing functions:
Start-up mode; needed to give the software an
opportunity to initialize the system
Window mode; detects too early and too late accesses
within Normal mode
Time-out mode; detects a too late access; can also be
used to restart or interrupt the microcontroller from time
to time
OFF mode; fail-safe shut-down during operation thus
preventing any blind-spots in system supervision.