TC1796
System Units (Vol. 1 of 2)
Watchdog Timer
User’s Manual
16-3
V2.0, 2007-07
WDT, V2.0
16.3
The Endinit Function
Because understanding of the ENDINIT bit and its function is an important prerequisite
for the descriptions in the following sections, its function is explained first.
There are a number of registers in the TC1796 that are usually programmed only once
during the initialization sequence of the application. Modification of such registers during
normal application run can have a severe impact on the overall operation of modules or
the entire system.
While the Supervisor Mode, which allows writes to registers only when it is active,
provides a certain level of protection against unintentional modifications, this might not
provide enough security for system-critical registers.
The TC1796 provides one more level of protection for such registers via the Endinit
feature. This is a highly secure write-protection scheme that makes unintentional
modifications of registers protected by this feature nearly impossible.
The Endinit feature consists of an ENDINIT bit incorporated in the WDT control register,
WDT_CON0. A system-wide line is connected to this bit. Registers protected via Endinit
use the state of this line to determine whether or not writes are enabled. Writes are only
enabled if ENDINIT = 0 and Supervisor Mode is active. Write attempts if this condition is
not true will be discarded and the register contents will not be modified in this case. In
this case, an interrupt in the corresponding bus control units of the TC1796 is generated
instead of a bus error trap. There is an exception: If read-modify-write instructions are
used for the write access, a bus error trap is generated instead of an interrupt.
An additional line, controlled through a separate bit, makes it possible to protect against
unintentional writes, providing an extra level of security. However, to get the highest level
of security, this bit is incorporated in the highly secure access protection scheme
implemented in the WDT. This is a complex procedure, that makes it nearly impossible
for the ENDINIT bit to be modified unintentionally. It is explained in the following
sections. In addition, the WDT monitors ENDINIT modifications by starting a time-out
sequence each time software opens access to the critical registers through clearing
ENDINIT to 0. If the time-out period ends before ENDINIT is set to 1 again, a malfunction
of the software and/or the hardware is assumed and the device is reset.
The access-protection scheme and the Endinit time-out operation of the WDT is
described in the following sections.
lists the registers that are protected via
the Endinit feature in the TC1796.
Note: The clearing of the ENDINIT bit takes some time. Accesses to Endinit-protected
registers after the clearing of the ENDINIT bit must only be done after ensuring
that ENDINIT has been cleared. As a solution, WDT_CON0 (the register with the
ENDINIT bit) should be read back once before Endinit-protected registers are
accessed the first time after ENDINIT has been cleared.
