How to interface external watchdog STWD100 with STM32 ?

[freeflyer]

I have added an external watchdog STWD100 to an STM32L433, but want to check that I have implemented it correctly.  See schematic below....

The STM32 reset pin has a reset button circuit (copied from the Nucleo development board) and an ST Link programming connector (tag connect).

The watchdog needs to work in combination with the reset button and programmer.

The STM32 uses standby and shutdown low power modes, so I cannot use the STM32 internal watchdog as I need to disable the watchdog when in these low power modes.

[Andrew Neil]

The datasheet says there's an option of push-pull or open-drain output.

To work with a switch, you'd want open-drain.

---

@freeflyer wrote:

The STM32 uses standby and shutdown low power modes, so I cannot use the STM32 internal watchdog as I need to disable the watchdog when in these low power modes.

---

The IWDG has a "Low-power freeze" mode for this:

[Ozone]

... and to add, the manual reset looks a bit overly complicated.

And I would add a jumper to disable the watchdog - I can tell you from experience you will need it for flashing and debugging.

[freeflyer]

Thanks

The watchdog is an open drain output (part number STWD100YNXWY3F)

The freeze mode only applies to stop and standby, but I use standby and shutdown.  So when in shutdown the watchdog will keep resetting the STM32

[freeflyer]

The manual reset circuit was taken from the Nucleo board schematic...

Regarding debugging and programming, the watchdog enable is active low and it is pulled up to 3.3V.

So as long as the digital output from the STM32 to the watchdog enable is not pulled low, the watchdog will not be enabled.

Are you saying that during debugging and programming the STM32 digital output (PC8 in this case) will go low and therefore enable the watchdog ?

[Ozone]

I don't know you specific WDG type, but have worked with boards that had one implemented.

> So as long as the digital output from the STM32 to the watchdog enable is not pulled low, the watchdog will not be enabled.

You need to consider the relevant scenarios here.
A "virgin" board with no application will most probably have the WDG-Enable output in high-Z state, which would be fine.

But since you will probably want to debug the rest of the application and not the WDG part, turning if off manually will be helpful - unless you are fine with a modified firmware for debugging.

And another point, regarding the same statement (thus quoted again):

> So as long as the digital output from the STM32 to the watchdog enable is not pulled low, the watchdog will not be enabled.

Make sure this doesn't contradict your use case in the first place.
If you can enable and disable the watchdog, wild-running code can as well, and you cannot really rely on the watchdog.
The application I worked on was considered "safe" (SIL-2, Pld, dual channel), and AFAIK would not have passed certification that way. Or the external WDG would not have counted as safety-relevant feature.

I used dedicated "debug boards", were the connection from the WDG output to the MCU reset was cut.

[Andrew Neil]

---

@Ozone wrote:

If you can enable and disable the watchdog, wild-running code can as well, and you cannot really rely on the watchdog.

---

^^^^^^ Absolutely this! ^^^^^^ 

This is exactly why the internal WD cannot be disabled once it's started!

[freeflyer]

---

@Andrew Neil wrote:

---

@Ozone wrote:

If you can enable and disable the watchdog, wild-running code can as well, and you cannot really rely on the watchdog.

---

^^^^^^ Absolutely this! ^^^^^^ 

This is exactly why the internal WD cannot be disabled once it's started!

---

How do you handle low power modes then ?  In my case, standby and shutdown

When I tried the internal WD, during standby and shutdown the processor kept resetting as the WD was not being reset.

[Andrew Neil]

For Standby, you have IWDG_STBY

But that's a separate issue - best to start a separate thread for it ...