Problem Snapshot

Failure roots: dead loop / priority inversion, feed path blocked, clock halt. Consequences: uncontrolled MTTR, FS/DB corruption, peripheral lockup.

Why External SWT

Independent timebase and enable chain not governed by firmware. Schmitt input and min pulse width reduce false feeds from EMI/glitches/RC drift.

MTTR & Data Consistency

Align TWD + tRST_MIN + power-up order to storage protection windows. Policy: IRQ soft-degrade (flush/throttle) → on failure after N tries, perform hard reset.

Procurement Checklist

• Low Iq (standby friendly)
• TWD tolerance & temp drift
• Output type: OD / PP, polarity
• tRST_MIN ≥ MCU requirement
• VIL/VIH compatibility across domains

BOM Remark (Copy-Ready)

“WDT timeout = 200 ms ±10%; RESET = OD/active-low; tRST ≥ 100 ms; Feed pulse ≥ 40 µs (Schmitt); No windowed behavior; AEC-Q100 Grade 1; Pin-compatible family required.”

Key Terms

• TWD: timeout to action after missed feed
• tKICK: min feed pulse width / edge
• tRST_MIN: guaranteed reset width
• tPD: SWT-to-system propagation delay

Tolerance Model

TWD_tol = ±(Initial + Temp Drift×ΔT + Aging). Budget across lifetime and full temperature range for automotive/industrial targets.

Feeding Mechanism

Prefer edge + min width with Schmitt input; avoid RC-only emulation which drifts across temp/aging. Add series R (22–100 Ω) + C (10–100 nF) after timing check.

Reset & Power Behavior

• tRST_MIN ≥ 50–150 ms (depends on MCU)
• Internal P0R & brown-out keep RESET asserted
• Block feeds during power dips to avoid false recovery

Engineering Rules

• TWD ≈ main-loop period × (3–5) + I/O flush budget
• Start with ±10% full-temp timing goal
• Validate jitter tolerance (±1% → ±10%)

Decision Goals

Minimize MTTR while preserving data. Scope is Simple WDT; windowed behavior, multi-rail thresholds and reset trees are covered in sibling pages.

IRQ-First Policy

Use when system still responds to interrupts. Perform flush/WAL, unmount or snapshot; enforce deadline and a bounded retry count N.

Direct RESET

Use for unrecoverable hangs, unknown peripheral state, or when storage can safely power down. Guarantee tRST_MIN and boot into a safe self-check mode.

Retry & Backoff

• N = 2–3 attempts
• Backoff: linear or exponential
• MaxRetryTime ≤ min(SLA, 2×TWD)

Output Stage

Open-drain + pull-up to target domain is the default for multi-voltage systems. Push-pull fits same-domain timing-critical resets.

BOD/POR Interlocks

Brown-out has priority: hold RESET when VDD is unstable. Gate reset release with PWR Good and avoid releases on supply ramps.

Dual-WDT Layering

External TWD > internal TWD to form a safety backstop. Internal WDT handles quick local recovery; external cannot be disabled by firmware.

Feed Input Chain

Prefer Schmitt input; add R=22–100 Ω and C=10–100 nF for noise filtering after tKICK checks. RC is for deglitching, not for pulse generation.

RESET Output & Domains

Use open-drain + pull-up to the target domain by default for multi-voltage systems. Push-pull suits same-domain timing-critical resets.

PG/EN Interlocks

• Hold RESET during dips/brown-out
• Gate release with Power Good
• Avoid RESET↔EN feedback loops

Layout & EMC

Short feed trace with close return path; place series R near the SWT pin; keep RESET away from noisy switching nodes; add test points off the most sensitive segments.

Iq Budget

Target ≤ 1–5 µA for battery/standby rails (device + pull-ups). Longer TWD reduces feed rate but increases MTTR—tune per wake policy.

Timing Stability

TWD_tol = ±(Initial + Temp Drift×ΔT + Aging). Design for −40~125 °C; baseline goal ±10% over full temp.

EMI & False Feed

Prefer Schmitt input. Add R=22–100 Ω series and C=10–100 nF to ground; enforce a digital tKICK_min to reject narrow spikes.

Aging & Maintenance

Track ppm/khr drift; forecast 5–10 year windows. Re-verify TWD and tKICK at cold and hot corners; re-size pull-ups if rise-time degrades.

Engineering Rules

• Iq ≤ 3 µA (battery) / ≤ 5 µA (always-on)
• TWD ≈ main-loop × (3–5) + flush budget
• Full-temp TWD tolerance ≤ ±10%
• tKICK_min ≥ 40 µs (Schmitt)
• RESET pull-up 4.7–100 kΩ per bus capacitance

Fault Models

• Main loop hang / priority inversion
• Timer/clock halt, PLL unlock
• Task congestion → feed delay
• Random jitter / narrow glitches

Software Injection

Mask feed API; insert controlled delay (±1–10% of TWD); randomize jitter (Gaussian/Uniform). Count soft-recovery success and RESET fallbacks.

Hardware & Environment

Function generator pulse/EMI on feed; temperature chamber −40/25/85/125 °C; supply droop/recovery (depth, dV/dt). Capture logic analyzer traces.

Pass Criteria

• MTTR ≤ 2×TWD (includes boot checks)
• 0 false resets / 24 h steady state
• Full-temp/full-voltage TWD bias ≤ ±10%

Logging & Traceability

Record reset-factor registers, GPIO event stamps (IRQ/RESET) and annotated waveforms with absolute timestamps. Retain failing specimens for review.

Shortest Loop & Return

Keep feed/RESET on inner layers with a solid reference plane. Stitch vias to give a symmetric return within 10 mm after layer changes.

Schmitt + R/C Deglitch

Place R=22–100 Ω near the SWT pin and C=10–100 nF to ground. RC is for deglitching, not for pulse forming.

RESET Pull-up & Edge

Use OD + pull-up to the target domain. Select 4.7–100 kΩ by bus C and VIH margin. Avoid edges that trigger receiver glitches.

Keep-out vs Noisy Nodes

Keep distance from DC/DC switch nodes, H-bridges and high-speed pairs (USB/Ethernet/PCIe). Add ground guard traces and stitch vias where needed.

Testability

Put test pads on non-sensitive nodes or behind the series-R. Leave grab-space for logic probes without hanging directly on feed/RESET.

Copy-Ready Rules

• Post-RC pulse width ≥ tKICK_min
• RESET 10–90% rise ≈ 1–5 µs
• Ring margin < ±10% of VIH/VIL
• Stitch via within 10 mm after any plane cross

AEC-Q100 Grades

• G0: −40~150 °C
• G1: −40~125 °C
• G2: −40~105 °C

Regulatory & Lifecycle

Maintain RoHS/REACH, optional halogen-free, and PPAP (e.g., Level 3). Track supply status (Active/NRND/EOL) and second-source maps.

System Compliance Context

SWT does not replace IEC-61000-4-2/-5 protection. Robust feed/RESET routing and domain-correct pull-ups materially raise pass probability.

Design Levers for Pass Rate

• PG-gated reset release on ramps
• OD reset pulled to target VIH domain
• RC/Schmitt hardening raises EMI threshold

Copy-Paste Statement

Device: AEC-Q100 G1, RoHS/REACH compliant; PPAP Level 3 on request. SWT is not intended as a system ESD/surge protector; layout per EMC guide. Supply: Active, second source mapped.

Mandatory

Watchdog timeout = 200 ms ±10%; RESET = OD/active-low; tRST ≥ 100 ms;
Disable via TEST pin high; AEC-Q100 Grade 1; Pin-compatible family required;
No windowed behavior.

Why: guarantees timing window, domain-safe reset, automotive temp range, and avoids accidental windowed devices.

Optional

Feed pulse ≥ 40 µs (Schmitt input); No RC-only feeding; Brown-Out Hold = Y;
Reset release gated by PG; Iq ≤ 3 µA (battery domain); VDD 1.8–5.5 V.

Why: blocks false feed, avoids supply-ramp glitches, fits standby rails and multi-domain IO levels.

Quality & Traceability

Provide RoHS/REACH CoC; PPAP Level 3 on request; maintain second source
pin-compatible where available; lifecycle status = Active.

Why: lifecycle and automotive-readiness; ensures a fallback if supply changes.