← Back to: Supervisors & Reset
What It Solves
Clock independence removes common-cause failures (CCF) where the watchdog (WDT) depends on the same clock tree as the MCU. Typical triggers include PLL stalls, XTAL non-start, clock-distribution degradation, or frequency/jitter excursions that distort the feed window during slow ramps and 20–50 mVpp ripple. The field symptoms are missed resets, non-recovering hangs, and lost logs.
Symptoms
- Cold-start fails to reset; intermittent boot lockups.
- Feed-window drift under slow ramp / pre-bias supply.
- Door access / motor / battery systems hang without self-recovery.
- Power-fail logs missing; root-cause hard to reconstruct.
Mechanism
Shared clock ⇒ WDT co-sourced with MCU. When the reference stalls, slows, or jitters, the watchdog timing collapses with it. Slow-ramp + 20–50 mVpp ripple act like a pseudo-frequency error, shifting the window and causing false passes or missed resets.
Cost
- Truck-rolls and field returns from non-recovering hangs.
- Black-box analysis blocked by missing logs.
- Safety cases weakened by latent common-cause dependencies.
Availability ≈ 1 − P(CCF) × Impact(CCF)Reset success goal: missed-reset rate ≤
100 ppm under combined “stopped-clock + temperature” stress.
Common Pitfalls
- Using MCU internal WDT still tied to main XTAL/PLL.
- Push-pull resets crossing voltage domains without level strategy → chatter or under-width pulses.
Decision Checks
- Any shared-clock path to WDT?
- Target environment: industrial/automotive (−40~+125 °C)? Need dual timebases (RC+XTAL)?
- MTBF / escape-risk and reset/response-time requirements?
Architectures for Clock Independence
Four reusable patterns map to different environments and fault models. Select by start-up criticality, long-term accuracy, cross-domain reset fan-out, and functional-safety targets.
A · RC-WDT (On-Chip Independent Timebase)
- Pros: survives main-clock loss; fast cold-start.
- Trade-offs: higher ppm/°C → use wider windows; verify corners.
- Use: cold-start critical, minimal BOM.
B · External µP Supervisor + Windowed WDT
- Pros: truly independent device; OD/PP; cross-voltage domains; delay/debounce.
- Trade-offs: area/cost; pull-up sizing and routing matter.
- Use: multi-domain reset fan-out; ripple/slow-ramp sensitive.
C · Dual Timebases (RC ⇄ XTAL) with Interlock/Voting
- Pros: mutual supervision; single-point tolerance ↑.
- Trade-offs: complexity; interlock logic and diagnostics required.
- Use: high availability / safety (ASIL paths).
D · RTC-Derived 1 Hz / CLKOUT Interlock
- Pros: WDT cross-checks a low-drift reference.
- Risks: loses independence if RTC power/clock shares sources.
- Use: systems with RTC that can ensure power/clock isolation.
ppm_total = |ppm_RC| + |ppm_XTAL| + temp + aging →
Δt ≈ t_nom × (ppm_total / 10^6)Window margin:
t_low < min_feed_across_corner and max_feed_across_corner < t_high (≥20% recommended).
Selection Hints
- Cold-start-critical → A or C (include RC path).
- Long-term accuracy → B or C (include XTAL).
- Cross-domain reset fan-out → B.
- High ASIL / availability → C (+ simple voting / interlocks).
Anti-Pitfalls
- “Dual timebases” secretly share the same LDO/clock tree.
- Interlock signals share domains and suffer back-powering.
- Missing level strategy on OD/PP resets across domains.
Timing Budget & Drift Mapping
Convert ppm/°C, aging, and jitter into milliseconds of window shift so windowed-WDT feeds remain safe across temperature, voltage corners, and cold-start. Then add blanking/debounce to absorb slow-ramp and pre-bias artifacts.
Collect Parameters
- Initial frequency error
ppm_init - Temperature drift
ppm_temp(T)(per °C curve) - Aging
ppm_aging(L)at lifetime L - Jitter →
jitter_margin(ms) inside window
Design the Window
Choose (t_low, t_high) around t_nom so min/max feed across corners stays inside, with
≥ 20% margin. RC-WDTs typically need wider windows or temperature-aware feeding.
Handle Slow Ramps
Slow dV/dt and 20–50 mVpp ripple create a pseudo frequency error. Use PG-based t_blank and input debounce
so the first feeds occur after rails are stable.
ppm_total(T,L) = |ppm_init| + |ppm_temp(T)| + |ppm_aging(L)| + jitter_equiv_ppmTime shift from ppm:
Δt_ppm(T,L) = t_nom × (ppm_total(T,L) / 10^6)High-side shift (incl. jitter band):
Δt_feed_high = t_nom × (ppm_total / 10^6) + jitter_marginPass criteria:
t_low < min_feed_across_corner and max_feed_across_corner < t_high (≥ 20% margin).
| Temperature (°C) | ppm_total | Δt_ppm (ms) | jitter_margin (ms) | Δt_total (ms) |
|---|---|---|---|---|
| −40 | … | t_nom × ppm_total/1e6 | … | Δt_ppm + jitter_margin |
| 25 | … | t_nom × ppm_total/1e6 | … | Δt_ppm + jitter_margin |
| 125 | … | t_nom × ppm_total/1e6 | … | Δt_ppm + jitter_margin |
Reset I/O & Level Domains (OD vs PP, Pull-ups, Back-Power)
Ensure that resets asserted by the independent timebase propagate across multiple voltage domains with clean edges and
no back-powering. Choose OD or PP deliberately, size pull-ups to meet t_RST(min), and block reverse-current paths.
Open-Drain (OD) + Pull-up
- Pros: natural cross-domain by pull-up rail; easy fan-out.
- Risks: slow
t_rise→ effective pulse shorter thant_RST(min); too-strong pull-up → power/bias issues. - Rule:
t_rise ≈ 2.2 × R_pullup × C_bus; verifyt_pulse_effective ≥ t_RST(min).
Push-Pull (PP)
- Pros: clean edges, controlled width.
- Risks: needs level translation across domains; may overdrive absolute ratings; can create back-power paths.
- Mitigation: use level shifters or switch to OD + per-domain pull-ups.
t_RST(min) ≥ datasheet × 1.2 (increase margin for slow ramps)Rise-time with OD:
t_rise ≈ 2.2 × R_pullup × C_busCross-domain levels: stay within absolute ratings; add level shifting or OD-with-local-pull-ups.
| Driver | Vpullup / Vout | Rpullup | Cbus | t_rise calc | t_RST(min) | Domains | Back-power risk | Mitigation |
|---|---|---|---|---|---|---|---|---|
| OD | … | … | … | 2.2×R×C | ≥ spec × 1.2 | e.g., 5V_IO → 3V3_MCU | Y/N | Schottky, series R, buffer |
| PP | … | — | C_load | driver slew | ≥ spec × 1.2 | e.g., 3V3_MCU → 1V8_Core | Y/N | Level shifter or OD |
Injection & Fault Modeling (Stopped/Slowed/Jittered Clock)
Define reproducible clock/power/temperature injections to validate reset effectiveness when the main clock is stopped, slowed, or jittered. Quantify field-relevant risks and decide mitigations (window, blanking, interlocks, domain fixes).
Clock Injections
- Stopped clock (gated/Hi-Z)
- Slowdown: −10% / −30% / −50%
- Burst period jitter: 10–30%
- Duty-cycle faults: 40/60, 30/70
Power Conditions
- Slow ramp: 100 mV/s → 1 V/ms
- Ripple: 20–50 mVpp @ 10–200 kHz
- Pre-bias on selected rails
Temperature Sweep
−40 / −20 / 25 / 60 / 85 / 125 °C (dwell ≥ thermal settle)
| Metric | Acceptance | How to Measure |
|---|---|---|
| LeakResetRate | ≤ 100 ppm (aggregate across corners) | Count missed/false resets over N cycles |
| ResetPulseWidth (min) | ≥ 1.2 × datasheet requirement | Scope histogram P1/P99 vs. spec |
| Back-power (per domain) | < 1 µA with domain off | SMU/µA meter on off domain pins |
Common Pitfalls
- Only testing “stopped clock” but not slow/jitter/duty faults → false pass.
- Room-temp only; too few ripple frequencies; missing pre-bias cases.
- PP driven across domains causing back-power (see Ch.4 mitigations).
Remediation Hooks
- Window re-centering / wider margins for RC paths
- PG-based blanking and debounce tuning
- OD + per-domain pull-ups, isolation diodes/buffers
Interlocks & Voting (PG/FAULT Semantics, N-of-M)
Make the independent timebase cross-validate with power-good and the watchdog window so no single signal can mask a true fault. Use PG-gated blanking, window overlap, and simple N-of-M voting with an RTC/CLKOUT veto.
PG/FAULT Semantics
- PG valid = thresholds + dwell time (PG_stable window).
- FAULT from UV/OV/window violations; latch/clear rules explicit.
- Feeding is forbidden until PG_stable; FAULT may block reset release.
Window Overlap
Ensure Overlap(t_feed_window, PG_stable) ≥ X ms (recommend 10–20% of t_feed), and do not erode t_RST(min).
Voting
- 1oo2:
(RC_OK ∨ XTAL_OK) ∧ PG_OK - 2oo2:
(RC_OK ∧ XTAL_OK) ∧ PG_OK - 2oo3:
maj(RC_OK, XTAL_OK, RTC_OK) ∧ PG_OK - Veto: if
RTC/CLKOUTabnormal ⇒ no reset release
t_blank_after_PG↑ = max(t_ramp_settle, k × τ_supply), with k≈3–5Overlap rule:
Overlap ≥ max(0.1 × t_feed, jitter_margin + Δt_ppm)
Selection Guide (RC vs XTAL vs Hybrid)
Map real use-cases to a timebase choice (RC / XTAL / Hybrid) and a window strategy (tlow, thigh, margin, interlocks). Use RC for cold-start, XTAL for long-term ppm, and Hybrid where EMI is harsh or ASIL evidence must be strengthened.
| Environment × Requirement | ≤ Startup time | ppm / drift priority | EMI robustness | Reset I/O across domains | Recommended scheme + window |
|---|---|---|---|---|---|
| Cold-start-critical (−40→room) × Quick recovery | < 10–50 ms | Moderate | Normal | OD + per-domain pull-ups | RC-WDT; centered window with ≥25–30% margin; PG-gated blanking |
| Long-term accuracy × Tight timing spec | > 50–100 ms acceptable | High (ppm + aging) | Normal | PP or OD (match domains) | XTAL-WDT; narrower window; verify temp/aging; overlap with PG_stable ≥10–20% tfeed |
| Harsh EMI × Field diagnostics | Flexible | Medium–High | High (burst/surge) | OD + level-shifters; no back-power | Hybrid (RC↔XTAL or RTC-CLKOUT interlock); centered window + interlocks; 1oo2/2oo3 voting + veto |
| Multi-domain resets × Cross-voltage fanout | App-specific | Medium | Normal/High | OD preferred; trise≈2.2·RPU·Cbus; enforce tRST(min) | RC or Hybrid depending on EMI; wide window if RC; per-domain pull-ups; isolation diodes |
Cross-Brand Shortlist (Seven Vendors)
Trial-friendly, automotive/industrial capable picks. Each row includes a datasheet link (rel="nofollow") and one-line selection rationale. Use with Ch.4 I/O rules and Ch.6 interlocks.
| Brand | Family / PN | Timebase | Windowed? | OD/PP | t_RST(min) | AEC-Q100 | Pkg H (mm) | Second-source | Datasheet |
|---|---|---|---|---|---|---|---|---|---|
| TI | TPS3430-Q1 | Independent WDT | Window | OD/PP options | DS spec | Yes (Q1) | Small (WSON/SOT) | Alt: STWD100, MLX80051 (SBC) | TI Datasheet |
| TI | TPS3435 | Independent WDT | Timeout (non-window) | OD/PP options | DS spec | Q variants | Tiny (SOT/WSON) | Alt: STWD180 | TI Datasheet |
| TI | TPS3890 / TPS3890-Q1 (Supervisor) | Voltage supervisor | — | OD (RESET), MR pin | DS spec (programmable delay) | Q1 option | SOT/SON | Alt: ISL88014 | TI Product Page |
| ST | STWD100 | Independent WDT | Timeout (OD/PP variants) | OD or PP (config) | DS spec (min reset widths) | Industrial/auto variants | SOT-23 | Alt: TPS3435 | ST Datasheet |
| ST | STM811/812 (Supervisor) | Voltage supervisor + MR | — | Active-low/-high options | DS spec (trec) | Industrial | SOT143-4 | Alt: TPS3890 | ST Product Page |
| NXP | VR5510 (PMIC) | Integrated Window WDT | Window (program.) | PG/FAULT semantics | Per DS | Automotive (ASIL docs) | QFN | Alt: onsemi NCV97400 | NXP Docs |
| NXP | MC33907/33908 (SBC) | Advanced WDT + supervisor | Window / challenge WDT | SPI control + safety states | Per DS | Automotive | SBC packages | Alt: Melexis MLX80051 | NXP Product Page |
| Renesas | ISL88015 (Supervisor + WDT) | Supervisor + WDT | Timeout (startup / normal) | Active-low/high options | DS (e.g., 1.6 s normal) | Industrial/auto variants | SOT-23 | Alt: STWD100 | Renesas (DS via Mouser) |
| Renesas | ISL88014 (Supervisor) | Voltage supervisor | — | Comp/OD variants | DS (e.g., 200 ms POR adj.) | Industrial | SOT-23 | Alt: TPS3890 | Renesas Product Page |
| onsemi | NCV97400 (PMIC) | Integrated Window WDT + monitors | Window | PG/FAULT tree | Per DS | Automotive | QFN | Alt: NXP VR5510 | onsemi Datasheet |
| onsemi | CAT824 (Supervisor + WDT) | Supervisor + WDT + MR | Timeout | Active-low | DS (≥140 ms typical) | Industrial/auto options | SOT-23 | Alt: MCP1316 | onsemi Product Page |
| Microchip | MCP1316 (Supervisor, PP) | Voltage supervisor (WDI pin) | Timeout (WDT mode) | Push-pull, active-low | Per DS (−40~+125 °C) | Auto-capable options | SOT-23 | Alt: CAT824 | Microchip Datasheet |
| Microchip | MCP1321 (Supervisor, OD) | Voltage supervisor (WDI pin) | Timeout (WDT mode) | Open-drain, active-low | Per DS (AEC-Q options) | AEC-Q (select codes) | SOT-23 | Alt: STM811 | Microchip Product Page |
| Melexis | MLX80051 (LIN SBC: Reg + WDT + RESET) | Integrated Window WDT | Window (ext. settable) | NRES reset output | Per DS | Automotive (LIN) | SOIC/QFN | Alt: NXP MC33907/8 | Melexis Datasheet |
TI TPS3430-Q1
Automotive window WDT (programmable window/reset delay). Works well with Ch.6 interlocks; a good independent timebase for ASIL projects.
ST STWD100
Independent WDT with OD/PP options and easy drop-in. Combine with OD pull-ups to cover multi-voltage-domain resets.
NXP VR5510
PMIC-class window WDT with PG/FAULT semantics; suited to domain controllers/gateways. Pair with voting/interlocks to build non-common-cause evidence.
Renesas ISL88015
Supervisor + WDT combo, small and low power; a solid starter for board-level watchdog and robust reset.
onsemi NCV97400
Multi-rail PMIC with window WDT; good for multi-rail systems—manage WDT together with power-health telemetry.
Microchip MCP1316/1321
Accurate voltage supervision with WDI. Pair with an external/internal WDT to form the classic “supervisor + independent timebase” setup.
Melexis MLX80051
LIN SBC: regulator + window WDT + RESET. For lighting/body nodes; still recommend an external independent supervisor to ensure non-common-cause coverage.
Request a Quote
BOM & Procurement Notes
Provide the fields below so we can return a two-option shortlist (primary/backup) within 48 hours. This page focuses on clock independence for watchdogs, cross-domain reset integrity, and small-batch readiness.
| Field | Definition | Engineering note |
|---|---|---|
V_rail, n_rails |
Target rail voltage(s) and count | Affects supervisor thresholds and reset fanout domains |
| WDT type / Timebase | Window vs one-shot; RC vs XTAL vs Hybrid | Choose for startup speed vs ppm/aging, see Selection Guide |
| tfeed window & drift budget | (t_low, t_high) with ppm + jitter margin | Center window, keep ≥20–30% safety margin |
| tRST(min), Output type | Minimum reset width; OD vs PP | t_RST ≥ 1.2× DS; OD + per-domain pull-ups across levels |
| AEC-Q100 / Package height / Second-source | Compliance & mechanical / sourcing | Prepare primary + backup vendor up front |
| Optional hooks | RTC 1 Hz/CLKOUT, I²C/PMBus, PG/FAULT semantics, temp grade, ESD/Surge | Enable interlocks and diagnostics without common-cause paths |
We will return a primary + backup shortlist, window & interlock advice, and reset I/O guidance.
Verification Plan & Acceptance (DOE)
A copy-ready DOE: how to inject faults, what to log, and how to accept. Reuse the injection matrix from Ch.5; add statistics and histogram views for watchdog timing and reset width.
| Item | Plan | Notes |
|---|---|---|
| Sample size | n ≥ 30 per condition; 6 temperature points (−40/−20/25/60/85/125 °C) | Covers startup, drift, aging corner |
| Clock injection | Stopped / −10% / −30% / −50% / jitter 10–30% / duty anomalies | MUX/gate source; RIN/period modulation for jitter |
| Power injection | Ramp 100 mV/s…1 V/ms; ripple 20–50 mVpp; pre-bias per domain | Scripted PSU + AWG; isolate domains to avoid back-power |
| Logging | Feed timestamps, violation rate (ppm), reset width histogram, back-power current, cross-domain delay | Scope + LA; SMU for leakage; store CSV per condition |
| Acceptance | Violation ≤ 100 ppm; t_RST ≥ 1.2× datasheet; Overlap(PG_stable, t_feed_window) ≥ 10–20% of t_feed; back-power < 1 µA | Use P1/P50/P99 to summarize distributions |
Stat rules
Report P1/P50/P99 for t_RST and feed timing; compute violation rate as ppm over the entire matrix.
I/O integrity
Enforce t_RST ≥ 1.2× datasheet; use OD + per-domain pull-ups; verify no back-power (< 1 µA).
Overlap
Ensure PG_stable and the feed window overlap by ≥ 10–20% of t_feed across corners.
FAQs — Clock Independence & Common-Cause Isolation
12 practical questions with engineer-grade, copy-ready answers. Visible text exactly matches the JSON-LD below.
How do I prove the watchdog clock is independent of the MCU PLL in production builds?
Show schematic and BOM evidence of separate clock and power domains, then run fault injection on production images: stop/derate the MCU PLL while the watchdog still asserts reset. Log missed-reset rate ≤ 100 ppm across −40~+125 °C. Include scope/LA captures, build hashes, and a factory test script that toggles PLL while verifying watchdog behavior.
What ppm/°C drift budget keeps window-WDT feeds safe over −40~+125 °C?
Use Δt ≈ t_nom × (ppm_total/1e6), where ppm_total = initial tolerance + temp drift + aging + jitter margin. Center the window and keep ≥ 20–30% safety margin versus worst-corner feed times. Validate with P1/P50/P99 statistics per corner and ensure the aggregate violation rate stays below 100 ppm across the full test matrix.
When should I choose an RC-WDT over an XTAL-WDT for cold-start reliability?
Prefer RC-WDT when fast, guaranteed start is critical and crystal start-up or low-temperature oscillation is uncertain. Use a wider window and larger drift budget. Choose XTAL-WDT for long-term accuracy and tighter windows, but add POR/blanking to cover slow or failed crystal start. Always confirm independence and behavior under stop/derate faults.
How do slow ramps and 20–50 mV ripple change the safe feed window?
Slow ramps and ripple can modulate internal thresholds and clock edges, behaving like an “effective slow clock.” Add a blanking/debounce period after PG rises and include jitter margin in the window calculation. Verify at min/max ramp rates and ripple levels that feeds remain inside the window with ≥ 20% residual margin across corners.
What is a robust minimum reset pulse width across domains (OD vs PP)?
Enforce t_RST(min) ≥ 1.2 × datasheet under worst loading. For open-drain resets crossing domains, check rise time t_rise ≈ 2.2·R_pullup·C_bus so the sampled pulse exceeds threshold across voltage and temperature. Use level shifting or buffering if domains differ. Confirm no back-power paths and verify pulse width histograms meet the limit.
Can I derive a 1 Hz from the RTC and still claim clock independence?
Yes, if the RTC’s timebase and supply are not common-cause with the MCU PLL or its regulators. Document separate sources, then prove it: stop or derate the MCU clock while the RTC-derived watchdog still asserts reset. Record missed-reset rate ≤ 100 ppm and include captures showing the independent path continues to operate correctly.
How do I interlock PG/FAULT semantics so a stuck WDT cannot mask faults?
Require PG_stable to overlap the watchdog feed window by ≥ 10–20% of t_feed and gate WDT feeds on power-good status. Latch FAULT or limit power on watchdog triggers to prevent silent masking. Add a veto: if RTC/CLKOUT sanity checks fail, block reset release. Validate interlocks with scripted timing and log the overlaps.
What blanking/debounce prevents chatter on pre-biased rails?
After PG rises, apply a blanking time sized to the slowest rail: t_blank_after_PG ≈ 1–5 × RC_ramp of that domain. This filters transient thresholds and pre-bias artifacts before enabling feeds or releasing resets. Verify empirically at min/max ramp rates and temperatures that no chatter occurs and windows remain respected.
How do I inject “stopped clock / stuck high / jitter burst” and define pass criteria?
Gate or tri-state the source for stopped clock, force a static level for stuck high, and modulate period or phase for 10–30% jitter bursts. Combine with slow ramps, ripple, and temperature corners. Pass criteria: missed-reset rate ≤ 100 ppm, t_RST histograms above limit, and validated overlap between PG_stable and the feed window.
What acceptance criteria make sense for ppm-level window violations?
Use an aggregate violation rate ≤ 100 ppm across the entire test matrix, reported with P1/P50/P99 statistics per corner. Maintain ≥ 20–30% timing margin after accounting for ppm drift and jitter. Include evidence of interlock overlap and no-chatter operation during ramps, ripple, and thermal extremes to support production readiness.
How do I size pull-ups to avoid back-power while meeting rise-time on OD resets?
Choose R_pullup so t_rise ≈ 2.2·R_pullup·C_bus still meets the sampled pulse width with margin. Verify domain leakage remains < 1 µA when powered down, adding series resistors or diodes if needed. Check the receiving threshold across temperature and voltage so the effective high level and timing are guaranteed in worst conditions.
What second-source pitfalls exist when swapping WDT/supervisor families?
Pitfalls include different window definitions, reset polarity, t_RST requirements, OD/PP output behavior, hidden common-cause timebases, and AEC-Q variants. Mitigate with A/B samples, I/O semantics review, and timing histograms under stop/derate faults and ramps. Confirm sourcing windows and keep a validated backup option to avoid late-cycle surprises.
