AON Timer Technical Specification

Overview

This document specifies the Always-On (“AON”) Timer IP functionality. This module conforms to the Comportable guideline for peripheral functionality. See that document for an overview of how it is integrated into the top level system.

Features

  • Two 32-bit upcounting timers: one timer functions as a wakeup timer, one as a watchdog timer
  • The watchdog timer has two thresholds: bark (generates an interrupt) and bite (resets core)
  • There is 12 bit pre-scaler for the wakeup timer to enable very long timeouts

Description

AON Wakeup timer

The always-on wakeup timer operation is straightforward. A count starts at 0 and slowly ticks upwards (one tick every N + 1 clock cycles, where N is the pre-scaler value). When it reaches / exceeds the wake count, a level wakeup signal is sent to the power manager and a level IRQ is sent to the processor. This wakeup signal stays high until it is explicitly acknowledged by software (software must write zero to the WKUP_CAUSE register to clear it). The wakeup timer can be used like a real-time clock for long periods in a low-power mode (though it does not give any guarantees of time-accuracy). TODO: specify accuracy

AON Watchdog timer

The always-on watchdog timer behaves similarly to the wakeup timer. It has an independent count starting at 0 which slowly ticks upwards. When the first threshold is met or exceeded, a level wakeup signal (if enabled) is sent to the power manager. Simultaneously, a level IRQ signal is also generated to the processor.

If the system is in a low power state, the wakeup signal asks the power manager to wake the system so that the IRQ can be serviced. If the system is not in a low power mode, the IRQ is immediately serviced. Both the wakeup and the IRQ signals remain asserted until system reset or explicit acknowledgement by software. This first threshold is known as the watchdog bark.

Note that it is not recommended to connect this IRQ to a non-maskable interrupt (NMI) pin. This would require the start-up (ROM) code to be able to handle the watchdog bark, or the core might get stuck when resuming from low-power modes.

When the second threshold is met (this is known as the watchdog bite), a reset request is sent to the power manager which will trigger a system reset. This is independent of the IRQ sent as part of the watchdog bark. The system reset also resets the always-on timer, so software is not required to directly acknowledge anything after a watchdog reset.

To prevent the watchdog bark or bite, software is expected to periodically reset the count when operating normally. This is referred to as petting the watchdog, and is achieved by resetting the count to zero.

Since this timer functions as a watchdog, it has two additional functions not present in the always-on wakeup timer:

  • Watchdog configuration lock
  • Watchdog pause in sleep

Unlike the wakeup timer, the watchdog timer configuration can be locked by firmware until the next system reset. This allows the option of preventing firmware from accidentally or maliciously disabling the watchdog.

The “pause in sleep” option controls whether the watchdog timer continues to count in low-power modes. This allows configurations where the watchdog timer can remain programmed and locked while the device is put to sleep for relatively long periods, controlled by the wakeup timer. Without this feature, the watchdog timer might wake up the core prematurely by triggering a watchdog bark.

Theory of Operations

Block Diagram

AON Timer Block Diagram

See the block diagram for high level function and connectivity. The timer interacts with the CPU core and the power manager and reset manager to drive wakeup / reset events and interrupts. There is also an extra input to tell the counter whether to run (“counter-run”). This is used to stop the watchdog timer running when in debugging mode or when the alert handler has put the system in a “killed” state.

Hardware Interfaces

Referring to the Comportable guideline for peripheral device functionality, the module aon_timer has the following hardware interfaces defined.

Primary Clock: clk_i

Other Clocks: clk_aon_i

Bus Device Interfaces (TL-UL): tl

Bus Host Interfaces (TL-UL): none

Peripheral Pins for Chip IO: none

Interrupts:

Interrupt NameDescription
wkup_timer_expired

Raised if the wakeup timer has hit the specified threshold

wdog_timer_bark

Raised if the watchdog timer has hit the bark threshold

Security Alerts:

Alert NameDescription
fatal_fault

This fatal alert is triggered when a fatal TL-UL bus integrity fault is detected.

Design Details

The always-on timer will run on a ~200KHz clock. The timers themselves are 32b wide, giving a maximum timeout window of roughly ~6 hours. For the wakeup timer, the pre-scaler extends the maximum timeout to ~1000 days.

Register reads via the TLUL interface are synchronized to the slow clock via a single asynchronous fifo. This synchronization guarantees that updates have propagated into the underlying registers on completion of a write. Note that as a consequence of this, reads and writes to the AON Timer peripheral will cause the CPU to stall.

Programmers Guide

Initialization

  1. Write the timer values WKUP_COUNT and WDOG_COUNT to zero.
  2. Program the desired wakeup pre-scaler value in WKUP_CTRL.
  3. Program the desired thresholds in WKUP_THOLD, WDOG_BARK_THOLD and WDOG_BITE_THOLD.
  4. Set the enable bit to 1 in the WKUP_CTRL / WDOG_CTRL registers.
  5. If desired, lock the watchdog configuration by writing 1 to the regwen bit in WDOG_REGWEN.

Watchdog pet

Pet the watchdog by writing zero to the WDOG_COUNT register.

Interrupt Handling

If either timer reaches the programmed threshold, interrupts are generated from the AON_TIMER module. Disable or reinitialize the wakeup timer if required by clearing the enable bit in WKUP_CTRL or clearing the timer value in WKUP_COUNT. Clear the interrupt by writing 1 into the Interrupt Status Register INTR_STATE.

Device Interface Functions (DIFs)

TODO

Register Table

aon_timer.ALERT_TEST @ 0x0

Alert Test Register

Reset default = 0x0, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  fatal_fault
BitsTypeResetNameDescription
0wo0x0fatal_fault

Write 1 to trigger one alert event of this kind.


aon_timer.WKUP_CTRL @ 0x4

Wakeup Timer Control register

Reset default = 0x0, mask 0x1fff
31302928272625242322212019181716
 
1514131211109876543210
  prescaler enable
BitsTypeResetNameDescription
0rwxenable

When set to 1, the wakeup timer will count

12:1rwxprescaler

Pre-scaler value for wakeup timer count


aon_timer.WKUP_THOLD @ 0x8

Wakeup Timer Threshold Register

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
threshold...
1514131211109876543210
...threshold
BitsTypeResetNameDescription
31:0rwxthreshold

The count at which a wakeup interrupt should be generated


aon_timer.WKUP_COUNT @ 0xc

Wakeup Timer Count Register

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
count...
1514131211109876543210
...count
BitsTypeResetNameDescription
31:0rwxcount

The current wakeup counter value


aon_timer.WDOG_REGWEN @ 0x10

Watchdog Timer Write Enable Register

Reset default = 0x1, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  regwen
BitsTypeResetNameDescription
0rw0c0x1regwen

Once cleared, the watchdog configuration will be locked until the next reset


aon_timer.WDOG_CTRL @ 0x14

Watchdog Timer Control register

Reset default = 0x0, mask 0x3
Register enable = WDOG_REGWEN
31302928272625242322212019181716
 
1514131211109876543210
  pause_in_sleep enable
BitsTypeResetNameDescription
0rwxenable

When set to 1, the watchdog timer will count

1rwxpause_in_sleep

When set to 1, the watchdog timer will not count during sleep


aon_timer.WDOG_BARK_THOLD @ 0x18

Watchdog Timer Bark Threshold Register

Reset default = 0x0, mask 0xffffffff
Register enable = WDOG_REGWEN
31302928272625242322212019181716
threshold...
1514131211109876543210
...threshold
BitsTypeResetNameDescription
31:0rwxthreshold

The count at which a watchdog bark interrupt should be generated


aon_timer.WDOG_BITE_THOLD @ 0x1c

Watchdog Timer Bite Threshold Register

Reset default = 0x0, mask 0xffffffff
Register enable = WDOG_REGWEN
31302928272625242322212019181716
threshold...
1514131211109876543210
...threshold
BitsTypeResetNameDescription
31:0rwxthreshold

The count at which a watchdog bite reset should be generated


aon_timer.WDOG_COUNT @ 0x20

Watchdog Timer Count Register

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
count...
1514131211109876543210
...count
BitsTypeResetNameDescription
31:0rwxcount

The current watchdog counter value


aon_timer.INTR_STATE @ 0x24

Interrupt State Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  wdog_timer_expired wkup_timer_expired
BitsTypeResetNameDescription
0rw1cxwkup_timer_expired

Raised if the wakeup timer has hit the specified threshold

1rw1cxwdog_timer_expired

Raised if the watchdog timer has hit the bark threshold


aon_timer.INTR_TEST @ 0x28

Interrupt Test Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  wdog_timer_expired wkup_timer_expired
BitsTypeResetNameDescription
0woxwkup_timer_expired

Write 1 to force wkup_timer_expired interrupt

1woxwdog_timer_expired

Write 1 to force wdog_timer_expired (watchdog bark) interrupt


aon_timer.WKUP_CAUSE @ 0x2c

Wakeup request status

Reset default = 0x0, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  cause
BitsTypeResetNameDescription
0rw0cxcause

AON timer requested wakeup, write 0 to clear