Shutdown Tasks

Contains API prototypes for Shutdown Tasks. More...

Files
file	tasks_shutdown.c
	Implements APIs for Shutdown Tasks.
file	tasks_shutdown.h
	Contains API prototypes for Shutdown Tasks.

Macros
#define	SWDT_WINDOW_MAX   0xFFFFU
	Defines max value for the 16-bit SWDT window register.

Functions
void	T_InitSafeShutdown (void)
	Initializes and prepares the system for safe entry into shutdown sleep modes.
void	T_VerifyFlashIntegrity (void)
	Verifies Flash integrity by running a CRCSCAN on all enabled Flash sections.
void	T_EnterShutdownSleep (void)
	Enters device sleep in either Standby or Power-Down mode depending on the configuration.
void	T_HandleShutdownWatchdogs (void)
	Clears both the Watchdog Timer (WDT) and Synchronous Watchdog Timer (SWDT).
void	T_RestartDevice (void)
	Restarts the device as part of the shutdown exit sequence.

Detailed Description

Contains API prototypes for Shutdown Tasks.

The Shutdown Task APIs are used by the Shutdown Task Manager to perform the Shutdown sequence.

Copyright

© 2026 Microchip Technology Inc. and its subsidiaries.

Subject to your compliance with these terms, you may use Microchip software and any derivatives exclusively with Microchip products. It is your responsibility to comply with third party license terms applicable to your use of third party software (including open source software) that may accompany Microchip software.

THIS SOFTWARE IS SUPPLIED BY MICROCHIP "AS IS". NO WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, APPLY TO THIS SOFTWARE, INCLUDING ANY IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE.

IN NO EVENT WILL MICROCHIP BE LIABLE FOR ANY INDIRECT, SPECIAL, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL LOSS, DAMAGE, COST OR EXPENSE OF ANY KIND WHATSOEVER RELATED TO THE SOFTWARE, HOWEVER CAUSED, EVEN IF MICROCHIP HAS BEEN ADVISED OF THE POSSIBILITY OR THE DAMAGES ARE FORESEEABLE. TO THE FULLEST EXTENT ALLOWED BY LAW, MICROCHIP'S TOTAL LIABILITY ON ALL CLAIMS IN ANY WAY RELATED TO THIS SOFTWARE WILL NOT EXCEED THE AMOUNT OF FEES, IF ANY, THAT YOU HAVE PAID DIRECTLY TO MICROCHIP FOR THIS SOFTWARE.

UML Class Diagrams

UML Activity Diagrams

UML Sequence Diagrams

Macro Definition Documentation

SWDT_WINDOW_MAX

#define SWDT_WINDOW_MAX   0xFFFFU

Defines max value for the 16-bit SWDT window register.

Function Documentation

T_EnterShutdownSleep()

void T_EnterShutdownSleep

(

void

)

Enters device sleep in either Standby or Power-Down mode depending on the configuration.

This function enters the selected sleep mode by enabling sleep and issuing a sleep instruction. The device remains in sleep until an interrupt configured by the application occurs. The sleep mode is set to Standby by default or Power-Down when SHUTDOWN_POWER_DOWN is enabled.

Warning

A suitable wakeup source must be configured and global interrupts must be enabled before calling this Task. If global interrupts are not enabled, the sleep instruction is aborted in hardware and a ERRID_VREGWARN_SERR is reported. If no suitable wakeup source is enabled, the device will not wake up.

Warning

Most hardware safety mechanisms are disabled during Standby and Power-Down sleep. See the device data sheet for more information. It is assumed that the system is configured to safely enter sleep before calling this Task. Moreover, it is recommended to restart the device to exit the Safe State. For more information, see T_InitSafeShutdown.

Note

This Task enters sleep once and returns after wake-up. Re-entering sleep is the responsibility of the caller.

Note

Since the clock sources monitored by CFM0, CFM1, CFD0 and CFD1 may be impacted by sleep entry and can report spurious errors when waking up from sleep, it is recommended to disable them before calling this Task. See SHUTDOWN_SUSPEND_CFD_CFM.

Note

Several device peripherals are disabled in Standby and Power-Down sleep to reduce power consumption. Select peripherals can optionally be enabled during different sleep modes. See the device data sheet for more information. To reduce power consumption further, see

INIT_VMON_ALWAYS_ON and INIT_VMON_FULL_POWER_MODE settings as well as Tips and Tricks for information on disabling the Brown-out Detector (BOD) and Watchdog Timer (WDT) Clock Monitor.

Note

See Tips and Tricks for information on using one or multiple periodic or asynchronous wake-up sources.

The following Error IDs may be reported to the Error Handler by this Task:

• ERRID_INIT_SLEEP Invalid sleep mode configuration

Here is the call graph for this function:

Here is the caller graph for this function:

T_HandleShutdownWatchdogs()

void T_HandleShutdownWatchdogs

(

void

)

Clears both the Watchdog Timer (WDT) and Synchronous Watchdog Timer (SWDT).

This function clears both Watchdogs assuming the shutdown configuration has been applied in T_InitSafeShutdown. During shutdown, if enabled, the WDT is configured to operate without windowed mode and the SWDT is configured to be effectively always in its open window. This allows both Watchdogs to be cleared at any time while the device is awake, before they expire.

Warning

This usage of the watchdogs is only recommended when the system is in a Safe State.

Note

The SWDT halts counting while the device is in any sleep mode and resumes counting when the device wakes up.

Note

If SHUTDOWN_WDT_DURATION is set to WDT_TIMEOUT_OFF, the WDT is disabled during shutdown. In this configuration, clearing the WDT has no effect, but the SWDT is still cleared.

The following Error IDs may be reported to the Error Handler by this Task:

• ERRID_SWDT_EXP SWDT already expired before attempting to clear it

Here is the call graph for this function:

Here is the caller graph for this function:

T_InitSafeShutdown()

void T_InitSafeShutdown

(

void

)

Initializes and prepares the system for safe entry into shutdown sleep modes.

This function ensures the system is reconfigured before it can safely enter either the Standby or Power-Down sleep modes. This is done by first entering a Safe State by floating all I/O pins when SHUTDOWN_SAFE_STATE is enabled. This ensures that sleep can be safely entered, as many hardware safety mechanisms are turned off during sleep.

Since the Synchronous Watchdog Timer (SWDT) is suspended during any sleep mode, but cannot be disabled, it is reconfigured to start counting in the open window with the maximum 16-bit timeout value. This effectively disables windowed mode and ensures the SWDT can be cleared at any time after the device wakes up.

The Watchdog Timer (WDT) is reconfigured to disable Window mode with a new duration set by SHUTDOWN_WDT_DURATION. This allows the WDT to run while the device is sleeping, and allows it to be cleared at any time after the device wakes up, before it expires. This configuration provides a fallback recovery mechanism if the device fails to wake up or re-enter sleep as expected during shutdown. Since the system has already transitioned into a Safe State, a more relaxed Watchdog configuration is acceptable compared to Mission Mode in order to require less frequent wake-ups and less strict WDT clear timing.

Since the clock sources monitored by CFM0, CFM1, CFD0 and CFD1 may be impacted by sleep entry and can report spurious errors when waking up from sleep, this Task can optionally disable all of them if SHUTDOWN_SUSPEND_CFD_CFM is enabled.

Finally, this Task enables global interrupts, which are required for successful sleep entry.

Note

In order for the Window Mode WDT to be reconfigured, it must be cleared while in the open window. This is done by first waiting for the SWDT to enter its open window. It is assumed that the SWDT timeout is already configured to ensure the correct timing before this Task is called. See DUR_UNTIL_SAFE_SHUTDOWN for more information.

Note

See TM_Shutdown for more information on how the application is responsible for periodically waking up and clearing the WDT.

Warning

The SHUTDOWN_WDT_DURATION can be set to WDT_TIMEOUT_OFF. This will disable the WDT. If this is acceptable for the application, it allows entering Shutdown sleep without requiring periodic wake-ups for maximum power saving. However, an external reset source through the reset pin is highly recommended in case the wake-up source fails or the program is stuck.

Warning

If SHUTDOWN_SAFE_STATE is disabled, because the application requires that one or more pins are not tri-stated, it is the responsibility of the user application to ensure the remaining pins are floated in the Shutdown Application Task passed to TM_Shutdown.

Warning

Should the Safe State entry fail, ERRID_SAFE_IO is reported to the Error Handler. It is recommended to abort shutdown entry by performing a device reset if this occurs.

The following Error IDs may be reported to the Error Handler by this Task:

• ERRID_SAFE_IO Failed to enter safe state
• ERRID_INIT_WATCHDOGS Invalid Watchdogs configurations or WDT is in invalid state
• ERRID_SWDT_EXP SWDT already expired before attempting to clear it
• ERRID_INT_DISABLED Failed to enable global interrupts

Here is the call graph for this function:

Here is the caller graph for this function:

T_RestartDevice()

void T_RestartDevice

(

void

)

Restarts the device as part of the shutdown exit sequence.

This function stores ERRID_NONE as the persistent reset reason value and then repeatedly issues a software reset request. Storing ERRID_NONE ensures that the reset reason can be reported as an intentional non-error software reset by the reset handling logic in the startup sequence. See T_HandleResetReason for more information.

Warning

This Task is designed to never return. It will continue requesting a software reset until a reset occurs. If the software reset does not take effect, no further error handling is attempted since the system is assumed to be in a Safe State. The function will continue issuing reset requests until the watchdogs time out or an external reset occurs.

Note

This Task is intended to be called when exiting the shutdown sequence, since it is recommended to exit the Safe State through a device reset after Standby or Power-Down sleep.

Here is the call graph for this function:

Here is the caller graph for this function:

T_VerifyFlashIntegrity()

void T_VerifyFlashIntegrity

(

void

)

Verifies Flash integrity by running a CRCSCAN on all enabled Flash sections.

This function computes the CRC of each enabled Flash section and compares the result with the stored CRC checksum. It configures the CRCSCAN module to scan Flash and enters Idle sleep until each scan completes.

To ensure the device wakes up from Idle sleep, the CRCSCAN Done interrupt is enabled. When the interrupt occurs, the flag is cleared and the result is reported by T_HandleCrcInterrupt. If an unrelated interrupt occurs, the device will return to Idle sleep after handling the interrupt until the scan is complete.

Which sections to scan and the CRC width (16-bit or 32-bit) are configured using CRCSCAN_BOOT_SECTION, CRCSCAN_APPCODE_SECTION, CRCSCAN_APPDATA_SECTION and CRCSCAN_CRC32.

Before scanning, the CRCSCAN error injection diagnostic can optionally be executed if DIAG_SHUTDOWN_CRCSCAN is enabled. See MW_DiagCrcScan for more information.

Note

This function depends on T_HandleCrcInterrupt to complete and report the result of a scan or to complete the CRCSCAN error injection diagnostic after the CRC Done interrupt occurs.

Note

When the device enters any sleep mode, including Idle sleep, the Synchronous Watchdog (SWDT) halts counting until the device wakes up.

Warning

The user is responsible for ensuring that the selected Flash sections are valid with respect to the configured Flash partitioning in the fuse settings, and that the correct CRC value is stored at the end of each Flash section, as described in the device data sheet.

Warning

This function enters Idle sleep to complete a CRC scan. If global interrupts are not enabled, a hardware sleep error is reported and sleep entry is automatically aborted. As a result, the scan will never run and the function will reattempt Idle sleep indefinitely. This can be mitigated by setting ERRID_VREGWARN_SERR to CRITICAL. If the CRCSCAN never completes for any reason, the same situation can occur. That risk can be mitigated by enabling the Watchdog or running the function in a Safe State.

Warning

This function assumes no CRC scan of Flash is already in progress. If it is, an

ERRID_INIT_CRCSCAN error is reported, but Idle sleep is still entered to complete the ongoing scan. This effectively skips scanning the first enabled section. An ongoing scan can be manually aborted by calling MW_AbortCrcScan.

Warning

This function assumes no CRC manual mode calculation is in progress. If it is, an

ERRID_INIT_CRCSCAN error is reported for each enabled section and the scan is skipped without entering Idle sleep. See MW_StartCrcManualMode and MW_EndCrcManualMode for more information.

Warning

If the CRCSCAN error injection diagnostic is enabled, it will always abort and return an error if either a Flash section scan or a manual mode calculation is in progress.

Warning

If scanning the Boot section or running the CRCSCAN diagnostic is enabled, ensure that the Boot Section Read Protection (BOOTRP) setting in NVMCTRL does not block read access. See

MW_EnableCrcScan and MW_DiagCrcScan for more details.

The following Error IDs may be reported to the Error Handler by this Task:

• ERRID_DIAG_CRCSCAN The MW_DiagCrcScan diagnostic reported an error
• ERRID_INIT_CRCSCAN CRC Scan not started because of invalid configuration or state
• ERRID_INIT_SLEEP Invalid sleep mode configuration

Here is the call graph for this function:

Here is the caller graph for this function: