Watchdog Timers
A watchdog timer resets or safes a system when software stops servicing it, catching hangs and deadlocks that other checks would miss.
A Guard Against Silence
A watchdog timer is an independent countdown that software must periodically reset to keep from expiring. If the software hangs, deadlocks, or enters an infinite loop and fails to reset the watchdog in time, the timer expires and forces a corrective action, typically a reset or a transition to a safe state. It catches the failure mode where software simply stops making progress and produces no error to report.
How It Works
The watchdog is a hardware counter, ideally driven by its own clock and independent of the processor it guards. In normal operation the software kicks, or services, the watchdog at intervals shorter than its timeout, signaling that it is alive and running. If a kick is missed, the watchdog assumes the software has failed and takes over. Because it is independent, it works even when the main software is completely stuck.
Doing It Right
- Kick from a place that proves real progress, not from a dumb periodic interrupt
- Use a windowed watchdog that also faults if kicked too early, catching runaway loops
- Keep the watchdog on an independent clock so a stopped main clock still trips it
- Drive the fault action to a defined safe state, not just a blind reset
The Naive-Kick Pitfall
A watchdog is only as good as the condition under which it is kicked. If the kick comes from a simple timer interrupt that keeps firing even when the main application has died, the watchdog is satisfied while the system is actually broken. The kick should be gated on evidence that the real work is happening, for example that every critical task has completed its cycle, so the watchdog reflects genuine health rather than mere clock activity.
Place in the Safety Design
Watchdogs are a cheap, independent layer that complements redundancy and interlocks. They cannot catch every fault, a system computing wrong answers quickly will still kick happily, but they reliably catch hangs and total stalls that would otherwise leave actuators frozen at their last command. Combined with a fail-safe reaction, they ensure that a stuck controller becomes a safe controller rather than a silently dangerous one.