hardware//embedded system//watchdog timer

A watchdog timer is a hardware counter that resets a processor, or switches a system to a safe mode, unless the software restarts the count before it expires, and it is the last line of defence against firmware that hangs, loops forever or stops responding. The software proves it is alive by kicking the watchdog periodically; silence is treated as failure.

A watchdog timer is a hardware counter that resets a processor, or switches a system to a safe mode, unless the software restarts the count before it expires, and it is the last line of defence against firmware that hangs, loops forever or stops responding. The software proves it is alive by kicking the watchdog periodically; silence is treated as failure.

It works because it sits outside the software it watches. An independent watchdog on a microcontroller runs from its own oscillator, so a crashed program, a corrupted clock configuration or an interrupt storm cannot stop it. The timeout is chosen from the system: longer than the slowest legitimate pause in the main loop, shorter than the time the machine can survive without control. A flight controller that hangs for 100 ms with its motors frozen is already in trouble; a temperature controller can wait seconds.

The watchdog with a saturator around it is the most widely deployed safety filter: command and rate limits, a flight envelope, and a timer that hands control to a safe mode when the controller stops answering. None of it is glamorous, and all of it is industry.

Where the kick happens decides what is protected. Kicking from a timer interrupt proves only that interrupts still run; kicking from the main loop after every critical task has reported progress proves the whole schedule is alive. Good designs collect a token from each task and kick only when all are present.

What happens on expiry has to be designed. A reset is right for a sensor node; for a flying drone a reset in mid-air can be worse than the hang, so autopilots pair the watchdog with failsafe actions (hold, land) and with fast restart that recovers state (fail-safe design).

A watchdog can also expose a deeper bug as a symptom. On Mars Pathfinder the resets were the watchdog's correct reaction to a bus task starved by priority inversion; the watchdog kept the lander safe while engineers found the cause.

In the formal version, a supervisor watching a complex controller and switching to a simple verified one is the Simplex architecture of the safety filter family.