Watchdog
A watchdog timer counts down from a preset value. The running firmware must periodically write a special key to restart the countdown. If the firmware crashes, freezes, or enters an infinite loop, the countdown reaches zero and the watchdog asserts a hardware reset, restarting the system.
A free-running counter decrements toward zero on each oscillator tick. Writing the correct unlock sequence to the service register reloads the counter to its preset value. The oscillator is intentionally independent of the system clock (often a dedicated RC oscillator) so a clock failure also triggers the timeout.
In plain terms
A dead-man's switch: firmware must kick it at regular intervals to prove it's alive; if it misses one kick, the watchdog assumes the code is hung and pulls the reset line.
Why designers use it
- Recover from software crashes in field-deployed devices without a technician on-site.
- Detect stuck-in-interrupt or priority-inversion bugs that make the main loop stop running.
- Meet safety standards (IEC 61508, ISO 26262) that require hardware-enforced failure recovery.
Best for
- Remote IoT
- Safety-critical firmware
- Industrial PLCs
Key specifications
- Timeout range: 1 ms – 60 s
- Quiescent current: 1 – 50 µA
- Window mode: Yes (min and max kick interval)
- Output: Open-drain reset
- Supply: 1.6 V – 5.5 V
When not to use it
- During active in-circuit debugging — the watchdog will reset the device while you step through code; disable it in debug builds.
Common mistakes
- Petting the watchdog inside an ISR rather than the main loop — the timer fires even when the main loop is frozen if the ISR still runs.
- Setting the watchdog timeout so short that it fires during legitimate long operations like flash erase.
Where you will find it
- TI illustrates a processor periodically driving a watchdog input. If the expected pulse fails to arrive within the timeout, the watchdog asserts its reset output.
- An external supervisor with a watchdog can monitor both the processor's supply and heartbeat signal. The system must still define what a reset means for its outputs and safe recovery.
A short history
A watchdog expects the processor to service it within a defined interval. If that activity stops, the watchdog can assert a reset or fault output. This helps a system recover from some software hangs, especially in unattended equipment, but a watchdog cannot detect every possible software fault.
Good to know
- An external watchdog timer survives software bugs that crash the microcontroller — even if the on-die watchdog gets disabled by a stack corruption, the external part still resets the system.
- Window watchdogs require the kick to arrive within a min/max interval; an attacker who patches the kick line to ground gets caught by the lower window edge.
- Industrial PLCs and aerospace controllers always pair an external watchdog with their main CPU — ‘failsafe of last resort’.