Watchdog Timer

A watchdog timer operates as a separate hardware circuit or a dedicated software task that is independent of the main application's execution flow. This isolation is crucial; it ensures the watchdog can detect failures even if the main CPU is stuck in an infinite loop, has crashed, or is overwhelmed by a high-priority interrupt storm. The watchdog's timer counts down continuously and must be periodically reset by the main program, proving the software is still functioning correctly.

The core parameter of a watchdog is its timeout period, a pre-configured duration (e.g., 100ms, 1s) within which the main program must service it. Servicing, often called 'kicking' or 'petting' the dog, involves writing a specific value to a hardware register or calling a specific function. If this action does not occur before the timer elapses, the watchdog triggers a system reset. This period is carefully chosen based on the system's worst-case execution time (WCET) for critical control loops.

Hardware Watchdogs are dedicated timer circuits, often external to the main microcontroller or integrated as a separate peripheral. They are more robust as they can function even during severe CPU malfunctions or power brownouts. Software Watchdogs are implemented as a high-priority task within a Real-Time Operating System (RTOS). While more flexible, they depend on the RTOS scheduler's health. Many safety-critical systems employ a two-stage watchdog: a software task that pets an independent hardware timer.

Upon timeout, the watchdog initiates a defined recovery sequence. The most common action is a full hardware reset, rebooting the entire system to a known good state. In more sophisticated systems, the watchdog may first trigger a non-maskable interrupt (NMI) to attempt a graceful software recovery or log diagnostic data before resetting. Some architectures support windowed watchdogs, which require servicing within a specific time window (not too early, not too late), preventing errors caused by code that is running too fast or in an unintended sequence.

In a robotic control system, the watchdog service call is strategically placed within the primary real-time control loop. It is typically serviced at the end of each successful loop iteration, after sensor data has been processed and actuator commands have been sent. This placement guarantees that a reset occurs if the loop hangs, misses its deadline, or fails to complete. Improper placement (e.g., inside a non-critical or infrequent task) can render the watchdog ineffective at detecting the most relevant faults.

Watchdog timers are a foundational element in achieving functional safety standards like ISO 26262 (automotive) or IEC 61508 (industrial). They are classified as a safety mechanism designed to detect and mitigate random hardware failures and systematic software errors. Their design, including independence, diagnostic coverage, and response time, is rigorously analyzed during Failure Modes and Effects Analysis (FMEA). They are often part of a layered safety architecture that includes redundancy and monitoring of other system components.

A Real-Time Operating System (RTOS) is a specialized operating system designed to guarantee deterministic and predictable execution of tasks within strict timing constraints. Unlike general-purpose OSs, an RTOS provides:

• Deterministic scheduling to ensure high-priority tasks always meet deadlines.
• Minimal interrupt latency and context switch time.
• Priority-based preemption to handle time-critical events. It is the foundational software layer upon which watchdog timers and control loops are implemented, ensuring the entire software stack behaves predictably.

A hard real-time constraint is a system requirement where missing a specified deadline results in a total system failure, potentially causing catastrophic damage or safety hazards. This is distinct from soft real-time, where missed deadlines degrade performance but are tolerable.

• In robotic control, actuator commands and collision avoidance loops are hard real-time tasks.
• A watchdog timer is a last-line defense to recover from a hard real-time deadline miss (e.g., a frozen control loop) by forcing a system reset before physical harm occurs.

A control loop is the fundamental, periodic software cycle in a robotic system. Its deterministic execution is what a watchdog timer typically monitors. The standard phases are:

1. Sense: Read data from sensors (encoders, IMUs, cameras).
2. Plan/Compute: Execute the control algorithm (e.g., PID, MPC) to compute actuator commands.
3. Act: Send commands to motors or actuators.

• The loop's fixed period (e.g., 1 kHz / 1 ms) is a critical real-time parameter.
• The watchdog timer is "kicked" or "serviced" at the end of each successful loop iteration. If the loop hangs or overruns its period, the watchdog expires and triggers a fault response.

Bare-metal programming is the practice of writing software that runs directly on the microcontroller's hardware without an intervening operating system. This approach is common in deeply embedded systems where a full RTOS is unnecessary.

• It offers maximum control, minimal latency, and deterministic execution by eliminating OS overhead.
• In a bare-metal system, the watchdog timer is often configured and serviced directly via hardware registers.
• The entire application is typically a single, carefully crafted super-loop or interrupt-driven architecture, making watchdog supervision straightforward but critical.

Functional Safety is the part of overall safety that depends on a system operating correctly in response to its inputs. Standards like ISO 26262 (automotive) define rigorous engineering processes to avoid unreasonable risk from electrical/electronic system malfunctions.

• A watchdog timer is a classic safety mechanism mandated by such standards.
• It is classified as a safety element out of context (SEooC), designed to detect and mitigate random hardware failures or systematic software faults (e.g., infinite loops) in the main processing unit.
• Its design must be independent from the logic it monitors to ensure it can't be disabled by the same fault.

An Interrupt Service Routine (ISR) is a short, time-critical function that executes in immediate response to a hardware or software interrupt, such as a timer overflow or a sensor-ready signal.

• ISRs must be extremely fast to avoid delaying other interrupts or starving main tasks.
• A poorly designed ISR that runs too long can prevent the main control loop from servicing the watchdog, causing a false reset.
• In advanced implementations, a separate watchdog ISR might handle the expiration event, logging the fault and initiating a graceful shutdown before a hardware reset occurs.