How Does a Hardware Watchdog Timer Reset Embedded Systems?

A hardware watchdog timer is an independent electronic counter inside a microcontroller or external integrated circuit that monitors software execution and forces a system reset if the program stops responding. Under normal operation, the running software periodically resets the counter before it reaches zero, a process known as kicking or petting the dog. If a software bug, infinite loop, or hardware glitch prevents the processor from updating the timer, the counter expires and triggers a hardware reset signal to restore the system to a known initial state.

Independent Clock and Counter Architecture

A hardware watchdog timer operates independently of the main central processing unit (CPU) and its primary system clock. Typically, it is driven by a dedicated, low-power internal oscillator, such as a 32 kHz RC oscillator, or an external crystal. Because this clock source is separate from the main CPU clock, the watchdog continues counting even if the primary clock fails or the CPU enters a halted state.

The core of the watchdog is a digital down-counter or up-counter register. When enabled, the counter increments or decrements on every tick of its clock source. The timeout period \(T_{\text{timeout}}\) depends on the counter's bit width \(N\), the prescaler division factor \(P\), and the watchdog clock frequency \(f_{\text{clk}}\):

\[T_{\text{timeout}} = \frac{2^N \cdot P}{f_{\text{clk}}}\]

If the counter reaches its terminal value without being cleared, the hardware logic immediately asserts a reset line connected to the microcontroller's reset controller.

Normal Operation and the Kick Mechanism

During healthy execution, the embedded firmware must periodically write a specific value or sequence of values to a designated watchdog control register. This action reloads the counter back to its starting value and restarts the countdown.

To prevent accidental resets caused by runaway code writing random values to memory, many microcontrollers require a specific multi-step key sequence to reload the timer. For example, the software might need to write 0xAAAA followed by 0x5555 to the watchdog register within a certain number of clock cycles.

Detecting Hangs and Infinite Loops

When software enters an unintended infinite loop, deadlocks on a shared resource, or hangs while waiting for an external peripheral that never responds, the main execution thread stops reaching the code that kicks the watchdog. Because the watchdog hardware relies on its own independent clock, it continues counting down unaffected by the stalled CPU.

Once the counter reaches zero (or its maximum count), the watchdog hardware generates a physical reset pulse. This pulse:

• Halts the stalled CPU immediately.
• Resets all internal registers, program counters, and peripherals to their default power-on states.
• Forces the microcontroller to reboot from the reset vector, restarting the application from scratch.

Windowed Watchdog Timers

A standard watchdog only checks that the software responds before a maximum time limit. However, if a software bug causes the CPU to run too fast or jump directly into a tight loop that repeatedly kicks the watchdog, a standard timer will not catch the fault.

A windowed watchdog timer solves this by defining both a minimum and a maximum time boundary. The software must kick the watchdog only within a valid time window \((T_{\text{min}}, T_{\text{max}})\). If the software kicks the timer too early (before \(T_{\text{min}}\)) or too late (after \(T_{\text{max}}\)), the watchdog immediately triggers a system reset.

Interrupts Before Reset

Some advanced watchdog timers support a two-stage timeout. When the counter expires the first time, it triggers a non-maskable interrupt (NMI) instead of an immediate reset. This brief grace period allows the system to log diagnostic data, save critical state information to non-volatile memory, or safely shut down actuators before the hardware reset occurs on the second timeout.