watchdog

To watchdog a system is to continuously reset its watchdog timer before it can trigger a fault condition. A watchdog timer is a hardware or software counter that counts down from a preset value, typically a few hundred milliseconds to several seconds. If the counter reaches zero, the timer generates an interrupt, a reset signal, or logs a fault. The trick is that some part of your control code must reset this counter back to its maximum value before it expires, preventing the alarm.

In industrial machines and safety systems, watchdog timers detect when a controller has frozen, crashed, or entered an infinite loop. If the main processor stops executing normal code cycles, it cannot send the reset pulse, the timer runs out, and the system forces a reboot or triggers a safe shutdown. This is a crude but effective guardian against runaway firmware. Programmable logic controllers (PLCs), motion controllers, and safety-rated electronics almost always have one or more watchdog timers built in.

Common watchdog patterns

A typical embedded application has a short housekeeping routine that executes several times per second and explicitly resets the watchdog timer as one of its first steps. If the watchdog requires a reset every 500 milliseconds and your program hangs in a data-logging loop, the timer expires after half a second and forces recovery. Some systems use a hardware watchdog independent of the processor: if no signal arrives on a dedicated pin within the timeout period, a relay or reset line is activated. These are harder for buggy code to circumvent.

The term comes from the image of a watchdog as a guardian that barks and bites when left unattended. The timer is the watchdog; resetting it repeatedly is feeding the dog so it stays loyal and awake. If you stop feeding it, it turns on you. In older industrial contexts, especially in safety systems meeting standards like ISO 13849, you will see watchdog discussed as a mandatory supervisory mechanism that runs independently of the application logic itself.

Failure to watchdog a time-critical controller can be serious. If a conveyor drive loses control signal and no watchdog catches the fault, the belt may continue running or jerk unexpectedly. Many machinery accidents have been traced to a processor hangup that went undetected. Conversely, a watchdog that is too aggressive, resetting after only 10 milliseconds when the system needs 50 milliseconds per cycle, will cause false faults and production downtime. Finding the right timeout requires understanding the actual cycle time of your application code and the expected jitter.